Privacy Policy Overview
 

This website is owned and operated by Arbor Realty Trust, Inc. (“Arbor,” “us,” “we,” or “our”). We respect your concerns about privacy. This privacy policy (“Policy”) applies to personal information we may obtain on this website and related websites where this Policy is posted (collectively, the “Web Site(s)”). Depending on where you reside, certain portions of this Policy also may apply to Arbor’s handling of personal information we collect from you whenever you communicate or interact with us, whether by using the Web Sites or whenever you engage with us in respect of the services we provide (together we refer to the Web Sites and services we provide as the “Services”). By using the Services, you agree to the terms of this Policy.
 

This Policy describes the types of information we may obtain through the Web Site and/or the Services, how we may use the information, with whom we may share the information and the choices you may have regarding our use of the information. We also describe the measures we take to safeguard the information and tell you how to contact us about our privacy practices.
 

Your use of this Web Site or the Services signifies that you consent to our Policy as described herein. Arbor reserves the right to change or update our Policy at any time by notifying visitors of the existence and location of the new or revised Policy. This Privacy Policy was last updated on September 2, 2021.
 

This Policy does not apply to the personal information that we may collect from you if you are an employee or contractor of Arbor. If you work on behalf of Arbor we will provide you with a separate privacy notice as applicable.
 

Other web sites, mobile applications, and other services, whether online or offline, may have their own privacy policies, and you should consult those accordingly. For example, this Web Site may contain links to external web sites or other online services, including those embedded in third-party advertisements or sponsor information, which are not controlled by Arbor. We are not responsible for the privacy practices and data collection policies for such third-party services. You should consult the privacy policies of those third-party services for details. Arbor also may allow interaction between the Web Sites and other online services such as social media providers. This may include plugins available through the Web Sites that allow you to share information with persons outside of the Services. Please consult the privacy policies of such third-party providers before using them to make sure you are comfortable with the level of sharing.
 

Information Collected
 

Personal information (“Personal Information”) is generally defined as information that, alone or in combination with other information, could identify, relate to, describe, reference, be reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household. The information we collect may include certain kinds of Personal Information. Depending on where you reside, categories of Personal Information may include, but are not limited to, your name, shipping/billing address(es), telephone number, email address, username and password, IP address or other online identifiers, browsing or search history, credit/debit card number or other financial information, professional or employment-related information, office address and other business information, demographic information, consumer preferences, biometric information such as fingerprints, precise location information, or any other type of information that, directly or indirectly, is reasonably capable of being associated with you.
 

When using the Services, the Personal Information we may collect includes contact information such as your name, address, email address, and phone number.
 

If you submit applications for loans or other Services, Arbor may collect unique identifiers about you, such as your signature and social security number.
 

To access Arbor Loan Express (ALEX) or certain other parts of the Services that require you to log in before using them, you may need to provide us with account information, such as your username and password.
 

Some Services will collect historical information about you, including your employment information and records of personal property.
 

We may gather certain navigational information in an automated manner about where visitors go on our Web Sites and information about the technical efficiencies of our Web Sites and Services. In the process of gathering navigational information, data that generally is non-personally identifiable information (i.e. domain type, browser version, service provider and IP address) may be collected which will provide information regarding a visitor’s use of our Web Site.
 

We may also gather voluntarily provided Personal Information through the ability to have questions answered through our ‘Contact Us’ section. Data we collect through these and other interactions you have with us may include demographic information that may include Personal Information such as your age and gender. Information that we may collect about you through online interaction includes information that you input and data resulting from your activity on the Web Sites or through the Services.
 

Other Personal Information we collect may include transaction information like your credit/debit card numbers or other payment or financial data including bank account information, and general location information such as your address or zip code.
 

Arbor also may make inferences about you based on some combination of the preceding categories of collected Personal Information. To the extent Arbor does this and the inferences reasonably can be associated with you, we will treat those inferences as Personal Information as well.
 

The Web Site may include social media features, such as widgets or other interactive features. These features may collect your Internet protocol address, which page you are visiting on the Web Site, and may set a cookie to enable the feature to function properly.
 

How Information is Gathered
 

We may collect Personal Information when you register an account for the Services, visit certain areas of the Web Sites or use certain Services, submit questions or comments, subscribe to any communications from Arbor, or voluntarily provide Personal Information to us in the course of loan screening and underwriting or other interactions you have with Arbor.
 

