COOKIE AND TRACKING TECHNOLOGIES NOTICE

1.Purpose. This Cookie and Tracking Technologies Notice explains how George uses cookies, analytics tools, session technologies and similar tracking mechanisms when you (“you”, “your”, “user”) visit GeorgeVA.com or access the George platform (the “Platform”). This notice supplements our Privacy Policy and Terms of Use and Acceptable Use Policy. In the event of a conflict between this Notice and the Privacy Policy, the Privacy Policy governs with respect to personal data rights and obligations.

2.What are Cookies? Cookies are small text files placed on your device when you visit a website. They allow websites to recognize devices, maintain session integrity, improve functionality, and analyze usage patterns.

George uses cookies and tracking technologies strictly for operational, security, and performance purposes.

3.Categories of Cookies We Use. George limits tracking to the minimum necessary to operate safely and effectively.

A.Strictly Necessary Cookies (Required). These cannot be disabled and are essential for:

•Maintaining session continuity

•Preventing automated abuse

•Protecting against fraud and malicious activity

•Ensuring secure transmission of user inputs

B.Performance and Analytics Cookies (Required). These cookies are necessary to operate the Platform reliably and securely, and cannot be disabled. We use limited analytics tools to understand Platform performance and identify errors. All analytics data is collected in aggregated, de-identified form and is used solely to maintain and improve Platform functionality. We do not use behavioral advertising cookies. Specifically, analytics data is:

•Aggregated and de-identified before analysis wherever technically feasible

•Used solely for Platform improvement and reliability; not linked to individual users or used to build user profiles

•Not used for cross-context behavioral advertising

•Not sold or shared with third-party advertising networks.

Examples of what analytics tools measure include page load performance, error rates, system load indicators, and feature usage frequency at an aggregate level.

C.Security and Abuse Prevention Technology. George uses automated tools to detect bot traffic, prevent scraping or automated document harvesting and to protect system integrity. These may log your IP address, device metadata, browser type and a timestamp. Such data is collected and processed as reasonably necessary to protect the security and integrity of the Platform and to prevent unauthorized access, consistent with George’s disclosed processing purposes. This processing does not require separate consent under the Virginia Consumer Data Protection Act. Data collected for security purposes is retained for up to twelve (12) months, after which it is deleted or anonymized.

4.Third-Party Tools and Subprocessors. Where George uses third-party tools or vendors to deliver analytics or security functions, those vendors process data on George’s behalf as data processors subject to written data processing agreements. George does not authorize third-party vendors to use data collected through the Platform for their own purposes or to sell such data. George maintains a current list of material third-party processors (“Subprocessors”) in its Third-Party Risk Management Policy (GG-3.07), which is updated when Subprocessors are added or changed. A summary of current Subprocessors relevant to tracking and analytics functions is available upon written request to governance@georgeva.com. George does not use third-party advertising networks, social media pixels, or behavioral advertising tools on the Platform.

George does not sell personal data.

George does not use third-party advertising networks.

George does not engage in targeted advertising.

6.Sensitive Data Considerations. Users may voluntarily input information relating to legal matters. Such information may include personal or sensitive information. George does not request social security numbers, does not require financial account information. George does not require account creation. Users are instructed not to submit unnecessary sensitive personal data.

7.Virginia Consumer Data Protection Act (VCDPA) Rights. If you are a Virginia resident, you may have rights under the Virginia Consumer Data Protection Act, including:

•Right to confirm whether we process your personal data

•Right to access personal data

•Right to correct inaccuracies

•Right to delete personal data

•Right to data portability

•Right to opt out of targeted advertising, sale of data, or profiling in furtherance of decisions producing legal or similarly significant effects.

George does not conduct profiling for automated decision-making with legal effects. To submit a request to exercise any of the rights above, contact governance@georgeva.com. George will respond within forty-five (45) days of receipt of a verified request, with a possible forty-five (45)-day extension for complex requests, of which you will be notified within the initial 45-day period. If George declines to act on your request, you will receive a written explanation and instructions for submitting an appeal. Appeals may be submitted to governance@georgeva.com within a reasonable period after receiving George’s decision. George will respond to your appeal in writing within sixty (60) days. If your appeal is denied, you may contact the Office of the Attorney General of Virginia.

8.Cookie Controls. You may manage cookies through your browser settings and/or device privacy controls. Because all cookies used by George are necessary to operate the Platform securely and reliably, disabling cookies may impair core functionality, including session continuity and case code retrieval. Questions about cookie practices may be directed to governance@georgeva.com.

9.Updates. We may update this Notice periodically. When we make material changes — such as adding new categories of tracking technologies, engaging new third-party vendors, or changing how we use collected data — we will post the updated Notice at georgeva.com with a revised effective date. The effective date at the top of this Notice reflects the date of the most recent version. For significant changes that affect your rights, we will make reasonable efforts to draw your attention to the update through a notice on the Platform.