State Data Privacy Notice

Last updated: August 2025

This State Data Privacy Notice (“Notice”) is provided on behalf of Insurance Services Office, Inc. (hereinafter “we” “our” or “us”) and applies to consumers (hereinafter, “you” or “your”) of California, Colorado, Connecticut, New Jersey, Utah, Virginia, and other states with comprehensive consumer data privacy laws (collectively, “Data Privacy Laws”). Colorado consumers are also entitled to the rights provided by C.R.S. § 6-1-1306. This notice applies to website visitors and supplements our website privacy notice.

This Notice describes the types of personal information we obtain, how we use the personal information, and with whom we share it. We also describe the rights you may have and how you can contact us.

Personal information we collect

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer.

We have collected personal information in the following categories from consumers in the last 12 months:

Category	Examples	Collected
Identifiers	Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, e-mail address, account name, or other similar identifiers	Yes
Personal information categories in California Civil Code §1798.80(e)	Name, address, telephone number, email address	Yes
Protected classification characteristics	Age (40 years of age or older), marital status, gender, veteran or military status	No
Commercial information	Records of products or services purchased, obtained, or considered (for customer support services)	Yes
Internet or other similar electronic network activity	Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement	Yes
Geolocation data	Physical location, geocode, longitude/latitude (via IP address)	Yes
Audio, electronic, visual, thermal, olfactory, or similar information		No
Professional or employment-related information	Current or past job history; performance evaluations	No
Education information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)	Records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records	No
Inferences drawn from any of the information identified above to create a consumer profile	Inference: A derivation of information, data, assumptions, or conclusions from facts, evidence Profile: information reflecting a consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes	No
Sensitive personal information	Social security number, driver’s license number, state identification card, passport number Account log-in, financial account, debit card, or credit card number in combination with any required access or security code, password, or similar credentials allowing access to an account Precise geolocation (data or information derived from a device or technology used or intended to be used to locate a consumer within a geographical radius of 1,750 feet) Racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership Contents of a mail, email, and text messages where the business or controller is not the intended recipient of such communication Genetic data Biometric information (physiological, behavioral, and biological characteristics or activity patterns used to extract a template or other identifier or identifying information, such as fingerprints, faceprints and voiceprints, imagery of the iris or retina, keystroke, gait, or other physical patterns, and sleep, health, or exercise data) Personal information concerning medical history, mental or physical health condition, diagnosis, or treatment Personal information concerning sex life or sexual orientation	No

Sources from which we collect personal information

We may obtain personal information from the following sources:

Directly from you: for example, from forms you complete or products and services offered to you through us, as well as when you communicate with us, such as when you send an e-mail or communication through a social media platform
Indirectly from you: for example, from action you take when visiting our websites or that is collected automatically
From our affiliates and subsidiaries
From the company or organization you are employed or affiliated with
Publicly available sources
Third party vendors and data providers

Purposes for which personal information is collected

We may use personal information that we collect for one or more of the following purposes:

To fulfill the reason the information was provided: for example, to provide the product or service requested
To operate, evaluate, and improve our business
To develop, maintain the quality or safety of, improve, upgrade, or enhance our products and services
To perform market research
To advertise and market our products and services and to determine the effectiveness of such advertising and marketing
To administer our websites
As required or necessary in response to law enforcement requests or to comply with applicable law, court orders, or governmental regulations
To perform auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards
To detect security incidents
To resist and protect against malicious, deceptive, fraudulent, or illegal activity
To identify and repair errors that impair existing intended website functionality
To perform services on behalf of, or for, clients or service providers, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of clients or service providers
To undertake internal research for technological research, development, analysis, or demonstration

Categories of third-parties that we disclose personal information to

Affiliates and subsidiaries
service providers and sub-processors that perform services for us, our affiliates, and/or subsidiaries
Our agents and representatives
Our customers who subscribe to or license our products and services

Purposes for which we disclose personal information to third-parties

We disclose the following categories of personal information to third-parties for the following purposes:

