REGIONAL MANAGEMENT CORP. PRIVACY POLICY

EFFECTIVE DATE: June 20, 2019

Regional Management Corp. and its subsidiaries and affiliates (“Regional” or “we”) respect your privacy, and we are committed to protecting your personally identifiable information (“Personal Information”). This privacy policy (“Policy”) describes how we collect, use, and share information that may be collected when you visit our website including RegionalFinance.com and RegionalManagement.com (“Site”).

Please read this Policy carefully. By using the Site, you acknowledge and agree that you consent to this Policy. If you do not agree to be bound by this Policy, please exit the Site now.

Please be aware that we may change or replace the terms of this Policy from time to time, at our sole discretion. If we make changes to this Policy, we will notify you by posting those changes to this Site. Any modifications to this Policy will go into immediate effect after they have been posted. Your continued use of the Site after we post any changes constitutes your consent to the updated Policy.

This Site is controlled, operated, and administered by Regional from its offices within the United States. If you are accessing this Site from a location outside the United States, you acknowledge and consent to the collection, storage, processing, and transfer of your Personal Information to our facilities in the United States and to those third parties with whom we share it as described in this Policy.

Information that We Collect
Through your use of our Site or our services, we may collect Personal Information, which is information that identifies you as an individual or relates to you as an identifiable individual. While we do not require you to provide Personal Information in order to navigate our Site, we may need to collect Personal Information if you choose to engage in certain activities on our Site. The Personal Information that we collect on the Site may be combined with Personal Information collected offline. Below are the types of Personal Information that we may collect.

Information Provided by You
We collect the Personal Information that you provide to us. If you register for an account on our Site, we will collect certain Personal Information from you, such as your name, contact information, and payment information.
We may also collect information based on your use of our services, such as payment history, account balance, and transaction information.
If you contact us, we will maintain records of your correspondence. This may include any of your questions, comments, or suggestions as well as our responses.

Information Provided by Third Parties
We may receive certain Personal Information about you from third parties. For example, we may receive information about your credit history from a credit reporting agency or income information from your employer.

Device and Usage Information
The Site automatically collects technical information through your use of the Site, such as the following:

• Usage Information: We collect certain information automatically through your use of the Site, such as which of the pages on our Site that you access, the frequency of access, and what you click on while on our Site.
• Location Information: We may collect information about your actual location which may be determined from GPS and other sensors that may reveal information on nearby devices, Wi-Fi access points, and cell towers.
• Device Information: We may collect information about the device you are using to visit our Site, such as hardware model, operating system, application version number, browser, and IP addresses.
• Mobile Device Information: In addition to the Device Information listed above, when you access our Site via a browser on your mobile device, we may collect mobile network information including telephone number, the unique device identifier assigned to that device, mobile carrier, operating system, and other device attributes.

Cookies and Other Tracking Technologies
A cookie is a small text file that is stored on a user’s computer and/or device for record-keeping purposes.

• Session Cookies: We use session cookies to make it easier for you to navigate our Site. A session ID cookie expires when you close your browser.
• Persistent Cookies: We use persistent cookies that remain on your hard drive for an extended period of time. For example, we may set a persistent cookie to store your password, so you don’t have to enter it more than once.

If you reject cookies, you may still use our Site, but your ability to use some areas of our Site may be limited.
We may also use other website or mobile tracking technologies to identify you and keep track of your preferences, prevent fraudulent activity or improve Site security, and assess the performance of the Site.

We use Hotjar in order to better understand our users’ needs and to optimize this service and experience. Hotjar is a technology service that helps us better understand our users experience (e.g. how much time they spend on which pages, which links they choose to click, what users do and don’t like, etc.) and this enables us to build and maintain our service with user feedback. Hotjar uses cookies and other technologies to collect data on our users’ behavior and their devices (in particular device’s IP address (captured and stored only in anonymized form), device screen size, device type (unique device identifiers), browser information, geographic location (country only), preferred language used to display our website). Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will ever use this information to identify individual users or to match it with further data on an individual user. For further details, please see Hotjar’s privacy policy by clicking on this link.

You can opt-out to the creation of a user profile, Hotjar’s storing of data about your usage of our site and Hotjar’s use of tracking cookies on other websites by following this opt-out link.

