California Consumer Privacy Act Policy

Effective and last updated: August 7, 2026

INTRODUCTION

This California Consumer Privacy Act Policy (“CCPA Policy”) explains how Nexus Nova LLC (collectively, “Nexus Nova,” “we,” “our,” or “us”) may collect, use, disclose, or retain personal information subject to the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its associated regulations (collectively, the “CCPA”). This CCPA Policy applies solely to California “consumers”, which generally means a natural person who is a California resident as defined under California law. Such persons may be referred to as “California consumer”, “you”, or “your” in this CCPA Policy. If you are not a California consumer, please review our Privacy Policy for privacy-related information that may be applicable to you.

Please note Nexus Nova is a master servicer that purchases the right to service mortgage loans but does not itself conduct mortgage servicing activities with respect to such mortgage loans, instead contracting with subservicers to perform such activities. Nexus Nova also acts as a mortgage lender and mortgage broker conducting mortgage origination activities with respect to mortgage loans and other loan products, generally under the trade names of “Rosegate” and “Rosegate Mortgage”. If we own the right to service your mortgage loan, or acted as a mortgage lender or mortgage broker with respect to your mortgage loan or other loan product, please note the CCPA generally does not apply to certain information collected, used, disclosed, or retained by us, such as information subject to the Gramm-Leach-Bliley Act (“GLBA”), the Fair Credit Reporting Act (“FCRA”), and certain other federal or state laws and regulations. As such, this CCPA Policy generally does not apply to information collected, used, disclosed, or retained by us under those laws and regulations. More information on the personal information we may collect, use, or disclose under those laws and regulations, such as under the GLBA or FCRA, can be found in the financial privacy notice provided to you either (1) during the origination of your mortgage loan or loan product, if we acted as the mortgage lender or mortgage broker, or (2) on our behalf by the subservicer directly servicing your mortgage loan, if we are the master servicer of your mortgage loan.

NOTICE AT COLLECTION OF PERSONAL INFORMATION

The CCPA defines “personal information” as information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer. Personal information does not include public information that is made lawfully available, deidentified or aggregated information, or lawfully obtained, truthful information that is a matter of public concern.

This notice and the table below identifies the categories of personal information Nexus Nova may have collected, used, or disclosed about a California consumer, the categories of sources that personal information may have been collected from, the business or commercial purpose(s) such personal information may have been collected, used, or disclosed, the categories of third parties with whom a California consumer’s personal information may have been disclosed to, and the categories of third parties with whom a California consumer’s personal information may have been shared or sold to in the last 12 months preceding the effective date of this CCPA Policy.

Categories of personal information that may be collected, used, and disclosed	Categories of sources that personal information may be collected from	Business or commercial purpose(s) personal information may be collected, used, or disclosed	Categories of third parties with whom personal information may be disclosed	Categories of third parties that personal information may be shared with or sold to
Identifiers Examples: name, Internet Protocol address, email address, telephone number, a device identifier, or other similar identifiers.	From you directly if you provide this personal information to us. From your device(s) when you visit our website. From vendors, affiliates, and business partners. From government or regulatory entities or agencies. From Fannie Mae, Freddie Mac, the FHA, or the VA.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business. To provide advertising and marketing services	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Personal information described in California’s Customer Records statute (California Civil Code § 1798.80(e)) Examples: name, address, telephone number, education, financial information, employment, or employment history.	From you directly if you provide this personal information to us. From your device(s) when you visit our website. From vendors, affiliates, and business partners. From government or regulatory entities or agencies. Fannie Mae, Freddie Mac, the FHA, or the VA.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business. To provide advertising and marketing services	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Protected classification characteristics under California or federal law Examples: age, race or ethnicity, national origin, citizenship or immigration status, or marital status.	From you directly if you provide this personal information to us. From vendors, affiliates, and business partners. From government or regulatory entities or agencies. Fannie Mae, Freddie Mac, the FHA, or the VA.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business.	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Geolocation data Example: location of an Internet Protocol address.	From you directly if you provide this personal information to us. From your device(s) when you visit our website. From vendors, affiliates, and business partners.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business. To provide advertising and marketing services	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Internet or other electronic network activity information: Example: Information regarding your interaction with our website.	From you directly if you provide this personal information to us. From your device(s) when you visit our website. From vendors, affiliates, and business partners.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business. To provide advertising and marketing services	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Audio, electronic, visual, or similar information Example: Audio recordings of voicemails you leave us.	From you directly if you provide this personal information to us. From vendors, affiliates, and business partners.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business.	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Professional or employment-related information and history, and education information Example: current employer and job title.	From you directly if you provide this personal information to us. From vendors, affiliates, and business partners. From government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	To help ensure security and integrity, including to detect security incidents, protect against malicious, deceptive, or fraudulent activity, and prosecute persons responsible for malicious, deceptive, or fraudulent activity. Short term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business. To provide advertising and marketing services.	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	Nexus Nova has not sold or shared personal information in the last 12 months preceding the effective date of this CCPA Policy.
Sensitive Personal Information: Example: Personal information that reveals a consumer’s Social Security, driver’s license, state identification card, or passport number, immigration or citizenship status, or contents of a consumer’s mail, email, or text messages.	From you directly if you provide this personal information to us. From vendors, affiliates, and business partners. From government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information. To resist malicious, deceptive, fraudulent, or illegal actions directed at the business and to prosecute those responsible for those actions. For short-term, transient use. To perform services for our business, including maintaining or servicing accounts, providing customer service, verifying customer information, or performing other services for our business.	Vendors, affiliates, and business partners. Government or regulatory entities or agencies, law enforcement, or other legal authorities. Fannie Mae, Freddie Mac, the FHA, or the VA.	Nexus Nova does not sell or share sensitive personal information.

