Privacy Policy

1. Information Collection

We collect personal information about you via our Websites when you provide it through various forms and places on the Websites such as in connection with a request or purchase of a product, service, or information or if you register for a Website account. You may browse our Websites without providing any personal information; however, if, for example, you decide to place an order, we will ask you for your name, age, delivery and billing address, phone number(s), email address, and payment information such as credit/debit card number, expiration dates, PayPal or third-party payment information. If you choose to complete a user registration form or survey, we may ask you for personal information, such as your contact information (e.g., name, e-mail address and mailing address). Occasionally, we may also ask you for other demographic information, such as gender, income level, and information about your prior experiences with the Company's products. If we combine demographic information with the personal information, we collect directly from you on our Websites, we will treat the combined data as personal information under this Privacy Policy. When you submit your personal information or demographic information on one of the Websites, you are giving your consent to the collection, use, and disclosure of your information as set forth in this Privacy Policy.

We may receive information about you from your friends and others that use the Websites, such as when they submit your information to us about you. Additionally, we may, from time to time, supplement the information we collect directly from you on our Websites with outside records from third parties for various purposes, including to enhance our ability to serve you, to tailor our content to you and to offer you opportunities that may be of interest to you. For example, if you choose to have your purchase delivered to another person’s address, we may ask for the other person’s name and delivery address. We will use this information to deliver your purchase to the address you choose to have it delivered. You may delete the other person’s information from your account or the other person may contact us at privacy@bodyfirm.com to request that we remove their information from our database. Note: Although you can remove the information from your account for future orders, the other person’s information may be retained with the original transaction for auditing and legal purposes. In no other circumstances do our statements under this Privacy Policy apply to information we receive about you from third parties.

We may also use the tracking technologies described in Section 6 below in order to automatically (or passively) collect, store or accumulate certain non-personally identifiable information concerning your use of this Website, such as information regarding which of our pages are most popular and remembering you and your preferences, your IP address, UDID or other unique identifier, device functionality (including browser, operator system, hardware, mobile network information), device location, device characteristics, city, time zone, and referring URL. Information gathered may be used in aggregate form for internal business purposes, such as generating statistics, developing marketing plans, customizing content, and improving the Website. This usage information may be stored or accessed using a variety of technologies that may be downloaded to your personal computer, browser, laptop, tablet, mobile phone or other device whenever you visit or interact with our Site. We may share or transfer such aggregate, non-personally identifiable information with or to our affiliates, licensees, partners and other third parties.

We may combine automatically collected Website usage information with your Personal Information. In those cases, we will apply this Privacy Policy to the combined information.

All of our Websites are intended for a general audience. We do not knowingly collect personal information from children under the age of 18. We will delete any personal information collected that we later determine to be from a user younger than the age of 18. If you are a parent or guardian of a child under the age of 18 and believe he or she has disclosed personal information to us, please contact Customer Service using the contact information below.

2. Use/Disclosure of Personal Information

“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identifiable individual. Personal information includes “personal data” as that term is defined in applicable privacy laws, as may be further described in Sections 13 and 14 of this Privacy Policy. Personal information does not include publicly available information; lawfully obtained, truthful information that is a matter of public concern; information that has been de-identified, or aggregate consumer information.

