California Personal Privacy Notice

Last Modified: 24 April 2023

This notice and policy supplements information contained in privacy notices from Vitamin Well  LLC, including its subsidiaries and affiliates (“Company”) and applies solely to residents of the State of California (“consumers” or “you”). Company adopts this notice and policy to comply with the California Consumer Privacy Act of 2018, as amended from time to time (“CCPA”) and the California Privacy Rights Act of 2020 (“CPRA”), as amended from time to time. Any terms defined in the CCPA or the CPRA have the same meaning when used in this notice and policy. This notice and policy does not reflect our collection, use, or disclosure of California residents’ personal information where an exception under the CCPA and CPRA applies. You can download a pdf version of the California Consumer Privacy Act Notice and Policy here.

1. RIGHT TO KNOW ABOUT PERSONAL INFORMATION COLLECTED, DISCLOSED OR SOLD

You have the right to request that we disclose what personal information we collect, use, or disclose about you specifically (“right to know”). To submit a request to exercise the right to know, please submit an email request to dpo@vitaminwell.com and include “California Request to Know” in the subject line or call our toll-free number at (888) 910-0273. Please specify in your request the details you would like to know, including any specific pieces of personal information you would like to access.

Company will ask that you provide certain information to verify your identity. The information that we ask you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. Company will respond to your request in accordance with the CCPA/CPRA. If we deny your request, we will explain why.

When a business sells your personal information, you have a right to opt out of such sale. Company does not sell information as the term “sell” is traditionally understood. However, Company may disclose certain information about you when you use Company’s site (“Site”), purchase products or services, or request information from Company for purposes that may be considered a “sale” under the CCPA/CPRA. For example, Company may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to provide you with more relevant advertising tailored to your interests. To the extent Company sells your personal information as the term “sell” is defined under the CCPA/CPRA, you have the right to opt-out of the sale of your personal information by us to third parties at any time. You may submit a request to opt-out by using the Do Not Sell My Personal Information button visible on every page and following the instructions. You may also choose to email us at dpo@vitaminwell.com to opt out (with the subject line “do not sell info”), including if you are an authorized agent for a California resident; however, the more immediate way of fulfilling this request is through the first option listed above.

If you have signed up for the Barebells Text Group, please find more information in our SMS PRIVACY POLICY.

PERSONAL INFORMATION HANDLING PRACTICES

We have set out below categories of personal information we collect about California residents and have collected in the preceding 12 months. For each category of personal information we have collected, we have included the reference to the enumerated category or categories of personal information in California Civil Code § 1798.140(o)(1) that most closely describe such personal information.

Corresponding reference to category of personal information under CCPA definition of personal information	Category of personal information
A. Identifiers.	First and last name, delivery address/billing address, telephone number, e-mail address, order information, payment details, payment history, credit card information and payment reference number. IP address in relation to order data.
B. Personal information categories listed in the California Customer Records Act (Cal. Civ. Code § 1798.80(e)).	First and last name, address, telephone number, bank account number, credit or debit card number, other financial information.
D. Commercial information.	Email address, shipping address, order number, purchased products, shopping history.
F. Internet or other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding a consumer’s interaction with an Internet Web site, application, or advertisement.	Times of visit, pages visited, time spent on each webpage; referring site details; type of web browser; type of operating system; flash version, JavaScript support, screen resolution, and screen color processing ability; network location and IP address; clicks on links leading to external Sites; user errors; clicks on videos; scroll depth; interactions with specific widgets; order data; HTTP headers; pixel specific data; button click data; optional values; form field names.
I. Professional or employment-related information.	First and last name, date of birth, job qualifications, employment history, home address, education, financial statements, phone number, criminal background, electronic signature, government issued identification.
K. Inferences drawn from any of the information.	Predictions of interests or inferences.

