Privacy

BREATHE99 PRIVACY POLICY

Last updated: 8/17/20

Breathe99 respects your right to privacy. Breathe99 is headquartered in the United States but we manufacture and distribute high-quality public health products direct to consumers [across the globe].

This Privacy Policy explains who we are and how we collect, share and use personal information about you when you visit our website https://breathe99.com (" Website") and buy our products. For more information about Breathe99, please see the "About" section of our Website.

If you have any questions or concerns about our use of your personal information, then please contact us using the contact details provided at the bottom of this Privacy Policy.

QUICK LINKS

We recommend that you read this Privacy Policy in full to ensure you are fully informed.

WHAT PERSONAL INFORMATION WE COLLECT AND WHY?

The personal information that we may collect about you broadly falls into the following categories:

• Information that you provide voluntarily

If you complete an order with us via our Website or over the phone, we will ask you to provide personal information to enable us to complete your order. For example, we will ask you to provide your contact details, payment information and shipping details. We will also collect any other information that you voluntarily provide to us, such as, your name and contact details if you subscribe to receive marketing communications from us, and/or to submit enquiries to us. The personal information that you are asked to provide, and the reasons why you are asked to provide it, will be made clear to you at the point we ask you to provide your personal information.

• Information that we collect automatically

When you visit our Website, we may collect certain information automatically from your device. In some countries, including countries in the European Economic Area, this information may be considered personal information under applicable data protection laws.

Specifically, the information we collect automatically may include information like your IP address, device type, unique device identification numbers, browser-type, broad geographic location (e.g. country or city-level location) and other technical information. We may also collect information about how your device has interacted with our Website, including the pages accessed and links clicked.

Collecting this information enables us to better understand the visitors who come to our Website, where they come from, and what content on our Website is of interest to them. We use this information for our internal analytics purposes and to improve the quality and relevance of our Website to our visitors.

Some of this information may be collected using cookies and similar tracking technologies, as explained further under the heading "Cookies and similar tracking technologies" below.

WHO WE SHARE PERSONAL INFORMATION WITH?

We may disclose your personal information to the following categories of recipients:

• to third party services providers and partners who provide data processing services to us (for example, to support the delivery of our products, to host our servers, provide functionality on, or help to enhance the security of our Website), or who otherwise process personal information for purposes that are described in this Privacy Policy or notified to you when we collect your personal information.

• to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;

• to an actual or potential buyer** or acquirer** (and its agents and advisers) in connection with any actual or proposed purchase, merger, acquisition, or disposition of assets in bankruptcy or similar proceeding, of any part of our business, provided that we inform the buyer or acquirer it must use your personal information only for the purposes disclosed in this Privacy Policy;

• to an affiliated company as part of a reorganization;

• to any other person with your consent to the disclosure.

additional information regarding Third-Party Service Providers

We may use a variety of third-party services to help provide our services, such as developing and hosting our Website, to help us understand the use of our Website, to process payments for products and services on our Website, and to provide information to us from you through contact forms, as well as to provide you with advertising regarding our Website and our products and services. These third-party service providers may collect, store, and share information as further dictated by the privacy policies of those third parties.

Currently we use at least these additional service providers to support our Website:

• Hubspot products to power our contact forms. You may learn more about Hubspot's use of your data by visiting their privacy policy here: https://legal.hubspot.com/product-privacy-policy.

• Shopify for our Website hosting and e-commerce platform. You may learn more about Shopify's use of your data by visiting their privacy policy here: https://www.shopify.com/legal/privacy/customers.

• Stripe for our e-commerce payment processing. You may learn more about Stripe's use of your data by visiting their privacy policy here: https://stripe.com/privacy.

• Google Analytics to provide us usage information regarding our Website. Google, Inc., may utilize the data collected to track and examine the use of this Website, to prepare reports on its activities and share them with other Google, Inc. services. Google, Inc. may also use the data collected to contextualize and personalize the ads of its own advertising network to serve ads to you based on your visit to our Website and other sites on the Internet. You may view Google's privacy policy here: https://policies.google.com/privacy?hl=en, with more information located here: https://www.google.com/policies/privacy/partners/ (including information regarding how to control how information is shared through your Ads Settings) and here: https://support.google.com/analytics/answer/6004245?hl=en. You can prevent the collection of the data generated by Google Analytics in relation to your use of the Site and the processing of this data by downloading and installing the browser plug-in, with more information regarding how you can opt out of Google Analytics data collection as instructed here: https://tools.google.com/dlpage/gaoptout. This link provides instructions for installing an opt-out cookie on your device. As a result, the collection of data by Google Analytics is prevented in future for the Site and for this browser as long as the opt-out cookie remains installed in your browser.

• Facebook Pixel for advertising purposes. Facebook similarly provides more information regarding the information it collects and how it is used in relation to advertising along, with methods to opt out of collecting and sharing of information here: https://www.facebook.com/settings?tab=ads; and https://www.facebook.com/policy.php.