Categories of Personal Data Collected	Examples	Processing Purposes Linked to Categories	Categories of Third- Party Recipients (Excluding Services Providers)
Identifiers	Real name Alias Postal address Shipping information Unique personal identifier Internet Protocol (IP) address Email address Account name Telephone number Account number Social Security number Driver’s license number, Passport number Other state or government-issued identification card numbers	To place an order made through the Website and fulfill your order request Customer communications and support To process transactions Marketing our products and services Marketing the products and services of others Promotions and sweepstakes For internal business purposes, including general business administration Internal analytics Audit, compliance, legal, policy, procedure, and regulatory obligations Customer claims and fraud investigation and prevention Systems and data security Protecting the safety of our employees and others Internal analytics	Third-party advertising marketing companies
Financial Information	Financial account information Account log-in combination with required security or access code, password, or credentials Debit or credit card information in combination with required security or access code, password, or credentials Information about your financial institution	Same purposes as noted for “Identifiers”.	N/A
Commercial information	Assets Income Records of personal property Products or services purchased, obtained, or considered Order and confirmation numbers Account balances Payment history Account activity Purchasing or consumer histories or tendencies	Same purposes as noted for "Identifiers" as well as: To improve merchandise selections and the overall shopping experience at the Websites To customize your experience on the Website or to serve you specific content or ads that are relevant to you	Third-party advertising marketing companies
Internet or other electronic network activity information	Cookie identifiers, pixel tags, clear gifs, session data, widgets, and information from other tracking technologies as described in Sections 5,7, and 9. Browser type Internet service provider (ISP) Referring/exit pages Operating system Date/time stamp Clickstream data Device platform Device version Browsing history Search history Device characteristics including preferred language and your choice of settings such as Wi-Fi, Bluetooth, and GPS Session data	Same purposes as noted for “Identifiers” and “Commercial information”.	Third-party advertising marketing companies
Audio, electronic, visual, or similar information	Records of calls to or from our customer service centers Photographic images of your face (solely for purposes of workplace safety in light of COVID-19);	Same purposes as noted for “Identifiers” and “Commercial information”.	Third-party advertising marketing companies
Geolocation Data	Precise geolocation Global Positioning System (“GPS”) data Locational information based upon your IP address Cell network data Locational data collected from various devices including your mobile device(s) or vehicles(s)	For internal business purposes, including general business administration Customer claims and fraud investigation and prevention Systems and data security Protecting the safety of our employees and others Internal analytics	N/A
Characteristics or protected classifications	Racial or ethnic origin Gender Nationality Marital status Military service/veteran status Date of birth Sex life or sexual orientation Certain health information	For internal business purposes, including general business administration Customer claims and fraud investigation and prevention Systems and data security Protecting the safety of our employees and others Internal analytics	N/A
Education information		For internal business purposes, including general business administration Customer claims and fraud investigation and prevention Systems and data security Protecting the safety of our employees and others Internal analytics	N/A
Professional or employment-related information	Your current and previous employers Job title and responsibilities Information related to your work history and/or prospective employment	For internal business purposes, including general business administration Customer claims and fraud investigation and prevention Systems and data security Protecting the safety of our employees and others	N/A
Inferences about you using any of the above	Information drawn from any of the information above categories of information	For any of the purposes listed above.

The Company and its affiliates and subsidiaries may use your Personal Information for the purposes listed above.

If for any reason you would no longer like to receive email marketing messages from the Company, you may follow the instructions contained within our promotional emails or please click here. Please allow up to ten (10) days for us to process your request. This will not affect subsequent subscriptions and if your opt-out is limited to certain types or categories of emails the opt-out will be so limited. Please note, if you opt not to receive marketing emails from the Company, you may still receive "transactional" email messages regarding your account, use of the Websites or your order (e.g., order confirmation, shipping information, recall notices, customer service notifications, etc.). If you have questions or concerns regarding this statement, please contact Customer Service.

The Company may share non-personal information, such as aggregated user statistics, with third parties. The Company may also share and sell your information, such as your name, email address, mailing address and/or telephone number to business partners, vendors, and other third-party organizations to provide you with information about products, services, and special offers we think may interest you or to improve our products, services, and advertising. If you are a California resident, you have the right to request additional information about this sharing, so please see Section 12 below. In addition, we may share the information we have collected about you, including personal information, as disclosed at the time you provide your information and as described below or otherwise in this Privacy Policy.

We may contract with companies or individuals to provide certain services including email and hosting services, credit card processing, shipping, data management, surveys and marketing, promotional services, to assist in preventing or deterring fraud, etc. We call them our “Service Providers”. We may share personally identifiable information with Service Providers solely as appropriate for them to perform their functions, but they may not use such information for any other purpose.

We do not share your credit card information with unaffiliated third parties unless you authorize us to do so, or if it is necessary to fulfill our responsibilities, including, but not limited to, delivering a product or service that you order.

Some of our pages utilize framing techniques to serve content to/from our partners while preserving the look and feel of our Website. Please be aware that you are providing your personal information to these third parties and not to Company.

The Company may, in its sole discretion, disclose personal information in special cases: (1) when we have reason to believe that disclosing this information is necessary to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) the rights of the Company or to anyone that could be harmed by such activities; (2) when we believe in good faith that the law requires it; (3) to a subsequent owner, co-owner or operator of a Website or applicable database or in connection with a merger, consolidation, restructuring, the sale of substantially all of our interests and/or assets or other corporate change, including, during the course of any due diligence process; and (4) in situations involving threats to the physical safety of any person.

