California Privacy Statement

CALIFORNIA PRIVACY STATEMENT

Effective Date: July 31, 2023

Last Updated: July 31, 2023

Do it Best Corp. and its affiliates, including Do it Best Commerce Company, LLC (collectively, “Do it Best”, “we”, or “us”) are providing this California Privacy Statement to comply with the California Consumer Protection Act (as amended by the California Privacy Rights Act) (“CCPA”), the corresponding regulations, and other applicable California statutes. This California Privacy Statement supplements the information contained in our general Privacy Policy found at www.doitbest.com/globl/privacy-statement (the “General Privacy Policy”) and applies only to residents of the State of California, USA, if the personal information you submit to us is within the scope of the CCPA or other applicable California statute. The California Privacy Statements for applicable persons that are (a) employees of Do it Best can be found on company intranet resources; and (b) job applicants can be found on doitbestcareers.com. In the event of any conflict between this California Privacy Statement (if applicable) and our General Privacy Policy, this California Privacy Statement shall prevail with respect to covered personal information. Any terms used below that are defined in a statute shall have the statutory meaning. Any capitalized terms not otherwise defined shall have the meaning in the General Privacy Policy.

1. CATEGORIES OF PERSONAL INFORMATION AND SENSITIVE PERSONAL INFORMATION COLLECTED

We collect, and have collected in the past 12 months, the following categories of personal information and sensitive personal information:

Cat	*Examples*
A	Identifiers such as name, postal address, phone numbers, unique personal identifier, online identifier, Internet Protocol (IP) address, email address, and account name.
B	Personal information as defined in the California Customer Records Act (Section 1798.80(e)) such as the Identifiers in category A as well as bank account number or payment card information.
C	Characteristics of protected classifications under California or federal law such as age or gender.
D	Commercial information such as records of products or services purchased or considered, and information on interactions with our Members, vendors or offerings.
F	Internet or other electronic network activity information such as information regarding your interactions with our Services, Websites or other offerings (e.g., Usage Information), including videos viewed.
G	Geolocation data such as physical location data of your device or computer.
H	Audio, electronic, visual thermal, olfactory, or similar information such as audio recordings of calls to our customer service centers and CCTV video recorded at our facilities.
K	Inferences drawn from any of the above categories to determine characteristics, preferences, attitudes, abilities, or behavior that we collect via our Services or other offerings or obtain from third parties in order to target advertisements or to personalize content.
L	Sensitive Personal Information such as precise GPS geolocation.

We have sold and shared (both as defined in the CCPA) personal information in categories A, B, C, D, F, G and K listed above. For more information on selling and sharing of data please see Section 6 below. You may exercise your right to opt-out of the sale or sharing of your personal information to third parties by one of the methods specified in Section 9.D below.

2. PURPOSES FOR COLLECTING PERSONAL INFORMATION

We collect the categories of personal information and sensitive personal information listed above for one or more of the following business or commercial purposes:

To contact you regarding business transactions and information related to the products or services you have purchased;
To provide products and services to you (for example, if you provide us with personal information in order to place an order with us, we will use that information to process your payment, complete the sale and ship product to you);
To administer, maintain and manage our business relationship and/or provide ongoing support to you;
To inform you about products, services, and offerings and promotional activities of us and our affiliates and Members (including through customized and interest-based advertising);
To respond to your comments or requests for information;
To enforce any contracts that we enter into with you, or defend claims arising from such contracts;
To customize and optimize our services, offerings and customer experience;
To enhance the security of our network and information systems;
To develop, enhance, and improve the products, services and offerings of us and our Members;
To understand and monitor how people interact with our websites, services and offerings;
For safety and security purposes, including where necessary to protect the rights, property or safety of us, our Members or other users or customers;
To comply with obligations under applicable law, industry guidelines and internal policies;
Where we are obligated, or permitted, to do so by applicable law, regulation or legal process, including disclosure to customs or other governmental authorities; or
As described to you when collecting your personal information.

