Effective January 1, 2021

Hello Nature, Inc. and its affiliates and brands, including Italpollina, Hello Nature, (collectively referred to as “Hello Nature”, “we”, “us” or “our” in this Privacy Policy) respect your privacy and are committed to protecting your personal data. This Privacy Policy will inform you as to how we look after, use, and share your personal data when you visit our websites, download, and use our mobile applications, and interact with us offline, and tell you about your privacy rights and how the law protects you.

PLEASE READ THIS PRIVACY POLICY CAREFULLY TO UNDERSTAND HOW WE HANDLE YOUR INFORMATION. BY USING ANY OF OUR WEBSITES OR APPLICATIONS, YOU ACKNOWLEDGE YOU HAVE READ AND UNDERSTAND THE PRIVACY POLICY AND THAT WE WILL COLLECT, USE AND SHARE YOUR INFORMATION AS SET FORTH BELOW.

1. CATEGORIES OF INFORMATION WE COLLECT

We may collect the following categories of information:

Identifiers such as:

• First name, maiden name, last name, company, and title
• Contact data including postal address (billing and shipping), email address and telephone number • Internet protocol address (“IP Address”), unique personal identifiers, login names, usernames, social media, instant messaging, or other online identifiers

Commercial Information including:

• Payment card details such as credit and debit card numbers, name on the credit card utilized, expiration date, cvv number, associated addresses, credit card provider, and signature
• Transaction data such as products or services purchased, obtained, or considered, product quantity, order number, model, serial number or part number, price, shipping & handling, tax, order management and other fees or charges, whether and what type of warranty applies to the product, the length of time since your purchase, metrics regarding your purchases from us, order confirmation with payment confirmation, delivery information
• Information about your customer service interactions with us such as the content of your conversations with us (including recordings of phone calls and transcripts of live chats), the help topic that you select, any details that you provide about the circumstances of your request when requesting a repair, return, warranty service, or other customer service, and the date and time of our communications with you regarding such requests

Marketing and Communications Information such as your preferences in receiving marketing from us, or from others on our behalf, your communications preferences, including the format of emails you prefer to receive and preferred send time, and data on the volume and nature of emails sent to you over time

Usage Data such as information about how you use our websites, including data we acquire from cookies on the websites (see Cookie Policy) as well as performance data regarding the email marketing communications that we send to you.

Location Data based on your IP address, zip code and time zone

Profile Data including your username and password, purchase or orders made by you, your interests, preferences, feedback and survey responses, location data including city/state/zip/country, birth date and month for promotional purposes, and activity levels

Internet Activity and Device Information, such as primary and mobile browser type and version, primary and mobile email client, and operating system, and browsing behavior 

Employment Information such as professional or employment-related information contained in your resume or other documents you may submit to apply for positions with us.

2. SOURCES OF DATA

We collect data from the following sources:

Direct Interactions with You. You may provide information such as Identifiers, Commercial Information, Marketing and Communications Information, Profile Data and Forum Data when you:

• Visit our websites or use our applications
• Purchase our products or services
• Create an account on our websites
• Contact us via email, phone, mail, or live chat
• Seek customer service
• Subscribe to our newsletter
• Request marketing to be sent to you
• Enter a competition, promotion, or survey via our Facebook page
• Give us feedback

Automatically. As you interact with our websites or our applications, we may automatically collect data such as Internet Activity, Usage Data and Equipment Information using cookies, server logs and other similar technologies. We may also receive data about you if you visit other websites employing our cookies, such as those displaying our videos, social media posts, and marketing messages. Please see our Cookie Policy for further details. We may combine data automatically collected from you with other personal information about you.

Third parties or publicly available sources. We may receive personal data about you from third parties and public sources such as:

• Social Media. We are active on social media, including Facebook, YouTube, Twitter, Instagram Pinterest, and LinkedIn (“Social Media”). Anything you post on Social Media is public information and will not be treated confidentially. We may post (or re-post) on our websites and Social Media pages any comments or content that you post on our Social Media pages. Your use of Social Media is governed by the privacy policies and terms of the providers that own and operate those websites and not by this Policy. We encourage you to review those policies and terms.

