California Consumer Privacy Statement

This California Consumer Privacy Statement supplements the OneMain Privacy Policy and Privacy Notice. It explains how OneMain Holdings, Inc. and its subsidiaries collect (both online and offline), use, and disclose Personal Information about California residents, such as our website visitors, business partners and job applicants, that is subject to the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA”). These subsidiaries include those that use “OneMain” or “Springleaf” in their name, such as OneMain Financial Group, LLC and OneMain Trim, LLC, as well as American Health and Life Insurance Company, Triton Insurance Company, and CommoLoCo, Inc.

This California Consumer Privacy Statement does not apply to OneMain personnel. This California Consumer Privacy Statement also does not apply to information collected, processed or disclosed pursuant to the Gramm-Leach-Bliley Act, its implementing regulations or the California Financial Information Privacy Act.

This California Consumer Privacy Statement uses certain terms that have the meaning given to them in the CCPA.

We may collect (and may have collected during the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement) the following categories of personal information about you:

• Identifiers: identifiers such as a real name, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers, and similar technology; unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, IP address, email address, Social Security number, and other similar identifiers
• Additional Data Subject to Cal. Civ. Code § 1798.80: signature, bank account number or other financial information, and education information
• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, national origin, age, gender, marital status, citizenship status, and military and veteran status (we may be required to collect protected classifications in connection with employment applications; however, we do not collect protected classifications in connection with consumer credit applications when prohibited by law)
• Commercial information: commercial information, including products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
• Geolocation Data: general location information, such as information obtained from your IP address
• Sensory Information: audio, electronic, visual, and similar information
• Employment Information: professional or employment-related information, such as résumé information, occupation details, education details, certifications and professional associations, historical compensation details, previous employment details, emergency contact information, and pre-employment screening and background check information, including criminal records information
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, predispositions, or behavior.

We may use (and may have used during the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement) your personal information for the purposes described in the OneMain Privacy Policy and for the following business purposes:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage, or providing similar services;
• Providing advertising and marketing services;
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
• Short-term, transient use, such as nonpersonalized advertising shown as part of your current interaction with us;
• Helping to ensure security and integrity;
• Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them;
• Debugging to identify and repair errors;
• Undertaking internal research for technological development and demonstration;
• Managing career opportunities with OneMain; and
• Managing our relationships with current or prospective partners, corporate customers and vendors and other business partner personnel.

We do not use or disclose (and have not used or disclosed during the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement) “sensitive personal information” (as defined under the CCPA) for any purpose other than those permitted under the CCPA.

To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

We will retain your personal information for the time period reasonably necessary to achieve the purposes described in the OneMain Privacy Policy and this California Consumer Privacy Statement, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.

During the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement, we may have obtained personal information about you from the following categories of sources:

• You directly, including through your device.
• Our affiliated entities.
• Marketing and business partners, such as consumer data resellers.
• Service providers, contractors and other vendors who provide services on our behalf, such as data analytics providers.
• Your employer, if you are a representative of one of our business partners.
• Government entities from which public records are obtained.
• Job references, such as your employers or teachers.
• Recruiting and talent agencies.
• Data brokers, such as credit bureaus, consumer reporting agencies and background check services.

We do not sell your personal information in exchange for monetary compensation. We may share your personal information by allowing certain third parties (such as online advertising services) to collect personal information via automated technologies on our websites and apps for cross-context behavioral advertising purposes. This kind of sharing may be considered a “sale” under California law when the personal information is exchanged for non-monetary consideration. You have the right to opt out of these types of disclosures of your information.

We may share for cross-context behavioral advertising purposes (and may have shared during the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement) the following categories of personal information about you to online advertising services:

• Identifiers
• Commercial Information
• Online Activity
• Inferences

You have the right to opt-out of this disclosure of your information, as detailed below. We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

During the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement, we may have disclosed the following categories of personal information about you for the business purposes listed above to the following categories of persons:

Category of Personal Information	Categories of Third Parties
Identifiers	Our affiliated entities Vendors who provide services on our behalf Our business partners Your employer, if you are a representative of one of our business partners Online advertising services ISPs and operating systems and platforms Data brokers, such as credit bureaus, consumer reporting agencies and background check services
Additional Data Subject to Cal. Civ. Code § 1798.80	Our affiliated entities Vendors who provide services on our behalf
Protected Classifications	Our affiliated entities Vendors who provide services on our behalf
Commercial Information	Our affiliated entities Vendors who provide services on our behalf Data analytics providers
Online Activity	Our affiliated entities Vendors who provide services on our behalf Data analytics providers
Geolocation Data	Our affiliated entities Vendors who provide services on our behalf
Sensory Information	Our affiliated entities Vendors who provide services on our behalf
Employment Information	Our affiliated entities Vendors who provide services on our behalf
Inferences	Our affiliated entities Vendors who provide services on our behalf

In addition to the categories of third parties identified above, during the 12-month period prior to the Last Updated date of this California Consumer Privacy Statement, we may have disclosed personal information about you to government entities and third parties in connection with corporate transactions, such as mergers, acquisitions or divestitures.

You have certain choices regarding your personal information, as described below.

• Access: You have the right to know what personal information we have collected about you, including the categories of personal information collected, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
• Deletion: You have the right to request that we delete certain personal information we have collected from you.
• Opt-Out of Sale or Sharing: You have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.

To submit a request, please visit our Online Request Portal (available 24/7) or call us at (844) 859-1865 (M-F 5:30 AM – 2:30 PM Pacific, except for holidays). This California Consumer Privacy Statement does not apply to OneMain personnel.

You can opt-out of the sale or sharing of your personal information by visiting our "Do Not Sell or Share My Personal Information" website or using the Global Privacy Control (“GPC”) signal. Like with other types of browser-specific controls, if you use the GPC, we will process it for the browser from which you submit the request, but the opt-out request will not apply outside of the browser to your device. After using the GPC, if you clear your cookies in your browser, you will need to use the GPC again for us to process your opt-out for that browser.

To submit a request as an authorized agent on behalf of a consumer, please follow these authorized agent instructions for submitting a request. For questions or concerns about our privacy policies and practices, please call us at (844) 859-1865 (M-F 5:30 AM – 2:30 PM Pacific, except for holidays).

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. We use a third-party identity verification service to verify your identity. If you request access to, correction of or deletion of your personal information, we may ask you to provide your: first name, middle initial, last name, current mailing address, date of birth, Social Security number or individual taxpayer identification number. We also will ask questions to verify your identity.

If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request.

Below are the metrics for CCPA requests received by us in the previous calendar year.

Requests to Know
Received	22
Complied with in whole or in part	18
Denied	4
Requests to Delete
Received	43
Complied with in whole or in part	0
Denied	43
Requests to Opt-Out
Received	0
Complied with in whole or in part	0
Denied	0
Mean Number of Days to Respond
Requests to Know	5 days
Requests to Delete	5 days
Requests to Opt-Out	Not applicable