California Consumer Privacy Act Addendum

Effective Date / Last Updated: June 1, 2020

This California Consumer Privacy Act Addendum (“CCPA Addendum”) supplements the information contained in the Riverstone Privacy Policy and applies solely to individual residents of the State of California.

This CCPA Addendum describes (i) how the Company collects, uses and shares personal information of California residents within the scope of the California Consumer Privacy Act of 2018 (Cal. Civ. Code Sections 1798.100 to 1798.199) (the “CCPA”) and (ii) the rights of California residents with respect to requesting access to or deletion of personal information. For purposes of this CCPA Addendum, the term “personal information” has the meaning set forth in the CCPA. And, unless otherwise expressly stated herein, all terms in this CCPA Addendum have the same meaning as defined in the Privacy Policy or as otherwise defined in the CCPA.

We reserve the right to amend this CCPA Addendum at our discretion and at any time. When we make changes to this CCPA Addendum, we will post the updated CCPA Addendum on the Riverstone Website (as an addendum thereto) and update the CCPA Addendum’s effective date. Your continued use of the Riverstone Website and your sharing of personal information with the Company (both directly and indirectly) following the posting of changes to this CCPA Addendum constitutes your acceptance of such changes.

DISCLOSURES REGARDING PERSONAL INFORMATION COLLECTED, USED AND SHARED BY THE COMPANY

I. CATEGORIES OF PERSONAL INFORMATION COLLECTED

In the twelve (12) months prior to the effective date of this CCPA Addendum, the Company has collected from consumers the following categories of personal information:

• Identifiers – such as: names, addresses, phone numbers, e-mail addresses and Internet Protocol addresses
• Personal Information (per California Civil Code Section 1798.80(e)) – such as: consumer’s income and household composition
• Characteristics of Legally Protected Classifications – such as: date of birth (ala age) and gender
• Commercial Information – such as: records of products or services purchased, obtained or considered (whether from the Company, its affiliates or neighborhood builders), including the address, purchase price, options and upgrades purchased (if any) and date of purchase / closing for any new residence purchased from a neighborhood builder
• Internet or Other Electronic Network Activity Information – such as: browsing history, search history, and information regarding a consumer’s interaction with the Riverstone Website or advertisements
• Geolocation Data – such as: the location of a consumer’s computer or device when accessing or utilizing the Riverstone Website
• Audio, Electronic, Visual, Thermal, Olfactory or Similar Information – such as: photographs, video recordings and voice recordings of consumers
• Professional and/or Employment-Related Information – such as: identification of a consumer’s profession and place of work
• Inference Data – such as: information regarding a consumer’s preferences, characteristics, predispositions, behavior and attitudes

II. CATEGORIES OF PERSONAL INFORMATION DISCLOSED FOR A BUSINESS PURPOSE

In the twelve (12) months prior to the effective date of this CCPA Addendum, the Company has disclosed the following categories of personal information for a business purpose:

• Identifiers – such as: names, addresses, phone numbers and e-mail addresses (for example: if we respond to a consumer’s request to transmit his/her contact information to a neighborhood builder, or if we issue a press release or similar announcement identifying the consumer as the winner of a sweepstakes or other promotion offered by the Company)
• Characteristics of Legally Protected Classifications – such as: age and gender (for example: if we issue a press release or similar announcement identifying the winner of a sweepstakes or other promotion offered by the Company)
• Commercial Information – such as: records of products or services purchased, obtained or considered by a consumer in relation to the Company’s communities and amenities (for example: if we calculate the benefit fees owed by a consumer in connection with the purchase of a new residence and report said information to the consumer’s neighborhood builder or escrow company)
• Internet or Other Electronic Network Activity Information – such as: browsing history, search history, and information regarding a consumer’s interaction with the Riverstone Website or advertisements (for example: if we use a service provider to assist in the collection of reports and other data that may be used for analyzing and promoting the function, operation and security of the Riverstone Website)
• Geolocation Data – such as: the location of a consumer’s computer or device (for example: if we use a service provider to assist with testing the function, operation and security of our mobile applications that provide directional and/or mapping services)
• Audio, Electronic, Visual, Thermal, Olfactory or Similar Information – such as: photographs, video recordings and voice recordings of consumers (for example: if we issue a press release or similar announcement that depicts -- via photograph or other medium -- the winner of a sweepstakes or other promotion offered by the Company)
• Inference Data – such as: information regarding a consumer’s preferences, characteristics, predispositions, behavior and attitudes (for example: if we use a service provider to evaluate the characteristics and behaviors of a group of consumers in relation to the Riverstone Website and/or the Riverstone community, and then aggregate said data (based upon non-identifying factors) and share the results thereof with our affiliates and neighborhood builders in order to improve products, services, etc. in response to consumer preferences, dispositions, etc.)