3. How to Exercise Your U.S. State Privacy Rights

Certain states provide residents with certain rights with respect to their personal information or personal data as defined under applicable law, including residents of California, Virginia, Colorado, Connecticut, and Utah as detailed in Sections 13 and 14. Please review Sections 13 and 14 for more information on state-specific rights and terms.

If you are a resident of California, Virginia, Colorado, Connecticut, and Utah, please use the following information to exercise your privacy rights. Please note that any request you submit to us is subject to an identification and residency verification process as permitted under applicable law, as well as certain other procedural requirements that may be noted in the sections below. Additionally, all requests are subject to certain exceptions under applicable law, which may vary. If you are a visually impaired customer, a customer who has another disability or a customer who seek support in other language, you may access your privacy rights by emailing us atprivacy@bodyfirm.com.

• Right to Know and Access. You have the right to know what personal information we collect, use, disclose, and/or sell or share as those terms are defined under applicable state law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.

• Right to Delete. You have the right to request under certain circumstances that we as well as our service providers and contractors delete the personal information that we collect about you.

• Right to Correct Inaccurate Personal Data. You have the right to request the correction of inaccurate personal information.

• Right to Opt Out. If we sell or share your personal information as those terms are defined in the applicable state law. Please review Sections 13 – 16 for information on how to opt out of the sale/sharing of your personal information under your state’s privacy laws.

• Sensitive Personal Information or Sensitive Data. You may have certain rights with respect to your sensitive personal information as defined in the CCPA or sensitive data as defined in the applicable state law. Please review Sections 13 – 16 for information on how to exercise these rights.

• Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

How to Exercise Your U.S. State Privacy Rights

If you are a resident of California, Virginia, Colorado, Connecticut, and Utah, please use the following information to exercise your privacy rights. Please note that any request you submit to us is subject to an identification and residency verification process as permitted under applicable law, as well as certain other procedural requirements that may be noted in the sections below. Additionally, all requests are subject to certain exceptions under applicable law, which may vary. If you are a visually impaired customer, a customer who has another disability or a customer who seek support in other language, you may access your privacy rights by emailing us at privacy@bodyfirm.com.

Except where otherwise noted, we will respond to your request within forty-five (45) days after receipt and we reserve the right to extend the response time by an additional forty-five (45) days when reasonably necessary and provided consumer notification of the extension is made within the first forty-five (45) days. As described below, in some jurisdictions, an authorized agent may submit a request to exercise your rights on your behalf.

How to submit a request. If you wish to exercise any of the rights in Sections 13 and 14, please send your request(s) using one of the following methods:

• By using our interactive web form accessible here
• By email: privacy@bodyfirm.com
• By calling our Toll-free number: 855-214-1617
• By mail:
  
  The Body Firm, LLC
  100 N. Pacific Coast Highway, Suite 1600
  El Segundo, California 90245
  Attn: [California, Virginia, Colorado, Connecticut, or Utah as applicable] Privacy Rights

We do not charge a fee to process or respond to your verifiable consumer request unless its excessive, repetitive, manifestly unfounded, or in accordance with applicable law. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

You may only make a verifiable or authenticated consumer request twice within a twelve (12) month period. If we have collected information on your minor child, you may exercise the above rights on behalf of your minor child. Additionally, in some jurisdictions, you may designate an authorized agent to submit a request on your behalf. The request must include:

• Sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to the request.

We cannot respond to your request or provide you with personal data if we cannot verify or authenticate your identity or authority to make the request and confirm that the personal information relates to you.

You are not required to create an account with us to submit a verifiable or authenticated consumer request. However, we do consider requests made through your password protected account sufficiently verified when the request relates to personal information associated with that specific account. We will only use personal information provided in a verifiable or authenticated consumer request to verify your (or your authorized agent’s as applicable) identity or authority to make the request.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

4. Information Security

We use Secure Sockets Layer (SSL), an advanced security protocol that protects your credit card information and ensures secure online ordering. SSL Internet connections are encrypted, and thus protect all credit card ordering information, including your name, address, and credit card number, so it cannot be read in transit. We use secure technology, privacy protection controls, and restrictions on employee access, to safeguard your personal information. Please note, however, that although we employ industry-standard security measures to safeguard the security of your personal information, no transmissions made on or through the Internet are guaranteed to be secure. Please note that we cannot ensure the security of any information you transmit to us, and you use our Website and provide us with your information at your own risk.

5. Access and Choice

If your personal information changes, or if you no longer desire our service, you may correct, update, amend, delete/remove, or deactivate it by making the change on our member information page or by emailing our Customer Support at privacy@bodyfirm.com or by contacting us by telephone or postal mail at the contact information listed below. We will respond to your request within a reasonable timeframe.

