The following chart details categories of Personal Data we collect, as well as categories of Personal Data we have collected and disclosed for operational business purposes in the preceding 12 months. The chart also details the categories of Personal Data that we “sell” or “share” for purposes of cross-context behavioral or targeted advertising, including within the preceding 12 months. For purposes of this Statement, “sold” or “sale” means the disclosure of Personal Data for monetary or other valuable consideration but does not include, for example, the transfer of Personal Data as an asset that is part of a merger, bankruptcy, or other disposition of all or any portion of our business. For the categories below, Westgate “sells” or “shares” the data solely for the purposes of Marketing and Promotion. Categories of Personal Data Identifiers, such as name, nationality, passport, visa or other government-issued ID, and online identifiers Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Service Providers -Franchisees -Owners -Homes and Property Management Companies -Strategic Business Partners -Third Parties (for purposes of approved Linked Accounts and Promotional activities) -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes -Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Operations & General Business -Emergency & Incident Response -Legal & Compliance -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Child-Related Services (for Parents & Legal Guardians) -Loyalty Programs, Accounts & Relationship Management -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Personal information, as defined in the California safeguards law, such as name, contact information, government-issued ID, and financial information Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes Service Providers -Franchisees -Owners -Homes and Villas Property Management Companies -Marketing Partners -On-Property or Travel Partners -Strategic Business Partners -Third Parties (for purposes of approved Linked Accounts and Promotional activities) -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes -Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Emergency & Incident Response -Legal & Compliance -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Child-Related Services (for Parents & Legal Guardians) -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Characteristics of protected classifications under California or federal law, such as gender, age, medical conditions, primary language, national origin, citizenship, and marital status Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Service Providers -Franchisees -Owners -Homes and Property Management Companies -Authorized Licensees -On-Property or Travel Partners -Strategic Business Partners -Third Parties -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes -Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Operations & General Business -Emergency & Incident Response -Legal & Compliance -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Child-Related Services (for Parents & Legal Guardians) -Loyalty Programs, Accounts & Relationship Management -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Commercial information, such as transaction information, purchase history, financial details, payment methods, and membership or loyalty program data Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes Service Providers -Franchisees -Owners -Homes and Villas Property Management Companies -Authorized Licensees -On-Property or Travel Partners -Strategic Business Partners -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Operations & General Business -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Child-Related Services -Loyalty Programs, Accounts & Relationship Management -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Internet or network activity information, such as browsing history and interactions with our and other websites and computer systems Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Service Providers -Governmental Agencies (if required) -Geolocation data, such as device location and IP location Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes -Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Operations & General Business -Legal & Compliance -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Child-Related Services (for Parents & Legal Guardians) -Loyalty Programs, Accounts & Relationship Management -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Geolocation data, such as device location and approximate location derived from IP address Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Service Providers -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes -Booking & Guest Registration -Operations & General Business -Emergency & Incident Response -Legal & Compliance -Loyalty Programs, Accounts & Relationship Management -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Audio, electronic, visual, and similar information, such as images and audio, video or call recordings created in connection with our business activities Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Service Providers -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold Westgate does not sell or share this data Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising Westgate does not sell or share this data Processing Purposes Booking & Guest Registration -Conferences & Events -Operations & General Business -Emergency & Incident Response -Legal & Compliance -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Inferences drawn from any of the Personal Data listed above to create a profile or summary about, for example, an individual’s preferences and characteristics Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Property Management Companies -On-Property or Travel Partners -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold -Advertising Partners Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising -Advertising Partners Processing Purposes -Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Operations & General Business -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Marketing, Promotions, Contests & Third-Party Products Categories of Personal Data Sensitive Personal Data -Personal Data that reveals an individual’s Social Security, driver’s license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, religious or philosophical beliefs, citizenship, immigration status, or union membership; the contents of mail, email, and text messages unless Westgate is the intended recipient of the communication; genetic data; -The processing of biometric information for the purpose of uniquely identifying an individual; -Personal Data collected and analyzed concerning an individual’s health; -Personal Data collected and analyzed concerning an individual’s sex life or sexual orientation; -Personal Data collected from a known