Effective Date: June 23, 2020
‍
This Privacy Policy solely covers the privacy practices of the division of The Upside Travel Company, LLC and its affiliates doing business as Upside Financial. For information concerning the privacy practices of the The Upside Travel Company, LLC generally, please visit: https://upside.com/privacy-policy. This Privacy Policy covers the privacy practices of Upside Financial and our websites, apps, emails and text message programs, as well as our handling of information we collect through our public social media pages (except where a different privacy policy has been posted) (collectively, the “Services”). This Privacy Policy also covers our handling of information we collect at the direction of, or have disclosed to us for processing according to the direction of our customers that are businesses. Please contact the Upside Financial privacy officer with any questions, complaints or requests regarding your data or our privacy practices and specify that your request concerns the privacy practices of Upside Financial:
Privacy Officer
The Upside Travel Company, LLC
4200 Wisconsin Ave NW #106-231
Washington, DC 20016
legal@upside.com

SOURCES OF INFORMATION WE COLLECT
Upside Financial receives information about individuals or their devices from the following sources:
Individuals (or others who share financial information on their behalf) who provide information to us to:
Establish or maintain an account with us;
Make a purchase or receive a service from us; Process a loan or loan-related paperwork with us;
Participate in a survey; or Connect with us via social media. Our websites, apps and emails, through the use of automated means (such as cookies) to collect data from users’ devices.
Information sharing within the Upside corporate family Referrals from users and others.
Businesses seeking assistance, review and preparation of paperwork to manage loans in conjunction with financial institutions.
Financial institutions of all kinds, third-party loan paperwork providers assisting individuals or businesses seeking loans or loan-paperwork processing including regulatory compliance paperwork processing, suppliers, and others involved in providing the Services.
Other third parties, including, advertisers, business or data partners, marketing partners and publicly available sources such as social networks.
‍
INFORMATION WE COLLECT
We collect some information directly from you, certain information through automated means when you use the Services, and we also collect information disclosed to us by our customers at your direction. We collect, use and disclose this information, as described within this Privacy Policy, for the purpose of providing you with assistance on your paperwork related to your loans services that you seek or that your employer seeks. Our collection, use and disclosure, if any, to third parties of your personally identifiable information or personal data, occurs only after we give you clear notice of our intent to collect, use and disclose that information and with your explicit consent so that we can provide you with loan forgiveness documentation review services. Your employer, or a third-party financial institution, may also provide us with this information or data after having given you notice that it will be shared with Upside, in which case we will process your personally identifiable information or personal data, as applicable, with either your explicit consent, implicit consent, or based upon our legitimate interest in fulfilling the requests of our customer in obtaining loan forgiveness documentation review services for you.
You may withdraw your consent for our collection and use of your personally identifiable information or personal data at any time, however doing so may prevent us from offering you some or all of our Services given requirements imposed upon us by financial institution customers, and various governments.
Information From and About You
From the sources listed above, we may receive information such as: name, physical address, email address, telephone number
Financial information, such as account numbers, assets, debts, liabilities, liens, etc.
Sales information, including of items that might allow another to extrapolate or assume information about you or your family, including sensitive personally identifiable information or personal data
Social Security numbers or tax ID numbers
Copies of government-issued identifications (e.g. drivers license or passport)
Credit rating or related credit information
Banking account information, financial information and tax filings
Purchase l details including dates, location, purchase information
title, company and professional details
gender and date of birth
billing details
opinions and other user-submitted content or information
details from social network profiles (such as name, email address, profile picture, location, and friend list)
data regarding use of credit cards
Information Collected Automatically Through Websites and Apps
‍
Use of Cookies and Similar Technologies
Through the Services, we, our service providers, and other third parties may collect certain information through automated means such as cookies, Web and audio beacons, JavaScript, and mobile device functionality (such as Bluetooth low energy and iBeacons). This information may include unique browser identifiers, IP address, browser and operating system information, device identifiers (such as the Apple IDFA or Android Advertising ID), geolocation information (as described in the next section below), Internet connection information, as well as details about individuals’ interactions with the Services (including referring and exit pages and URLs, platform type, the number of clicks, domain names, landing pages, pages and content viewed and the order of those pages, the amount of time spent on particular pages, the date and time you used the Services, the frequency of your use of the Services, error logs, and email open rate).We and third parties also may use such automated means to read or write information on users’ devices, such as through various types of cookies and other browser-based or plugin-based local storage (such as HTML5 storage or Flash-based storage). Cookies and local storage are files that contain data, such as unique identifiers, that we or a third party may place on or read from a user’s device for purposes such as recognizing the device, service provision, record-keeping, analytics and marketing. You may choose to set your web browser to refuse certain types of cookies, or to alert you when certain types of cookies are being sent. Some browsers offer similar settings for HTML5 local storage, and Flash storage can be managed here. However, if you block or otherwise reject our cookies or local storage, certain websites and emails (including our own) may not function properly.For more information about how we use cookies and similar technologies, see Section 5 below.

