ABOUT BRANDS SOCIAL RESPONSIBILITY CONTACT CAREERS SHOP DIVERSITY & INCLUSION PRIVACY POLICY 1. OUR COMMITMENT TO PERSONAL PRIVACY This Policy reflects American Licorice Company’s commitment to protecting information we learn from each visitor to a company owned or operated general audience web site or other online services in which the company participates. American Licorice Company owned and operated web sites include www.americanlicorice.com and https://shop.amerlic.com. American Licorice Company participates in online services such as social media platforms, including: Facebook: https://www.facebookcom/RedVines Pinterest: http://pinterest.com/redvinescandy/ Twitter: http://twitter.com/RedVines Instagram: https://www.instagram.com/redvinescandy The above list of company web sites and online services is not intended to be an exhaustive list and may change from time to time. Please review the privacy policies linked to each web site, social media platform and online activity you may visit or participate. BY USING A COMPANY OWNED OR OPERATED WEB SITE OR ONLINE SERVICE, YOU CONSENT TO THE MANNER AND PURPOSE OF COLLECTION AND PROCESSING OF YOUR PERSONAL INFORMATION, AS DESCRIBED IN THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THE TERMS OF THIS PRIVACY POLICY, PLEASE DO NOT PROCEED TO USE A COMPANY OWNED OR OPERATED WEB SITE OR ONLINE SERVICE. THANK YOU. 2. CARU COPPA SAFE HARBOR PARTICIPATION This Policy and the CARU icon shown on our websites confirm that American Licorice Company is a valid licensee and participating member in the CARU Safe Harbor Program (“CARU Safe Harbor”). To protect your privacy, we have voluntarily undertaken this privacy initiative. CARU has reviewed and certified that we meet established online information collection and use practices on all American Licorice Companies properties where this privacy policy is posted. As part of the CARU Safe Harbor, we are subject to audits and frequent monitoring of our websites and other enforcement and accountability mechanisms administered independently by CARU. If you believe that we have not responded to your privacy inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at: CARU Safe Harbor Attn: Director 1676 International Drive, Suite 550 McLean, VA 22102 infocaru@bbbnp.org 3. THIS SITE NOT INTENDED FOR USE BY MINORS American Licorice Company does not collect or maintain information from visitors known to be under the age of 13, and no part of our web sites or online services is structured to attract anyone under the age 13. If you have reason to suspect that we have collected personal information from any visitor known to be under the age of 13, please contact us (see Section 23) so that we can review the matter and take appropriate action. 4. PERSONAL INFORMATION: WHAT WE COLLECT, WHEN YOU GIVE IT TO US Personal information collected from a visitor on our websites or online services may include: first and/or last name birth date e-mail address home or mailing address phone numbers credit/debit card information bank account login name password photograph the user ID that you use on a social network or third-party service American Licorice Company will treat any information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a visitor or a visitor’s household, as "Personal Information.” The submission of Personal Information is purely voluntary but may be a necessary step for registering or participating in certain activities and promotions offered or made available. By providing Personal Information, the visitor consents to the collection, pricessing and use of the Personal Information by American Licorice Company, as stated in this privacy policy. 5. AUTOMATIC DATA COLLECTION TECHNOLOGIES (“PERSISTENT IDENTIFIERS”) Our web sites and online services use automatic data collection technologies (“persistent identifiers”) including but not limited to "cookies" and “web beacons” to collect certain information about visitor equipment, browsing actions and website usage. Cookies are small files placed on the hard drive of your computer, which may collect: a customer number, an IP address (a Uniform Resource Locator or “URL”), a processor or device serial number, a unique identifier that might be used to recognize a user’s online activities over time and across different web sites or online services (behavioral tracking), including but not limited the type of operating system and software the visitor is using to browse the Internet, the "URL" (web address) that the visitor visited before and after our site and the visitor's Internet Service Provider; and geolocation data of the visitor which may be sufficient to identify a street name and name of city or town. Web beacons are small, transparent graphic images (such as clear GIFs, pixel tags and single-pixel GIFs) placed on website pages and advertisements for use in combination with cookies to collect website statistics, for example, to count the number of visitors to a page, to determine the popularity of website content, to determine visitor interest in website content, to identify visitors when they return to a website or online service, to store information about visitor preferences, and to verify system and server integrity. Many internet browsers or devices may allow you to block and/or remove cookies, but you may not be able to use some features or participate in some activities or offers if you block cookies. A.THIRD PARTY USE OF AUTOMATIC DATA COLLECTION TECHNOLOGIES Some content, features, advertisements