PRIVACY POLICY

Effective Date: July 17th, 2019

-----

We at Brathwait Watches, Inc. (“BWI”) along with our subsidiaries and affiliates (collectively, “BWI”) respect your concerns about privacy.

This Privacy Policy informs you about the types of information we collect, how we use and look after that information, with whom we share that information, and your privacy rights. It is provided in a layered format so you can click through to the specific areas set out below. If you have any questions about this Privacy Policy, please contact us

We urge you to read this Privacy Policy carefully to understand our policies and practices. By visiting any part of our Sites (as defined below) or by otherwise providing BWI with personal information by any means, you accept and agree to the practices described in this Privacy Policy.

In addition to the other provisions in this Privacy Policy, residents of the European Economic Area (EEA) (which includes the member states of the European Union plus Iceland, Lichtenstein, and Norway), the United Kingdom, and Switzerland should be sure to read the important information provided in Section 19, and consumers in the State of California should be sure to read the important information provided in Section 20.

Our Sites are not designed for, directed to, or intended for children, and we do not knowingly collect personal information from or about children. If you are under 16, do not use our Sites or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or username you may use. If you believe BWI may have personal information about someone under the age of 16, please contact us.

1. What Is Brathwait Watches?
2. What Is the Purpose of this Privacy Policy?
3. To Whom Does This Privacy Policy Apply?
4. When Does this Privacy Policy Apply?
5. How Will I Know About Changes to this Privacy Policy?
6. What Is Personal Information?
7. What Types of Personal Information Does BWI Collect?
8. How Does Brathwait Watches Collect Personal Information?
9. What Types of Cookies, Pixel Tags, or other Automated Means Does Brathwait Watches Use?
10. How Does Brathwait Watches Use Personal Information?
11. With Whom Does Brathwait Watches Share Personal Information?
12. What Should I Know About Third Party Interactions?
13. How Can I Opt-Out of Marketing or Change My Marketing Preferences?
14. How Does Brathwait Watches Handle International Transfers?
15. What Are Brathwait Watches Data Security Practices?
16. How Long Does Brathwait Watches Keep Personal Information?
17. What if I Don’t Want You to Collect, Use or Share My Personal Information?
18. What Rights and Choices Do I Have?
19. Which Brathwait Watches Companies Process and Share Information?
20. The GDPR Applies to Me, What Else Should I Know?
21. The CCPA Applies to Me, What Else Should I Know?
22. I Live in the United States, What Else Should I Know?
23. I Still Have Questions. How Can I Ask Them?

1. What Is Brathwait Watches?

BWI is a company that design, make, promote, and distribute watches, jewelry, eyewear, accessories, and related products. BWI owns the Brathwait® brand, and it is the worldwide authorized licensee. BWI also sell these products directly to consumers through online and mobile applications or through affiliate Stores.

This Privacy Policy is issued on behalf of BWI. When we use “BWI,” “we,” “us,” or “our” in this Privacy Policy, we are referring to BWI and any service provider that BWI has directed to perform those services on its behalf.

2. What Is the Purpose of this Privacy Policy?

This Privacy Policy aims to give you information about how BWI collects and uses your personal information, including any information you may provide through our Sites, when you sign up for an account or loyalty program, when you join our marketing lists or participate in promotions, and when you purchase a product or use a service. It also informs you about your rights and how the law protects you.

3. To Whom Does this Privacy Policy Apply?

This Privacy Policy applies to BWI consumer (B2C) relationships, to its business-to-business (B2B) customer relationships, and to its employee relationships. It is important that you read this Privacy Policy together with any other privacy notice or fair processing notice we may provide on specific occasions when we are collecting or using personal information from you so that you are fully aware of how and why we will be using that information. This Privacy Policy supplements all other notices.

For our B2B relationships, this Privacy Policy may be augmented and/or modified by our contracts and our vendor/customer policies, and we encourage our customers and vendors to read this Privacy Policy in that context.

For our employee relationships, this Privacy Policy is augmented and/or modified by our company policies and employee handbooks, and we encourage our employees to read this Privacy Policy in that context.

4. When Does this Privacy Policy Apply?

This Privacy Policy applies any time BWI processes personal information, whether itself or through someone else. Some common examples of situations in which this Privacy Policy applies include: when you visit or interact with a website, feature, or online service that is owned or controlled by BWI, whether accessed via computer, mobile device, or otherwise (collectively, the “Websites”); when you purchase a product or service, whether through one of our Websites or at an Affiliate Store; when we provide after-sales service; when we answer customer inquiries; when you connect with us via “smart” wearable devices, social media channels, at our events, through sweepstakes and promotions, in response to surveys, and via emails, chats, text messages, or telephone; and when you seek a job with BWI or are employed by BWI.

However, this Privacy Policy does not apply to uses, products, or services that are not owned or controlled by BWI. For example, our Websites may provide links to non-BWI websites, apps, plug-ins, or services. Moreover, certain content on our Websites may be hosted and served by third parties that BWI does not control. In addition, our products and services may be made available to you through third-party platforms (such as providers of app stores) or through other third-party channels (such as other retailers’ stores). The collection and use of your information by such third parties and through such third-party channels is subject to the policies and practices of those third parties, for which BWI is not responsible. We encourage you to read the privacy policy of every site and channel you visit.