6. Technology Utilized / Tracking Technologies

We and our marketing partners, affiliates, or analytics or service providers, use technologies such as cookies, beacons, tags, browser fingerprinting, recognition technologies and scripts, to analyze trends, administer the Website, tracking users’ movements around the Websites, and to gather demographic information about our user base as a whole. We may receive reports based on the use of these technologies by these companies on an individual and aggregated basis. This information may be combined with information collected from other third-party sources of information not collected during your visit to our website, which may include your name and mailing address, for purpose of determining whether you may be interested in receiving direct mail.

Our Website utilizes tracking technologies to collect and record your activities and movements across our websites throughout your browsing session, including to track clicks/touches, mouse movements, scrolling, keystrokes, data entered, device information and orientation, and screen size (“session data”), for purposes of our own internal analytics and improving our products, services, and user experience. We may share session data with our third-party analytics or service providers for these purposes, who will use the session data solely on our behalf and for our benefit. Please review how you consent to the collection, use, and sharing of session data in Terms of Use and Conditions of Purchase Terms of Use and Conditions of Purchase.

There may be other tracking technologies now and later devised and used by us in connection with the Website. Further, third parties may use tracking technologies in connection with our Websites, which may include the collection and storing of information about your online activities over time and across third-party websites or online services.

We and third-party vendors, including Google and Facebook, use first-party cookies (such as the Google Analytics cookie) and third-party cookies (such as a DoubleClick cookie), device fingerprinting, web beacons, and other storage technologies together to collect or receive information to report how your ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to visits to our Websites and elsewhere on the Internet. Google’s use of the DoubleClick cookie enables it and its partners to serve ads based on your visit to our Websites and/or other sites and online services. To learn more about how to opt out of Google’s use of first-party cookies, click here. To learn more about how to opt out of DoubleClick’s use of cookies, visit the DoubleClick opt-out page, here.

We use Local Storage, such as HTML5, to store content information and preferences. Third parties with whom we partner to provide certain features on our Website or to display advertising based upon your web browsing activity also use Flash cookies and HTML5 to collect and store information. Various browsers may offer their own management tools for removing HTML5. To manage Flash cookies, please click here: http://www.macromedia.com/support/documentation/en/flashplayer/help/settings_manager07.html.

To opt-out of receiving our direct mail, you may send us an email at privacy@bodyfirm.com or call us at 888-708-2042.

7. Do Not Track Signals

Some web browsers are developing or offering signals or other mechanisms for the expression of consumer choice regarding the collection of information about an individual consumer’s online activities over time and across third-party web sites or online services (e.g., a "Do Not Track" ("DNT") signal). A DNT signal is a HTTP header field indicating your preference regarding tracking or cross-site user tracking. We do not monitor or take any action with respect to DNT signals.

8. Ads and Information About You

We may work with third parties, such as network advertisers and ad exchanges that use tracking technologies on our Websites in order to provide tailored advertisements on our behalf and/or on behalf of other advertisers across the Internet and we may use third-party analytics service providers to evaluate and provide us and/or third parties with information about the use of these ads on third-party sites and viewing of ads and of our content. Network advertisers are third parties that display advertisements, which may be based on your activities (including past visits to our Websites) across the Internet and mobile media (“Behavioral Ads”). Behavioral Ads enable us to target advertisements to you for products and services in which we believe you might be interested. If you object to receiving Behavioral Ads from us on third-party sites, you can learn more about your ability to limit Behavioral Ads below. Our third-party ad network and exchange providers, the advertisers and/or traffic measurement services may themselves set and access their own technologies on your device and track certain behavioral usage information via a device identifier. These third-party technologies may be set to, among other things: (a) help deliver advertisements to you that you might be interested in; (b) prevent you from seeing the same advertisements; and (c) understand the usefulness of the advertisements that have been delivered to you.

Statements regarding our practices do not apply to the methods for collecting information used by these third parties or the use of the information that such third parties collect. We do however work with third parties to make efforts to have you provided with information on their practices and any available opportunity to exercise choice. We make no representations regarding the policies or practices of third-party advertisers or advertising networks or exchanges or related third parties.