and applications on the company websites or online services are served by or linked to third parties, including advertisers, ad networks and servers, content providers and application providers (including mobile and social media applications). These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about visitors to our websites and online services. The information they collect may be associated with Personal Information (as authorized by a visitor) or they may collect information, including Personal Information (as authorized by the visitor), about your online activities over time and across different websites and other online services. They may use this information to provide visitors with interest-based (behavioral) advertising or other targeted content. We do not control these third parties' tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. B. CALIFORNIA DO-NOT-TRACK DISCLOSURES American Licorice Company uses the information collected through automated data collection technologies (alone or in conjunction with Personal Information) to make the company websites and related online services more useful and more personal to visitors and their individual interests. Therefore, we do not respond to “do not track” requests. Visitors may refuse to accept browser cookies by activating the appropriate setting on the visitor’s Internet browser or by using third party do not track technologies. However, if visitors refuse, disable or delete cookies from our websites or related online services (including mobile applications), certain parts or features of our company websites or online services may be inaccessible or not functional. Unless a visitor has adjusted his or her Internet browser setting so that it will refuse cookies or the visitor uses third party technology to refuse, disable or delete cookies or other automated data collection technologies, your use of American Licorice Company websites or online services constitutes consent to the use of automated data collection technologies in connection with company sites and related online services. 6.USE OF PERSONAL INFORMATION American Licorice Company and its affiliates use Personal Information only to the extent necessary: For internal business purposes, including maintaining business records; For online order fulfillment services; To maintain and improve the performance or functionality of online services; To prevent fraud or harm; To enforce contracts; To communicate to visitors and customers about products, services, customer support, questions and concerns, preferences, events, and special offers and promotions; For registration, notification and publicity of participants and winners in promotions and contests; To comply with valid legal requirements; and/or In connection with business transactions involving the ownership or assets of the Company. American Licorice Company will share Personal Information with affiliates, agents and third-party service providers for the purposes described above. It is the policy of American Licorice Company to require that all affiliates, agents and third-party service providers use Personal Information in accordance with this Privacy Policy and to not further collect, sell or transfer Personal Information except as necessary to perform a business purpose on behalf of American Licorice Company in accordance with this Privacy Policy. Personal Information will not be sold, rented, disclosed, disseminated, made available, transferred or otherwise communicated to another business or third party for monetary consideration or other valuable consideration for advertising and marketing purposes without prior consent or request from the visitor. Personal Information may be complied alone or with other information (“Aggregated Data”). The Aggregated Data does not identify you personally. American Licorice Company may use and share Aggregated Data with its affiliates, agents and business partners for analysis and research to better understand customer preferences, demographics, behavior, and use of the online services. The Aggregated Data may also be used to describe the Company’s business and services to prospective business partners and for other lawful purposes. 7. REVIEW, CORRECTION AND REMOVAL OF PERSONAL INFORMATION A visitor may review, correct and/or delete Personal Information by e-mail request to consumerfeedback@amerlic.com. Visitors may also opt out of receiving communications from us about offers, contests, promotions, activities or new products by advising us by e-mail request to consumerfeedback@amerlic.com or through available opt-out features. If Personal Information is deleted or consent to the use of Personal Information is revoked, a visitor's participation in activities requiring the use of Personal Information may be restricted or terminated. A visitor acknowledges and agrees that even if American Licorice Company receives a request to delete information, American Licorice Reserves the right, alone and with third parties, to maintain Personal Information to the extent necessary to perform a lawful business purposes, including: auditing transactions; performing services on behalf of the business to fulfill contracts with customers; detecting security incidents, and/or protect against malicious, deceptive, fraudulent, or illegal activity, debugging to identify and repair errors that impair existing intended functionality; exercise lawfully protected free speech, comply with the California Electronic Communications Privacy Act or other applicable federal, state, or local laws. conduct scientific, historical, or statistical research, and/or conduct internal business operations. 