5. How Will I Know About Changes to this Privacy Policy?

The easiest way to know when our Privacy Policy was last updated is to look at the Effective Date stated at the very top of the Privacy Policy. Any changes, updates, or modifications will be effective immediately on that date.

BWI reserves the right, at any time and without notice, to add to, change, update, or modify this Privacy Policy simply by posting such change, update, or modification. However, if we make changes to our Privacy Policy that materially impact our use of personal information about you that we collected prior to the date of such changes, we will make reasonable efforts to notify you. Accordingly, it is important that we have accurate and current contact information for you. You may update your information with us by updating your account or by Contacting Us, and we will use good faith efforts to make the requested changes in our then-active databases as soon as reasonably practicable. However, prior information may persist internally for our administrative purposes, and residual data may remain on backup media or for other reasons.

Your continued interactions with BWI, including your continued use of the Websites, following the posting or notice of a revised privacy policy means that you have accepted and agreed to the terms of the revised privacy policy.

Please check this Privacy Policy regularly to ensure that you are aware of our most recent policy and practices.

6. What Is Personal Information?

The definition of personal information, or personal data, varies from country to country and state to state. For example, the EEA, United Kingdom, and Switzerland have defined personal data as any information relating to an identified or identifiable natural person. In contrast, the State of California has defined personal information as information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. As you can see, these definitions overlap, but they are not the same.

While it is important to understand what personal information is, it is equally important to understand what personal information is not. Personal information does not include deidentified, aggregated, anonymized, or pseudonymized data.

Deidentified data is information that cannot reasonably identify or be connected to a particular person. Aggregated, anonymized and pseudonymized data are subtypes of deidentified information. In each instance, identifying links have been removed.

Aggregated data is information that relates to a group of individuals and from which individual information has been removed. Aggregated data may be derived from your personal information but is not itself personal information. For example, we may aggregate your Usage Data with Usage Data from others to calculate the percentage of users accessing a specific Website feature. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly reasonably identify you, then we will treat the combined data as personal information.

Anonymized data is information where the direct identifier has been removed, but the information still refers to a single user or account. Pseudonymization replaces the original identifier with a different identifier. For example, we may remove your name and replace it with a series of numbers. While anonymized or pseudonymized data may once have been personal information, after the links to identity are removed it no longer is.

Throughout this Privacy Policy, we will talk about personal information generally and about certain categories or types of personal information. While we try to apply a single definition of personal information globally, our processes are intended to align with the applicable legal definition. So please keep in mind that some of the information we discuss in this Privacy Policy may not be considered personal information under the law that applies to you. In that case, this Privacy Policy should not be interpreted to provide greater rights than you have under applicable law.

7. What Types of Personal Information Does BWI Collect?

We collect the following types of personal information:

• Identity Information, such as first name, last name, username or similar identifier, and title.
• Contact Information, such as billing address, delivery address, email address, and telephone number.
• Payment Information, including bank account and payment card details, expiration date, authorization number or security code, and billing address.
• Transaction Information,including your Identity Information, Contact Information, Payment Information, and details about your purchases of products and services from us.
• Customer Service Information, such as a record of your service inquiries, comments, reviews, and warranty and repair history.
• Technical Information,including internet protocol (IP) address, your login data, browser type and version, time zone setting and geographical location, browser plug-in types and versions, operating system and platform and other technology or other unique identifier (a set of numbers or characters that is assigned to your computer, mobile phone, or other device when you are on the Internet) (“Device Identifier”) for any computer, mobile phone, tablet or other device (any of which are referred to as a “Device”) used to access the Sites.
• Demographics Information,such as zip code, age, and income.
• Profile Information, including your username or similar identifier, password, date of birth, gender, marital status, Demographics Information, Transaction Information, Customer Service Information, and your interests, preferences, feedback, and survey responses among other User Content.
• Usage Information,including information about how you use our Sites, products, and services, such as all of the areas within our Sites that you visit, how often you visit, the time of day you visit, etc
• User Content Information,including text (such as questions, comments, and suggestions), pictures, audio recordings, videos, and other content you share by participating or posting content publicly in reviews, interactive features, sweepstakes, or other communication functionality..
• Location Information, including information about your location gathered from a variety of technologies, such as GPS, IP address, and connected or nearby Wi-Fi networks.
• Marketing and Communications Information, including your choice whether to receive direct marketing communications from us and others and your communication preferences.
• Friends Information,including Contact Information about friends or other people you would like or have directed us to contact, such as when you make a gift.
• Employment Information, such as the name and address of past or current employers and employment history.