Location Information
We may collect different types of information about your location, including general information (e.g., IP address, zip code) and more specific information (e.g., GPS-based functionality on mobile devices used to access the Services), and may use that information to customize the Services with location-based information, advertising, and features. For example, if your IP address indicates an origin in Chicago, the Services may be customized with Chicago-specific information and advertisements. If you access the Services through a mobile device and you do not want your device to provide us with location-tracking information, you can disable the GPS or other location-tracking functions on your device, provided your device allows you to do this. See your device manufacturer’s instructions for further details.Using Mobile and Other Devices
We and/or our service providers may collect and store unique identifiers matched to your mobile device, in order to deliver customized ads or content while you use applications or surf the internet, or to identify you in a unique manner across other devices or browsers. In order to customize these ads, or content, we, or third parties may collect your information, e.g., your email address, or data passively collected from you, such as your device identifier or IP address.You may be able to manage how your mobile device and mobile browser share information with the Services, by adjusting the privacy and security settings on your device. Please refer to instructions provided by your mobile service provider or the manufacturer of your device to learn how to adjust your settings.

HOW WE USE THE INFORMATION WE COLLECT
Upside uses and discloses the data we collect as follows:
To assist you in preparing loan forgiveness applications.
On the basis of implied or express consent after providing you full and clear notice of our data practices, such as:
To send you certain information, including updates concerning your documentation and preparation, or any regulatory updates that could affect your preparation of documentation, marketing communications, technical notices, software or Services updates, security alerts, and support messages;
To improve and customize the content and advertising you see on the Services, across the Internet, and elsewhere; or
To share information with lenders, accountants and other advisors to provide you the Services.
For our legitimate interests in conducting our business to provide you the Services you seek, such as:
To respond to questions, concerns, or customer service inquiries;
To communicate with individuals about Upside Financial accounts, applications, or transactions;
To review your loan forgiveness documentation or compliance filings;
To carry out certain marketing activities;
To conduct research and analysis, including surveys; or
To enforce the legal terms that govern our services.
For the legitimate interests of banks or the United States government in verifying and accounting for loan applications or regulatory compliance filings(such as to confirm the accuracy of an Upside Financial filing and transaction details).
To respond to legitimate requests from regulatory agencies.
To comply with law, such as statutory or regulatory requirements, protect rights, safety and property, and respond to lawful requests from public authorities.
To perform a service on behalf of a customer who gives us the data.
We may also use your information to anticipate your loan forgiveness application review needs or provide you with potential opportunities that may benefit you both at the time of your request and in the future. To do so, we may process your information using algorithms alone or in combination with the data of others. This processing is undertaken to provide you with improved loan forgiveness application review services or regulatory compliance options.
We may use manual or automated means (such as automated text messages and automated live or prerecorded/artificial voice calls) to perform some of the marketing and other communications described in this Section.
‍
Combined Information
You consent that, for the purposes discussed in this Policy, we may combine the information that we collect through the Services with information that we receive from other sources, including from your financial institutions or the US government, both online and offline, and use such combined information in accordance with this Policy.
Aggregate/De-Identified Information
‍We may aggregate and/or de-identify information collected through the Services so that such information can no longer be linked to you or your device (“Aggregate/De-Identified Information”). We may use Aggregate/De-Identified Information for any purpose, including without limitation for research and marketing purposes, and may also share such data with any third parties, including financial institutions, advertisers, promotional partners, sponsors, event promoters, and/or others.
‍
HOW WE SHARE THE INFORMATION WE COLLECT
We share your information in the following ways:
Affiliates and Subsidiaries. We may share all data we collect within the Upside family of companies.
Suppliers. We share your data with financial institutions and expediters, and similar providers, to assist in reviewing your loan forgiveness documentation and requests. By requesting our assistance with loan forgiveness review, through the Services, you are authorizing us to disclose to your financial institution the data required to complete the loan forgiveness paperwork and deliver related services. We do not control the privacy practices of these third parties or of the US government. We encourage you to review the privacy policies of any financial institution with which you interact for more information regarding the applicable privacy practices.