Company collects such information from the following categories of sources:

• Directly from you. For example, when you contact or request information from us including via the Company Site, make an online purchase, or create a Company account.
• Third Parties, including Service Providers. For example, service providers that Company uses, analytics companies, advertising networks and cooperatives, and other third parties that Company’s chooses to collaborate or work with.
• Social media platforms and networks. For example, companies that you use in connection with the Site or mobile application, or that share or allow you to share information with Company, such as Facebook. For more information on network privacy practices, please review the privacy policies and settings of the social media platforms and networks that you use.
• Using cookies and automatic collection methods.Company and its service providers may collect information from the computer, tablet, phone, or other device that you install our mobile application on, that you use to access our Site, or that you use to open an email or click on an advertisement from Company. Methods Company uses include: cookies (which may be session-based or persistent, and are typically small data files that are stored on your hard drive or in connection with your Internet browser); web beacons or tags; flash cookies or Local Stored Objects; any other technologies.

Company collects, uses, retains, and discloses your personal information for the purposes described below:

• To provide you with products and services, such as to: fulfill your orders and process your payments; process, maintain and service your account(s);
• Register an account, manage customer relationship, communicate with you, and send marketing communications;
• Measure consumer response to online content, identify consumer interests for marketing purposes, and personalize web content;
• Review and train on call center recordings;
• Handle and record consumer rights requests, including opt-ins and opt-outs;
• Monitor, protect and improve Company security assets and resources, including devices, systems, customer data, infrastructure, and Company’s network; and
• Comply with laws, regulatory requirements and to respond to lawful requests, court orders and legal processes.

3. SHARING OF PERSONAL INFORMATION

In the preceding 12 months, Company disclosed the above categories of personal information to the following categories of third parties for a business purpose, in some cases as directed by you:

• Company For example, Company affiliates may share business processes and common data systems.
• Third parties and service providers that provide products or services to us. For example, companies that help us market or advertise to you, or that provide products or services to you. Company may use third parties or service providers to help with auditing interactions and transactions with you, addressing security, fixing errors, helping us with advertising or marketing, maintaining accounts and providing customer service, helping with our internal research, and verifying service quality or safety.
• Social media platforms and networks. For example, companies that offer functionalities, plugins, widgets, or tools in connection with our Site or mobile application. For more information about what information is shared or collected, and how it is used, see the applicable social media company’s privacy policy.

Company may also access, transfer, disclose, and preserve personal information when doing so is necessary to: comply with applicable law or respond to valid legal process, including from law enforcement or other government agencies; operate and maintain the security of Company’s systems, including to prevent or stop an attack on our computer systems or networks; protect the rights or property or ourselves or others, including enforcing our agreements, terms, and policies; or act in urgent circumstances such as protecting the health or personal safety of an employee or worker, agent, customer, user of Company’s products or services, or member of the public.

4. ONLINE ADVERTISING AND THIRD PARTIES WE WORK WITH

Company works with third-party companies for advertising purposes, including to: serve advertisements across the Internet; track and categorize your activity and interests over time on our Site and mobile application, and on third-party Sites and mobile applications; and to identify the different device(s) you use to access Sites and mobile applications. These companies may collect information automatically when you use our Site or mobile application through the methods described in “Using cookies and automatic collection methods” above. The information that these companies collect or that we share may be used to customize or personalize the advertisements that are displayed to you.

Company does not provide personal information about you to other companies for money, but to help us market or advertise to you. When this information is in a format that directly identifies you by name, it is generally not shared with any companies for third-party marketing or advertising purposes. Even though Company does not provide personal information to these companies for money, California law may characterize such sharing of information to personalize your experience as a “sale” of personal information. See the Request to Opt-Out (“Do Not Sell my Personal Information”) section below to request to opt out from such sharing of personal information.

5. REQUEST TO OPT OUT (“DO NOT SELL MY PERSONAL INFORMATION”)

You may submit a request to opt-out by using the Do Not Sell My Personal Information button visible on every page and following the instructions. You may also choose to email us at dpo@vitaminwell.com to opt out (with the subject line “do not sell info”), including if you are an authorized agent for a California resident; however, the more immediate way of fulfilling this request is through the first option listed above. Once Company receives your request and validates the information you provide, your request will be processed.