8. How Does BWI Collect Personal Information?

We use different methods to collect information from and about you. These methods include:

Direct interactions You may give us your Identity, Contact, Payment, Transaction, Customer Service, Profile, User Content, Employment, Marketing and Communications and/or other Information by filling in forms or by communicating with us through chat messages, text messages, mail, telephone, email, social media, or otherwise. For example, this includes personal information you provide when you:

• Interact with one of our websites or applications;
• Use our chat feature;
• Contact our customer service team;
• Create an account;
• Purchase or seek to purchase our products;
• Use or apply for our services (such as warranty, after-sales service, or in-store WiFi);
• Subscribe to our newsletter;
• Request to be on one or more of our marketing lists;
• Enter a competition, promotion or survey;
• Interact with us on social media;
• Apply for a job; or
• Give us feedback.

Automated technologies or interactions. As you navigate through or interact with our Sites, we may automatically collect and log Technical, Profile, Location, Usage and/or other Information about your equipment, browsing actions, and patterns. We collect and log this personal information by using cookies, pixel tags, embedded scripts, server logs, location-sensing technology, and other similar technologies. We also may receive Technical, Profile, Location, Usage and/or other Information about you if you visit other websites employing our cookies or similar technologies. Please see section 9 “What Types of Cookies, Pixel Tags, or other Automated Means Does BWI Use?” for further details.

Community Features. Our Sites may provide you the opportunity to participate in and post User Content publicly through reviews, surveys, interactive features, or other communication functionality (“Community Features”). We may provide functionality for you to submit or post User Content through Community Features by linking our Sites to a third-party service or otherwise. User Content consisting of uploaded files may contain metadata, which may contain personal information. You should remove all such metadata, especially personal information, from your files before transmitting them to BWI. When you choose to use Community Features, anything you submit is public – others (not just BWI) will have access to your User Content and may use or share it with third parties. Consequently, if you choose to disclose personal information, that information will be considered public information, and the protections of this Privacy Policy will not apply. If you submit User Content, it may be published online or offline at any time, and BWI may share it publicly or privately including by using it in whole or in part in our advertising, marketing, publicity, and promotional activities. Once shared, BWI cannot control who and under what circumstances someone may further publish it.

Third parties and publicly available sources.We may receive personal information about you from various third parties and public sources. For example, if you are on another website and you agree to receive information from us, the other website will forward your contact and other information to us so that we may contact you as requested. We also may supplement the information we collect with outside records from third parties in order to provide you with information, services, or goods you have requested, to enhance our ability to serve you, and to tailor our content to you. We may combine the information we receive from those other sources with information we collect from you or through our Sites. Other examples of information we may obtain from third party or public sources include:

• Technical, Demographics, Marketing & Communications, and/or other Information from analytics providers and search information providers;
• Contact, Payment, Transaction and/or other Information from payment processor, fraud detection and prevention companies, and providers of technical and delivery services;
• Identity, Contact and/or other Information from publicly available sources;
• Identity, Contact and/or other Information from friends or people you know and who have asked us to communicate with you;
• Identity, Contact, Profile, Demographics, Usage, User Content, Friends, and/or other Information from social media channels like Facebook, Instagram, Pinterest, and Twitter;
• Identity, Contact, Profile, Usage and/or other Information from advertising networks and marketing lists; and
• Identity, Contact, Profile, and/or other Information from marketing insights companies like Experian.

Information provided from other users.If you decide to invite someone else to create an account or to purchase our products or services, or if you opt to ship or gift products or services to someone else, we will collect the Identity, Contact, and other personal information you provide about the other person. In such circumstances, we may send a message to that person about your invitation, shipment, or gift. We rely upon you to obtain whatever consents from the other person may be required by law for us to collect that information and to contact them as you have requested.

9. What Types of Cookies, Pixel Tags, or other Automated Means Does BWI Use?

When you go to our Websites, open our emails, use our apps or “smart” wearable devices, interact with BWI-related social media sites or tools, widgets, or plug-ins (all digital and physical sources, our “Sites”), we and third parties may collect and log certain information by automated means, such as cookies, pixel tags, embedded scripts, and flash LSOs (collectively, “Cookies”).

A “cookie” is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser and is stored by the browser or the hard drive of your computer or other electronic device like a tablet or smart phone. The identifier is then sent back to the server each time the browser requests a page from the server.

“Pixel tags” (also called clear GIFs, 1x1 GIFs, web beacons, pixels, tracking pixels, web bugs, tracking bugs, tags, web tags, and page tags) are small blocks of code on a webpage or email that allow websites to do things like read and place cookies. In contrast to cookies, which are stored on a user’s device, pixel tags are embedded in web pages or other content. The resulting connection can unobtrusively (usually invisibly) allow the collection of “clickstream data,” which is information about the links and other content a user views while, for example, browsing a site or reading an email.

“Embedded scripts” are programming code designed to collect information about your interactions with the Sites, such as the links you click. The code is temporarily downloaded onto your device from our web server or a third party and is active only while you are connected to the Sites.

“Flash LSOs” (also called flash cookies) are local shared objects used to store your preferences for volume control or to personalize certain video features. Flash cookies are different from browser cookies because of the amount and type of data and how the data is stored.