Other data, such as navigational information that may be Personal Information to the extent it is reasonably capable of identifying you, could be collected in an automated manner whenever you visit or use the Web Sites. For example, when you access or use the Web Sites, we and third parties that may provide certain functionality on or through the Web Sites may engage, receive, collect, and store certain device information and other online identifiers through automatic data collection tools including cookies, pixel tags, web beacons, embedded web links, and similar technology (see the “Cookies” section, below). These technologies may collect information including, but not limited to, your IP address, browser type, the date and time that you use the Web Sites, referring/exit pages and URLs, number of clicks, cookies that may uniquely identify your browser, and information about your mobile device. This navigational information generally cannot be associated with you or other individuals, but if there is reason to believe that any device information could be linked to you, we will treat it as Personal Information.
 

Using Information
 

The Personal Information Arbor collects allows us to improve our product and service offerings as well as improve the Web Site’s functionality. For example, borrower information collected is used to help us identify what loans the borrower should have access to. It provides us a way to contact you and provide you with login credentials and other account information.
 

Depending on the nature of your interaction with Arbor, we may use collected Personal Information and other data to:
− process loan applications;
− administer and secure accounts;
− maintain proper business records and other relevant records;
− respond to questions, comments or other messages;
− send Arbor newsletters or other updates with information or advertising relating to the Services;
− process loan transaction information;
− perform evaluations and surveys regarding your experiences with the Services;
− contact you if there are issues with information or content you provided through the Services;
− provide ongoing technical support related to the Web Sites and other Services;
− communicate with you regarding additional uses of your Personal Information beyond the scope of this list and this Policy;
− provide services based on Personal Information you provide through the Web Sites or through other Services;
− improve the content and general administration of the Services;
− perform internal operations related to the Web Sites (e.g., fraud prevention);
− troubleshoot software issues and operational problems with the Web Sites;
− conduct data analysis and testing; and/or
− monitor usage of the Web Sites.
 

Cookies
 

We may use a browser feature known as a “cookie.” Cookies are small data files sent by a website and stored by the browser to assist in providing a customized browsing experience on that website. The “Help” section of the toolbar on most browsers will inform you on how to prevent your browser from accepting new cookies, how to have the browser notify you upon the receipt of a new cookie, or how to disable the use of cookies completely. Certain areas of the Web Sites have been designed to take advantage of the use of cookies; therefore, if you configure your browser to decline their use, certain features of the Web Sites may not function correctly.
 

Processing by Third-Party Service Providers
 

Arbor and certain third parties that provide services on our behalf will collect, process and use your Personal Information as described in this Policy and for the purposes set forth in this Policy.
 

Except as noted herein, Arbor does not share or sell your Personal Information with any person or entity outside of Arbor.
 

We may disclose certain portions of your Personal Information to service providers or third parties as necessary to fulfill the business purposes for which the Personal Information was collected.
 

For example, we may provide contact information such as your name, address or phone number to authorized marketing vendors to verify their accuracy prior to contacting you.
 

The Services may allow you to share information, including Personal Information, with third-party services and social networking websites, such as Facebook or LinkedIn. We do not share your Personal Information with these third-party services unless you direct Arbor to share it through the Services. Any third-party use of such information will be governed by the applicable third party’s privacy policy, and you may be able to modify your privacy settings on or through the applicable third party’s website. Please consult the privacy policies of these third-party services and websites before using them to make sure you are comfortable with the level of sharing.
 

We also may disclose your Personal Information to other service providers and for other purposes with your permission, or for one or more of the following purposes:
 

− To carry out our obligations and enforce our rights arising from any contracts related to your use of the Services, including for billing and collections;
− As necessary or appropriate to protect the rights, property or safety of Arbor, our customers or others;
− To respond to law enforcement requests and as required by applicable law, subpoena, court order, other legal process or governmental regulations;
− As otherwise described to you at or before the point when we collect your Personal Information; or
− To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or to transfer some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which Personal Information held by us is among the assets transferred.
 

By providing to Arbor the Personal Information and other data referenced above, you agree that Arbor may use and share such Personal Information and other data in accordance with the terms of this Policy. We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.
 

Your Rights and Choices
 

Depending on where you reside, you may have one or more of the following rights with regard to Arbor’s collection, use and sharing of your Personal Information on or through the Services:
 

− The right to request details about what Personal Information we collect, use, disclose or sell about you;
− The right to request the deletion of Personal Information we have collected or maintain about you;
− If applicable, the right to opt-out of any sale of your Personal Information; and
− The right not to receive discriminatory treatment by Arbor, in terms of the services, products and prices offered on or through our Services, because you exercised these rights regarding the collection, use and sharing of your Personal Information.
 