• Buttons from other websites and services such as social media websites like Twitter, Facebook, and Instagram. These third parties may use cookies or other tracking devices to collect and track information about you across the Internet. In general, you can identify these social media buttons and the companies they represent by their logos. You should check the privacy policies of these other websites when providing personally identifiable information or to find out what other information they collect from users, whether while on their platform or website or in relation to buttons.

COOKIES AND SIMILAR TRACKING TECHNOLOGIES

We use cookies and similar tracking technologies (collectively, " Cookies") to collect and use personal information about you. Cookies are widely used by website and application owners in order to make their digital properties work, or to work more efficiently, as well as to provide reporting information and serve more personalised content and advertising. Cookies that we set are called "first party cookies", Cookies set by third parties are called "third party cookies". We use the following Cookies on our Website:

You have the right to control non-essential Cookies. You can exercise your Cookie preferences via the Cookie Banner on our Website.

Additional general information regarding opt-out from interest-based advertising from companies belonging to the Network Advertising Initiative can be found here: http://optout.networkadvertising.org/#!/, information regarding opting out through the Digital Advertising Alliance can be found here: http://optout.aboutads.info/#!/, and opt-out information for individuals across much of the globe can be found here: https://www.youronlinechoices.com/.

HOW WE KEEP YOUR PERSONAL INFORMATION SECURE?

We use appropriate technical and organisational measures to protect the personal information that we collect and process about you. The measures we use are designed to provide a level of security appropriate to the risk of processing your personal information.

INTERNATIONAL DATA TRANSFERS

Your personal information may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.

Specifically, our Website servers are located in the United States, and our third party service providers and partners operate in the United States. This means that when we collect your personal information we may process it in any of these countries.

However, we have taken appropriate safeguards to require that your personal information will remain protected in accordance with this Privacy Policy. If you are a resident in the European Economic Area (" EEA") or the United Kingdom, these include implementing the European Commission's Standard Contractual Clauses for transfers of personal information and further details can be provided upon request.

DATA RETENTION

We retain personal information we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with services you have requested or to comply with applicable legal, tax or accounting requirements).

When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymise it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your Nevada Opt-Out Rights

We do not sell your personal data, but nevertheless we offer an opt out to sales of your data to comply with Nevada law. Verified requests under Nevada law (NRS 603A) to not make any sale of any covered information we have collected or will collect regarding you may be sent to support@breathe99.com. Please included in your email "Request for Nevada Opt-Out" in the subject line and in the body of your message.

Do Not Track

Presently the Website does not honor "do not track" settings on web browsers and does not offer you the opportunity to request that we not track your use of its services except as otherwise stated in this Privacy Policy.

Access to Personal Information for Reviewing, Editing, and/or Removing

If you wish to discuss this Privacy Policy and the information we collect, you may contact us at the address provided in this Privacy Policy. At this time, except as set forth in this Privacy Policy (and specifically, as set forth below as to residents of the EEA or UK) we may not be able to specifically identify and provide you with all of the information we have collected about you for your review, editing, or removal from our databases.

ADDITIONAL INFORMATION IF YOU ARE A RESIDENT OF THE EEA OR UK

If you are a resident of the EEA or the UK, the following sections apply to how we collect and manage your personal data.

_ Legal basis for processing personal information _

Our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.

However, we will normally collect personal information from you only (i) where we need the personal information to perform a contract with you, (ii) where the processing is in our legitimate interests and not overridden by your rights, or (iii) where we have your consent to do so. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person.

If we ask you to provide personal information to comply with a legal requirement or to perform a contract with you, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).

If we collect and use your personal information in reliance on our legitimate interests (or those of any third party), this will normally be to operate our Website, to communicate with you in order to provide our services, to undertake marketing or to detect or prevent illegal activities. We may have other legitimate interests and if appropriate we will make clear to you at the relevant time what those legitimate interests are.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the details provided under the "How to contact us" heading below.

_ Your data protection rights _

You have the following data protection rights:

• To access, correct, update or request deletion of your personal information.

• To object to processing of your personal information, ask us to restrict processing of your personal information or request portability of your personal information.

• To opt-out of marketing communications we send you at any time. You can exercise this right by clicking on the "unsubscribe" or "opt-out" link in the marketing e-mails we send you.

• If we have collected and process your personal information with your consent, then you have the right to withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent.

• To complain to a data protection authority about our collection and use of your personal information.

You can exercise any of these rights by contacting us using the contact details provided under the "How to contact us" heading below. If you wish to exercise your right to complain to a data protection authority, please contact your local data protection authority.

We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.

UPDATES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time in response to changing legal, technical or business developments. When we update our Privacy Policy, we will take appropriate measures to inform you, consistent with the significance of the changes we make, which generally consists of posting the revised Privacy Policy at the Privacy Policy link on our website. We will obtain your consent to any material Privacy Policy changes if and where this is required by applicable data protection laws.

You can see when this Privacy Policy was last updated by checking the "last updated" date displayed at the top of this Privacy Policy.

HOW TO CONTACT US

If you have any questions or concerns about our use of your personal information, please contact us using the following details:

Our email: hello@breathe99.com

The data controller of your personal information is Breathe99 PBC.