Further, while sites use a variety of companies to serve advertisements, you may wish to visit http://www.networkadvertising.org/optout_nonppii.asp, which provides information regarding this practice by Network Advertising Initiative (“NAI”) members, and your choices regarding having this information used by these companies, including the “opt-out” procedures of NAI members. Opting out of one or more NAI members only means that those NAI members no longer will be allowed under their own rules to deliver Behavioral Ads to you but does not mean you will no longer receive any targeted content and/or ads. Also, if your browsers are configured to reject cookies when you visit this opt-out page, or you subsequently erase your cookies, use a different device, or change web browsers, your NAI opt-out may not, or may no longer, be effective. You may also opt-out of receiving Behavioral Ads on participating sites and services by visiting the Digital Advertising Alliance (“DAA”) website at http://www.aboutads.info/choices/ (or if located in the European Union click here). Similar limitations may apply to the DAA opt-out. We are not responsible for effectiveness of or compliance with any third parties opt-out options or programs. Deleting browser cookies and/or using a different browser (for e.g., in-app browsers on mobile) will remove the cookie preferences you have selected, including do not sell my personally identifiable information. As a result, you may need to opt-out again in the future to maintain your preferences.

9. External Links

Our Websites may offer links to and from other third-party sites. Other sites have their own policies regarding privacy. If you visit one of these sites, you may want to review the privacy policy on that site. For example, you may have linked to the Company’s brand site through a banner advertisement on another site. In such cases the site you have linked from may collect information from people who click on the banner or link. You may want to refer to the privacy policies on those sites to see how they collect and use this information.

10. Social Media Widgets

Our Websites include social media features (“Features”), such as the Facebook Like button, and widgets, such as the Share This button or interactive applications or mini programs that run on our Websites. These Features may collect your Internet protocol address, which page you are visiting on our Website, and may set a cookie to enable the Feature to function properly. The use of this functionality may involve the third-party operator providing certain information, including Personal Information, to us. If you click on social media icons on the Website (such as for Facebook, Twitter, or Instagram), those actions may be associated with, and we may have access to, your Personal Information you provided on those third-party sites or applications. If so, we will then treat it as Personal Information under this Privacy Policy since we are collecting it as a result of your accessing of and interaction on our Websites. Features are either hosted by a third-party or hosted directly on our Websites. Your interactions with these Features are governed by the privacy statement of the company providing it. You should review the applicable third-party privacy policies before using such third-party tools on our Website.

11. Blogs/Forums

Our Websites may, from time to time, offer publicly accessible blogs or community forums where you can submit ideas, photographs, writings, music, video, audio recordings, computer graphics, pictures, data, information about your location, questions, comments, suggestions, or other content, including personal information. You should be aware that any information you provide in these areas may be read, collected, and used by others who access them. Please note that Company does not control who will have access to the information that you choose to make public and cannot ensure that parties who have access to such publicly available information will respect your privacy or keep it secure. To request removal of your personal information from our blog or community forum, contact us at privacy@bodyfirm.com. In some cases, we may not be able to remove your personal information, in which case we will let you know if we are unable to do so and why. We are not responsible for the privacy or security of any information that you make publicly available on the Websites or what others do with information you share with them on the Websites. We are not responsible for the accuracy, use or misuse of any user content that you disclose or receive from third parties through the Websites.

12. International Users

Our Websites are operated in the United States and intended for users located in the United States. Like almost every website, our Websites can be accessed by an international audience. If you are located outside of the United States, please be aware that information we collect, including personal information, will be transferred to, and processed, stored, and used in the United States. The data protection laws in the United States may differ from those of the country in which you are located, and your personal information may be subject to access requests from governments, courts, or law enforcement in the United States according to laws of the United States. In addition, such data may be stored on servers located outside your resident jurisdiction and in jurisdictions which may have less stringent privacy practices than your own. By using the Website or providing us with any information, you consent to the transfer to, and processing, usage, sharing and storage of your information, including personal information, in the United States as set forth in this Privacy Policy.

13. California Privacy Notice

This Section 13 applies to any California residents about whom we collect personal information, as defined in Section 2, from any source, including through the use of the Websites, by buying our products or services, or by communicating with us electronically, in paper correspondence, or in person (collectively, “you”). “Personal information” also includes personal information as described in California Civil Code Section 1798.80(e), which includes “Financial Information” as described in Section 2.

For purposes of this section, “publicly available information” includes: information that is made available from federal, state, or local government records; information that a business has a reasonable basis to believe is lawfully available to the general public either through widely distributed media or by the consumer; and information that is made available by a person to whom the consumer has disclosed the information if the consumer has not restricted the information to a specific audience.