Cookies may be either “persistent” cookies or “session” Cookies. A persistent Cookie will be stored and will remain valid until its set expiration date, unless deleted by the user before the expiration date. They basically allow us to remember your preferences, such as language and other local settings, to make your next visit faster and easier. A session Cookie, on the other hand, will expire at the end of the user session when the web browser is closed. We and the third parties we permit to place Cookies on our Sites use session Cookies to manage and measure your access and use during a single browser session. They ensure the best performance of the electronic service we offer through our Sites.

Cookies also may be described as “internal” or “external” Cookies. Internal Cookies, also known as first-party Cookies, are placed by us and can only be read by us. For example, we use first-party Cookies to speed up the log-in process or enhance your user experience. External Cookies, also known as third-party Cookies, are placed by external companies and are used to analyze and measure audience and to improve the relevance of our Sites’ content and electronic services, among other things. Aside from placing Cookies ourselves, we also allow carefully-selected external parties to set third-party Cookies during your visit to our Sites. These organizations provide us with information on your use of the Sites. They also may use Cookies to promote our newest products and latest offers to you on other sites. For example, you may see products you viewed on our Sites presented on other sites as you navigate the internet. Some of these external parties may use your location to provide more relevant messaging.

There are several types of persistent and session Cookies, and internal and external Cookies, including:

• Strictly necessary Cookies: These are technically mandatory Cookies that are required for the operation of our Sites. They include, for example, Cookies that enable you to log into secure areas of our Sites, use a shopping cart, make use of ecommerce and payment services, or engage with customer service.
• Functional Cookies: These are used to perform functions, such as storing your shopping cart selections while you continue to shop and navigate to different pages of our Sites. They also allow us to determine when your cart selections are about to be or have been abandoned and recognize you when you return to one of our Sites. This enables us to personalize our content for you, greet you by name, remember your preferences (for example, your choice of language or region), and send you abandoned cart reminders. Functional Cookies also help us direct consumers to their appropriate Site and to determine whether an order is valid.
• Analytical or performance Cookies: These Cookies help us improve the quality of our Sites and our services by collecting information to assess how you use our Sites. For example, analytical Cookies allow us to recognize and count the number of visitors and to see how visitors move around our Sites when they are using them. This helps us to improve the way our Sites work; for example, by ensuring that users are finding what they are looking for easily. This is known as web analytics, and we use tools such as Google Analytics, Daasity, and Lucky Orange for this function. We use web analytics to provide aggregate and anonymous statistics on how our Sites are used; to see how effective our advertisements are by identifying where you click and from which site you arrived; to provide feedback to carefully selected outside companies that one of our visitors also visited their site; to help us improve the Site by capturing errors in your browsing experience; and to provide you with improved Site functionality.
• Targeting & Advertising Cookies: These Cookies record your visit to our Sites, the pages you have visited, and the links you have followed. We and selected external parties use this information to make our Sites and the advertising displayed on them more relevant to your interests. We also may share this information with third parties to provide third party advertisements targeted to your interest. These Cookies help us evaluate and optimize our advertising campaigns on third-party platforms, such as sponsored posts on social media or banners on other sites, according to the preferences expressed by users of these third-party platforms.

BWI also uses cookies to collect information around abandoned shopping carts. A cart is considered abandoned within one hour of inactivity/lack of purchase. Once the cart is considered abandoned, BWI may send an SMS message as a reminder.

A complete listing of all the types of information and uses of Cookies is not practicable, and the examples described above should not be considered exhaustive. However, our uses will be of the general nature described.

WHAT INFORMATION DO WE COLLECT THROUGH COOKIES?

Most of the information captured by Cookies will not directly identify you. The data we collect through Cookies may include unique device identifier; browser characteristics; device characteristics; operating system; language preferences; referring URLs; information on actions taken on our site; dates and times of Site visits, downloads, and activations. In some circumstances, however, Cookies do collect and/or log personal information.

SETTING AND CHANGING YOUR COOKIE SETTINGS

When visiting one of our Sites on a particular device, you may see a banner that allows you to accept or reject certain types of Cookies. After you have made your selection, the banner will not appear again on that device for that Site for a period of time unless you clear your Cookies by adjusting your browser settings. However, please be aware that disabling, blocking, or deleting Cookies in your browser settings may impact your experience on all sites you visit, not just our Sites. Should you wish to change your Cookies settings for our Sites only, you may use the Cookies Settings

Please remember that you may need to repeat your Cookies selection on each separate device you use to access our Sites and for each individual Site you visit.

Additionally, some third parties may provide services to help you opt out of receiving online advertisements from their networks. Visit: http://optout.networkadvertisi... for more information. BWI is not responsible for these third party services.

If you choose not to change your Cookies settings and you proceed to navigate through our Sites, then you are affirmatively agreeing to the Site’s default Cookies settings (which may vary by location), and you are allowing us to use and share all information (including personal information) collected through the dropped Cookies for the purposes described in this Privacy Policy and in any other notice at collection.