child. Categories of Third Parties to Whom Personal Data Has Been Disclosed for Operational Business Purposes -Service Providers -Governmental Agencies (if required) Categories of Third Parties to Whom Personal Data Has Been Sold Westgate does not sell or share this data Categories of Third Parties to Whom Personal Data Has Been Shared for Cross-Context Behavioral or Targeted Advertising Westgate does not sell or share this data Processing Purposes Booking & Guest Registration -On-Site Reception & Stay Services -Conferences & Events -Operations & General Business -Emergency & Incident Response -Legal & Compliance -Spa, Beauty, Golf & Fitness Services -Food & Beverage Services -Child-Related Services -Marketing, Promotions, Contests & Third-Party Products As a company that conducts activities that are financial in nature, Westgate is a “financial institution” as that term is defined in the Gramm-Leach-Bliley Act (“GLBA”). While the CCPA does not exempt financial institutions, Section 1798.145(e) of the CCPA does exempt personal information collected by a financial institution pursuant to the GLBA. Personal information does not include publicly available information from government records, de-identified or aggregated consumer information, or information otherwise excluded from the CCPA’s scope, such as information collected pursuant to the GLBA. We have obtained the categories of personal information listed above from the following categories of sources: 1. Directly from you. For example, from forms you complete or products and services you purchase. 2. Indirectly from you. For example, from information we obtain in the course of providing our services to you, or from observing your actions on our website. 3. From third-party business partners including, but not limited to, social media sites, ad networks, and analytics providers. We do not knowingly “sell” or “share” the Personal Data, including the Sensitive Personal Data, of individuals under the age of 16. We may also use and disclose Personal Data to a third party in the context of any reorganization, financing transaction, merger, sale, joint venture, partnership, assignment, transfer, or other disposition of all or any portion of our business, assets, or stock (including in connection with any bankruptcy or similar proceedings). Legitimate Business Interests/Purposes for Collecting Information We may use the Personal Information you provide to Westgate to verify your identity, complete your transaction, administer your memberships associated with Westgate, send you commercial messages, advise you of other offers and information, carry out general recordkeeping, maintain a list of current and former owners or members, create informational or analytical reports, supplement your disclosed information, carry out verifications, planning or other legitimate business needs of Westgate, allow for revenue collection or debt recovery, respond to your inquiries or others who you have identified as an authorized agent or proxy, and such other purposes as permitted by applicable law. We may use information provided to Westgate for Marketing Purposes including ‘Targeted Marketing’ which generally include, but are not limited to, the operation of our rewards programs and notifying you about promotions and special offers regarding products and services provided by Westgate, contacting you via email or text message, and contacting you in response to your inquiries, comments and suggestions. These notifications are provided via our Websites, mobile apps, direct mail or email, text messages, or by telephone. Depending on your location, you may have certain rights regarding the Personal Data we collect. To review these rights or submit a request, please visit our Data Requests page. We may use information provided to Westgate for Non-Marketing Purposes, which generally include, but are not limited to, validating your identity, recording gaming-related activity, issuing credit and collecting debt, facilitating reservations and processing purchase transactions from payment cards or other financial transactions, conducting market research and to improve customer service, complying with legal and regulatory requirements, satisfying contractual obligations and application for employment verifications. We may collect and use your Personal Information to satisfy any applicable law, regulation, legal process, or enforceable governmental request, or when we have a good faith belief that use and disclosure is necessary to investigate, prevent or protect against harmful activities Westgate, owners, guests, visitors, associates, or property (including our Websites), or to others, prevent fraud, or cooperate with law enforcement or other government agencies. Data from your information may also be used generally for our legitimate business interests/ purposes concerning data analysis, audits, fraud monitoring and prevention, internal quality assurance, developing new products, enhancing our services, helping us comply with legal requirements or process, enforcing compliance with our Terms and Conditions or any product, service or program terms and conditions, helping protect our Services, determining the effectiveness of our promotional campaigns and operating and expanding our business activities. We also may share certain information with Affiliates and other non-affiliated third parties as permitted by law and as described below under “Disclosure of Information to Third Parties.” Reservation Information The Personal Information you provide to us for making a reservation is made available to the applicable property for the purpose of meeting your reservation request. After making a reservation or completing your stay at a Westgate property, unless you tell us otherwise, the information you provide may be used by us and our Authorized Licensees for marketing of Westgate properties and certain other Westgate branded products. Westgate may use the services of third-party mail houses for the sole purpose of mailing materials. After your stay, we retain your personally identifiable information including details of your stay, room type and accommodation type. User Generated Content We may offer platforms for users to submit content such as reviews, message boards or other content. Any information disclosed in these areas becomes public information and you should always be careful when deciding to disclose your Personal Information. We are not responsible for privacy practices of other users including website operators to whom you provide information. Internet Based Advertising Westgate and third parties may use the information collected through our Websites using cookies, web beacons, and other technologies to help manage online advertising programs and deliver electronic advertisements that may be more relevant to individual consumers. Please see Cookies and Related Technologies below for more information.