Privacy Notice

Effective date: 09.15.26 · Notice version: 1.2

Data controller contact information

alooola, LLC
4422C Route 27
PO Box 399
Kingston, NJ 08528
info@alooola.com

Compliance contact: Patrick O'Boyle

Introduction

Our privacy notice governs our privacy practices when you are using our websites www.gleneagleadv.com, www.alooola.com, and our mobile application called alooola®, hereinafter and collectively referred to as our website.

Our privacy notice tells you what personal data and non-personal data we collect from you, how we collect them, how we protect them, how we disclose them, how you can access and change them, and how you can limit our disclosing of them. Our privacy notice also explains certain legal rights that you have about your personal data. Any capitalized terms not defined herein will have the same meaning as where they are defined elsewhere on our website.

Definitions

‘NONPERSONAL DATA’ (NPD) means any information that is in no way personally identifiable.

‘PERSONAL DATA’ (PD) means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person can be identified directly or indirectly by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person. PD is in many ways the same as Personally Identifiable Information (PII). However, PD is broader in scope and covers more data.

‘SENSITIVE PERSONAL DATA’ (SPD) means a consumer's social security, driver's license, state identification card, or passport number; a consumer's account log-in, financial account, debit card, or credit card number in combination with any required security, access code, password, or credentials allowing access to an account; a consumer's exact geolocation; a consumer's ethnic or racial origin, religious or philosophical beliefs, or union membership; the contents of a consumer's mail, text messages, and email unless the business is the intended receiver of the communication; a consumer's genetic data; the processing of biometric data to uniquely identify a consumer; personal information collected and analyzed about a consumer's health; sex life or sexual orientation.

Your rights

Contact us using the information at the top of this privacy notice to exercise any of your legal rights contained within this privacy notice. We will respond to your request within 30 days after receiving it. Occasionally it may take longer for multiple requests or complex circumstances.

When using our website and submitting PD to us, you may have certain rights under privacy laws in the United States including the California Consumer Privacy Act (CaCPA), the California Privacy Rights Act (CPRA), and privacy laws of other countries including the European Union General Data Protection Regulation (the EU GDPR), the UK General Data Protection Regulation (the UK GDPR), the UK Data Protection Act of 2018, Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other global privacy laws. Even if not listed here, we will make reasonable efforts to honor data subject access requests even though we may be under no legal obligation to do so. However, we reserve the right to decline any data subject access request that we are not legally obligated to comply with. Your rights may include but are not limited to the following:

1. The right to equal service, price, and not be discriminated against even if you exercise your privacy rights.
2. The right to one or more means where you can submit requests under this privacy notice including (at minimum) a toll-free telephone number and an email address if the business operates a storefront and a website. If the business operates only an Internet website, then it must have a dedicated email address where you can submit requests for information required to be disclosed by law.
3. The right to know whether your PD is sold or disclosed and to whom.
4. The right to request that we do not sell any of your PD.
5. The right to be informed about the PD that we collect from you and how we process them.
6. The right to get confirmation that your PD are being processed and you can access your PD.
7. The right to have your PD corrected if they are inaccurate or incomplete.
8. The right to request the removal or deletion of your PD if there is no compelling reason for us to continue processing them. However, the right to deletion is not absolute and can be overridden to continue data processing in some cases where we still have a legal ground or overriding legitimate interest to process your data.
9. The right to ‘block’ or restrict the processing of your PD. When your PD are restricted, we are permitted to store your PD, but not to process them further.
10. The right to request the PD that you provided to us and use them for your own purposes. Upon express request, we will provide your data to you or another service or product provider within 30 days of your request subject to commercial and industrial secrets.
11. The right to object to us processing your PD for the following reasons: processing was based on legitimate interests or the performance of a task in the public interest/exercise of official authority (including profiling); direct marketing and targeted advertising (including profiling); processing for purposes of scientific/historical research and statistics.
12. The right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects regarding you or similarly significantly affects you.
13. The right that we limit the collection of your PD to that which is "adequate, relevant and reasonably necessary" with the purposes for which the data is processed.
14. The right that we do not process your PD for purposes that are neither reasonably necessary nor compatible with the disclosed purposes for which such personal data is processed, as disclosed to you unless the controller obtains your consent.
15. The right to designate an authorized agent to make a request on your behalf. When designating an authorized agent, you must provide a valid power of attorney, the requester's valid government-issued identification, and the authorized agent's valid government-issued identification.
16. The right to file a complaint with supervisory authorities if your information has not been processed in compliance with your rights under privacy laws.

Information we collect and how we collect it

Generally, you control the amount and type of information that you provide to us when using our website.

Our legal basis for collecting and processing PD

Our legal basis for collecting and processing your PD when you buy our products, services, or fill in any of the contact forms on our website is based on the necessity for the performance of a contract or to take steps to enter into a contract.

Automatic information

We automatically receive information from your web browser or mobile device. This information may include the IP address of your computer or the proxy server you use to access the Internet, your Internet service provider's name, your web browser type, the type of mobile device, your computer operating system, and data about your browsing activity when using our website. We use all this information to help improve our website.

