; (2) each category of data the covered entity collects and the processing purposes for which such data is collected; (3) whether the covered entity transfers covered data and, if so— (A) each category of service provider and third party to which the covered entity transfers covered data and the purposes for which such data is transferred to such categories; and (B) the identity of each third party to which the covered entity transfers covered data and the purposes for which such data is transferred to such third party, except for transfers to governmental entities pursuant to a court order or law that prohibits the covered entity from disclosing such transfer; (4) how long covered data processed by the covered entity will be retained by the covered entity and a description of the covered entity’s data minimization policies; (5) how individuals can exercise the individual rights described in this title; (6) a description of the covered entity’s data security policies