Privacy and Data Protection Policy

Effective Date: July 2, 2026

Purpose

The purpose of this Privacy and Data Protection Policy (this “Policy”) is to explain how, when, and why The Commonwealth Group and any of its subsidiaries (collectively, the “Company,” “CWG,” “we,” “us,” or “our”) collect, use, and disclose Personal Data (also referred to as Personal Information) from individuals (“you”), including:

• When you access our website (the “Website”) regardless of how you access or use it (via personal computers, mobile devices, or otherwise).
• When you, as a business partner or a representative of a company, utilize our services.

This Policy is not intended to override the terms of any services rendered by The Commonwealth Group or any contract you have with us, nor any rights you are afforded under applicable federal and state privacy laws.

CWG performs contract and consulting services for the mortgage industry on a national basis. The Company does not perform services for individual consumers directly; we provide services exclusively to business entities through our operations in the United States.

In addition, please review the CWG Website’s Terms and Conditions of Use, which governs your use of all CWG Website(s).

What Personal Data Do We Collect?

When we use the term Personal Data or Personal Information, we mean any information relating to an identified or identifiable natural person, or that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer, business representative, or household, depending on applicable state law.

Certain pieces of information are excluded from the definition of Personal Data, including publicly available information, de-identified information, or aggregate information. By “aggregate information” or “de-identified information,” we mean information that does not allow us to identify or contact a specific individual.

1. Prospective Borrowers for Our Customers

In order to provide contract and consulting services to our lender clients, we may process personal data provided to us by those clients. The types of personal data may include:

• Individual Details: Name, address, gender, marital status, date of birth, nationality, marketing preferences, bank account details or payment card details, vehicle details, relevant criminal convictions and offenses, penalty points, employer, job title, and family details.
• Identification Details: Identification numbers and photo ID issued by government bodies or agencies.
• Credit and Anti-Fraud Data: Credit history, credit score, sanctions, and information from various anti-fraud databases.
• Risk Details: Information collected to assess mortgage risk.

2. Business Partners and Website Users

• Business Partners: If you are a business partner or company representative, we collect your business contact details, professional expertise, and experience.
• Website Users: If you visit our Website, you may voluntarily provide us with personal data (e.g., via contact forms or online portals). We, alongside our third-party service providers, also automatically or passively collect usage information (such as your browser type, device identifier, IP address, and interaction history) via cookies and tracking technologies.

Cookies, Third-Party Analytics, and Marketing Tracking

We utilize cookies and advanced tracking technologies to ensure our Website functions correctly, analyze performance, and optimize our marketing efforts. Specifically, we use the following third-party services:

• Google Analytics: We use Google Analytics to monitor and analyze website usage, traffic patterns, and overall site functioning. This helps us optimize user experience.
• Cloudflare Analytics: We use Cloudflare Analytics to track website performance, usage, security metrics, and functional health.
• Lead Forensics: We use Lead Forensics for data analytics and B2B marketing. Lead Forensics identifies the business identities of website visitors by reversing IP addresses to reveal corporate entities, enabling us to better understand business engagement and tailor our B2B outreach.

You can modify your browser settings to reject cookies, though doing so may impact certain functionalities of our Website.

When Do We Collect Your Personal Data?

We collect your personal data:

1. Where you or your employer provides your contact or other information to us in the course of working with us, either directly as a business partner or as a representative of your company.
2. Where you attend meetings, events, or conferences that we organize or sponsor.
3. Where you visit, interact with, and/or contact us through the Website, its forms, or one of our online portals.

How Do We Use the Personal Data Collected?

We may use the personal data we collect for the following purposes:

• To consider an application for a mortgage loan submitted by one of our business customers (lender partners) and evaluate associated risks.
• To improve our products and services, carry out market research, perform data analytics, and execute general risk-modeling or statistical analyses.
• For the prevention, detection, and mitigation of fraud, money laundering, or other crimes.
• To manage our B2B relationships, respond to inquiries, and perform marketing and outreach to business prospects.

How and When Do We Disclose Personal Data to Third Parties?

We share your personal data with third parties to provide our services and comply with legal obligations. We do not sell your personal data or share it with third parties for their independent marketing purposes.

Disclosures may be made to:

• Affiliated Companies: We may share personal data within The Commonwealth Group of companies. We also reserve the right to disclose and transfer such information in connection with a merger, consolidation, restructuring, or asset sale.
• Third-Party Service Providers: We use third-party vendors to perform services on our behalf, such as IT support, back-office operations, analytics (e.g., Google, Cloudflare, Lead Forensics), and professional advisors (e.g., attorneys and auditors). These transfers are protected by contractual agreements requiring strict data protection compliance.
• Judicial, Regulatory, and Law Enforcement Bodies: We disclose personal data to satisfy legal obligations, subpoenas, or governmental requests; to protect and defend our rights, property, and safety; and to address fraud, security, or technical issues.