Aggregate Information
Statistical or aggregated information does not directly identify you or any specific person, but it may be derived from your Personal Information. For example, we may aggregate Personal Information to calculate the percentage of users in a particular ZIP code.

How We Use and Share Information

Please see our Privacy Notice, which we provide to all our customers, for a comprehensive explanation of how we collect, use and share Personal Information and what your can do to limit the use and sharing of your Personal Information.

We use Personal Information that we collect in the following ways:

• Provide Services: We use your Personal Information in order to provide you with our services and to fulfill our contractual obligations to you.
• Communicate: We use Personal Information to communicate with you about our Site or services. We may also use your Personal Information to send you account updates or other communications regarding your account or to inform you of any changes to our Site or services.
• Specific Purposes: You may be asked to provide information for a specific purpose. For example, we may request that you fill out a survey to provide us with feedback on our technical support. We will only use the information that you provide for the purpose for which you provided it to us.
• Customer Support: We may use your Personal Information to provide you support or other services you request. For example, we may need your information in order to provide technical support or answer questions about our Site.
• Maintenance and Improvement: We analyze how our users interact with our Site in order to maintain and improve it. We also use information that we collect to diagnose any problems with our Site to improve the user experience.

We reserve the right to share information, including Personal Information, with third parties, as described below:
Service Providers: We may share information with service providers that help us perform Site functions and administer our services. For example, we may share your information with third-party customer service providers.

• Corporate Family: We may share information within our corporate family, such as with subsidiaries, joint ventures, or affiliates, to the extent permitted by law.
• Corporate Structure: We may share information in connection with a merger, acquisition, consolidation, change of control, or sale of all or a portion of our assets or if we undergo bankruptcy or liquidation.
• Consumer Reporting Agencies: We may report the status of your account with us to consumer reporting agencies.
• To Prevent Harm: We may share information if we believe it is necessary in order to detect, investigate, prevent, or take action against illegal activities, fraud, or situations involving potential threats to the rights, property, or personal safety of any person.
• As Required by Law: We will share information where we are legally required to do so, such as in response to court orders or legal process, to establish, protect, or exercise our legal rights, to defend against legal claims or demands, or to comply with the requirements of any mandatory applicable law.
• With Your Consent: We may request your permission to share your Personal Information for a specific purpose. We will notify you and request consent before you provide the Personal Information or before the Personal Information you have already provided is shared for such purpose.

Security
The security of your Personal Information is important to us. We maintain reasonable physical, technical, and administrative security measures to protect and limit access to your Personal Information. However, no method of transmission over the Internet or electronic storage technology is 100% secure. While we strive to use commercially acceptable means to protect your Personal Information, we cannot guarantee its absolute security.

Third-Party Data Collection
Some content or applications on the Site may be provided by third parties, including analytics companies and advertising providers. Our Site may also include social media features, such as the Facebook “Like” button, and other widgets, such as the “Share” button or interactive mini-programs provided by third parties. These third parties may use cookies or other tracking technologies to collect information about you when you use our Site. The information they collect may be associated with your Personal Information or they may collect information, including Personal Information, about your online activities over time and across different websites and other online services.
One of the third-party services that we use is Google Analytics, which is a web analysis service provided by Google. Google utilizes the data collected to track and examine the use of our Site and may share this data with other Google services. You can learn more about how Google uses and shares Personal Information and about any choices you may have with regards to your Personal Information by visiting their website at www.google.com/policies/privacy/partners/.
Similarly, the Site may contain links to third-party websites that are not owned or controlled by Regional. We have no control over the content, privacy policies, or practices of any third-party website. You are subject to the policies of those third-party websites, where applicable. We encourage you to review the privacy policies of these third-party websites before you disclose your Personal Information.

Browser Do Not Track
The Site is not currently configured to respond to Do Not Track signals.

Children’s Privacy
Our Site is not intended for use by children. We do not knowingly collect Personal Information from children under the age of 13 years. Please contact us if you believe we may have unknowingly collected information about a child under 13, and we will take immediate steps to delete any such Personal Information.

This Privacy Policy is provided to you for informational purposes only. You do not need to call or take any action in response to this notice. We recommend that you read and retain this notice for your personal files.