RETENTION OF PERSONAL INFORMATION

Nexus Nova may retain personal information for different periods of time. The retention period is dependent on the reason why the personal information was collected and how it will be used. Unless applicable law requires otherwise, Nexus Nova will exercise commercially reasonable efforts to delete or deidentify personal information when it is no longer needed to fulfill the applicable business purpose(s) the information was collected for. If we are unable to fully delete or deidentify such personal information due to technical or operational reasons, Nexus Nova will take commercially reasonable measures to prevent further usage of such personal information.

CALIFORNIA CONSUMER RIGHTS

Subject to certain exemptions or exceptions, California consumers have the following rights under the CCPA with respect to their personal information:

The right to know what personal information we have collected, used, or disclosed about you, including the categories of personal information, the categories of sources from which we collected personal information, the business or commercial purpose(s) for collecting, using, disclosing, selling, or sharing personal information (if applicable), the categories of third parties to whom we disclose personal information (if applicable), and the specific pieces of personal information we collected about you;
The right to delete personal information that we collected from you;
The right to correct inaccurate personal information that we maintain about you;
If we sell or share personal information, the right to opt out of the sale or sharing of such information;
If we use or disclose sensitive personal information for purposes other than those specified by the CCPA, the right to limit our use or disclosure of such information;
If we use automated decisionmaking technology to process personal information in order to make significant decisions about you, such as those pertaining to (a) financial or lending services or (b) employment or independent contracting opportunities or compensation, the right to opt-out of the usage of automated decisionmaking technology in making such decisions;
If we use automated decisionmaking technology to process personal information in order to make significant decisions about you, such as those pertaining to (a) financial or lending services or (b) employment or independent contracting opportunities or compensation, the right to access information concerning the automated decisionmaking technology, such as the specific purpose for the use of such technology and information about the logic of the technology; and
The right not to receive discriminatory treatment by us for the exercise of the privacy rights the CCPA confers, including if you are a job applicant, employee, or independent contractor.

HOW TO SUBMIT A REQUEST TO KNOW, DELETE, AND/OR CORRECT

California consumers, and their authorized agents, may submit a request to know, delete, and/or correct by contacting us as described in the How to Contact Us section below.

When you submit a request to know, delete, and/or correct, we will attempt to verify your identity using reasonable measures. To do so, we will request for you to provide us with information and attempt to match that information with other sources of similar information we already maintain. Depending on the sensitivity of the information that is the subject of your request, we may utilize more stringent identification measures to verify your identity. If your authorized agent submits the request on your behalf, we will also request the authorized agent to provide proof of their authority to act on your behalf. We will only request personal information from you, or information from your authorized agent demonstrating their authority to act on your behalf, to the extent reasonably necessary to verify your identity or your authorized agent’s authority to act on your behalf. In addition, we will only use such information to verify your identity or your authorized agent’s authority to make the request. If we are unable to verify your identity, we will either deny the request or ask for additional identifying information, to the extent reasonably necessary to verify your identity.

If you believe that we’ve maintained personal information about you for longer than 12 months, you may submit a request to know such information by contacting us as described in the How to Contact Us section below. When submitting your request, please include a date range for the period that you believe we’ve maintained such personal information.

We will attempt to process and respond to requests within 45 days after receipt of the request. If we require additional time beyond 45 days, we will inform you of that and the extension period. If we determine that your request is subject to an exemption or exception, we will notify you in writing of our determination. If we determine that your request is not subject to an exemption or exception, we will proceed with reviewing and processing your request following completion of the above-referenced identity verification process. If we determine that we are able to comply with your request, we will proceed with fulfilling your request. If we determine that we are unable to comply with your request, we will notify you in writing of the reason.