Cookies & Other Tracking Technologies. We may use cookies, web beacons, pixel tags and other tracking technologies (collectively “Cookies”) on our websites. You can set your browser to refuse all or some browser cookies, or to alert you when websites set or access cookies. If you disable or refuse cookies, please note that some parts of our websites may become inaccessible or not function properly.  For more information about the cookies we use, please see our Cookie Policy.

Analytics. We use analytics providers including Google Analytics to collect and process information about your use of our websites. These analytics providers set cookies on your browser or device, and then your web browser will automatically send information to them. They use this information to provide us with reports that we use to better understand and measure how users interact with our websites. 

We may also implement additional add-on services to Google Analytics, such as:

• Demographics and Interest Reporting, which gathers information such as the age and gender of users, along with certain interests those users express through their purchasing activities and other online activities, by tracking users across websites and across time.
• Remarketing with Google Analytics, which uses user behaviors on our Site to help us identify users for our remarketing campaigns.
• Google Display Network Impression Reporting, which provides us information about how often our ads are shown.

To learn more about how Google uses data, visit Google’s Privacy Policy and Google’s page on “How  Google uses data when you use our partners’ sites or apps.” You may download the Google Analytics opt out Browser Add-on for each web browser you use, but this does not prevent the use of other analytics tools. To learn more about Google Analytics cookies, visit Google Analytics Cookie Usage on Websites.

Interest-based Advertising. We use third parties and/or service providers for interest-based or targeted advertising services. These services may serve advertisements on our behalf that are customized based on predictions about your interests generated from your visits to websites (including our websites) over time and across different websites. The data collected may be associated with your personal information.  These advertisements may appear on our websites and on other websites and may be sent to you via email.

We use Google Ads to serve ads across various websites. Google uses Cookies to collect data about your visits to our websites to generate targeted advertisements to you on other websites that you visit. To opt out of this type of advertising by Google, to customize your ad preferences, or to limit Google’s collection or use of such data, visit Google’s Safety Center and Google’s Ad Settings, and follow Google’s personalized adopt-out instructions. Opting out will not affect your use of the websites.

To change your preferences with respect to certain online ads or to obtain more information about ad networks and online behavioral advertising, visit National Advertising Initiative Consumer opt-out page or the Digital Advertising Alliance Self-Regulatory Program. Changing your settings with individual browsers or ad networks will not necessarily carry over to other browsers or ad networks. As a result, depending on the opt-outs you request, you may still see our ads. Opting out of targeted advertising does not opt you out of all ads, just those targeted to you.

Video Content. Our websites contain videos and embedded content provided by Hello nature and other parties, including visible content and/or feeds scripts embedded in the websites’ code. Hello nature and such other parties may collect data about how you interact with such content. For example, YouTube may collect usage data on videos embedded on the websites. Even if you do not watch videos, YouTube may still collect certain information about your interactions with our websites if you are signed into your YouTube account or Google account when accessing our websites. YouTube, LLC is owned by Google.  Please see Google’s Privacy Policy for more information. 

Maps. The websites contain maps provided by third parties and/or service providers to help you locate nearby dealers. We and such other parties may collect data about how you interact with the maps. For example, Google may collect usage data on maps embedded on the websites. Even if you do not interact with the maps, Google may still collect certain information about your interactions with our websites if you are signed into your Google account when accessing our websites. Please see Google’s Privacy Policy for more information.  

3. PURPOSES FOR COLLECTING AND USING YOUR PERSONAL DATA

We have set forth below the categories of data we may collect from you described in Section 2 above and the purpose for the collection and use of the data. 