10. How Does BWI Use Personal Information

BWI collects, logs, uses, and shares personal information to perform a variety of business functions and for any purpose required or permitted by law. For example, BWI collects and uses personal information:

• To provide product and service offerings;
• To process your registration and account creation with the Sites, including verifying your Contact Information is active and valid;
• To identify you as a user in our system;
• To perform the contract we are about to enter into or have entered into with you (for example, processing and shipping an order or performing after sales service) and to enforce our rights arising from that contract;
• To process payments and provide accurate billing and shipping;
• To send administrative notifications, such as order confirmations, order status updates, security, or support and maintenance services;
• To bill you for products or services;
• To form a view on what may be of interest to you or that you may want or need;
• To deliver relevant and optimized content and to improve our Sites, products, services, marketing, customer relationships, and experiences including, without limitation, through session replay;
• To present our Sites and their content in a suitable and effective manner for you and your computer;
• To customize and tailor your experience on the Sites;
• To market and advertise our products and services, including sending newsletters, surveys, offers, and other promotional materials and recommending products or services that might be of interest to you;
• To respond to your inquiries related to employment opportunities;
• To notify you of changes to our Sites, services, terms and conditions, this Privacy Policy, or otherwise;
• To perform compliance and fraud prevention and safety functions, including enforcing our terms of service and this Privacy Policy, protecting our rights, safety, or property, and protecting against, investigating, or deterring fraudulent, harmful, unauthorized, unethical, or illegal activity;
• To perform accounting, auditing, and other internal functions;
• To investigate, protect and enforce intellectual property rights;
• To comply with and enforce public company reporting and other legal requirements, relevant industry standards, contractual obligations, and our policies;
• To comply with lawful requests and legal process, such as to respond to subpoenas or requests from government authorities; and
• perform other functions (x) as described at the time of collection, (y) with your consent, or (z) as stated in other parts of this Privacy Policy.

We will use your personal information for all purposes disclosed in this Privacy Policy for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us.

If we need to use your personal information for an incompatible purpose, we will notify you and explain the legal basis under which the information will be used.

For more information about the legal bases on which we rely for the processing of data when the General Data Protection Regulation (GDPR) applies, please read The GDPR Applies to Me, What Else Should I Know?

11. With Whom Does BWI Share Personal Information?

We may share non-personal information (including deidentified and aggregated information) in our discretion and without restriction.

We may share personal information either as disclosed in this Privacy Policy or at the time of collection or with your consent.

We may share your personal information within BWI or affiliated companies worldwide. In addition, as described above, BWI’s business includesdifferent brands. Please know that when you share personal information with one of our brands, that information may be stored and shared across BWI, including with our other brands.

We also may share your personal information with external companies who perform services on our behalf based on our instructions. We do not authorize these service providers to use or to disclose the data except as necessary to perform services on our behalf or to comply with legal requirements. Examples of these service providers include entities that process credit card payments, manage and reduce our credit risk, verify information, fulfill orders, and provide web hosting, analytics, and marketing services.

Where permitted by law or as instructed by you, we may share your personal information with other third parties for those parties’ own purposes, such as to offer products or services that may interest you. For example, personal information is shared in connection with third party interactions. For more information about this, please read What Should I Know About Third Party Interactions?

In addition, we may disclose information about you (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government officials, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity, (iv) to third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets, and/or (v) to new owners who have acquired or have merged with our business.

12. How Can I Opt-Out of Group Marketing or Change My Marketing Preferences?

As explained in this Privacy Policy, we may share your personal information within BWI or affiliated companies worldwide and across BWI brands. Among other things, BWI maintains a group marketing database. When you are entered into our marketing database you may receive marketing materials from one or all of our brands and across one or all of our Sites.

You may opt-out or change your marketing preferences, including restricting the marketing materials you receive, by clicking the applicable “unsubscribe” link on the communication sent to you or submit a request to: support@brathwait.com.

When you unsubscribe from or opt out of certain marketing, we will stop sending you direct marketing communications as requested but may continue using your personal information for other purposes for which a different lawful basis for processing exists. For example, if enabled, we will honor a request to stop sending a particular brand’s marketing materials to you while keeping you on other brands’ marketing lists.

13. What Should I Know About Third Party Interactions?

Certain functionality on our Sites may permit interactions that you initiate between the Sites and a third-party website or service (“Third Party Interactions”). For example, you may be invited: (a) to “like” or “share” content from the Sites on or to other websites or services, (b) to transmit content to the Sites from your account on a third party website or services account, (c) to apply for or use purchase financing or other third-party services related to your transaction (such as PayPal, Apple Pay, Stripe, Shopify, Affirm, Klarna, etc.), (d) to enable discounts and promotions available through third party sites, such as Rakuten and Honey, (e) to submit a review, (f) to register for an account and login through social networking sites such as Facebook and Twitter (each an “SNS”), or (g) to otherwise connect the Sites to a third party website or services, such as through an application programming interface (API) made available by BWI or a third party.

By registering or logging in through an SNS, or by initiating other third-party interactions, you are allowing and directing the Sites to access your personal information, and you are agreeing to the SNS’s or other third party’s terms of use and privacy policy in your use of such services. We may receive information from the SNS or other third party to make it easier for you to create an account with us or to perform other services. Any information that we collect in this manner may depend on the privacy settings you have with that SNS or third party, so please consult their privacy and data policies.