14. Privacy Notice for Residents of Other States

Certain states provide residents with certain rights with respect to their personal information or personal data as defined under applicable law, including residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia.

This Privacy Notice contains additional information for residents of Colorado, Connecticut, Montana, Oregon, Texas, Utah, and Virginia regarding personal data as defined in Collecting Personal Data that we collect, how we use it, what sources it is derived from, and who we disclose it to, and provides information regarding your rights, and our responsibilities, under applicable laws and regulations. The provisions contained within this section are intended to provide notices in compliance with the Colorado Privacy Act (“CPA”), the Connecticut Data Privacy Act (“CTDPA”), the Montana Consumer Data Privacy Act (“MCDPA”), the Oregon Consumer Data Privacy Act (“OCDPA”), the Texas Data Privacy and Security Act (“TDPSA”), the Utah Consumer Privacy Act (“UCPA”), and the Virginia Consumer Data Protection Act (“VCDPA”). This section does not apply to certain personal data that is already subject to certain federal and state regulations, such as protected health information.

The CPA, CTDPA, UCPA, VCDPA, TDPSA, and OCPA provides rights to residents of Colorado, Connecticut, Utah, Virginia, Texas, and Oregon, respectively, to receive certain disclosures and access regarding collection, use, sale, and sharing of personal data.

We explain what kinds of personal data we may collect or have collected, how we collect it, why we collect it, and to whom we may disclose it to, including for purposes of cross-context behavioral advertising, above in Sections 1 and 2.

A. What Information We Collect

We may collect, use, and disclose personal data from or about you as described in Sections 1 and 2.

Certain of the information we collect constitutes “sensitive data” as defined under the Colorado, Connecticut, Utah, and Virginia law, including:

• Racial or ethnic origin;
• Sexual orientation;
• Precise or specific geolocation data as applicable; and
• Certain information concerning a consumer’s health.

B. What We Do With Your Information

We may collect or use personal data from you for the purposes identified in Section 2 of this Privacy Policy. To the extent we collect sensitive personal information as identified in Section 14A above, it may be used for all of these purposes.

C. Sources of Collected Information

We may collect personal information from the categories of sources identified in Section 13C.

D. Who We Disclose Information To

We may “sell” or “share” certain personal data with third-party partners as part of targeted advertising initiatives. These disclosures constitute “selling” and/or “sharing” under the CPA, CTDPA, MCDPA, OCDPA, TDPSA, UCPA, and VCDPA even though we do not receive monetary payment for sharing or disclosing personal data to these third parties. Pursuant to requirements regarding data sharing under applicable law, we have provided you with opt-out rights as to that activity as described in Section F below.

The only category of third parties with whom we may share your personal data is advertising and marketing companies for the limited purpose of providing you with tailored digital advertising. The only categories of personal data that we may share with these third parties are identifiers, commercial information, and information relating to Internet activity or other electronic network activity, as further detailed in Section 2 above.

E. How Long We Keep Your Information For

We retain your personal data, including sensitive data, for as long as reasonably necessary to provide you with the products or services you have requested from us as detailed in Section 13E above.

F. Your Privacy Rights

If you are a resident of Colorado, Connecticut, Montana, Oregon, Texas, Utah, or Virginia, you have the following rights under applicable law in relation to your personal data, subject to certain exceptions:

• Right to Know and Access. You have the right to know what personal data we collect, use, disclose, and/or sell or share as those terms are defined under applicable state law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.
• Right to Delete. You have the right to request under certain circumstances that we as well as our service providers and contractors delete the personal data that we collect about you.
• Right to Correct Inaccurate Personal Data. You have the right to request the correction of inaccurate personal data.
• Right to Opt-Out. You have the right to opt-out of our processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. Please note that we do not use your personal data for sales or profiling.
• Rights Concerning Sensitive Personal Data. If you are a Connecticut, Colorado, Montana, Oregon, Texas, or Virginia resident, we cannot process your sensitive data or your sensitive data inferences or use your personal data for certain purposes without your affirmative consent. If you are a Utah resident, you have the right to opt out of having your sensitive personal data processed.
• Right to Non-Discrimination. You have the right not to receive discriminatory treatment for the exercise of the privacy rights described above.

You may exercise or designate an agent to exercise the above rights by following the instructions in Section 3.