3. RETENTION OF PERSONAL INFORMATION AND SENSITIVE PERSONAL INFORMATION

Do it Best will retain collected personal information and sensitive personal information as long as necessary to fulfill the purposes for which it was collected, and thereafter as reasonably necessary to meet accounting, reporting, audit, or legal and regulatory requirements (including record retention requirements), to defend or bring potential legal claims, or for a longer period if we have other legitimate business reasons for retaining the information. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

4. SOURCES OF PERSONAL INFORMATION

We obtain the categories of personal information listed above from the following categories of sources:

directly from our customers or prospective customers. For example, from information that our customers provide to us related to the orders for products that they purchase from us or our Members, in connection with establishing an Account with us, or when visiting a Member store.
directly and indirectly from activity on our Websites, Services and other offerings. For example, from submissions through our Website or information collected automatically from use of our Websites, Services or mobile applications.
from third party sources.
from publicly available sources.
from our Members or third party vendors or Service Providers, including Payment Processors
from Third Party Services, including Analytics Services and AdTech Services, and from cookies, web beacons and embedded tracking codes that collect information about visitor traffic on our Websites and Services.

5. DISCLOSURE OF PERSONAL INFORMATION FOR BUSINESS PURPOSES

In the preceding 12 months, we have disclosed the categories of personal information and sensitive personal information listed above in Categories A (Identifiers), B (Personal Data), C (Characteristics), D (Commercial Information), F (Online Activity), G (Geolocation Data), K (Inferences), and L (Sensitive Personal Information) (see Section 1 to: Service Providers performing services for us or assisting us to provide a requested product or service (including Payment Processors and chat service providers); third parties authorized by you (including Members with whom you have placed a Ship-to-Store Order or an order via a Hosted Member Service); our affiliates and related companies; IT infrastructure providers; Analytics Services that help us generate performance metrics regarding our Website and Services; and Third Party Services, including AdTech Services that provide advertising services and serve ads for Products and Services. We have disclosed information in Categories A (Identifiers), B (Personal Data), C (Characteristics), D (Commercial Information) and K (Inferences) to Members with whom you have interacted such as by purchasing products from such Member or by placing a Ship-to-Store Order or an order via a Hosted Member Service.

6. SALE AND SHARING OF PERSONAL INFORMATION

We do not sell the personal information of consumers in the traditional sense. However, California’s definition of “selling” data is broad and potentially covers many types of data transfers that do not involve selling for monetary consideration, including some disclosures of personal data to our Members. Under the CCPA “share” means to disclose personal information to third parties for cross-context behavioral advertising which means targeting advertising based on personal information obtained from a consumer’s activities across third party websites or services. Like many companies we may use personal information to target advertising as further described in our General Privacy Policy. As defined in the CCPA, we sell or share, and have sold or shared in the preceding 12 months, the following categories of personal information listed above to third parties:

Category	Categories of Third Parties to Whom Info was Sold or Shared	Purposes for Selling or Sharing
A Identifiers	Members with whom consumer interacted Analytics Services AdTech Services	Customer & order management Marketing & advertising
B Personal Information under Cal. Records Act	Members with whom consumer interacted Analytics Services AdTech Services	Customer & order management Marketing & advertising
C Protected Characteristics	Members with whom consumer interacted AdTech Services	Customer & order management Marketing & advertising
D Commercial Information	Members with whom consumer interacted AdTech Services	Customer & order management Marketing & advertising
F Internet/Network Info	Analytics Services AdTech Services	Customer & order management Marketing & advertising
G Geolocation Data	Analytics Services AdTech Services	Marketing & advertising
K Inferences from Data	Members with whom consumer interacted AdTech Services	Customer & order management Marketing & advertising

To learn more about your right to opt out of the sale and/or sharing of your personal information, please see Section 9.

7. PERSONAL INFORMATION OF CONSUMERS UNDER 16 YEARS IF AGE

We do not knowingly sell or share (as defined in the CCPA) the personal information of consumers under 16 years of age.

8. SENSITIVE PERSONAL INFORMATION

We do not use or disclose sensitive personal information (as defined in the CCPA) for purposes other than those permitted purposes specified in the CCPA, including to perform services on behalf of our business (such as using location to determine the nearest store to a consumer).

