California Privacy Rights Addendum (“CCPA”)

Effective date: January 1st, 2023

1. Scope of the CCPA

This California Privacy Addendum (“Addendum”) applies solely to California residents who are consumers as defined under the California Consumer Privacy Act of 2018 (“CCPA”) and other applicable California privacy laws. We adopt this Addendum to comply with the CCPA as amended by the California Privacy Rights Act of 2020 (collectively, the “CPRA”). Any terms defined in the CPRA have the same meaning when used in this Addendum. This Addendum supplements our Privacy Policy.

This Addendum outlines the specific information (“Personal Information”) that we collect, use, and share about California residents, as well as their rights under the CCPA. We encourage California residents to review this Addendum and our Privacy Policy in their entirety:

2. Categories of Personal Information Collected Sources of Personal Information: we may collect Personal Information directly from you, when you create an account or make a purchase; automatically through our website and mobile application; from third-party service providers, such as advertising and analytics providers.

 Category (C) Applicable Pieces of Personal Information Collected (A)

C1. Identifiers.

A1. This category includes a real name, alias, postal address, unique personal identifier, online identifier, internet protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers.

C2. P e r s o n a l I n f o r m a t i o n categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).

A2. (Cal. Civ. Code § 1798.80(e)). This category includes a name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information.

C3. Protected classification characteristics under California or federal law.

A3. This category includes age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).

C4. Commercial information

A4. Records of personal property, products, or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

C5. Internet or other similar network activity.

A5. Browsing history; search history; information on a consumer’s interaction with a website, application, or advertisement.

C6. Geolocation data.

A6. IP-based physical location or movements, which may determine your location to town, city, and state.

C7. Sensory data.

A7. Visual or similar information, such as photographs if you choose to provide them.

C8.  Inferences drawn from other Personal Information.

A8. This category includes a profile reflecting a person’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

C9. Sensitive Personal Information

A9. Complete account access credentials (user names; account numbers; or card numbers combined with required access/ security code or password). Racial or ethnic origin (only if provided by you, including through a photograph that you may optionally provide).

3. CCPA and Disclosures of Personal Information for a Business Purpose

We may disclose your Personal Information to a third party for a business purpose( as defined under the CCPA). In the preceding 12 months, we have disclosed the following categories of Personal Information, for a business purpose to the parties identified below:

a) Service providers: We may disclose your Personal Information to service providers that assist us in performing business functions and providing services to you. These service providers are contractually obligated to use your Personal Information solely for the purposes specified by us and in compliance with applicable privacy laws. These service providers include third parties with whom we partner to offer products, services, and promotions to you.

b) Advertising and marketing partners: We may share your Personal Information with advertising and marketing partners who help us deliver personalized advertisements and promotional materials. These partners may use your Personal Information to tailor ads to your interests and preferences.

c) Business partners: We may share your Personal Information with trusted business partners with whom we collaborate on joint offerings or co-branded services. These partners may use your Personal Information for their own marketing and business purposes in accordance with their privacy policies.

d) Third-Party data brokers: In some cases, we may share your Personal Information with third-party data brokers. These brokers collect and sell Personal Information from various sources, and your information may be used for purposes such as targeted advertising and data analytics.

4. CCPA and CPRA Additional Rights

a) Right to opt-out of sharing- You have the right to opt-out of the sale of your Personal Information, if applicable. Please note, the right to opt-out of selling does not extend to sharing Personal Information with service providers and contractors.

b) Right to delete and correct - Subject to certain limitations, you have the right to request that we remove any Personal Information we have obtained from you or maintain about you.

c) Right to data portability- You also have the right to request that we provide you with a copy of the specific pieces of Personal Information that we have collected about you, including any Personal Information that we have created or otherwise received from a third-party about you (a data portability consumer request). Upon your request, we will provide you with a copy of your Personal Information in a commonly used and machine-readable format, allowing you to transfer it to another entity.

d) Rights of children- We do not “sell” the Personal Information of minors under the age of 16 for monetary or other valuable consideration and we do not “share” such Personal Information for cross-context behavioral advertising without affirmative consent as required by the CPRA. Parents or legal guardians who believe that their child may have provided us with Personal Information without their consent should contact us immediately using the information provided in the 'Contact Us' section of our Privacy Policy. We will take prompt steps to remove any such information from our records.

e) Implement contracts- We are required by the CPRA to have appropriate contractual provisions in place with service providers, contractors and third parties. Such contracts prohibit the retention, use, or disclosure of Personal Information for purposes other than the services specified. Contracts may also permit businesses to monitor the service providers’ compliance with contractual provisions through manual reviews, automated scans, regular assessments, and audits at least once a year. We encourage parents and guardians to actively participate in and monitor their children's online activities to ensure their privacy and safety.

f) Minimize data collection and storage- CPRA mandates that we only collect Personal Information that is reasonably necessary for the purpose it is collected. We may not retain Personal Information for longer than what is necessary for the purpose it was collected.

g) No employee exemption- In accordance with CPRA, we are required to comply with requirements on processing Personal information for employees and job applicants.

f) Right to request third-party disclosure- You have the right to request and obtain information about your Personal Information (if any) we disclosed to third parties for their own direct marketing purposes in the preceding calendar year, as well as the names and addresses of those third parties.

5. How to Exercise your CCPA Privacy Rights

To exercise your CCPA privacy rights, please submit a request to us by contacting us using the contact information provided below. Please include your name, email address, and a description of your request. We may need to verify your identity before responding to your request, to protect your privacy and security.

Please note that we may need to retain certain information for legal or business purposes, such as to fulfil a transaction or comply with a legal obligation. We will respond to your request in accordance with applicable data protection laws and regulations, such as the CCPA and the General Data Protection Regulation (GDPR)."

To allow us in effectively handling your request, please ensure you

a) Provide us with enough information to fairly confirm that you are the person about whom we obtained Personal Information or any individual acting on behalf (“Authorized Agent “) of such a person. This could include verifying Personal Information that we may already have on file for you, such as prior order numbers, address / ZIP code, and other similar data.