G. How To Appeal Decisions About Your Rights

Colorado, Connecticut, Oregon, Montana, Texas, and Virginia residents can appeal our decisions concerning privacy rights requests, as follows:

• Colorado residents. If you are a Colorado resident and want to appeal our decision with regard to a request that you have made, please contact us using the information in Section 3 above. Within forty-give (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Colorado’s Office of the Attorney General by phone at (720) 508-6000 or by submitting a form here.
• Connecticut residents. If you are a Connecticut resident and want to appeal our decision with regard to a request that you have made, please contact us using the information in Section 3 above. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Connecticut’s Office of the Attorney General by phone at (860) 808-5420 or by submitting a form here.
• Montana residents. If you are a Montana resident and want to appeal our decision with regard to a request that you have made, please contact us using the information in Section 3 above. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Montana’s Office of the Attorney General by phone at (406) 444-4500 or by submitting a form here.
• Oregon residents. If you are an Oregon resident and want to appeal our decision with regard to a request that you have made, please contact us using the information in Section 3 above. Within forty-give (45) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Oregon’s Office of the Attorney General by phone at (877) 877-9392 or by submitting a form here.
• Texas residents. If you are a Texas resident and want to appeal our decision with regard to a request that you have made, please contact us using the information in Section 3 above. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Texas’ Office of the Attorney General by phone at (800) 621-0508 or by submitting a form here.
• Virginia residents. If you are a Virginia resident and want to appeal our decision with regard to a request that you have made, please contact us using the information in Section 3 above or notify the Office of the Attorney General of Virginia online here. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken, including an explanation of our reasons in reaching the decision. If the appeal is denied, you may contact Virginia’s Office of the Attorney General by phone at (804) 786-2071, written correspondence to 202 North 9th Street, Richmond, Virginia 23219, or online here.

H. Bona Fide Loyalty Program Notice for Colorado residents.

We may offer rewards programs that award points and other incentives for certain activity, including purchase frequency, purchase volume, social media activity, and membership milestones, as further detailed in Section 13H above. Incentives that may be redeemed with points may include exclusive sales, product rewards, and free shipping offers. In order to join such programs, if we offer them, you need to provide your first and last name, email address, and password to create a rewards account. We may also offer free-to-join membership programs for qualified beauty industry professionals that offer various incentives such as product discounts, free gifts, early access to new products, and other exclusive promotions. In order to join such programs, if we offer them, you need to provide your first and last name, email address, and applicable profession. Please note that your exercise of the Right to Delete may make it impossible for us to continue to offer our Loyalty Programs because the Loyalty Programs requires us to track your purchases and other activities across time and among our retail and online stores. If you refuse to provide your opt-in consent for a bona fide loyalty program, we will not contact you for at least twelve (12) months before requesting again. If you wish to opt out of our bona fide loyalty programs, please use the information in Section 3.

15. SMS/text program

You may elect to receive text messages from us. When you sign up to receive text messages, we will send you information about promotional offers and more. These messages may use information automatically collected based on your actions while on our sites and may prompt messaging such as cart abandon messages (IE Cookies). To the extent you voluntarily opt to have Text notifications sent directly to your mobile phone, we receive and store the information you provide, including your telephone number or when you read a text message. You may opt out of receiving text messages at any time by texting “STOP” to our text messages. For more information about text messages, see our Terms and Conditions. All the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties, excluding aggregators and providers of the Text Message services.

16. Notification of Changes

We may revise this Privacy Policy from time to time. If we decide to change our Privacy Policy, we will post the revised policy here. If we make any material changes, we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on this Website prior to the change becoming effective. As we may make changes at any time without notifying you, we suggest that you periodically consult this Privacy Policy. Your continued use of the Website after the changes are posted constitutes your agreement to the changes, both with regard to information we have previously collected from you and with regard to information we collect from you in the future. If you do not agree to the changes, please discontinue your use of our Website.

For purposes of this section “publicly available information” means information that is lawfully made available from federal, state, or local government records and information that a business has a reasonable basis to believe the consumer has lawfully made available to the general public.

A. What Information We Collect

We may collect the personal data from or about you as detailed in Section 5 of this Privacy Policy.

Certain of the personal data described above constitutes “sensitive data” as defined under Colorado law, including:

• Racial or ethnic origin;
• Sexual orientation;
• Precise geolocation data; and
• Information about a mental or physical health condition

B. What We Do With Your Information

We may collect or use personal data from you for the purposes identified in Section 2 of this Privacy Policy. To the extent we collect sensitive personal data as identified in Section 15A above, it may be used for all of these purposes.

