Virginia Privacy Rights Statement

Effective: July 1, 2024

(Defined terms used but not otherwise defined herein shall have the same meaning as used in the eXp World Holdings, Inc. Privacy Policy and Data Processing Policy, or Attendee Terms (as defined below)).

If you are a Virginia resident, you have additional rights with regards to your Personal Information. Please note that this Statement only applies to Virginia residents.

Virginia Consumer Data Protection Act Disclosures: The Virginia Consumer Data Protection Act (“CDPA”) (Va. Code §59.1-571- 582) requires that we inform you of your rights and that we disclose, among other things, the categories of Personal Information we have processed from Virginia residents, the purpose for such processing, how you may exercise your rights, the categories of data we share with third parties, and the categories of third parties with whom we share Personal Information. 

I.Personal Information Processing

We process the Personal Information set forth in the table below:          

Categories	Collected?	Purpose for Processing
Identifiers (Examples: name, address, email address, IP address, account username)	Yes	– Market, improve, test, manage, and provide Services; – Administer accounts, issue invoices, process transactions; – Communicate with you, respond to your comments or inquiries, and promote our Services and the products and services of our Affiliates and Independent Third Parties; – Detect and address security incidents; – Identify and repair errors; – Displaying advertisements; and – Internal research.
Financial Information (Examples: bank account number or other financial information)	Yes	– Provide the products or services you requested; – Administer accounts, issue invoices, process transactions; – Detect and address security incidents; and – Internal research.
Sensitive Data (Examples: gender)	Yes	– Register you for events.
Commercial Information  (Examples: records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies)	Yes	-Market, improve, test, manage, and provide Services; – Administer accounts, issue invoices, process transactions; – Detect and address security incidents; – Internal research; – Displaying advertisements; and – Promote our Services and the products and services of our      Affiliates.
Internet Information (Examples: browsing history, search history, or other information about a consumer’s interaction with eXp Site or Services)	Yes	-Market, improve, test, manage, and provide Services, including providing information about properties in a specific geographic location; – Displaying advertisements; – Detect and address security incidents; – Identify and repair errors; and – Remember your preferences, tailor the Services to you
Audio, Electrical, or Visual Information	Yes	-Market, improve, test, manage, and    provide Services; – Displaying advertisements; – Detect and address security incidents; and – Identify and repair errors

II.    Personal Information Disclosure

We generally share the following categories of Personal Information, as defined in the table above, with third parties:

• • Identifiers
  • Financial Information
  • Commercial Information
  • Internet Information

Such information was disclosed to:

• • our Affiliates (joint ventures and service providers that eXp has an ownership stake);
  • Independent Third Parties (third-party service providers that are not Affiliates) such as loan providers, advertising networks, service providers that provide services to you on our behalf, service providers that help us with fulfilling orders, sending postal mail and email, analyzing data, providing marketing assistance, providing search results and links, tracking website analytics, processing credit card payments, organizing events, and providing customer service;
  • Our Agents (independent contractor real estate agents and brokers) when you request information about the Services. We may also share identifiers with your fellow Agents to facilitate networking at our events.

If you sign up to attend any eXp World Holdings, Inc. virtual event or in-person event, the collection, use, and disclosure of your Personal Information may also be governed by the applicable event’s terms and conditions (the “Attendee Terms”). To the extent that the Attendee Terms and this Virginia Privacy Rights Statement conflict, the Attendee Terms shall govern. 

1.  Right to Know

Pursuant to the CDPA, you have the right to know whether we are processing your Personal Information and to access the Personal Information we hold about you. 

2.  Right to Correct

You have the right to correct inaccuracies in the Personal Information we hold about you.

3.  Right to Delete

You also have the right to request that we delete any Personal Information you have provided to us or we have obtained about you. Once we verify your request, we will delete Personal Information from our records. Please note, however, that we may not be able to delete all Personal Information about you in certain circumstances, such as to provide a product or service you requested or fulfill a contractual obligation. Where we have obtained Personal Information about you from a third party, we may either (i) retain a record of your request and the minimum data necessary to confirm your Personal Information remains deleted from our records, or (ii) cease processing your Personal Information for any non-exempt purposes.

4.  Right to Data Portability

You have the right to obtain a copy of your Personal Information you have provided to us in a portable and readily usable format, to the extent technically feasible. You can request a transfer of Personal Information to you or a third party where we process the data based on your consent or a contract with you, and in a commonly used and machine-readable format.

5.  Right to Opt-out of Sales, Targeted Advertising, and Profile Creation

You have the right to opt-out of the sale of your Personal Information or the use of Personal Information for targeted advertising or profiling. You may opt-out of targeted advertising by adjusting your cookie preferences on our Sites, visiting the opt-out request pages of industry groups providing broad opt-out options like the Network Advertising Initiative, Digital Advertising Alliance, AdChoices Canada, or European Interactive Digital Advertising Alliance, or by visiting the specific ad networks like Google, LinkedIn, Twitter, and Meta. Please note that opting out with industry groups or advertising networks will only apply to the specific browser or device from which you opt-out. On your mobile device you may also go to your device settings and select “Limit Ad Tracking” (iOS devices) or “Opt-out of interest-based ads” (Android devices), which will allow you to limit our use of information collected from or about your mobile device for the purposes of displaying online targeted advertising to you. You can opt-out of the sale of your Personal Information here. 

6.  Right to Opt-in to Processing of Sensitive Data

We will only process your Sensitive Data where you have provided consent.

7.  Right to Be Free From Discrimination

We will not discriminate against you for exercising any right described in this Statement. This means we cannot, among other things:

• Deny goods or services to you;
• Charge different prices or rates for goods or services; or
• Provide a different level or quality of goods or services to you.

VI.    How to Make a Request

1.  Where to Send Your Request

If you are a Virginia resident and you wish to make any of the above requests, please send a request to:

Webform: Please click here.                

Email:  send request to [email protected] with  “Virginia Privacy Information Request” in the subject line

2.  Authenticating Your Request

When you contact us, you will need to provide us with enough information to authenticate your request. The specific information we request to authenticate your request will depend on how you make a request, what right you are exercising, and our relationship with you. You must also provide a description of what right you want to exercise and the information to which your request relates. If we are unable to reasonably authenticate your request, we may deny your request.

3.  Responding to Your Request

We will respond to authenticated requests within forty-five (45) days of receipt. Please note that we are only required to respond to each individual twice per year. We are not required to: (1) maintain data in identifiable form, or collect, obtain, retain, or access any data or technology in order to associate your request with your Personal Information; or (2) reidentify de-identified data or pseudonymous data. We will comply with authenticated requests free of charge, unless your requests are manifestly unfounded, excessive, or repetitive, in which case we may charge a reasonable fee to cover the administrative costs of complying with your request.

4.  Appeal

If we refuse to take action on your request to exercise any of your rights described in Section III, you can appeal our decision within a reasonable time by submitting an appeal using the methods for submitting a request in Section IV(1) above. We will consider your appeal and inform you of our decision within sixty (60) days of receiving your appeal. If your appeal is denied, we will provide you notice of such decision and a method of submitting a complaint to the Virginia Attorney General’s office.