Global Privacy Control (GPC) and Do Not Track

Certain state laws require us to disclose how we respond to privacy signals. While we do not universally monitor older, non-standardized browser "Do Not Track" (DNT) signals, we do aim to process opt-out preference signals like the Global Privacy Control (GPC) where required by applicable state regulations for users seeking to limit tracking or opt out of automated profiling.

Does the Website Include Third-Party Content and Links?

The Website may contain third-party content or links to third-party websites. We are not responsible for the privacy practices or data collection protocols of these third parties. We encourage you to review their independent privacy policies.

State-Specific Privacy Rights (CA, TN, FL, and Other US States)

Depending on the U.S. state you reside in you may possess specific rights regarding your personal information. Because CWG operates primarily in a B2B capacity, these rights apply to you as a consumer or as a business representative interacting with us, subject to statutory statutory thresholds and exemptions.

Your Rights:

• Right of Access / Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the sources of collection, and the business purpose for sharing it.
• Right to Correct: You have the right to request that we correct inaccurate or outdated personal information that we maintain about you.
• Right to Delete: Subject to certain legal exceptions (such as regulatory compliance, fraud prevention, or ongoing contractual obligations), you have the right to request the deletion of your personal information.
• Right of Data Portability: You have the right to receive your personal information in a portable, structured, and readily usable format.
• Right to Opt-Out of Sale or Targeted Advertising: While we do not sell your data for monetary value, you have the right to opt-out of the processing of your data for targeted advertising or profiling.

We will not discriminate against you for exercising any of these privacy rights.

How to Exercise Your Rights & Verification Process

To submit a request, please contact us at privacy@thecommonwealth.net. Before fulfilling your request, we must verify your identity to prevent unauthorized access to data. We will match information you provide against records we already have on file. If you wish to designate an authorized agent to act on your behalf, you must provide a notarized special power of attorney or a signed letter from your legal counsel.

Gramm-Leach-Bliley Act (GLBA) and Fair Credit Reporting Act (FCRA)

To the extent we receive, obtain, or generate information in connection with a financial service or product provided to an individual by our lender partners, that data is generally governed and exempted by the Gramm-Leach-Bliley Act (GLBA) and/or the Fair Credit Reporting Act (FCRA).

Individuals in their personal capacity are not direct consumers or customers of CWG; they are customers of our financial institution clients. We protect all GLBA and FCRA data in accordance with strict federal security standards and only use or share it to execute our everyday business purposes (such as processing transactions or risk modeling) as permitted by law.

Children’s Privacy

CWG Websites are strictly intended for business professionals and are not targeted at children. We do not knowingly collect any personal data from individuals under the age of 16. If we discover that a child has provided us with personal data, we will promptly delete it. Parents or guardians may contact us at privacy@thecommonwealth.net.

Security and Retention of Personal Data

We implement appropriate technical, organizational, and physical security measures designed to protect personal data against unauthorized access, loss, alteration, or destruction. However, no internet-based transmission can be guaranteed 100% secure; interactions with our Website are at your own risk.

We retain personal data only for as long as necessary to fulfill the purposes outlined in this Policy, comply with our document retention policies, or meet statutory, legal, tax, regulatory, or accounting obligations. Once no longer required, data is securely anonymized or destroyed.

SMS / Text Messaging Terms of Use

• Consenting to Text Messaging: By consenting to receive text messages from us, you agree to these Text Messaging Terms and Conditions.
• Costs: We do not charge you for sending or receiving messages via our text services. However, standard message and data rates may apply based on your carrier plan.
• Frequency: This service is for conversational, person-to-person communication between you and our employees. Message frequency varies depending on your interactions with us.
• Opting Out: You may opt out at any time by replying STOP, CANCEL, or UNSUBSCRIBE to any message. Opt-out requests are specific to individual conversational phone numbers.
• Privacy: Mobile information and consent collected for SMS communication will not be shared with third parties or affiliates for marketing or promotional purposes.

Changes to Our Privacy Policy

We reserve the right to update, modify, or change this Policy at any time to reflect changing legal requirements or operational updates. Changes become effective immediately upon being posted to the Website.

Contact Us

If you have any questions or would like to exercise your privacy rights, please contact us:

• Postal Mail: The Commonwealth Group, P.O. Box 38626, Germantown, TN 38183
• Email: privacy@thecommonwealth.net