Cookies and browser storage

Our websites do not set advertising cookies, and we do not use advertising tools. We use your browser's storage for a few specific things:

• keeping you signed in to the alooola web app;
• on alooola.com, remembering for the length of your visit which page or campaign brought you to the site;
• on alooola.com, if you submit a form, remembering the email address you entered so that your later visits are linked to it;
• on alooola.com, Google Analytics cookies that tell a returning visitor apart from a new one, described under Google Analytics below.

The scheduling tool on our Schedule page is provided by Calendly, which may set its own cookies under Calendly's privacy policy.

Most web browsers let you block or clear cookies and site storage. If you do, some features, such as staying signed in, may not work.

Web beacons

We may use a technology called web beacons to collect general information about your use of our website and your use of special promotions or newsletters. The information we collect by web beacons allows us to statistically watch the number of people who open our emails.

At user registration or when buying products or services

When you register as a user or when buying our products and or services, we may collect some or all the following PD: first and last name, email address, physical address, birth date, employment status, estimated annual income, estimated monthly expenses, savings, investments, does your company provide a 401K match, do you have kids under the age of 13, do you have debt, insurance, a will, or financial goals. Note: when you open an account we ask you to link your bank and provide your social security number, but we do not hold that data; it goes directly to Drivewealth or Plaid.

Collecting information about your physical location

When you use our services, we may collect and process information about your actual physical location. We use several technologies such as GPS and IP tracking to determine your location. These technologies may also give us information about nearby cell towers, Wi-Fi access points, and other devices.

Chat software or contact forms

Our website contains chat software or contact forms that enable visitors to communicate with us online or offline by email. Sometimes, visitors can communicate with us without buying our products and services. When you use our chat software or contact forms, we may collect some or all the following information: your email address, first name, last name, location, and any other information you willingly choose to give us. You should limit the information you give to us to one that is necessary to answer your questions.

Product analytics

We run our own analytics system to understand how our websites and app are used and to improve them. It is hosted on our own servers at Amazon Web Services in the United States. We do not sell this information or use it for advertising.

On alooola.com, it records the pages you view, the links and buttons you click, how far you scroll, the forms you start and submit, the page or campaign that brought you to the site, and your browser and device type. If you submit a form, the email address you enter is linked to that activity.

In the alooola app and web app, it records the screens you view and the steps you take in features such as opening an account, making a deposit, and planning tools, along with an identifier for your device. When you are signed in, this activity is linked to your account, together with your name, email address, phone number, city, state and ZIP code, date of birth, profession and career stage, the types of accounts you hold, and your assets and income as recorded in your profile, including ranges based on them. We never send your Social Security number to our analytics system.

We use your IP address to estimate your approximate location, meaning your city and region. The IP address itself is not stored.

Analytics activity is deleted automatically after 90 days, and backups of the analytics system are kept for up to one year. You can ask us to delete your analytics profile using the contact information at the top of this privacy notice.

Google Analytics

On alooola.com we also use Google Analytics, loaded through Google Tag Manager, to see how visitors find the site and which pages they read. It records the pages you view, how you arrived, for example from a search engine or a campaign link, and your browser, device and approximate location. It sets cookies on alooola.com so that a returning visitor can be told apart from a new one.

These requests pass through our own server on their way to Google. We do not send Google your name, your email address or anything you type into a form. We have turned off Google signals and ad personalization, so this activity is not linked to your Google account or used for advertising. Google handles it under its privacy policy. You can opt out with Google's browser add-on.

What happens if you don't give us your PD

If you do not provide us with enough PD, we may not be able to provide you with all our products and services. However, you can access and use some parts of our website without giving us your PD.

How your PD is used and disclosed

We use the PD we receive from you to:

• respond to any requests from you regarding sales and support;
• contact you regarding any agreements or accepted terms that you may have with us for our services;
• contact you regarding changes to our services or website;
• charge you for our products and or services and collect payment;
• help personalize your searches;
• diagnose problems;
• find and prevent fraud; provide our products and services you have requested or purchased from us;
• personalize and customize our content;
• make improvements to our website;
• contact you with updates to our website, products, and services;
• resolve problems and disputes.

Communications and emails

When we communicate with you about our website, we will use the email address you provided when you registered as a user or customer. We may also send you emails with promotional information about our website or offers from us or our affiliates unless you have opted out of receiving such information. You can change your contact preferences at any time through your account or by contacting us using the information at the top of this privacy notice.

Text messaging, SMS, push notifications, and telephone calls

If you provide a mobile telephone number, or landline telephone number to us, you are giving your express consent and authorize us or a third party to contact you by using any of these communication methods. You are not required to give us your consent to contact you through these communication methods. However, withholding your consent may interfere with or prevent us from providing some or all our services to you. You can stop receiving text messages, push notifications, and telephone calls by contacting us or using one of our opt-out methods.

Disclosing your PD to third parties

We do not sell or rent your PD to third parties for marketing purposes. However, for data aggregation purposes we may use your NPD, which might be sold to other parties at our discretion. Any such data aggregation would not contain any of your PD.