Third Party Vendors. We share your data with third party vendors, for example Braintree, FullStory, Hubspot, Salesforce, Intercom, Survey Monkey, who provide services or functions on your behalf. These third party vendors include banks, lenders and other types of financial institutions, credit card processing companies, loan processing companies, business analytics platforms, customer service organizations, advertising and business partners, distributors of surveys or sweepstakes programs, and fraud prevention firms.
Customers. We may jointly offer products or services with our customer. You can tell when a customer is involved in a product or service you have requested because their name will appear, either alone or with ours. If you choose to access these optional services, we may share your data with our customers. We do not control the privacy practices of customers. We encourage you to review the privacy policies of our customers for more information regarding their applicable privacy practices.
Future Business Transactions. We may share your data in connection with any proposed or actual merger, reorganization, transfer of control, a sale of some or all of our assets, or a financing or acquisition of all or a portion of our business by another company (whether the recipient of data in these cases will handle the data pursuant to this Privacy Policy depends on applicable law and other factors).
Referring Platforms. If you are referred to our Services from another service, an advertising site, a blog, a social media site, etc., we may collect data about you from the referring service. Also, we may provide them with appropriate referral data (such as the amount of a purchase) to compute referral fees or for similar purposes.
Surveys and Promotions. Upside Financial may conduct surveys and promotions on our Services that collect your data. Our surveys and promotions are voluntary and any information you provide may be collected, used, shared, disclosed, stored, transferred and processed in accordance with this policy. Your participation in our surveys and promotions, and your submission of Information, serves as your consent to these practices.
Protection of Upside Financial and Others. By using the Services, you acknowledge, consent and agree that we may access, preserve and disclose your data if required to do so by law or in a good faith belief that such access, preservation or disclosure is reasonably necessary to: (a) comply with legal process (e.g., a subpoena or court order); (b) enforce our Terms of Service, this Policy, or other contracts with you, including investigation of potential violations thereof; (c) respond to claims that any content violates the rights of third parties; (d) respond to your requests for customer service; and/or (e) protect the rights, property or personal safety of Upside Financial, The Upside Travel Company, LLC,  its agents and affiliates, its users and/or the public. This includes exchanging information with other companies and organizations for fraud protection, and spam/malware prevention, and similar purposes.
Public Forums. Some features of our websites, apps and services may allow users to make data public or engage in other sharing. For example, if you post content or otherwise participate in discussion forums or other social areas of our websites or apps, your participation (including the content you post, your name, and a link to your profile) may be shared across our websites and apps and in other public or private areas of the internet.
‍
ONLINE ANALYTICS AND ADVERTISING
In some cases, we facilitate the collection of information through advertising services administered by third parties. The ad services may track users’ online activities over time by collecting information through automated means such as cookies, and they may use this information to show users advertisements that are tailored to their individual interests or characteristics and/or based on prior visits to certain sites or apps, or other information we know, infer or have collected from those users. For example, we and these third-parties may use cookies, first-party cookies and third-party cookies together, as well as other automated means, and other data (such as the data described above) (a) to recognize users and their devices, (b) to inform, optimize, and serve ads, and (c) to provide analytics about our ad impressions, uses of ad services, and how users interact with these impressions and services (including how they are related to visits to specific sites or apps).
To learn more about interest-based advertising generally, including how to opt out from the targeting of interest-based ads by some of our current ad service partners, visit the consumer choice pages offered by Network Advertising Initiative and Digital Advertising Alliance. For controls specific to advertising and analytics services offered by Google, click here, here and here. You also can use certain choice mechanisms offered by Facebook and Twitter. If you replace, change or upgrade your browser, or delete your cookies, you may need to use these opt-out tools again.
California Do-Not-Track disclosure requirements. We are committed to providing you with meaningful choices about the information collected on our Services for third-party purposes, and that is why we provide above the Network Advertising Initiatives Consumer Opt-out link, Digital Advertising Alliances Consumer Opt-Out Link, and other consumer choice mechanism links above. However, we do not recognize or respond to browser-initiated Do Not Track signals, as the Internet industry is currently still working on Do Not Track standards, implementations and solutions.
