Supplemental CAPTRUST Privacy Notice for Residents of Certain U.S. States

Last Updated: May 26, 2026

This Supplemental CAPTRUST Privacy Notice for Residents of Certain U.S. States supplements the information provided in CAPTRUST’s Privacy Policy and applies exclusively to information collected by CapFinancial Partners, LLC and its affiliates, including but not limited to CapFinancial Securities, LLC, Member SIPC (collectively referred to herein as “CAPTRUST”), from individuals who reside in U.S. states that have enacted comprehensive consumer data privacy laws (“consumers” or “you”). This Privacy Policy does not apply to account and financial information that we receive from or about our individual clients. Click here for our Financial Privacy Notice.

Categories of Personal Information We Collect

In particular, we may have collected the following categories of personal information about our consumers within the twelve (12) months preceding the date we last updated this Privacy Notice as provided above:

Sources of Personal Information

We obtain the categories of personal information listed above from the following categories of sources:

• Directly from you, such as from forms you complete or products and services you purchase, or from your computer or device through digital tracking technologies such as internet cookies or web beacons.
• Indirectly, such as from 3^rd parties you authorize to provide us with information, or from your employer, when your employer is a client of ours.
• Public databases and third-party partners such as data brokers/resellers, social media companies, and analytics or marketing providers.

Purposes of Use of Personal Information

We use the personal information we collect for the purposes disclosed in the CAPTRUST Privacy Policy. For more information, please see “How We Use Personal Information” in the CAPTRUST Privacy Policy.

• The business purposes for which we may use personal information include:
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards;
• Helping to ensure security and integrity to the extent the use of the consumer’s personal information is reasonably necessary and proportionate for these purposes;
• Debugging to identify and repair errors that impair existing intended functionality;
• Short-term, transient use, including, but not limited to, nonpersonalized advertising shown as part of a consumer’s current interaction with the us;
• Performing services on our behalf, such as maintaining or servicing accounts, providing customer service, or verifying your information, providing analytic services, providing storage, or providing similar services;
• Providing advertising and marketing services;
• Undertaking internal research to develop and demonstrate technology; and
•  Conducting activities to verify, maintain, improve, upgrade, or enhance the quality or safety of our Services.

We may de-identify personal information about you or receive de-identified personal information about you, and we may use and disclose such information for any purpose in accordance with applicable law. We will maintain de-identified information in de-identified form, and will not re-identify such information, except in accordance with the requirements of applicable law.

Disclosures of Personal Information

We may disclose your personal information to third parties for any of the business purposes set out above or as further described under “How We Use Personal Information” in the CAPTRUST Privacy Policy. We have disclosed personal information in all or substantially all of the categories identified in this Supplemental CAPTRUST Privacy Notice for Residents of Certain U.S. States to our affiliates, vendors who provide services to us, in connection with a sale or transfer of all or part of our business, and as otherwise provided in “How Personal Information  Is Disclosed” in the CAPTRUST Privacy Policy. 

Use and Disclosure of Sensitive Personal Information

We do not collect, use, or disclose sensitive personal information for purposes of inferring characteristics about a consumer. Therefore we do not offer a right under applicable law for you to limit our use or disclosure of sensitive personal information.

Sales and Sharing of Personal Information

In the preceding twelve (12) months, CAPTRUST has not engaged in the sale of personal information in exchange for monetary consideration. However, as is common practice among businesses that operate Internet websites, CAPTRUST discloses certain personal information to third-party partners for business and commercial purposes, such as analytics and advertising. Under U.S. state data privacy laws, our use of tracking technologies and related disclosures may be considered “sales” and/or “sharing” of personal information, or processing of personal information for targeted advertising.

CAPTRUST does not disclose personal information of individuals we know to be under the age of 18 to businesses or third parties for monetary or other valuable consideration as a “sale” of personal information, for targeted advertising, or as the “sharing” of personal information as defined under U.S. state comprehensive data privacy laws.

Retention of Personal Information

CAPTRUST retains personal information for as long as necessary to provide our products and services, administer our business, comply with applicable legal and regulatory requirements, resolve disputes, and enforce our agreements. We maintain personal information in accordance with our record‑retention policies and applicable law.

Your Rights and Choices

If you reside in a U.S. state that has enacted a comprehensive consumer data privacy law, you may have one or more of the following rights. We will honor requests received to the extent required by applicable law and within the time provided by law.

