State Privacy Rights Addendum

Last Revised on: April 25, 2025

If you are a resident of the applicable states identified below, this Addendum applies to our collection, use, and disclosure of your personal data and supplements the Eberjey Privacy Policy. Certain sections may have limited applicability as indicated below. Eberjey respects the rights of consumers to make privacy rights requests and will not discriminate against a consumer for making such a request.

Applicable states: California, Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia.

Personal Data Use

We may use personal data for business purposes as described in the Eberjey Privacy Policy. The following table explains in more detail the business purposes for which we use personal data and the types of personal data used for each purpose.

NOTICE OF FINANCIAL INCENTIVES AND LOYALTY PROGRAM

Eberjey provides special offers, typically a stated benefit, to customers who provide us their contact information (“Communication Program”) in exchange for their consent to receive marketing communications. This program qualifies as a permissible financial incentive under applicable privacy laws.

The value of Communication Program benefits vary based on the promotion. For example, if you receive a percentage-off coupon in return for participating in the Communication Program, the value of that coupon in dollars will vary based on the purchase amount to which that coupon is applied. You may opt-out of marketing communications, and by extension the Communications Program, by following the instructions provided in connection with those communications or by emailing us at privacy@eberjey.com. We do not sell or share (for cross-context behavioral advertising purposes) personal data in connection with the Communications Program except for the general purposes described in our Privacy Policy.

If you are a resident of a state that provides privacy rights and you request that we delete your personal data, we will no longer be able to provide the Communication Program to you because we cannot (1) communicate with you about the Communication Program once we delete your contact information, (2) accurately track your purchases to allocate benefits, and/or (3) determine your eligibility for certain benefits.

Although we do not directly tie Communication Program benefits to the value of customers’ personal data, the aggregate customer benefits are reasonably related to the value of customers’ personal data based on the following considerations:

· Participants receive tangible benefits such as price discounts;

· Participants receive intangible benefits such as timely updates on new products and promotions;

· We derive value from the financial incentive programs because participants typically spend more money than nonparticipants; however, we do not sell personal data derived solely from a consumer’s participation in the Communication Program for money; and

· We incur direct and indirect expenses in connection with administering the programs.

Privacy Rights (Except Nevada)

If you are a resident of an applicable state, with the exception of Nevada, we provide the following privacy rights to you. We will retain a record of your request for at least two years and in compliance with applicable laws.

Right to Know

You have the right to request twice per twelve (12) month period that we provide you (i) the categories or specific pieces of personal data we collected about you; (ii) the categories of sources from which we collected your personal data; (iii) the business or commercial purpose for which we collected your personal data; and (iv) the categories of third parties with whom we shared or to whom we sold your personal data. We are not permitted to provide access to specific pieces of personal data if the personal data is sensitive or creates a high risk of potential harm from disclosure to an unauthorized person. To protect consumers’ personal data, you must provide required information and/or documentation to verify your identity. We will process verified requests within forty-five (45) days, subject to any applicable exceptions and extensions permitted by law.

If you are an Oregon or Minnesota resident, you also have the right to request once per twelve (12) month period that we provide you with a list of specific third parties to whom we disclosed (a) your personal data or (b) any personal data. To the extent permitted by applicable law, we have the discretion to determine which list to provide.

Right to Deletion

You have the right to request that we delete any personal data we collected about you. Please understand that we are not required to honor a deletion request if a legal exemption applies such as if we need the information to complete a requested or reasonably anticipated transaction, prevent security incidents or fraud, enable internal uses that are reasonably aligned with your expectations, or comply with legal obligations. We will process verified requests within forty-five (45) days, subject to any applicable exceptions and extensions permitted by law.

To prevent unauthorized individuals from making deletion requests, you must provide required information and/or documentation to verify your identity.

Right to Correction

You have the right to request that we correct any personal data that we have on file about you that you believe to be erroneous. When you make your request, please be sure to provide us with the specific information that you believe is inaccurate and the correct information. You should also provide us with any documentation you believe supports your proposed correction, and we will take that documentation into consideration. We will only correct the information if we determine, based on the totality of the circumstances, that your correction is more likely than not accurate. We may also choose to delete the allegedly inaccurate information instead of correcting it. We will process verified requests within forty-five (45) days, subject to any applicable exceptions and extensions permitted by law.

Right to Opt-Out from the Sale or Sharing of Personal Data

You have the right to direct us not to sell your personal data to third parties or to share it with third parties for targeted or cross-context behavioral advertising purposes. We will process requests within fifteen (15) business days, subject to any applicable exceptions and extensions permitted by law.

For consumers visiting our websites from select states, we will recognize and process browser-based opt-out signals such as Global Privacy Control. If we are able to reasonably associate a browser-based opt-out signal with an identifiable consumer, we will treat it as a request to opt-out of the sale or sharing of that consumer’s personal data as if the consumer made the request using a method above. If we are not able to reasonably associate a browser-based opt-out signal with an identifiable consumer, we will treat it as a request to opt-out of the sale or sharing of that website visitor’s personal data collected while the signal is present. While the signal is present, we will also disable any cookies or other tracking tools present on the website from a third party that may result in the sale of personal data or the sharing of personal data to the third party for targeted or cross-context behavioral advertising purposes.

RIGHT TO APPEAL

If we deny your privacy request, in full or in part, you may appeal our decision. If we deny your appeal, you may also contact your state Attorney General to lodge a complaint and we will provide you with instructions for an online mechanism to do so. We will process requests to appeal within the timeframes established under applicable law, but typically within forty-five (45) days.

SUBMITTING A REQUEST

If you are a resident of a state that provides privacy rights and you would like to exercise your rights, you may submit a request by email to privacy@eberjey.com, by calling us at 305 635 0030, or by using our online form. After you submit your request, we may contact you to obtain additional information necessary to verify your identity. For example, we may require you to verify certain information in our files or submit a signed declaration under penalty of perjury verifying your identity. We will not be able to process certain requests without verifying your identity, so please respond promptly to our request. If you have a password-protected online account with us, we may fulfill your Know, Deletion, Correction, or Appeal request via that account. If you do not have a password-protected online account with us, we will give you the option of electronic or mail fulfillment of such request. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

AUTHORIZED AGENT

If you are an authorized agent submitting a Know, Deletion, Correction, or Appeal request on behalf of a consumer, you must provide a copy of a lawful power of attorney or a written signed authorization from the consumer along with proof your identity. You may provide this documentation via email to privacy@eberjey.com after submitting the request. We may contact you and/or the consumer on whose behalf you claim to act to verify your identity, the consumer’s identity, and your authorization to act on the consumer’s behalf.

NEVADA OPT-OUT OF SALE RIGHT

If you are a Nevada resident, you are entitled under Nevada law to formally request that we not sell any of your personal information. Please email us at privacy@eberjey.com to submit your request and we will confirm your request.