Intentionalist Privacy Notice

INTENTIONALIST, SPC

PRIVACY NOTICE

Last Updated December 2019

Intentionalist Values Your Privacy. At Intentionalist, we take your personal privacy very seriously and recognize that you expect privacy and security for all of your personal information. We understand the need to protect and safeguard sensitive information about you, and we maintain strict standards and procedures designed to prevent misuse of this information. This privacy notice (the “Privacy Notice”) constitutes an agreement between you and Intentionalist, SPC and its affiliates, corporate parent(s), and subsidiaries (collectively, “Intentionalist ,” “us,” “our,” or “we”) while accessing and using our websites, mobile applications, social media channels, applications and services (collectively, the “Site”), and is governed by and part of our Terms of Use.

This Privacy Notice describes how Intentionalist collects, protects, uses, and discloses information and data collected and created in the course of your access to and use of the Site, as well as your interactions with Intentionalist via telephone, through mail or at our physical locations. Your privacy is important, and we encourage you to read this Privacy Notice carefully to understand the information we collect and what we do with it.

Consent. By accessing the Site, registering with Intentionalist, creating a user profile on our Site, or submitting information to Intentionalist, you consent to this Privacy Notice and the collection and use of information as described below. We will take reasonable steps to notify you and confirm that you agree at different stages of collecting information. If you do not agree with our policies and practices, you may not be able to access or benefit from certain portions of this Site.

Scope. Please be advised that this Privacy Notice applies to information that we collect: when you visit this Site; when you download, register or use our mobile application or other online service; when you submit your information to us on this Site; when you create or use a user profile on this Site; when we communicate with you through email and other communications; when you visit a brick and mortar location of a merchant within our network of merchants (the “Merchant Network”); through third parties that we work with to provide our services; and by any other means over the course of your use of our services. This Notice does not apply to information collected by us through applications or content, including any other websites, not operated by Intentionalist.

Personal Information. As used in this Privacy Notice, “Personal Information ” means information that specifically identifies an individual (e.g., name, address, telephone number, email address, username) or information about that individual that is directly linked to personally identifiable information. Personal Information does not include (a) aggregate information, meaning data we collect about your use of the Site or about a group or category of services or users from which individual identities or other Personal Information has been removed; or (b) deidentified information that cannot be easily linked back to the individual.

Lawful Basis. We will only collect your Personal Information (a) with your consent or (b) if we have a legitimate interest in doing so. If we collect or use your Personal Information based on your consent, we will also notify you of any changes and will request your further consent as needed.

COLLECTION AND USE OF PERSONAL INFORMATION

In general, you can visit our Site without disclosing any Personal Information, but some offers, services, or portions of our Site may only be accessible to you if you register with us.

Information collected directly from you, with your consent. If you access or submit an inquiry through our Site, sign up for an account, or make a purchase, we may ask you to provide certain Personal Information such identifiers like your name, email, phone number, address, and any Personal Information you choose to provide to us. You provide this Personal Information to us voluntarily and with your consent.

We use the Personal Information we collect directly from you to respond to your inquiries, fulfill your requests, complete your requested transactions, provide and maintain your access to our online services, and communicate with you about your account and our services. We may also use your Personal Information for direct marketing purposes, such as sending you promotional emails. We will only send you marketing communications in ways that are compatible with your communications choices, and you can opt out at any time.

Intentionalist does not collect or maintain any payment information. All payments are processed through a PCI compliant third-party payment processor to ensure secure transfer of funds. When you provide payment information on this website, you will be redirected to our secure third-party payment portal. This information is only used for billing purposes and to provide services.

Information collected from you offline via the Merchant Network, with your consent or with a legitimate interest. We may collect certain Personal Information directly from you when you visit a brick and mortar location of a merchant within the Intentionalist Merchant Network. This Personal Information may include (i) identifiers like your personal contact information, such as your name, address, email address, and phone number; (ii) your payment information as needed to process or confirm a purchase; or (iii) commercial information like your purchase history. We collect this information with your consent or to achieve our legitimate interest of streamlining our business processes and improving the services we offer to you.