The Right to Access and Right to Know:

You may have the right to request that we disclose the following information to you about our collection and use of your personal information:

• Whether we are processing personal information about you;
• The categories of personal information we collected about you;
• The categories of sources for the personal information we collected about you;
• Our business or commercial purpose for collecting, selling, or sharing your personal information;
• The categories of personal information we disclosed, sold, or shared, and the categories, or if applicable, a list of third parties to whom we disclosed, sold, or shared your personal information by each category of personal information disclosed, sold, or shared;
• The specific pieces of personal information we collected about you (also called a data portability request), in a readily useable format that allows the consumer to transmit this information from one entity to another entity without hindrance, if applicable;

Right to Correct:

You may have the right to correct inaccurate personal information we have collected about you. 

Right to Delete:

You may have the right to request that we delete any of your personal information that we collected from or about you.

Right to Opt-Out:

You have the right to opt-outof sales or out of sharing for targeted advertising. To submit an opt-out request, click here or as provided below under “Exercising Your Rights.” We do not process your personal information for profiling in furtherance of “decisions that produce legal or similarly significant effects” as such term is defined under applicable U.S. state comprehensive privacy laws.

If we receive and are able to process a signal from your device indicating your preference to opt out of the sale or sharing of personal information, as defined by applicable law, then we will apply that preference to personal information we collect from that device, provided that we may not be able to associate the signal with the same device if:

• you use a different web browser or other tool to interact with us,
• you make changes to your browser (e.g., uninstall and reinstall or certain types of upgrades) that impact our ability to associate the device with the signal your device originally sent, or
• you clear cookies or browsing data from your browser or device in a way that impacts our ability to associate the device with the signal your device originally sent.

Please note that a signal sent from one device may not apply to other devices you use or to data that we collect from you through other sources.

If we are able to link an opt-out preference signal with a known person, then we treat the signal as a request to opt out of sale and sharing applicable to that individual.

To learn more about opt-out preference signals generally, please visit the California Attorney General’s “California Consumer Privacy Act (CCPA)” page or the California Privacy Protection Agency’s “Frequently Asked Questions (FAQs).”

Right to Appeal:

If we decline to take action on a request that you make in accordance with the foregoing to exercise the foregoing privacy rights, then the response to your original request will contain details on how to initiate an appeal.

Exercising Your Rights:

To exercise any of the rights mentioned in this notice, please submit a verifiable consumer request to us by using one of the following methods:

• Calling us at (800) 216-0645.
• Emailing us at legal@captrust.com.
• CAPTRUST Privacy Rights Request Form for Certain US States

Only you, or someone legally authorized to act on your behalf, may make a request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

You may designate an authorized agent to make a request under the rights above on your behalf. You may make such a designation by providing the agent with written authorization, signed by you, to act on your behalf. The authorized agent can submit requests via email to legal@captrust.com.  We reserve the right to deny a request if the agent does not submit sufficient proof of their authorization or if we are unable to verify your identity.

As required or permitted under applicable law, we may take steps to verify your request before we can provide personal information to you, correct or delete personal information, or otherwise process your request. Such information may include, but is not limited to, your name, phone number, date of birth, or last four digits of your Social Security Number to verify your identity. If we believe we need further information to verify your request as required by law, we may ask you to provide additional information to us. We will not use personal information you provide in order for us to verify and process your request for additional purposes.

Making a verifiable consumer request does not require you to create an account with us.

Response Timing and Format:

We will confirm receipt of your verifiable consumer request within ten (10) days and will provide a response within forty-five (45) days of its receipt. If we require more time (up to 45 additional days), we will inform you of the reason and extension period in writing. We will deliver our written response by mail or electronically, at your option.

Any disclosures we provide in our response to a right to know request will cover only the 12-month period preceding the verifiable consumer request’s receipt. You may request we provide personal information which we have collected beyond this 12 month period, as long as the information was collected on or after January 1^st, 2022, and we are able to do so without disproportionate effort or expense. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination:

We will not discriminate against you for exercising any of your state-specific privacy rights, including by:

• Denying you goods or services.
• Charging you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Providing you a different level or quality of goods or services.
• Suggesting that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
• Retaliating against an employee, applicant for employment, or independent contractor for exercising their rights under this policy.

Contact Information

If you have any questions or comments about this notice, how CAPTRUST collects and uses your information described in this Notice, including as your choices and rights regarding such use, please do not hesitate to contact us at:

Phone: (800) 216-0645

Email: legal@captrust.com

Address:

CapFinancial Partners, LLC

Attn: Legal Department

4208 Six Forks Rd, Suite 1700

Raleigh, NC 27609