D. Who We Disclose Information To

We may share any of the categories of personal data identified above in Section 2 with our service providers receiving information to perform services for us on our behalf and third party advertising marketing companies.

We do sell your personal data as that term is defined under Colorado law. As with nearly every e-commerce company, we do sell a limited set of data that is gathered when you visit our Websites and other web-based services, such as cookies and pixels, with third parties for targeted advertising purposes. You may opt-out of such sharing by following the instructions provided in Section D below.

F. Your Privacy Rights

If you are a resident of Colorado, Connecticut, Utah, or Virginia, you have the following rights under applicable law in relation to your personal data, subject to certain exceptions:

• Right to Know and Access. You have the right to know what personal data we collect, use, disclose, and/or sell or share as those terms are defined under applicable state law. You may ask us to provide you a portable copy of this information up to two times in a rolling twelve-month period.
• Right to Delete. You have the right to request under certain circumstances that we as well as our service providers and contractors delete the personal data that we collect about you.

You may exercise or designate an agent to exercise the above rights by following the instructions in Section 3.

E. Our Bona Fide Loyalty Program

We may offer rewards programs that award points and other incentives for certain activity, including purchase frequency, purchase volume, social media activity, and membership milestones, as further detailed in Section 13(H) above. Incentives that may be redeemed with points may include exclusive sales, product rewards, and free shipping offers. In order to join such programs, if we offer them, you need to provide your first and last name, email address, and password. We may also offer free-to-join membership programs for qualified beauty industry professionals that offer various incentives such as product discounts, free gifts, early access to new products, and other exclusive promotions. In order to join such programs, if we offer them, you need to provide your first and last name, email address, and applicable profession.

Please note that your exercise of the Right to Delete may make it impossible for us to continue to offer our Loyalty Programs because the Loyalty Programs requires us to track your purchases and other activities across time and among our retail and online stores.

17. Contact Information

If you have any questions about the Privacy Policy or practices described in it, you should contact us in the following ways:

For purposes of this section, “publicly available information” means information that is lawfully made available through federal, state or municipal government records or widely distributed media, and a business has a reasonable basis to believe a consumer has lawfully made available to the general public.

A. What Information We Collect

We may collect the personal data from or about you as detailed in Section 5 of this Privacy Policy.

Certain of the personal data described above constitutes “sensitive data” as defined under Connecticut law, including:

• Racial or ethnic origin;
• Sexual orientation;
• Precise geolocation data; and
• Information about a mental or physical health condition

B. What We Do With Your Information

We may collect or use personal data from you for the purposes identified in Section 2 of this Privacy Policy. To the extent we collect sensitive personal data as identified in Section 16A above, it may be used for all of these purposes.

D. Who We Disclose Information To

We may share any of the categories of personal data identified above in Section 2 with our service providers receiving information to perform services for us on our behalf. We do sell your personal data as that term is defined under Connecticut law.

As with nearly every e-commerce company, we do sell a limited set of data that is gathered when you visit our Websites and other web-based services, such as cookies and pixels, with third parties for targeted advertising purposes. You may opt-out of such sharing by following the instructions provided in Section D below.

F. Your Privacy Rights

If you are a Connecticut resident, subject to applicable law, you have the rights described in Section 2 and the following additional rights under Colorado law with respect to your personal data:

• Right to Opt-Out. You have the right to opt-out of our processing of your personal data for purposes of (i) targeted advertising, (ii) the sale of personal data, or (iii) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. Please note that we do not use your personal data for sales or profiling.
• Right to Provide Affirmative Consent. We cannot process your sensitive data or use your personal data for certain purposes without your affirmative consent.

You may exercise or designate an agent to exercise the above rights by following the instructions in Section 3.

18. Notification of Changes

We may revise this Privacy Policy from time to time. If we decide to change our Privacy Policy, we will post the revised policy here. If we make any material changes, we will notify you by email (sent to the e-mail address specified in your account) or by means of a notice on this Website prior to the change becoming effective. As we may make changes at any time without notifying you, we suggest that you periodically consult this Privacy Policy. Your continued use of the Website after the changes are posted constitutes your agreement to the changes, both with regard to information we have previously collected from you and with regard to information we collect from you in the future. If you do not agree to the changes, please discontinue your use of our Website

19. Contact Information

If you have any questions about the Privacy Policy or practices described in it, you should contact us in the following ways:

The Body Firm, LLC
100 N. Pacific Coast Hwy, Suite 1600
El Segundo, California 90245

Email: privacy@bodyfirm.com