Information collected from you automatically, with a legitimate interest. Intentionalist collects Internet and other similar network activity, as well as anonymous information, to achieve our legitimate interest of maintaining and improving the design, content and performance of the Site and our services. The information we collect in this manner may include:

Log Files. Intentionalist collects anonymous and technical information from visitors’ computers including the Internet Protocol address, date and time of the visit, the type of browser used (e.g., Internet Explorer, Safari), the type of operating system used, the ISP

from which the visitor receives internet access, and aggregate information regarding what pages users of the Site access or visit. We use this information to analyze preferences, trends and statistics related to the use of the Site and Intentionalist. This allows Intentionalist to ensure that our Site will appear and function appropriately on your computer, and to conduct our own analyses and research to improve our programs, products, services, and content.

Cookies. Like most commercial websites, we use cookies to track use of our Site. Please read our Cookie Notice for more information about how we use cookies.

Other Ways We Might Use Your Information. In addition to the specific uses and purposes described above, we use your Personal Information for the purposes described at the time of collection and to manage the internal operations and security of our Site consistent with this Privacy Notice. We might use information that we collect about you, including any Personal Information:

to notify you about changes to the Site or our services; to protect your privacy and enforce this Privacy Notice;

if we believe it is necessary to identify, contact or bring legal action against persons or entities who may be causing injury to you, to Intentionalist, or to others;

to analyze preferences, trends, and statistics;

to provide you with other information from and about Intentionalist or a business or organization with which we are associated;

to protect our rights and property;

to comply with a law, regulation, legal process or court order; and for any other purpose with your consent.

Social Networking. If you access our Site from a social networking site (e.g., Facebook or Twitter), or if you otherwise agree to associate your account with us with a social networking site, we may also receive Personal Information about you from such social networking site. Our receipt of your Personal Information via a social networking site is governed by the terms of use and privacy notice of the social networking site. We may retain this information with the information we collect from you directly.

Intentionalist Is Not Intended for Children. Intentionalist’s products and services are designed for adults, not children. Intentionalist is dedicated to protecting children online. As such, no one under age 16 may provide any Personal Information on the Site. If you are under 16, do not use or provide any information on this Site or on or through any of its features, register on the Site, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or user name you may use. If we learn we have collected or received Personal Information from a child under 16 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under age 16, please contact us at [email protected].

SECURITY

Security Practices. It is Intentionalist’s policy to treat your Personal Information with complete confidentiality. We employ commercially appropriate and reasonable safeguards both online and offline to maintain the security, confidentiality, and integrity of information that we collect about you. Intentionalist maintains internal policies to govern the collection, processing and handling of data, and restricts access to data to those employees who require such access to

perform their job functions. We educate our employees about the importance of confidentiality and customer privacy through standard operating procedures.

Merchants with which we have written agreements to participate in our Merchant Network and vendors that provide Intentionalist with various services (collectively, “Service Providers”) may have access to your Personal Information while they are performing their contractual obligations. We prohibit our Service Providers from selling or disclosing the Personal Information we provide, and we require all Service Providers to maintain confidentiality standards that are commercially reasonable to ensure the security of your Personal Information.

We also maintain physical, electronic and procedural security measures to safeguard your nonpublic Personal Information. We store and manage data in a cloud- based data center that is protected by industry leading safeguards including strong encryption for content delivery and passwords. We update and test our technology to improve the protection of our information about you and to assure the integrity of that information.

Please note that no transmission of data over the internet is 100 percent secure. While we employ reasonable measures to protect your Personal Information, we cannot guarantee that unauthorized third parties will not defeat those measures or use nonpublic Personal Information for improper purposes. We are not responsible for circumvention of any privacy settings or security measures contained on the Site, our services, or for actions of third parties. The safety and security of your information also depends on you, and you are responsible for keeping your password confidential. Remember to log off your account and close your browser window when you have finished your visit. This is to ensure that others cannot access your account, especially if you are sharing a computer with someone else or are using a computer in a public place. All internet users should take care with how they handle and disclose their Personal Information. Please refer to the Federal Trade Commission’s website for information about how to help protect yourself against identity theft.

Disclosure of Personal Information. Intentionalist does not share, sell, rent, or transfer your Personal Information to any business that is not a Service Provider. Intentionalist may also share contact information and other data with businesses controlling, controlled by, or under common control with Intentionalist. Intentionalist reserves the right to disclose aggregated information about our Site visitors and information that does not identify any individual, without restriction. In addition, we may disclose Personal Information:

if we are required to do so by law or legal process, such as to comply with any court order or subpoena or to respond to any government or regulatory request;

to law enforcement agencies or for an investigation related to public safety;

if we believe disclosure is necessary or appropriate to protect Intentionalist’s rights or property, or the safety of our users or others;

to a buyer or other successor, in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding or event, and we may transfer the Personal Information that we have collected or maintain to the buyer or other successor; and

for any other purpose disclosed by us when you provide the information; and with your consent.