Disclosing your PD to service providers and or contractors

At times we give your PD to service providers and or contractors whom we hire to provide services to us. These service providers and or contractors may include but are not limited to payment processors, cloud hosting and error-reporting providers, call centers, data management services, help desk providers, accountants, law firms, auditors, shopping cart and email service providers, and shipping companies.

Legally required releases of information

We may disclose your PD if such disclosure is (a) required by subpoena, law, or other legal processes; (b) necessary to assist law enforcement officials or government enforcement agencies; (c) necessary to protect us from legal action or claims from third parties, including you and or other users; or (d) necessary to protect the legal rights, personal and or real property, or the personal safety of our company, users, employees, and business partners.

Disclosures to successors

If our business is sold or merges in whole or in part with another business that would become responsible for providing the website to you, we retain the right to transfer your PD to the new business. The new business would retain the right to use your PD according to the terms of this privacy notice as well as to any changes to this privacy notice as instituted by the new business. We also retain the right to transfer your PD if our company files for bankruptcy and some or all of our assets are sold to another individual or company.

Holding and destroying your PD

We only retain your PD for as long as necessary to fulfill the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for PD, we consider the amount, nature, and sensitivity of the PD. When your information is no longer needed, we will destroy, delete, or erase it.

Protecting the privacy rights of third parties

If you make any postings on our website that contain information about third parties, you agree that you have permission to include that information. While we are not legally liable for the actions of our users, we will remove any postings about which we are notified if such postings violate the privacy rights of others.

Do not track settings

Some web browsers let you send a Do Not Track signal. When your browser sends it, alooola.com does not load any analytics, ours or Google's. The alooola app and web app do not respond to this signal; the analytics they collect is described in the Product analytics section above.

Links to other websites

Our website may contain links to other websites. These websites are not under our control and are not subject to our privacy notice. We have no responsibility for these websites, and we provide links to these websites solely for your convenience. You accept that your use of and access to these websites are solely at your risk.

Protecting children's privacy

Our website is not designed for use by anyone under the age of 18. We do not knowingly collect PD from children under the age of 16. If you are a parent or guardian and believe that your child is using our website and they are under the age of 18, please contact us. Before we remove any information we may ask for proof of identification to prevent malicious removal of account information. If we discover that a child under the age of 18 is accessing our website, we will delete their information within a reasonable period of time. You acknowledge that we do not verify the age of our users nor have any liability to do so.

Our email policy

You can always opt out of receiving email correspondence from us or our affiliates. We will not sell, rent, or trade your email address to any unaffiliated third party without your permission except in the sale or transfer of our company, or if our company files for bankruptcy as described in the section Disclosures to Successors.

Our security policy

We have built our website and services using industry-standard security measures and authentication tools to protect the security of your PD. We and the third parties who provide services to us also maintain technical and physical safeguards to protect your PD. SPD is protected at a higher level than most PD. Unfortunately, we cannot guarantee the prevention of loss or misuse of your PD or secure data transmission over the Internet because of its nature. We strongly urge you to protect any password you may have for our website and not disclose it to anyone.

Use of your credit card

You may have to provide a credit or debit card to buy products and services from our website. We use third-party billing services and have no control over them. We use commercially reasonable efforts to ensure that your credit card number is kept strictly confidential by using only third-party billing services that use industry-standard encryption technology to protect your credit card number from unauthorized use. However, you understand and agree that we are in no way responsible for any misuse of your credit card number.

Transferring PD from other countries

PD that we collect from you may be stored, processed, and transferred among any countries in which we operate. The European Union has not found the United States and some other countries to have an acceptable level of protection of PD under Article 45 of the GDPR. Our company relies on derogations for specific situations as defined in Article 49 of the GDPR. If you are a European Union user, or a user from another country, with your consent your PD may be transferred to the United States or other countries when you request information from us. When you buy goods or services, we will use your PD to perform a contract with you. Wherever we transfer, process, or store your PD, we will try to apply reasonable safeguards to protect it. We will use the information we collect from you by following the practices described in our privacy notice. Also, we enter into data processing agreements and standard contractual clauses when appropriate. By using our website, services, or products, you agree to the transfers of your PD described within this section.

Changes to our privacy notice

We reserve the right to change this privacy notice at any time. If our company decides to change this privacy notice, we will post those changes on our website so our users and customers are always aware of what information we collect, use, and disclose. If at any time we decide to disclose or use your PD in a method different from that specified at the time it was collected, we will provide advance notice by email sent to the email address on file in your account. Otherwise, we will use and disclose our users' and customers' PD in agreement with this privacy notice in effect when the information was collected. Your continued use of our website, services, and products after any change to this privacy notice will constitute your acceptance of such change. If you have questions about our privacy notice, please contact us through the information at the top of this privacy notice.

Contact

Questions about this privacy notice or your information can be sent to info@alooola.com or by phone at (484) 275-5525.

alooola® is an SEC Registered Investment Adviser.