Records of products or services purchased, obtained, or considered (for customer support services)
Administer accounts or transactions
Market our products or services
Conduct analytics and data analysis
Prevent, detect, monitor, and investigate security incidents, fraud, or other malicious or illegal actions
Comply with and enforce applicable legal and regulatory requirements, legal processes, contractual obligations, terms of use, record retention obligations, and our policies
Exercise and defend against legal claims

Selling, sharing, Targeted Advertising, and Profiling in furtherance of decisions that produce legal or similarly significant effects concerning consumers

We do not sell or share consumers’ personal information collected via Verisk.com as such terms are defined in applicable Data Privacy Laws. We do not use personal information collected via Verisk.com for targeted advertising purposes or for profiling in further of decisions that produce legal or similarly significant effects concerning consumers as such terms are defined in applicable U.S. consumer data privacy laws.

Personal information retention

We will retain your Personal Information for the period necessary to meet the purposes for which it was collected as documented in our corporate retention schedule, unless a longer period is required or permitted by law or legal process, such as a pending claim, investigation or litigation requiring preservation of relevant records.

Special considerations for minors

Our websites are not intended for children under 16 years of age and we do not knowingly market our products or services to children. We do not knowingly collect or retain Personal Information from individuals under the age of 13. Visit the Federal Trade Commission website for more information about the Children’s Online Privacy Protection Act (COPPA).

Your additional rights

You have the right to request the disclosure of:
- The categories of personal information we collected about you
- The categories of sources from which we collected personal information about you
- The purposes for which your personal information was collected
- The categories of third parties with whom we disclosed your personal information
- The specific pieces of personal information we collected about you
You have the right to request the deletion of personal information that we have collected from or about you, subject to certain exceptions and limitations as provided in applicable law
You have the right to correct inaccurate personal information we maintain about you
You have the right to data portability

Exercising your rights

To exercise your rights under applicable consumer data privacy laws, or to appeal a refusal to take action on a previously submitted request to us, you or your authorized agent may contact us at:

https://secure.ethicspoint.com/domain/media/en/gui/69464/index.html
Email us at: privacy@verisk.com
1-844-845-6988

In order for us to process your request, we may ask that you provide information to verify or validate your identity and address in accordance with applicable law, such as a billing statement or utility bill. Any information collected will only be used for verification purposes. Information such as account numbers, balances, etc. should be removed from any such documents prior to submitting to us.

Submitting a request through your authorized agent

In certain circumstances, you are permitted to use an authorized agent (as that term is defined by the applicable Data Privacy Laws) to submit requests on your behalf through the designated methods set forth in this disclosure, where we can verify the authorized agent’s authority to act on your behalf. To do this, you must do the following:

Indicate you are an "authorized agent" in the request
Provide proof of authorization, signed by the Consumer who is the subject of the request.
Submit the information to us in the manner set forth in "Exercising your rights”

Right to appeal

Please note that in accordance with applicable Data Privacy Laws, you may have the right to appeal our determination not to take action regarding your request. If you wish to do so, you may submit your appeal to Verisk at privacy@verisk.com by specifying the specific determinations that are the subject of your appeal. Please include any additional information that may assist with our review of your appeal. If Verisk denies or declines to take action concerning your appeal, you have the right to file a complaint with your state’s Attorney General. Residents of the following states may use the links provided below.

If you are a resident of any other state with a consumer data privacy law, you may also contact your state’s Attorney General’s Office or the applicable data privacy/protection agency.

Nondiscrimination

You will not receive discriminatory treatment or be retaliated against for exercising any of your rights as described above or in accordance with applicable law. We will not:

Deny you goods or services
Charge you a different price or rate for goods or services, including through granting discounts and other benefits or imposing penalties
Provide you a different level or quality of goods or services
Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services

Changes to this privacy notice

We reserve the right to amend this Notice at our discretion and at any time. When we make changes, we will post the updated notice on the applicable website and update the notice's date. Your continued use of our websites following the posting of changes constitutes your acceptance of such changes.

Contact us

If you have questions or concerns about this Notice, you may contact privacy@verisk.com.