‍
THIRD PARTY LINKS AND SERVICES
Financial Institutions and Other Providers
As described above, Upside Financial assists individuals with reviewing loan forgiveness paperwork, sometimes at the direction of third parties, such as financial institutions, including banks. These third parties use and disclose information (including information received from Upside Financial) according to their own privacy policies and practices. For example, financial institutions may use the information for communicating with borrowers about their loans or regulatory compliance requirements (including through automated calls or automated text messages regarding travel updates or other topics). As another example, some lenders may correlate information received from Upside Financial with additional information they collect (such as financial data you provide to them for other financial services). We encourage you to review their privacy policies and contact them for more information.
Other Third Parties
Some third parties’ embedded plugins or other automated technology on our websites, apps and emails, such as cookies or social sharing buttons, may allow their operators to learn that you have visited or interacted with our websites, apps and emails, and they may combine this information with other, identifiable information they have collected about your visits to other websites, apps, emails or online services. These third parties may handle this information, and other information they directly collect through their content and plugins, pursuant to their own privacy policies.
‍
SECURING YOUR INFORMATION
There is no perfect security. We have implemented certain physical, technical, and administrative measures to help prevent unauthorized access, use and disclosure of your information, but we cannot promise that these measures will work. You are responsible for maintaining the secrecy of any credentials that can be used to access any account or service with Upside Financial, and you should report suspected unauthorized activity to us. You are responsible for activity conducted with your credentials.
‍
INFORMATION AND DATA SUBJECT RIGHTS AND CHOICES
You may review and update certain information Upside Financial holds by logging in to the Upside Financial account through which the information was provided (or by asking the Upside Financial account holder to do so). In some instances you may need to provide updated information directly to the lender or financial institution.
In addition, individuals residing in California, the European Union and some other jurisdictions outside the United States may obtain confirmation of whether we hold personally identifiable information (as defined by California law) or personal data (as defined by EU privacy law) about them, to access any information or data we hold about them (including, in some cases, in portable form), and to obtain its correction, update, amendment or deletion in appropriate circumstances. They may obtain a version of the personally identifiable information or personal data about them in a common machine readable format so that they may take that information to another travel service provider. They may also object to our uses or disclosures of personal data or exercise legal rights to withdraw consent, though such actions typically will not have retroactive effect. To exercise any of the above rights (or any other rights under applicable law), please contact us through the contact information provided at the beginning of this Privacy Policy.
The rights described here are subject to limitations and exceptions under applicable law. In particular, and as required by California law and by principles of prudent data security, we will endeavor to verify the identity of anyone requesting to exercise a data subject right and will endeavor to only release the personally identifiable information or personal data of that person to that person.
In addition to the rights above, you may lodge a complaint with the relevant supervisory authority. However, we encourage you to contact us first, and we will do our very best to resolve your concern.
‍
DATA RETENTION
We generally retain information for so long as it may be relevant to the purposes above. Information may persist in copies made for backup and business continuity purposes for additional time.
‍
CALIFORNIA PRIVACY RIGHTS
If you are a California resident and your questions about our data practices are not fully answered by this Privacy Policy, you may request that we make disclosures pursuant to the California Consumer Privacy Act of 2018, codified at California Civil Code § 1798.100 et seq. You may do so by emailing us a request at: privacy@upside.com. You may also contact us by phone at: (855) 252-2151 Alternatively, you may submit a request through our website at: https://upside.com/ (chat with a navigator). Upon receipt of any request, we will endeavor to verify that the identity of the requestor matches the identity of the person whose personally identifiable information is requested. We declare that we do not and have not sold any personally identifiable information.
Subject to certain limits under California Civil Code § 1798.83, if you are a California resident, you may ask us to provide you with (a) a list of certain categories of personal information (as defined in the Civil Code) that we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year; and (b) the identity of the third parties that received personal information from us for their direct marketing purposes during that calendar year. To make such a request, please contact us as described at the beginning of this Privacy Policy.
INTERNATIONAL DATA TRANSFERS
Upside Financial is based in the United States. The recipients of the data disclosures described in this Privacy Policy may be located in the United States or elsewhere in the world. Privacy laws in these countries may not provide protections equivalent to those of your country of residence, and your government may or may not deem such protections adequate.

CHANGES TO THIS PRIVACY POLICY
We may change this Privacy Policy to reflect changes in the law, our information handling practices or the features of our services, websites, apps and emails. The updated Privacy Policy will be posted on the relevant Services.
‍
CONTACT US
If you have questions regarding our practices or this Privacy Policy, or would like to send us requests or complaints relating to your data, please contact us as described at the beginning of this Privacy Policy.