As mentioned in the Introduction section above, if we own the right to service your mortgage loan (i.e., are the master servicer of your mortgage loan), or acted as a mortgage lender or mortgage broker with respect to your mortgage loan or other loan product, the personal information that we may collect, use, disclose, or retain about you is generally exempt from the CCPA and, therefore, is not subject to the rights discussed above or in this section.

RIGHT TO OPT-OUT OF SALE OR SHARING OF PERSONAL INFORMATION

California consumers have the right to direct businesses to stop selling or sharing their personal information with third parties. Under the CCPA, “selling” personal information generally means providing a consumer’s personal information to a third party for monetary or other consideration. In addition, under the CCPA, “sharing” personal information generally means providing a consumer’s personal information for “cross-context behavioral advertising”, which means targeting of advertising to you based on personal information obtained from your activities across other businesses, websites, applications, or services.

As stated above in the NOTICE AT COLLECTION OF PERSONAL INFORMATION section, and to the extent the CCPA applies to the personal information of California consumers that we may collect, disclose, use, or retain, we may “sell” personal with our affiliates or certain other third parties for use pursuant to their privacy policies, and may “share” such information with third parties or affiliates to serve you personalized promotions or advertisements based on your online activities. While we have not “sold” or “shared” such information in the last 12 months preceding the effective date of this CCPA Policy, we provide a “Do Not Sell My Personal Information” webpage that allows you to submit a request to opt-out of the sale or sharing of your personal information, to the extent the CCPA applies to such information and to the extent we have sold or shared such information. This webpage can be accessed here: Do Not Sell My Personal Information. The link to the Do Not Sell My Personal Information webpage may also be accessed through the link in the footer of nexusnova.com and rosegate.com.

RIGHT TO LIMIT USE OF SENSITIVE PERSONAL INFORMATION

California consumers have the right to limit the use or disclosure of sensitive personal information if a business uses it for purposes other than those permitted under the CCPA. To the extent the CCPA applies to the personal information of California consumers that we may collect, disclose, use, or retain, we do not use or disclose sensitive personal information of California consumers for purposes other than those set forth in the NOTICE AT COLLECTION OF PERSONAL INFORMATION section above.

RIGHT TO OPT-OUT OF AND TO ACCESS AUTOMATED DECISIONMAKING TECHNOLOGY

If a business uses automated decisionmaking technology to process personal information in order to make significant decisions about a California consumer, such as those pertaining to (a) financial or lending services or (b) employment or independent contracting opportunities or compensation, California consumers have the following rights under the CCPA:

The right to opt-out of the usage of automated decisionmaking technology in making such decisions, subject to certain exemptions or exceptions; and
The right to access information concerning the automated decisionmaking technology, such as the specific purpose for the use of such technology and information about the logic of the technology.

To the extent the CCPA applies to the personal information of California consumers that we may collect, disclose, use, or retain, we do not use automated decisionmaking technology to make significant decisions concerning a California consumer.

CALIFORNIA SHINE THE LIGHT

Under California law, California consumers may request businesses to provide certain details about how their personal information is shared with third parties for direct marketing purposes. Should you like to submit a request for this information, please contact us as described in the How to Contact Us section below.

INFORMATION SECURITY

We maintain commercially reasonable security measures to protect the personal information we collect and store from loss, misuse, destruction, or unauthorized access, use, disclosure, or exposure. However, no security measure or data transmission over the Internet is 100% secure. As a result, while we strive to protect your personal information, you acknowledge that: (a) there are security and privacy limitations inherent to the Internet which are beyond our control and (b) security, integrity, and privacy of any and all information and data exchanged between you and us cannot be guaranteed.

THIRD PARTY LINKS

This website may contain links that will let you leave the website and access another website. Linked websites are not under our control. We accept no responsibility or liability for these other websites.

CHILDREN’S PRIVACY

Our websites and any services we provide, as well as the content, materials, products, or services available on or through our websites, are not intended for children or minors under the age of 18. We do not knowingly collect, use, sell, share, or otherwise disclose personal information from children or minors under the age of 18. Please do not use our websites, communicate with us, or otherwise provide us your personal information if you are a child or minor under the age of 18.

If you believe we may have any Personal Information from or about a person under the age of 18, please contact us as described in the How to Contact Us section below.

ACCESSIBILITY

We are committed to ensuring this CCPA Policy is accessible to individuals with disabilities. If you are using a screen reader or other auxiliary aid and are having problems viewing this CCPA Policy, please contact us as described in the How to Contact Us section below.

CHANGES TO THIS CCPA POLICY

From time to time, we may update this CCPA Policy. If we do, we will note near the top of this page the date that any changes went into effect.

HOW TO CONTACT US

If you have questions or concerns regarding our privacy policies or practices, or wish to submit a request or exercise a consumer right under the CCPA, please email us at legal@rosegate.com or call us toll free at (800) 548-1882.