Category of Information Purpose/Activity

Identifiers To register you as a new customer

To process and deliver your order or to facilitate warranty or customer 

service

To manage our relationship with you

To enable you to partake in a promotion, contest, or sweepstakes or 

complete a survey

To provide marketing communications

To deliver relevant website content and advertisements to you, including 

email marketing, and measure or understand the effectiveness of the 

advertising we serve to you

To protect our legal rights and rights of third parties

Commercial Information To process and deliver your order or to facilitate warranty or customer service

To manage our relationship with you

To provide marketing communications

To improve products

To protect our legal rights and rights of third parties

Internet Activity and Device Information

Usage Information

Equipment Information  

Marketing and  

Communications Data Profile Data

To help with proper website and App function

To deliver relevant website content and advertisements to you, including email marketing, and measure or understand the effectiveness of the advertising we serve to you

To use data analytics to improve our website, applications, products/services

To manage our relationship with you

To provide marketing communications

To enable you to partake in a promotion contest, or sweepstakes or complete a survey

To deliver relevant website content and advertisements to you, including email marketing, and measure or understand the effectiveness of the advertising we serve to you

To make suggestions and recommendations to you about goods or services that may be of interest to you

Employment Information To evaluate your candidacy for the position you apply for

Lawful Bases for Using, Sharing or Disclosing your Information. The laws of some jurisdictions, such as the European Union, require companies to tell you about the legal basis for using, sharing, or disclosing your information. To the extent those laws apply, we may rely on the following legal bases:

Performance of a contract: where use of your information is necessary to provide you with products or services under a contract.

Legitimate interest: where use of your information is necessary for our or others legitimate interests such as:

• providing products or services
• improving our products and services and developing new ones
• recognizing and better understanding our users, including across platforms
• conducting security and fraud prevention activities
• marketing and promoting our content and services
• building and managing business relationships
• conducting compliance and risk management activities
• providing and managing access to our systems

Legal obligation: where use of your information is necessary to comply with laws and regulations such as those relating to anti-bribery and corruption and anti-money-laundering, complying with requests from government bodies or courts, or responding to litigation.

With consent: we may ask for your consent to process your information in a certain way. Where we rely on this basis, you have the right to withdraw your consent at any time.

4. DISCLOSURE OF YOUR PERSONAL DATA

We may share your personal data with the categories of parties set out below:

Employees and Affiliates. We may share personal information with our employees and affiliates who have a need to know the information for our business purposes.

Third Parties and/or Service Providers. We may share personal information with third parties and/or service providers that provide services for us. For example, we may share personal information with  vendors to help us host and manage the websites; provide targeted advertising and other marketing;  improve the content and functionality of the websites; perform data analysis and statistical analysis;  troubleshoot problems with the websites; provide payment processing services and online storefronts;  provide public relations; provide learning management systems; provide email services; provide data  processing; and support or provide the security of the websites. 

Government Officials/Law Enforcement. We will cooperate with law enforcement and other governmental agencies, and may disclose personal information: (a) if we believe in good faith, we are legally required to disclose that personal information, (b) if we are advised to disclose personal information by our legal counsel, or (c) when necessary to identify, contact or bring a legal action against someone who may cause or be causing harm to, or interfering with our legal rights or those of any other party.

Professional Advisors. We may share personal information with our professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to us.

Other Users. By submitting a copyright infringement notice, counter-notice, or other similar notification, you consent to having that communication forwarded to any person or entity to whom the notice or counter-notice relates to, to facilitate a prompt resolution of the copyright infringement claim.  Copyright infringement notices and/or counter-notices from you will be treated in accordance with our DMCA Policy found at: https://www.hello-nature.com/copyright-policy (“DMCA Policy”).

Change in Ownership. In the event (a) we are subject to a change of control, (b) the websites change ownership, in whole or in part, or (c) of a bankruptcy, receivership or a similar transaction, we may provide personal information to the subsequent owner(s).

