OPRA - Privacy Notice and Policy

Last Updated: June 29, 2020

The Options Price Reporting Authority, LLC ("OPRA") has created this Privacy Notice and Policy in order to demonstrate its commitment to the privacy of (a) users of the OPRA website ("OPRA Website"); (b) OPRA's existing and prospective vendors and subscribers, and such persons' personnel, users and representatives; and (c) any other individuals from whom OPRA collects personal data during the course of its business activities.

Contract administration for OPRA is provided by Cboe Exchange, Inc. (“Cboe”). Except as described in this Privacy Notice and Policy, collection, sharing and use of personal data, and access to personal data, “by OPRA” includes collection, sharing and use of personal data and access to personal data by Cboe personnel who have been assigned by Cboe to perform contract administration services for OPRA.

This Privacy Notice and Policy describes the personal data OPRA collects, how OPRA uses your personal data, with whom OPRA may share such data, and how you can contact OPRA, access your personal data and exercise your rights regarding OPRA's use of your personal data. By using or accessing the OPRA Website, using OPRA products or services, or otherwise providing personal data to OPRA, you signify your acknowledgment and assent to this Privacy Notice and Policy.

Data Collection and Dissemination

Except as otherwise provided in this Privacy Notice and Policy, the following discloses OPRA's data gathering and dissemination practices.

OPRA values your privacy and processes your personal data, as a data controller, in accordance with applicable data protection laws, including the EU General Data Protection Regulation 2016/679 (“GDPR”) with respect to personal data that is within the scope of the GDPR. Processing means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

OPRA may collect personal data from you directly (e.g. from a contract or service application, from forms on the OPRA Website, from surveys, in connection with an audit, or when you submit a query to us), and we may also collect information about you from other sources, including any OPRA market data vendor that provides data disseminated by OPRA to you, and public sources (where permitted by law).

OPRA processes your personal data for certain legitimate business purposes/interests which may include some or all of the following:

• To administer and manage OPRA's relationship with you
• To evaluate, review, approve, or enter into potential contractual arrangements
• To further inform and educate persons about U.S. listed options
• To enable OPRA to enhance, modify, or otherwise improve its services / communications for the benefit of users
• To enhance the security of OPRA's network and information systems
• To better understand how people interact with the OPRA Website
• To comply with OPRA's obligations under applicable law, industry guidelines and internal policies
• To keep you informed about changes in OPRA's activities, products and services, as permitted by applicable law

Use of the OPRA Website may involve the collection of personal data by OPRA.

What Data OPRA Shares

OPRA will only grant access to personal data on a need-to-know basis, and such access will be limited to the personal data that is necessary to perform the business function for which such access is granted.

From time to time, your personal data may be processed on our behalf by, or shared with, parties not affiliated with OPRA (collectively “third parties”), including Cboe personnel providing administrative services to OPRA. Third parties that process your data may include agents, suppliers, vendors, business partners, and regulatory agencies that are located in the United States and in other countries inside and outside the European Economic Area (“EEA”) for the purposes outlined above. For personal data subject to GDPR that originates in the EEA and is transferred to third parties outside the EEA, OPRA relies on appropriate safeguards, as defined in GDPR and as approved by the European Commission, to provide an adequate level of protection.

Security

OPRA exercises reasonable precautions to safeguard and secure personal data. OPRA has security protections in place that help to protect against the loss, misuse and alteration of the data under its control. Security protections use technology consistent with current industry standards. OPRA periodically tests the security protections of its information systems and monitors the effectivenessof its information security controls, systems and procedures. Although OPRA takes proper measures to safeguard against unauthorized disclosures of data, no assurances can be provided that personal data that OPRA collects will never be disclosed in a manner that is inconsistent with this Privacy Notice and Policy.

Data Retention

OPRA will retain your personal data for as long as your relationship is active and as reasonably needed to maintain business records for audit purposes, meet regulatory requirements, defend or bring potential legal claims, and respond to post-termination inquiries. In addition, personal data may be retained for such additional time as may berequired under applicable law, including record retention requirements. If youwish to cancel your account or request that OPRA no longer use your personal data to provide you with products or services, contact OPRA using the contact information provided below.

Usage Information

OPRA's servers collect general data pertaining to users of the OPRA Website and the mobile devices andprograms from which they access the OPRA Website ("Usage Information"). Usage Information can include: the name of the domain andhost from which you access the Internet; the Internet Protocol (IP) address of the device you are using; the browser software and operating system you are using; mobile device type, device identifiers, device operating system, device settings, the date and time at which you access the OPRA Website (including the length of time spent, the pages accessed while visiting this website, and links clicked); and the address of the Internet site from which you have arrived atthe OPRA Website. This Usage Information is collected to help OPRA manage and administer the OPRA Website, improve the content of the OPRA website and customize and improve the website user experience. Usage Information is gathered using cookies and general detection and use of your internet protocol (IP) address or domain name. OPRA may share anonymous, statistical or aggregated Usage Information or other non-personal information with service providers or other third parties. Usage Information may also be used for information security-related activities in connection with performance monitoring, investigations, questions, claims or complaints relating to use of the OPRA Website.