Behavioral Advertising. We allow some Service Providers to assist us with behavioral advertising by collecting and analyzing certain information when you visit our Site (e.g., click

stream information, browser type, time and date, subject clicked or scrolled over). These Service Providers typically use a cookie or third-party web beacon to collect this information.

Third-party Websites and Advertising. This Privacy Notice applies only to information collected by Intentionalist. We may provide links to third- party websites from our Site as a service to our Site visitors, but we have no ability to control, and we are not responsible for, the privacy and data collection, use, and disclosure practices of third-party websites. When you click on links that take you to external websites, you will be subject to their privacy notices and practices and not ours. We encourage you to review and understand the privacy notices of such websites before providing them with any information.

CONTROLLING YOUR PERSONAL INFORMATION

Your Privacy Rights. You have the right to submit a complaint or to object to our collection and use of your information at any time, or to require us to review, transmit, change, or delete your information that we have collected and retained. We will fulfill your request to exercise any of these rights within 30 days of receiving a complete request. You can exercise these rights, express concerns, or obtain additional information about the use of your Personal Information by contacting us at [email protected].

Opting Out of Communications. We want to communicate with you only if you want to hear from us. You can modify or limit the communications we send to you by clicking the “unsubscribe” link at the bottom of any of our marketing emails. You may also contact us at [email protected]. Please be sure to include your full name, email address, mailing address, and specifically what information you do not want to receive. If you like, you may use one of the following statements in your message to us:

I prefer not to receive email advertisements, such as updates regarding products and services, special promotions, or upcoming events.

I prefer not to receive direct mail advertisements, such as periodic catalogs and mailings regarding products and services, special promotions, or upcoming events.

California Privacy Rights. Because Intentionalist is a small startup based in Washington, we are currently exempt from compliance with the California Consumer Privacy Act (the “CCPA”; Ca. Civil Code sections 1798.100 – 1798.199) . However, some of our contracts with service providers and other third parties may require us to comply with the CCPA. Users of our Site who are California residents may have certain rights related to their Personal Information, such as the right to (a) receive information describing the categories of Personal Information about you that we have collected, and whether that information was sold to a third party; (b) receive a list of categories of third parties with which we have shared your Personal Information; (c) if we sell your Personal Information, instruct us to not sell your Personal Information to third parties; and

(d) receive equal service regardless if you exercise your privacy rights.

Additionally, California Civil Code sections 1798.83-1798.84 entitles California residents to ask us for a notice that identifies the categories of Personal Information we share with affiliates and/ or third parties for marketing purposes, and provides contact information for such affiliates and/or third parties.

If you are a California resident and you would like to request a copy of this Privacy Notice or exercise the rights available to you under applicable California law, please contact us at [email protected] with the subject line “Request for California Privacy Information.”

Do Not Track Signals. Do Not Track is a privacy preference that users can set in their web browsers. When a user turns on the Do Not Track signal, the browser sends a message to websites requesting them not to track the user. For information about Do Not Track, visit www.allaboutdnt.org. At this time, the Site and Intentionalist do not respond to Do Not Track browser settings or signals. Intentionalist may use other technology that is standard to the internet to track Site visitors. Those tools may be used by us and by third parties to collect information about you and your internet activity, even if you have turned on the Do Not Track signal.

Unauthorized Use. If you become aware of any unauthorized submission of information to Intentionalist, including children’s information, please inform us by contacting us at the contact information listed below so that we may delete it.

TERMS

Terms of Use. The Terms of Use for this Site and our services govern all matters not set forth in this Privacy Notice. We encourage you to familiarize yourself with our Terms of Use.

Changes to this Privacy Notice. If we make changes to this notice, we will post the changes here with a new effective date at the top. Please check back to this page periodically to see if it has changed so that you can always know what information we collect, how we use it, and to whom we disclose it.

For More Information. Please let us know if you have any questions or comments regarding this Privacy Notice, or if you wish to exercise any of your rights over your Personal Information or if you have any questions about this Privacy Notice. You can contact us at [email protected].

Attachments