Other. We may share personal information with third parties and/or service providers when explicitly requested by or consented to by you, or for the purposes for which you disclosed the personal information to us as indicated at the time and point of the disclosure (or as was obvious at the time and point of disclosure).

5. THIRD-PARTY LINKS

This website may include links to third-party websites, plug-ins and applications not owned by us. Clicking on those links or enabling those connections will allow those third parties to collect and/or share data about you. We do not control these third-party websites and are not responsible for their privacy statements or practices. This Privacy policy does not apply to any third-party websites or to any data that you provide to third parties. When you leave our websites, we encourage you to read the privacy policy of every website you visit.

6. CHILDREN

The websites are not directed at children. We do not knowingly collect, use, or share personal information from children under 13. If a parent or legal guardian learns that their child provided us with personal information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such personal information.

7. INTERNATIONAL TRANSFERS

If you are providing data from the European Economic Area (EEA), your data may be the transferred outside the European Economic Area (EEA), including to the United States. 

We will ensure that required safeguards for the transfer of such personal data are in place using (I) standard contractual clauses (or its successor contract) or (ii) EU-U.S. Privacy Shield certification.

8. DATA SECURITY

We maintain appropriate security measures to prevent your personal data from being accidentally lost, used, or accessed in an unauthorized way, altered, or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

We maintain procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

9. DATA RETENTION

We will retain your personal data in accordance with applicable law. 

10. YOUR LEGAL RIGHTS

Under certain circumstances, you may have rights under data protection laws in relation to your personal data including:

Request access to your personal data, also known as the right, to know.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

Request erasure/deletion of your personal data. This enables you to ask us to delete or remove personal data Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.

Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.

Request restriction of processing of your personal data. This enables you to ask us to suspend the  processing of your personal data in the following scenarios: (a) if you want us to establish the data’s  accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you  need us to hold the data even if we no longer require it as you need it to establish, exercise or defend  legal claims; or (d) you have objected to our use of your data but we need to verify whether we have  overriding legitimate grounds to use it.

Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.  Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.

Withdraw consent at any time where we are relying on consent to process your personal data.  However, this will not affect the lawfulness of any processing carried out before you withdraw your

consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.

If you wish to exercise any of the rights set out above, please email our Data Privacy Manager, specifying your request.

No Fee Usually Required

You will not have to pay a fee to access your personal data (or to exercise any of the other rights).  However, we may charge a reasonable fee if your request is clearly unfounded, repetitive, or excessive.  Alternatively, we may refuse to comply with your request in these circumstances.

What We May Need from You

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

11. TERMS APPLICABLE TO CALIFORNIA RESIDENTS ONLY

This Section provides additional terms that apply to residents of California. In the event of a conflict between this Section and the remainder of this Policy, this Section shall take precedence for California residents. In this Section only, any capitalized terms not defined in this Policy have the meanings set forth in the California Consumer Privacy Act of 2018 (the “CCPA”).

Categories of Personal Information Collected. In the last 12 months, we collected the following categories of personal information:

• Identifiers
• Commercial Information
• Marketing and Communications Information
• Usage Data
• Profile Data
• Location Data
• Internet and Device Activity
• Forum Information
• Employment Information

Categories of Personal Information Disclosed for a Business Purpose. In the last 12 months we disclosed the following categories of Personal Information set forth in section 2 above [hyperlink] for our Business Purposes:

• Identifiers
• Commercial Information
• Marketing and Communications Information
• Usage Data
• Profile Data
• Location Data
• Internet and Device Activity
• Employment Information

Your Right to Opt-out of the Sale of Your Information. You have the right to opt out of the Sale of your personal information. 

In the last 12 months we have not Sold, and we currently do not Sell, your Personal Information. 