Company may continue to collect and share personal information about you with third parties as described in this Notice that sharing is not a “sale” of personal information, such as to continue to provide services to you. If you use the Company mobile application, you will also need to opt out of the “selling” activity under the Do Not Sell My Personal Information function for the application.

6. RIGHT TO REQUEST DELETION OF PERSONAL INFORMATION

You have a right to request the deletion of personal information that we collect or maintain about you. To submit a request to delete personal information, please submit an email request to dpo@vitaminwell.com and include “California Request to Delete” in the subject line or call our toll-free number (888) 910-0273. Please specify in your request the personal information about you that you would like to have deleted, which can be all of your personal information as required by the CCPA/CPRA.

Company is required verify your identity. The information that Company asks you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue. Once confirmed, Company will respond to your request in accordance with the CCPA/CPRA. Company will provide an explanation for denying a request.

7. RIGHT TO NON-DISCRIMINATION FOR THE EXERCISE OF CCPA/CPRA RIGHTS

You may not be discriminated against because you exercise any of your rights under the CCPA/CPRA in violation of California Civil Code § 1798.125.

8. THE RIGHT TO CORRECT INACCURATE PERSONAL INFORMATION

You as a consumer may request us to correct inaccurate personal information about you, taking into account the nature of the personal information and the purposes of the processing of the personal information. If we receive a verifiable consumer request to correct inaccurate personal information, then shall we use commercially reasonable efforts to correct the inaccurate personal information as directed by you.

9. THE RIGHT TO LIMIT USE AND DISCLOSURE OF SENSITIVE PERSONAL INFORMATION

You have the right, at any time, to require us to limit our use of your sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services, to perform the services set forth in paragraphs (2), (4), (5), and (8) of subdivision (e) of Section 1798.140, and as authorized by regulations adopted pursuant to subparagraph (C) of paragraph (19) of subdivision (a) of Section 1798.185. “sensitive personal information” means:

(1) Personal information that reveals:

(A) A consumer’s social security, driver’s license, state identification card, or passport number.

(B) A consumer’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account.

(C) A consumer’s precise geolocation.

(D) A consumer’s racial or ethnic origin, religious or philosophical beliefs, or union membership.

(E) The contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.

(F) A consumer’s genetic data.

(2) (A) The processing of biometric information for the purpose of uniquely identifying a consumer.

(B) Personal information collected and analyzed concerning a consumer’s health.

(C) Personal information collected and analyzed concerning a consumer’s sex life or sexual orientation.

(3) Sensitive personal information that is “publicly available” pursuant to paragraph (2) of subdivision (v) /CPRA shall not be considered sensitive personal information or personal information.

10. AUTHORIZED AGENT

You can designate an authorized agent to make a request under the CCPA/CPRA on your behalf if:

• The authorized agent is a natural person or a business entity registered with the Secretary of State of California; and
• You sign a written declaration that you authorize the authorized agent to act on your behalf.

If you use an authorized agent to submit a request to exercise your right to know or your right to request deletion, please have the authorized agent take the following steps in addition to the steps described in subsections 1 and 6 above:

• Mail a certified copy of your written declaration authorizing the authorized agent to act on your behalf to dpo@vitaminwell.com; and
• Provide any information Company requests in our response to your email to verify your identity. The information that Company asks you to provide to verify your identity will depend on your prior interactions with us and the sensitivity of the personal information at issue.

If you provide an authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130, it may not be necessary to perform these steps and we will respond to any request from such authorized agent in accordance with the CCPA.

11. CONTACT FOR MORE INFORMATION

If you have any questions or comments about this notice, the ways in which we collect and use your personal information, your choices and rights regarding such use, please do not hesitate to contact us at:

Postal address: Vitamin Well LLC located at c/o Corporation Service Company, 251 Little Falls Drive, Wilmington, New Castle County, Delaware 19808. United States.

Email: dpo@vitaminwell.com