In addition, if you choose to use a Third Party Interaction, information you post or provide access to may be publicly displayed on the Sites or by the provider of the social feature that you use. Similarly, if you post information on a third party platform that references the Sites (for example, by mentioning one of the Sites or by using a hashtag associated with one of the Sites in a tweet or status update), your post may be published on our Sites in accordance with the terms of the third party website or service. Also, both BWI and the third party may have access to certain information about you and your use of the Sites as well as the third party website or service. In addition, we may receive information about you in connection with other users’ use of Third Party Interactions (for example, we may learn that you are someone’s “friend” or “connection” or receive other information that the other user enables us to receive).

The information that we collect and control through Third Party Interactions is subject to this Privacy Policy. However, the information collected and stored by the third party remains subject to that third party’s privacy practices, including whether the third party continues to share information with us, whether the information with be shared with others, the types of information shared, and your choices with regard to what is visible to others on that third party’s website or service. Because we do not direct or control these Third Party Interactions, you should contact these third parties directly should you wish to exercise any deletion or other rights.

14. How Does BWI Handle International Transfers?

Our disclosure of information may require a transfer of your personal information in and out of the country in which we originally collected the information. Those countries may not have equivalent data protection laws. When we transfer your information to other countries, we will protect that information as described in this Privacy Policy. By using a Site or by providing us with information, you acknowledge and consent to this transfer, processing, and storage of your information in countries where the privacy laws may be less stringent than those in the country where you reside or are a citizen.

BWI has implemented measures to protect personal information using the European Commission’s standard contractual clauses for residents in the EEA, United Kingdom, and Switzerland to ensure that adequate protection be given to personal information transferred from the EEA, United Kingdom and Switzerland to the United States or other places not deemed to provide ‘adequate protection.’ These agreements are based on “standard contractual clauses” promulgated by the EU, United Kingdom, and Swiss governments.

When BWI transfers personal information to service providers it undertakes to obtain assurances that the information will be used consistently with BWI’s instructions, this Privacy Policy, and/or law. If the personal data from a resident of the EEA, United Kingdom, or Switzerland is transferred out of the EEA, United Kingdom, or Switzerland, then we undertake to ensure a similar degree of protection is afforded to it by implementing at least one of the following safeguards: (i) confirming that the European Commission has determined that the country provides an adequate level of protection for personal data; (ii) using specific contracts approved by the European Commission or Switzerland that give personal data the same level of protection it has in the EEA or Switzerland; (iii) using providers based in the transferee countries under arrangements approved by the European Commission; or (iv) putting contractual provisions in place that provide appropriate data protections.

15. What Are BWI’s Data Security Practices?

We maintain administrative, technical, and physical safeguards designed to protect personal information against accidental, unlawful, or unauthorized destruction, loss, alternation, access, disclosure or use. While no safeguards are infallible, we take data security seriously and believe that we have implemented appropriate measures to minimize the risk of data breaches. However, we cannot guarantee the security of your data transmitted over the internet, and we do not warrant the security of any information, including personal information, which you transmit to us over the internet.

16. How Long Does BWI Keep Personal Information?

We will retain your personal information for as long as we believe it is needed to fulfill the purpose(s) we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. In general, we will retain consumer personal information for as long as we engage with the consumer and, following that period, we will retain the personal information for as long as is reasonably necessary under the circumstances.

To determine the appropriate retention period for consumer personal information, we may consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of the personal information, the administrative burden to delete the personal information, the purposes for which we process the personal information and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we may anonymize your personal information for analytical, statistical, or other purposes, in which case we may use or share this information indefinitely without further notice. Similarly, we may use or share aggregated data indefinitely without further notice.

17. What if I Don’t Want You to Collect, Use or Share My Personal Information?

Generally, unless we are required by law to do so, we do not rely on consent as a legal basis for collecting, using, or sharing your personal information. There are many times when we need to collect, use, or share personal information from or about you, such as when required by law, to provide products or services, to comply with contractual obligations, or for employment purposes. If you fail to provide that information when requested, or if you instruct us not to collect, use, or share your personal information, we may not be able to perform. For example, we may not be able to process your order, maintain your shopping cart, send you promotions, or provide you with other goods and services. In such a case, we may have to cancel a product or service you have with us. We will endeavor to notify you before doing so.

However, we strive to provide you with choices regarding certain personal information uses, particularly around marketing and advertising. You can change those choices at any time as described in Section 12.

18. What Rights and Choices Do I Have?

We offer you certain choices in connection with the personal information we collect about you, such as how we communicate directly with you. To update your preferences, to exercise your rights, or to submit a request, please contact us.

To the extent permitted by law, you also may contact us to request access to the personal information we maintain about you or to request that we correct, amend, delete, or block the information. Once we have received your request, we many need to contact you for additional information to confirm your identity and verify your rights. This helps us to ensure that personal information is not disclosed to a person who does not have the right to receive it. It also may help us to speed up our response.