9. RIGHTS UNDER THE CCPA

The CCPA grants California residents the following rights:

A. Right to Know

You have the right to request that we disclose the below information to you. To request this information, you can submit a verifiable consumer request. Once we receive and confirm your verifiable request, we will disclose the requested information to you.

• The categories of personal information we collected about you,

• The categories of sources for the personal information we collected about you,

• Our business or commercial purpose for collecting selling, or sharing that personal information,

• The categories of third parties to whom we disclose personal information, and

• The specific pieces of personal information we collected about you.

B. Right of Deletion

You have the right to request that we delete the personal information that we have collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers and contractors to delete) your personal information from our records, unless an exception applies. If your request is denied, the response we provide to your verifiable consumer request will explain the reason for denying your request.

C. Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will correct (and direct our service providers and contractors to correct) inaccurate personal information that we maintain about you, unless an exception applies. If your request is denied, the response we provide to your verifiable consumer request will explain the reason for denying your request.

D. Right to Opt-Out of Sale and/or Sharing

You have the right to opt-out of the sale and/or sharing (both as defined in the CCPA) of your personal information. You can submit a request to opt-out by:

• Clicking the Do Not Sell or Share My Personal Information link here or in the footer of our Website or accessing our Privacy Preference Manager and opting out of "Sale or Sharing of Personal Information",

• Clicking here,

• Sending us an email at privacypolicy@doitbest.com, or

• Turning on “Global Privacy Control” signals through your browser, which our Website will process as a request to opt-out of sale and sharing for the relevant browser and device as further described in Section 13.

Please note that when you place a Ship-to-Store Order or an order via Hosted Member Services, we must share your personal information with the applicable Member to complete that transaction, and you may not opt-out of such sharing if you choose to place such an order. By accessing and using Hosted Member Services or placing a Ship-to-Store Order you consent to the transfer to and processing and use of your personal information and related Usage Information by the applicable Member for its own purposes.

In addition, participation in the Best Rewards^SM program is reliant on the exchange of personal information between us and our Members, and if you opt-out of the sale and/or sharing of your personal information this will result in termination of your participation in Best Rewards. To the extent permitted under applicable law we will endeavor to obtain your confirmation that this is your intent at the time you exercise your right to opt-out, but will have no liability for any unintended termination of your Best Rewards Account.

E. Right To Limit Use of Sensitive Personal Information

We do not use or disclose sensitive personal information that we have collected from you for purposes other than those business purposes permitted under the CCPA and therefore do not provide a method to limit such activities.

F. Right of Non-Discrimination

You have the right to not receive discriminatory treatment by us for exercising any of your CCPA rights.

10. EXERCISING YOUR PRIVACY RIGHTS

You may exercise your right to opt-out of the sale and/or sharing as provided above in Section 9(D). To exercise your right to know, right of deletion, or right to correct please submit a verifiable consumer request to us by:

Clicking here,
Calling us at (833) 800-5906, or
Sending us an email at privacypolicy@doitbest.com.

We reserve the right to confirm your California residency to process your requests. In accordance with the CCPA, we will need to confirm your identity to process your requests and we may require you to login to your account with us, provide information associated with your account or transactions with us, or require you to provide government identification, signed declarations and other proof of identity. You may designate an authorized agent to make a request on your behalf as provided under California law and we reserve the right to request proof of such authorization. You may also make a verifiable consumer request on behalf of your minor child. We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you, or if you do not provide us with sufficient detail to allow us to understand and respond to your request. Our response will explain any reasons we cannot comply with a request, if applicable.

11. AUTHORIZED AGENTS

You may use an authorized agent to submit a request to know, request to delete, or request to correct on your behalf. The authorized agent can submit such requests on your behalf by following the instructions in Section 10 above. When you use an authorized agent to submit a request to know, request to delete, or request to correct, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; and/or (b) confirm directly with us that you provided the authorized agent permission to submit the request.