Your Rights to Access and Deletion. California residents have certain rights under the CCPA, such as the right to request certain information or request deletion of their personal information. Subject to certain limitations such as (a) exceptions permitted by applicable law and (b) verification of your identity, California residents may exercise the following rights about their Personal Information:

Right to Access. You have the right to access any of the following which occurred in the prior 12-month  period: (a) the categories of Personal Information we collected from you, (b) the categories of sources  from which the Personal Information was collected, (c) the business or commercial purpose for  collecting your Personal Information, (d) the categories of third parties with whom we shared your  Personal Information, (e) the specific pieces of Personal Information we collected from you (i.e. “data  portability”), and (f) a list of categories of Personal Information we disclosed for a Business Purpose in  the last 12 months.

Right to Deletion. You have a right to request that we delete Personal Information we collected from you. We will comply with such request, and direct our service providers to do the same, subject to certain exceptions permitted by applicable law. 

How to Exercise Your Rights of Access and Deletion. To exercise your California rights described in this Section, you may submit your request to us by contacting us at either of the following:

Toll-free Number – 844.987.8608

Email – DataPrivacyManager@hello-nature.com

Verifying Your Request. To verify your request, you must provide sufficient information to allow us to reasonably verify you are the person about whom we collected Personal Information, and you must describe your request with sufficient detail to allow us to properly understand, evaluate, and respond to your request.

When we receive your request to exercise your rights under the CCPA: (a) we will acknowledge receipt  of your request; (b) we will try to match the information you provide in making the request with  information we already maintain about you; (c) if required to verify your identity, we may ask you to  provide additional information, including personal information; (d) we will consider various factors when  determining how to verify your identity, such as the sensitivity and value of the data, the risk of harm,  the likelihood of fraud, etc.

We will only use personal information we collect during the verification process for the purpose of verifying your identity. If you maintain an account with us, we may use that account to respond to your request and/or verify your identity. If we are unable to verify your identity as required by applicable laws and regulations, we will decline to comply with your request, and let you know why. 

When We Will Respond. We will try to respond to your request for access or deletion within 45 days. If we require additional time, we will inform you of the reason and extension period. Any disclosures we

10

provide will only cover the 12-month period preceding our receipt of your request. For data portability requests, we will select a format to provide your Personal Information to you. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded. 

Authorized Agent. You have a right to submit requests to exercise your rights under the CCPA through an authorized agent. An authorized agent must be registered with the Secretary of State in California to conduct business in California. If you choose to use an authorized agent, you must (a) provide signed permission to that authorized agent to submit requests on your behalf, (b) verify your identity directly with us, and (c) directly confirm that you granted permission to the authorized agent to submit the request on your behalf. For clarity, you are required to verify the identity of both yourself and the authorized agent. 

We may deny a request from an authorized agent if we do not have proof that they are authorized by you to act on your behalf. 

Non-Discrimination. California residents have the right to not receive discriminatory treatment for exercising any of their rights under the CCPA. 

California Shine the Light. Pursuant to California Civil Code Section 1798.83, if you are a California resident, you have the right to obtain: (a) a list of all third parties to whom we may have disclosed your Personal Information within the past year for direct marketing purposes, and (b) a description of the categories of Personal Information disclosed, by contacting us via our Data Privacy Manager as set forth above.

Do Not Track. We do not respond to Do Not Track requests.

12. CHANGES TO THE PRIVACY POLICY AND YOUR DUTY TO INFORM US OF CHANGES This version was last updated on November 1, 2020.

We may modify this Privacy Policy at any time. All changes will be effective immediately upon posting to the websites. 

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

13. CONTACT DETAILS

Hello Nature is a controller under the General Data Protection Regulation and has appointed a data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. 

If you have any questions about this Privacy Policy, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

Full name of legal entity: Hello Nature USA.

Email address: DataPrivacyManager@hello-nature.com

Postal address: 1800 Purdue Parkway, Anderson, IN (USA)

If you do not receive satisfactory resolution from us of your data protection concern, and you are a European Economic Area resident, you also have the right to make a complaint at any time to supervisory authority for data protection issues for the country of your residence.