CALIFORNIA PRIVACY STATEMENT

Last Updated: January 1st, 2024

California Privacy Rights

This California Privacy Statement supplements the Privacy and Security Policy. It applies solely to California residents, except for USA Pan, and addresses personal information we collect online and offline.

This Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA/CPRA”).

1. Notice of Collection and Use of Personal Information

We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal information about you:

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), online identifier, internet protocol address, email address, account name, Social Security number, driver's license number, passport number, and other similar identifiers
• Additional Data Subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, state identification card number, education, bank account number, credit card number, debit card number, other financial information, medical information, and health insurance information
• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, gender identity, gender expression, sexual orientation, marital status, medical condition, ancestry, disability, citizenship status, and military and veteran status
• Commercial Information: commercial information, including records of personal property, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with websites, applications or advertisements
• Geolocation Data
• Sensory Information: audio, electronic, visual, and similar information
• Employment Information: professional or employment-related information
• Education Information: education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99)
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

We may use (and may have used during the 12-month period prior to the effective date of this Statement) your personal information for the purposes described in our Privacy & Security Policy and for the following business purposes specified in the CCPA/CPRA:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing analytics services, providing storage or providing similar services
• Providing advertising and marketing services to you, except for cross-context behavioral advertising (which is addressed in Section 5 of this Statement)
• Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance
• Short-term, transient use, including, but not limited to, non-personalized advertising shown as part of your current interaction with us
• Helping to ensure security and integrity, to the extent the use of your personal information is reasonably necessary and proportionate for these purposes
• Debugging to identify and repair errors that impair existing intended functionality
• Undertaking internal research for technological development and demonstration
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us
• Managing career opportunities with USA Pan.

2. Collection and Use of Sensitive Personal Information

We do not collect or use (and have not collected or used during the 12 month period prior to the effective date of this Statement) "sensitive personal information," as defined under the CCPA/CPRA.

3. Retention of Personal Information

We will retain your personal information for the time period reasonably necessary to achieve the purposes described in our Privacy and Security Policy and this Statement, or any other notice provided at the time of data collection, taking into account applicable statutes of limitation and records retention requirements under applicable law, as well as our records retention requirements and policies.

4. Sources of Personal Information

During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources:

• Directly from you, such as when you make a purchase
• From your devices, such as when you visit our Sites
• Our affiliates and subsidiaries
• Vendors who provide services on our behalf
• Online advertising services and advertising networks
• Data analytics providers
• Government entities
• Social networks
• Data brokers
• Recruiting and talent agencies
• Job references

5. Sale or Sharing of Personal Information

We do not exchange your personal information for monetary consideration. We may allow certain third parties (such as online advertising services and social networks) to collect your personal information via automated technologies on our Sites for cross-context behavioral advertising purposes. Under California law, these kinds of disclosures may be considered a "sale" when the personal information is exchanged for non-monetary consideration, or “sharing” when the personal information is disclosed for

cross-context behavioral advertising purposes. You have the right to opt out of these types of disclosures of your information.

We may sell or share for cross-context behavioral advertising purposes (and may have sold or shared during the 12-month period prior to the effective date of this Statement

the following categories of personal information about you to online advertising services and social networks:

• Identifiers
• Commercial Information
• Online Activity
• Inferences

We do not have actual knowledge that we sell or share personal information of minors under 16 years of age.

6. Disclosure of Personal Information

During the 12-month period prior to the effective date of this Statement, we may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

In addition to the categories of third parties identified above, during the 12-month period prior to the effective date of this Statement, we may have shared personal information about you with government entities.

7. California Privacy Rights

You have certain choices regarding your personal information, as described below.

• Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed and sold about you during the past 12 months.
• Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
• Deletion: You have the right to request that we delete certain personal information we have collected from you.
• Opt-Out of Sale or Sharing: You have the right to opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.
• Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties. Data obtained through the short code program will not be shared with any third parties for their marketing reasons/purposes.

How to Submit a Request. To submit a Shine the Light request or opt out of the sale or sharing of your personal information for cross-context behavioral advertising purposes [or limit the use and disclosure of your sensitive personal information] please contact us at info@usapan.com. For questions or concerns about our privacy policies and practices, please contact us at info@uspan.com.

Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign in to your account. If you do not have an account with us and you request access to or deletion of your personal information, we may require you to provide any of the following information: first name, last name, mailing/shipping address, phone, and email address. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. 

Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by

Changes to the Privacy and Security Statement

We may change this Privacy and Security Policy at any time at our sole discretion. Any updates to our Privacy and Security Policy will be posted on this page so that you are always aware of what information we collect, how we use it, and under what circumstances we disclose it. Continued use of our Site, Customer Call Center or other USA Pan  services following our posting of the change notice or an updated Privacy and Security Policy will constitute binding acceptance of those changes.