If you are a resident of the EEA, United Kingdom, or of Switzerland, you have the right to make a complaint at any time to the European Data Protection Supervisor, to the Data Protection Authority in the applicable EU Member State, to the UK Information Commissioner’s Office (ICO), or to the Swiss Federal Data Protection and Information Commissioner. A list of EEA authorities is available at http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm. We would, however, appreciate the chance to respond to your concerns before you approach these governmental agencies, so please contact us in the first instance.

For more information about the rights granted under the General Data Protection Regulation and similar laws in the United Kingdom and Switzerland, please see section 19. “The GDPR Applies to Me, What Else Should I Know?”

For more information about the rights granted under the California Consumer Privacy Act, please visit our US Privacy Center.

19. The GDPR Applies to Me, What Else Should I Know?

The General Data Protection Regulation (GDPR) promulgated by the European Union limits the legal bases upon which we may collect and use personal data (personal information) and requires us to explain which legal bases we rely on for the processing of data when the GDPR applies. It also grants certain rights. References to personal information throughout this Privacy Policy should be read to include personal data under the GDPR where applicable, including whenever the subject of the personal data is a resident of the EEA. Similar rights are granted under the laws of the United Kingdom and Switzerland, and the below references to “GDPR” should be understood to refer to the similar provisions of the United Kingdom or Swiss law where applicable, including whenever the subject of the personal data is a resident of the UK or Switzerland, respectively.

PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We have set out below in table format (the “GDPR Table”) a description of the ways we plan to use personal data and which of the legal bases (other than your explicit consent) we rely on to do so if and when the GDPR applies. Although we generally do not rely on consent as a legal basis to collect or use personal data, for certain uses we may in fact obtain your explicit consent for doing so. In the GDPR Table “legitimate interests” means our interest in conducting and managing our business to enable us to give you the best products and services and the best and most secure experience and to grow our business. Although many things go into making this happen, to help you better understand what our legitimate interests are we have identified in the GDPR Table certain examples.

Note that under the GDPR we may process your personal data for more than one lawful ground depending upon the specific purpose for which we are using your data. Please Contact us if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the GDPR Table below.

Purpose/Activity under GDPR	Type of data	Lawful basis under GDPR for processing
To register you as a new customer / to identify you as a user in our system / to create and manage your user account	(a) Identity (b) Contact (c) Payment (d) Transaction (e) Location	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to keep our records updated, to service our consumers and optimize the consumer experience)
To verify your identity	(a) Identity (b) Contact (c) Payment (d) Transaction (e) Technical (f) Location	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to protect against identity theft and to prevent fraud and other unlawful activity, claims, and other liabilities)
To process and deliver your order including: (a) Send administrative notifications, such as order confirmations, order status updates, security, or support and maintenance services (b) Manage payments, fees, and charges (c) Reduce credit risk (c) Bill, collect and recover money owed to us	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications (f) Location	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated, to protect our business and shareholders, to study how customers use our products/services)
To form a view on what may be of interest to you or that you may want or need	(a) Identity (b) Contact (c) Demographics (d) Profile (e) Usage (f) Location (g) Marketing and Communications (h) Customer Service (i) Technical (j) Location	(a) Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business, and to inform our marketing strategy)
To provide product and services offerings to you	(a) Identity (b) Contact (c) Transaction (d) Profile (e) Usage (f) Technical (g) Marketing and Communications (h) Friends (i) Demographics (j) Location	(a) Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business, and to inform our marketing strategy)
To determine warranty coverage and provide customer services, including responding to your inquiries	(a) Identity (b) Contact (c) Transaction (d) Customer Service (e) Technical (f) Location	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to improve our products/services, to grow our business)
To respond to complaints of injuries and/or administer product recalls	(a) Identity (b) Contact (c) Transaction (d) Customer Service (e) Technical (f) Location	(a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to improve our products/services)
To perform accounting, auditing, and other internal functions	(a) Transaction (b) Customer Service (c) Usage (d) Technical (e) Location	(a) Necessary to comply with a legal obligation (b) Necessary for our legitimate interests (for running and growing our business)
To comply with and enforce public company reporting and other legal requirements, relevant industry standards, contractual obligations, and our policies	(a) Transaction (b) Customer Service (c) User Content (d) Technical (e) Location	(a) Necessary to comply with a legal obligation (b) Necessary for our legitimate interests (for running and growing our business)
To enable you to partake in a prize draw, competition, or sweepstakes or to complete a survey	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Friends (g) User Content (h) Technical (i) Location	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them, and to grow our business)
To operate, evaluate, improve, administer and protect our business, this website, and our apps and other services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical (d) Profile (e) Usage (f) Demographics (g) Location	(a) Necessary for our legitimate interests (for running our business, to study how customers use our products/services, for provision of administration and IT services, network security, to prevent fraud, and in the context of a business reorganization or group restructuring exercise, to inform our marketing strategy)
To deliver relevant and customized website, app, social media, and other digital content and advertisements to you, and to measure or understand the effectiveness of the advertising we serve to you	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Demographics (g) User (h) Friends (i) Technical (j) Location	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business, and to inform our marketing strategy)
To use data analytics to improve our website, apps, products/services, marketing, customer relationships, and experiences	(a) Technical (b) Usage (c) Profile (d) Demographics (e) Location	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our websites, apps, devices and tools updated and relevant, to develop our business, and to inform our marketing strategy)
To notify you of changes to our Sites, service, terms and conditions, Privacy Policy, or otherwise	Identity Contact Transaction Customer Service Technical Profile Location	(a) Necessary to comply with a legal obligation (b) Necessary for our legitimate interests (for running our business, for provision of administration and IT services, network security, to prevent fraud, in the context of a business reorganization or group restructuring exercise)
To respond to a data security breach or attempted breach	Identity Contact Transaction Customer Service Technical Profile	(a) Necessary to comply with a legal obligation (b) Necessary for our legitimate interests (for running our business, for provision of administration and IT services, network security, to prevent fraud, mitigating risk, legal compliance)
To perform compliance and fraud prevention and safety functions, including enforcing our terms of service and our Privacy Policy, protecting our rights, safety, or property, and protecting against, investigating, or deterring fraudulent, harmful, unauthorized, unethical, or illegal activity	Identity Contact Transaction Customer Service Technical Profile	(a) Necessary to comply with a legal obligation (b) Necessary for our legitimate interests (for running our business, for provision of administration and IT services, network security, to prevent fraud, mitigating risk, legal compliance)
To investigate, protect and enforce intellectual property rights	Identity Contact Technical Usage User Content	(a) Necessary for our legitimate interests (for running our business, brand protection, mitigating risk, legal compliance)
To make suggestions and recommendations to you about goods or services that may be of interest to you	(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile (f) Demographics (g) User (h) Friends (i) Location	Necessary for our legitimate interests (to develop our products/services and to grow our business)
To market and advertise our products and services	(a) User Content (b) Identity (c) Contact (d) Profile (e) Friends (f) Customer Service (g) Location (h) Technical	Necessary for our legitimate interests (to inform our marketing strategy, to develop our customer base, to grow our business)