12. REQUEST RESPONSE TIMING AND FORMAT

Upon receipt of your request, we will provide directions on identity verification requirements which may include submission of pieces of personal information that we can match to our records. Once you provide such information and assuming we are able to verify your identity by matching the information you provided to our records, we will begin to gather information to respond to your request. For requests to correct, we may require you to provide additional documentation to rebut any of our own documentation that the personal information that you are requesting to correct is accurate.

No later than 10 business days after receiving your request, we will confirm receipt of the request and provide information about how we will process the request. We will endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (we may take up to 45 additional days), we will inform you of the reason and extension period in writing. If we cannot verify the request within the 45 calendar days, we may deny the request. If we deny your request, we will inform you of the reason for its denial.

13. PROCESSING OF PRIVACY OPT-OUT PREFERENCE SIGNAL

Certain browsers and other technologies send opt-out preference signals to a website notifying the website of your desire to stop the sale or sharing of your personal information. For more information, please see www.globalprivacycontrols.org. Our Website will interpret such signal as a request to opt-out of sale and sharing for the relevant browser and device – see Section 9(D). At this time, this signal only applies to the browser you are searching from and only includes the online sale and sharing of your personal information.

14. NOTICE OF FINANCIAL INCENTIVE

We provide reward price discounts, coupons, services and other benefits for members of the Best RewardsSM loyalty program, Account holders, members of our mailing and email lists, and participants in other promotional programs (collectively, “Programs"). Because Programs involve the collection of personal information (including Categories A, B, C, D, F, G, K, and L identified in Section 1 above), they may be interpreted as a “financial incentive” program under California law. If you choose to participate in a Program, personal information will be collected, used, processed, disclosed, shared and sold by us as provided in this Privacy Statement. You may choose to participate in a Program by signing up for Best Rewards, opening an Account, enrolling via our Website, redeeming a coupon provided in connection a Program or otherwise signing up as provided in applicable Program promotional materials. You may opt-out of participation by ceasing to participate in the Program (including by cancelling your Account), opting out of sharing or selling of your personal information as provided in Section 9.D, or by contacting us as provided in Section 17.

We do not receive any direct monetary compensation from any third party for the use of your personal information in connection with Programs. We incur expenses when providing and operating these Programs. To the extent we create overall value from Programs for our business that could be directly or reasonably related to the value of customer information, an estimation of that value would be based on specific facts such as (1) whether and to what extent consumers take advantage of any Program offerings; (2) the expenses associated with the Program such as data analytics and marketing, (3) the expenses related to the collection, retention, processing and enhancement of consumers' personal information; and (4) all other expenses reasonably related to the Programs. While we do not assign a monetary value to the data we collect through the Programs, based on our reasonable good-faith estimate, the value we receive from your personal information by participating in the Programs is reasonably equal to the value of the discount or financial incentive we provide to participants in the Programs. For example, with respect to the Best Rewards loyalty program, a good-faith estimate of the value of a consumer’s data would generally be that the expenses related to the financial incentive program are approximately $5 for each 250 points that the consumer accrues, with the total value and expense depending on the quantity of points accrued.

15. DIRECT MARKETING DISCLOSURES

California’s "Shine the Light" law (Civil Code Section 1798.83) requires businesses to respond to requests from California customers asking about the business's practices related to disclosing personal information to third parties for the third parties’ direct marketing purposes unless the business has in place a policy not to disclose personal information for the third parties’ direct marketing purposes if the customer has exercised an option to opt-out of such information-sharing. We have such a policy in place and California residents can exercise their right to opt-out of such sharing using the methods provided above in Section 9(D).

16. CHANGES TO OUR PRIVACY STATEMENT

We reserve the right to amend this California Privacy Statement from time to time as provided in our General Privacy Policy.

17. CONTACT INFORMATION

If you have any questions, comments, or concerns about this California Privacy Statement, the ways in which we collect and use your personal information, or your choices and rights regarding such use, please do not hesitate to contact us by:

Clicking here,
Calling us at (833) 800-5906, or
Sending us an email at privacypolicy@doitbest.com.