In addition to the foregoing, the Company may disclose personal information for the following business-related purposes:

• Detecting security incidents, and protecting against malicious, deceptive, fraudulent or illegal activity;
• Debugging to identify and repair errors that impair existing intended functionality of the Riverstone Website;
• Performing services related to the Company’s business and activities (including but not limited to: maintaining or servicing account registrations, processing requests and reservations, and verifying consumer information);
• Undertaking internal research for technological development and demonstration; and
• Undertaking activities to verify and/or maintain the quality or safety of each service and/or device that is offered, owned, manufactured for, or controlled by the Company (including any improvements, upgrades, or enhancements thereto).

III. NO SALE OF PERSONAL INFORMATION

In the twelve (12) months prior to the effective date of this CCPA Addendum, the Company has not sold any personal information of consumers (as said terms are specifically defined in the CCPA).

PRIVACY RIGHTS APPLICABLE TO CALIFORNIA RESIDENTS

I. YOUR CALIFORNIA PRIVACY RIGHTS

1. The Right to Access Specific Information / Data Portability Rights (“Right to Know”)

As a California resident, you have the right to request that we disclose to you certain information about our collection of your personal information during the past twelve (12) months. Upon receipt and verification of your consumer request (see Section II, below), we will disclose to you:

• The categories of personal information that we have collected about you
• The categories of sources for the personal information that we have collected about you
• The Company’s business or commercial purpose for collecting your personal information
• The categories of personal information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed
• The specific personal information that we have collected about you

B. The Right to Request Deletion

As a California resident, you also have the right to request that we delete any of your personal information that we have collected from you (subject to certain conditions and limitations under the law). Upon receipt and verification of your consumer request (see Section II, below), we will delete – and direct our service providers to delete – your personal information from our records (unless an exception applies).

II. EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS

To exercise the rights identified in Section I, above, please submit a consumer request using one of the following methods:

• Call the Privacy Administrator at: 281-949-6401
• E-mail the Privacy Administrator at: marketing@riverstone.com

Each consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom the Company has collected personal information. This information may include (i) your name, (ii) your address and (iii) other information depending upon the type of request and the sensitivity of the information. Moreover, each consumer request must clearly identify what right is being exercised (i.e., “Right to Know” or “Right to Delete”) so that we may properly understand, evaluate and respond to the request being made.

Please note that we cannot respond to your consumer request or provide you with personal information if we are unable to verify your identity or authority to make the request and confirm that the personal information relates to you. Also note that we will only use personal information provided in a consumer request to verify the requesting party’s identity or authority to make the request.

Pursuant to the CCPA, you may submit a consumer request for access and data portability not more than twice within a twelve (12) month period.

III. RESPONSE TIMING AND FORMAT

Following receipt of a verified consumer request, we will endeavor to provide a response thereto within forty-five (45) days. If we require more time (up to forty-five (45) additional days), we will notify you of the reason and extension period in writing.

We will deliver our written response by mail or email address submitted by you and through a secure link (at your preference). Please note that any disclosures we provide will cover only the twelve (12) month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a consumer request, if applicable.

For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another without hindrance.

We will not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

IV. NON-DISCRIMINATION

We will not discriminate against you for exercising any of your California privacy rights. Unless permitted by law, the Company will not (as a result of you exercising your rights under the CCPA):

• Deny goods or services to you.
• Charge you different prices or rates for goods or services, including through the use of discounts or other benefits, or imposing penalties.
• Provide a different level or quality of goods or services to you, if you exercise your California privacy rights.
• Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services.