YOUR LEGAL RIGHTS UNDER THE GDPR

Where the GDPR applies, under certain circumstances you have rights in relation to your personal data, including the right to:

Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you. If we provide you with access to the data we hold about you, we will not charge you unless permitted by law. If you request further copies of this data from us, we may charge you a reasonable administrative cost. Where we are legally permitted to do so, we may refuse your request. If we refuse your request, we will tell you our reasons for doing so.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us. If we have shared this personal data with third parties, we will notify them about your correction request unless this is impossible or involves disproportionate effort. You also may request details of the third parties to whom we have disclosed the inaccurate or incomplete personal data. Where we think that it is reasonable for us not to comply with your request, we will explain our decision to you.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully, or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. Where we are processing your personal data for direct marketing purposes you have the right to object to processing. You also have the right to object to processing in the event we do so to enable us to perform a task in the public interest or exercise official authority, or for scientific, historical, research, or statistical purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise, or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. If we have shared your personal data with third parties, unless it is impossible or involves disproportionate effort, we will use reasonable efforts to notify them about your request to restrict processing.

Request the transfer of your personal data to you or to a third party. On request, we can provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you seek to withdraw your consent. In the event you withdraw your consent, we will cease to use your data for that purpose unless we consider that there is an alternative legal basis to justify our continued processing of your information for this purpose, in which case we will inform you of this legal basis.

20. I live in the United States, What Else Should I Know?

The United States has not passed comprehensive data privacy laws that apply to residents of all states. However, certain states have enacted laws that provide certain data privacy rights.

• The California Privacy Rights Act (CPRA), amending the California Consumer Privacy Act (CCPA), became operative on January 1, 2023.

• The Colorado Privacy Act (CPA) was passed in 2021 and takes effect July 1, 2023.

• The Connecticut Data Privacy Act (CDPA) was passed in 2022 and takes effect July 1, 2023.

• The Indiana Data Privacy Law (IDPL) was passed in 2023 and will take effect January 1, 2026.

• The Montana Consumer Data Privacy Act (MCDPA) was passed in 2023 and will take effect October 1, 2024.

• The Nevada Privacy Law (NPL) went into effect in 2017 and was amended in 2019 and again in 2021. Please be aware that the definition of personal information under the NPL is more narrow than under other data privacy laws.

• The Texas Data Privacy and Security Act (TDPSA) was passed in 2023 and will take effect July 1, 2024.

• The Virginia Consumer Data Protection Act (VCDPA) was passed in 2021 and took effect January 1, 2023.

• The Utah Consumer Privacy Act (UCPA) was passed in 2022 and will take effect December 31, 2023.

These laws vary in terms of the rights granted and obligations imposed. However, for the most part, these laws align with the policies and practices set forth in this Privacy Policy. For more information about these laws and rights you may have under these laws, please visit our U.S. Privacy Center.

21. I Still Have Questions. How Can I Ask Them?

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, you may send us an email to: compliance@brathwait.com. We will try to respond as quickly as we can and within any legal requirements.