Cookies

When you use the OPRA Website, OPRA and third party service providers may use “cookies.” Cookies involve placing small files/code on your device or browser that serve a number of purposes, such as remembering your preferences (e.g., language) and generally improving your experience on the OPRA Website. Specifically, OPRA may use such technology for purposes such as to gather analytics about the OPRA Website, including Usage Information and demographic information in a non-identifiable form, in order to improve the OPRA Website's performance and customize users' experience. You can set your browser to notify you when you receive a cookie, giving you the opportunity to decide whether to accept it. You may continue browsing the OPRA Website even if you decide not to accept the cookie, however certain capabilities of the OPRA may be impaired. This Privacy Notice and Policy covers the use of cookies by the OPRA Website and does not cover the use of cookies by any service providers to OPRA Websites.

Policies for Children

OPRA does not intentionally collect or use any personal data from users under 16 years of age. No data should be submitted to the OPRA Website by users under 16 years of age.

California Privacy Rights - CCPA Notice

If you are an individual within the State of California, USA, the California Consumer Privacy Protection Act of 2018 (“CCPA”) and other California statutes may apply to the personal information that you provide through the OPRA Website or otherwise through your interaction with OPRA. If so, OPRA is required by the CCPA to provide additional information to you, which you can find in the California Privacy Statement here.

Access to Personal Data

If you wish to access, update or delete personal data previously provided to OPRA, to the extent authorized by law, OPRA will endeavor to correct, update or remove the personal data being maintained by OPRA. You can do this by contacting OPRA at the contact points specified below.

OPRA Communications

If you wish to request that OPRA no longer use your personal data to provide you with communications, you may use the opt-out method contained in any message you receive or you can contact OPRA at the contact points specified below. You may not opt-out of receiving essential updates regarding your relationship or transactions with OPRA.

If you have any questions about opting out of any communications from OPRA, send an e-mail via the contact points specified below. Please include your full name and mailing address.

Data Subject Rights Under GDPR

To the extent provided for under GDPR, if you are a data subject in the EEA you are entitled to:access your personal data; obtain information on the processing of your personal data; have your personal data rectified or erased or its processing restricted; exercise your right to data portability; or withdraw any consent that you might have given to the processing of your personal data, including any consent for any direct marketing purposes with future effect. These are known as “Data Subjects Rights.”

If you would like to exercise your Data Subjects Rights or learn more about the details of the processing of your personal data, please send an e-mail via the contact points specified below. OPRA will respond to your request(s) as soon as reasonably practicable within the legally required period of time. To help protect your privacy, OPRA takes reasonable steps to verify your identity before granting access to your personal data or responding to your requests.

If you are not satisfied with OPRA's response or believe that OPRA is not processing your personal datain accordance with applicable law please contact OPRA via the contact information provided below. You also may contact or register a complaint with the competent supervisory authority or seek other remedies under applicable law.

Special Cases

OPRA reserves the right to disclose personal data in special cases, when OPRA has reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury or interference with (either intentionally or unintentionally) OPRA's rights or property, other OPRA Website users, or anyone else that could be harmed by such activities. OPRA may also disclose personal data without notice to you in response to a subpoena, or when requested from a governmental, regulatory body or law enforcement agency or any other forum of competent jurisdiction when OPRA believes in good faith that such disclosure is required, or to respond to any emergency situation.

Links to Third-Party Websites

For the user's convenience, the OPRA Website may provide links to other external websites.Should you leave the OPRA Website via such a link, the content of any third party website is not provided by OPRA. OPRA is not responsible for, nor has it developed or reviewed, the content or privacy practices of those sites. Third party websites may collect personal information from or about users. This Privacy Notice and Policy does not cover any such collection activities, and users are advised to review the privacy policies of those websites for information.

Notice of Changes

OPRA reserves the right to update or change this Privacy Notice and Policy or any part of it from timeto time without prior notice. Any changes will be effective when posted or published. OPRA may also notify you using any contact information you have provided to OPRA, OPRA encourages you to review this Privacy Notice and Policy periodically for changes. You may at any time contact OPRA to request a copy of this Privacy Notice and Policy.

Contact Information

If you have any questions, comments or feedback regarding this Privacy Notice and Policy or OPRA's privacy practices please contact OPRA at [email protected] or call 312-786-7067.