Under applicable privacy laws, you may have the right to request to review, make amendments, have deleted or otherwise exercise your rights over your Personal Information that we hold, subject to certain legal limitations and requirements. If you are subject to such a privacy law, you may submit a request to us related to your Personal Information by emailing us at [email protected].
 

We will respond to verifiable requests as required by law.
 

You are permitted to make a verifiable consumer request to know information twice within a 12-month period. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm that the Personal Information relates to you. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.
 

You may grant an authorized agent written permission to submit requests regarding your Personal Information, but we may deny authorized agent requests absent proof that you authorized such agent to act on your behalf, or if we are unable to verify your identity.
 

We may obtain your Personal Information from third parties to engage in online marketing efforts. You have the right, at any time, to direct us not to sell your Personal Information. To opt out, visit the Do Not Sell My Personal Information request form. We will act upon opt-out requests and will notify you and/or your authorized agent when the request has been processed.
 

If you have a password-protected account with us, we will use our existing authentication procedures to verify your identity. For most other requests, Arbor will ask you to provide information that matches at least two pieces of Personal Information we store about you before responding to your request. If you would like to request the specific pieces of your Personal Information that Arbor has collected, or if you would like us to delete highly sensitive information, you will need to match at least three pieces of information we store about you, and you must provide a signed declaration under penalty of perjury that you are the consumer whose Personal Information you are requesting.
 

Making a verifiable consumer request does not require you to create an account with us. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.
 

You may be able to opt-out of Arbor sharing your Personal Information with certain entities identified in this Policy by contacting us using the information above, unless the sharing of your Personal Information is necessary to perform one of the following business purposes: to count ad impressions and evaluate their effectiveness; to detect, protect against, and prosecute security incidents; to debug or troubleshoot functional errors that may arise with the Services; to complete short-term tasks related to an existing interaction you have with Arbor; to maintain or service your account; to process payments and fulfill orders or other transactions you authorize; to verify your customer information; and to ensure the safety and quality of the Services.
 

Any removal of content by Arbor does not ensure or guarantee complete or comprehensive removal in all places. The content may have been shared or reposted by other parties, or federal or state law may require maintenance of the content or information. Arbor will do its best to accommodate your request, but we cannot guarantee we can remove all Personal Information from the specified uses. Therefore, please be as specific as possible in your request. If the request relates to information that Arbor needs to make certain Services function properly for you, you may not be able to use those Services properly moving forward. We may deny your deletion request if retaining the information is necessary for us or our service providers to:
 

1. Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise to perform a contract we entered into with you;
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;
3. Debug products to identify and repair errors that impair existing intended functionality;
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law;
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546);
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;
8. Comply with a legal obligation; or
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.
 

Arbor reserves the right to maintain proper records as required by law, or for otherwise legitimate business purposes to the extent permitted by law, even if such records contain your Personal Information.
 

Marketing. You may opt-out from receiving marketing-related communications from us on a going-forward basis by contacting us or by using the unsubscribe mechanism contained in each email. We will try to comply with your request(s) as soon as reasonably practicable. Please note that if you opt-out of receiving marketing-related emails from us, we may still send you important administrative messages, from which you cannot opt-out.
 

Cookies and similar technologies. Please review your browser or device settings for certain cookies and see above to exercise certain choices regarding cookies.
 

We follow applicable law to take steps to keep your Personal Information accurate, complete and up-to-date. In your request that is covered by an applicable privacy law, please make clear what Personal Information you would like to have changed, whether you would like to have your Personal Information suppressed from our database or otherwise let us know what limitations you would like to put on our use of your Personal Information. We may only implement requests: (a) where required by applicable law; and (b) with respect to the Personal Information associated with the particular email address, phone number, or other information that you use to send us your request, and we may need to verify your identity before implementing your request. We will try to comply with your request as soon as reasonably practicable.
 

Deactivation. You can request to deactivate your account at any time by contacting us at the email address at the bottom of this page. However, you will not be able to access many of the Services after deactivating your account. Please note that if you request deactivation of your account, it may take some time to fulfill this request.
 

Responding to Requests. Please note that we may need to retain certain information for recordkeeping purposes and/or to complete any transactions that you began prior to requesting a change or deletion. There may also be residual information that will remain within our databases and other records, which will not be removed. We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.
 

Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to request from a business, with whom the California resident has an established business relationship, certain information with respect to the types of Personal Information the business shares with third parties for those third parties’ direct marketing purposes and the identities of the third parties with whom the business has shared such information during the immediately preceding calendar year. To exercise your rights, you may make one request each year by emailing us at [email protected].
 

Some browsers have a ”do not track” feature that lets you tell websites that you do not want to have your online activities tracked. Arbor does not currently have the capability to process these kinds of technical requests. To learn about ways to opt-out of certain kinds of tracking for targeted advertising purposes, please visit the Network Advertising Initiative website and the Digital Advertising Alliance website. Options you select are browser- and device-specific, and there is no guarantee that these industry-provided opt-out tools will prevent all targeted advertising.
 

We are committed to respecting the privacy rights of individuals under all privacy laws applicable to us.
 

Securing Personal Information
 

Arbor takes the issue of protecting your Personal Information seriously, but you should exercise discretion in what information you disclose and/or transmit through the Services. Arbor cannot guarantee that information sent over the Internet is fully secure. The transmitted information may be intercepted by others before it reaches Arbor. If you are concerned about sending information to Arbor over the Internet, please send the information by mail or call us to make other arrangements. Arbor is not responsible for the security of information sent over the Internet.
 

Arbor retains collected information for a reasonable amount of time in order to fulfill the stated purpose for why the information was collected. Arbor also retains collected information connected to business records for periods of time required by law. If Arbor determines that collected information is no longer needed, it will delete such information. Our collection times will be consistent with applicable law.
 

Children’s Privacy
 

The Services are intended for individuals 16 years of age and older located in the United States. Arbor neither collects nor sells the Personal Information of minors under 16 years of age.
 

The Services are not directed at, marketed to, nor intended for, individuals under 16 years of age. No one under the age of 16 is permitted to provide any information on or through the Services. If you are under 16 years of age, DO NOT: use or provide any information on or through the Services; use any of the Services’ features; use any interactive or public commenting feature on the Services; and/or provide any information about yourself to Arbor. We do not and will not knowingly collect any information, including Personal Information, from any person under 16 years of age and Arbor will take prompt steps to delete any such information if it is inadvertently received. If Arbor learns that we have received Personal Information from any person under 16 years of age, Arbor will delete the information. If you believe Arbor might have information from or about any person under 16 years of age, please contact us immediately at [email protected].
 

Linking
 

Periodically, links may be established from this Web Site to one or more external web sites or resources operated by third parties (the “Third Party Sites”). These links are provided for your convenience only. We are not responsible for the privacy practices or the content of such Third Party Sites. To help ensure the protection of your privacy, we recommend that you review the privacy policy of any Third Party Site you visit via a link from our Web Site or through any such Third Party Site.
 

Interactive Forums
 

The Web Site may offer an opportunity to subscribe to participate in online forums and other interactive features of the Web Site, such as Chatter by Arbor, that allow you to insert comments, participate in discussion or access other interactive features (collectively, the “Forums”). You understand and agree that any Personal Information and other data that you post or upload, whether comments, messages, images or other user-generated content or materials (collectively, the “User Content”) might be read, collected, and used by others who access it through a Forum.
 

Changes to Our Privacy Policy
 

We amend this Policy from time to time by posting an amended version of this Policy to this Web Site. Please check the Web Site periodically for amended versions of this Policy. We will revise the date of the Policy at the time any material changes to the Policy are made. Any updates to the Policy become effective when we post the updates to the Web Site. If at any time you do not agree to the terms of this Policy, you should cease any further use.
 

Any changes will be immediately incorporated into this Policy, and will be prospective only. We will not make any changes that have retroactive effect unless legally required to do so. Any change to this Policy is effective immediately. Your continued use of the Services after any changes are made to this Policy constitutes your acceptance of the changes.
 

If any changes to this Policy materially affect how Arbor shares Personal Information that you have already provided to us or that has otherwise been collected by Arbor, we will notify you by email (if Arbor has a valid email address to use) and give you thirty (30) days to opt-in to the changes as they pertain to your information. If you do not opt-in, your information will continue to be used in a manner that is consistent with the version of this Policy under which it was collected, or the information will be deleted.
 

Notices Regarding Privacy Policy Compliance
 

If at any time you believe we have not adhered to this Policy, or if you have any questions about this Policy or the Services, please notify us and we will use commercially reasonable efforts to promptly identify, diagnose and correct the problem. You may reach us by mail: CCPA Requests, 333 Earle Ovington Blvd., Suite 900, Uniondale, NY 11553 or email: [email protected].