8. CALIFORNIA PRIVACY RIGHTS: THE “SHINE THE LIGHT” LAW Any visitor who is a resident of California has the right under California’s “Shine the Light” law (Civil Code Section 1798.83) to require American Licorice Company to disclose, upon the visitor’s request, the following information: (1) the types of Personal Information the company shared with third parties for their direct marketing purposes during the immediate preceding calendar year; and (2) the identities of the companies with which the company shared the Personal Information. As set forth in Section 5 of this Privacy Policy, American Licorice Company will not share a visitor’s Personal Information with a third party for its own direct marketing purposes without prior authorization or request from the visitor. California resident visitors should send their requests for information under the Shine the Light law to privacyrequests@amerlic.com with the subject line “Attention Legal Department: Shine the Light Request,” or write us at: Attention Legal Department: Shine the Light Request, American Licorice Company, 1914 Happiness Way, La Porte, Indiana 46350. Please include sufficient contact information for American Licorice Company to contact you in response to your request. 9. CALIFORNIA PRIVACY RIGHTS FOR MINOR USERS: THE “MINOR ERASER” LAW Any visitor who is under the age of 18 has the right under California’s “Minor Eraser” law (California Business and Professions Code 22581) to view, correct, or remove content posted by the visitor as a registered user of the site. A visitor may view, correct or remove content by accessing the registered account using the visitor’s user name and password. A visitor may also send American Licorice Company a request to remove certain posted content at privacyrequests@amerlic.com with the subject line “Attention Legal Department: Minor Eraser Request,” or write us at: Attention Legal Department: Minor Eraser Request, American Licorice Company, 1914 Happiness Way, La Porte, Indiana 46350. Please include enough information to identify the content to be removed and sufficient contact information for American Licorice Company to contact you in response to your request. 10. CALIFORNIA CONSUMER PRIVACY RIGHTS California residents have the right under the California Consumer Privacy Act of 2018 (CCPA) and certain other privacy and data protection laws, as applicable, to exercise free of charge, the following rights: Disclosure of Personal Information We Collect About You –You have the right know: The categories of personal information we have collected about you; The categories of sources from which the personal information is collected; Our business or commercial purpose for collecting or selling personal information; The categories of third parties with whom we share personal information, if any; and The specific pieces of personal information we have collected about you. Please note that we are not required to: Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained; Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information; or Provide the personal information to you more than twice in a 12-month period. Please note that we are required to update the information required to be disclosed under the CCPA at least once every 12 months. Personal Information Sold or Used for a Business Purpose –In connection with any personal information we may sell or disclose to a third party for a business purpose, you have the right to know: The categories of personal information about you that we sold and the categories of third parties to whom the personal information was sold; and The categories of personal information that we disclosed about you for a business purpose. You have the right under the California Consumer Privacy Act of 2018 (CCPA) and certain other privacy and data protection laws, as applicable, to opt-out of the sale (or disclosure) of your personal information. If you exercise your right to opt-out of the sale (or disclosure) of your personal information, we will refrain from selling your personal information, unless you subsequently provide express authorization for the sale of your personal information. To opt-out of the sale or disclosure of your personal information, visit our homepage and click on the Do Not Sell My Personal Information link here: redvines.com. Please note that it is our policy not to sell any Personal Information for any business purpose. Therefore, we have not sold to a third party any personal information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Please note that it is our policy not to disclose any Personal Information for any business purpose except as described in this Privacy Policy. Therefore, in the preceding 12-months, and except as expressly described in this Privacy Policy, we have not disclosed to a third party any personal information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Right to Deletion—Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will: Delete your personal information from our records; and Direct any service providers to delete your personal information from their records. Please note that we may not delete your personal information if it is necessary to: Complete the transaction for which the personal information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between you and us; Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity; Debug to identify and repair errors that impair existing intended functionality; Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law; Comply with the California Electronic Communications Privacy Act; Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of the information is likely to render impossible or seriously impair the achievement of such research, provided we have obtained your informed consent; Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us; Comply with an existing legal obligation; or Otherwise use your personal information, internally, in a lawful manner that is compatible with the context in which you provided the information. Protection Against Discrimination—You have the right to not be discriminated against by us because you exercised any of your rights under the CCPA. This means we cannot, among other things: Deny goods or services to you; Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; Provide a different level or quality of goods or services to you; or Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services. Please note that we may charge a different price or rate or provide a different level or quality of goods and/or services to you, if that difference is reasonably related to the value provided to our business by your personal information. To Exercise Your Rights under the CCPA—If you would like to exercise any of your rights as described in this Privacy Policy, please make a “Data Subject Request” by: Call us, toll-free, at the toll-free phone number provided below under Contact Us; or Write us at the mailing address provided below under Contact Us; or Email using the email address: privacyrequests@amerlic.com. Please note that you may only make a CCPA-related data access or data portability disclosure request twice within a 12-month period. You will need to provide us with: Enough information to identify you (e.g., your full name, address and customer or matter reference number); Proof of your identity and address (e.g., a copy of your driving license or passport and a recent utility or credit card bill); and A description of what right you want to exercise and the information to which your request relates. We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person’s behalf. Any personal information we collect from you to verify your identity in connection with you request will be used solely for the purposes of verification. 11. THIRD PARTY E-COMMERCE SERVICES We may use third party platforms to host our online e-commerce stores that help us sell our merchandise online. Our online e-commerce stores are currently hosted by Shopify, Inc. (“Shopify”). To learn how Shopify treats personal information/data learned through the provision of hosted services, visit Shopify’s Terms of Service and Privacy Statement here. 12. VISITOR COMMENTS, SUBMISSIONS AND POSTINGS Our web sites and the online services in which we participate may allow the ability to post comments, information about yourself and others, and to upload media content (for example. pictures, videos, artwork, etc.). Submissions to American Licorice Company web sites are subject to the posted Terms of Service. Please be aware that any information you post to publicly viewable site and services can be accessed and use by others. We cannot control what others may do with information you voluntarily post, and once you post information you may not be able to edit or delete it. We urge you to use caution when posting any information online. 13. ONLINE SOCIAL MEDIA SERVICE We participate in the use of third-party social media web sites and services such as Facebook, Linkedin, Pinterest, Twitter, and YouTube. The use of such web sites is subject to the Terms of Service of each respective web site or service. In addition, information that you submit through the use of social media sites and services is subject to the privacy policy of each site and service. American Licorice Company has no control or responsibility for the security, privacy or use of information submitted to these sites or services that are unrelated to American Licorice Company activities. You should carefully review the terms and conditions, and privacy policy of any other site or service provider before using their site or service. Any information that we collect through the intermediary use of such sites or services, such as information submitted for contests or prizes, is subject to this Privacy Policy. 14. ACCESS FROM MOBILE DEVICES Visitors using social media sites should be aware that information you submit on such sites may be accessed on mobile phones and other mobile devices that allow information to be synced and saved by friends and others. You should only share important or sensitive information with people you trust because they may be able to save and share it, knowingly or unknowingly, with others you do not intend the information to be shared with. 15. MOBILE DEVICE AND WIRELESS NETWORK SECURITY Mobile devices such as cell phones and other devices using WiFi networks can have financial and other information intercepted during use. It is important to use only encrypted transmissions on secured WiFi networks when transmitting Personal Information. In addition, passwords and other login information should be stored in password protected files in case a mobile device is lost or stolen. 16. DATA SECURITY, INTEGRITY, AND DATA RETENTION American Licorice Company and its affiliates use appropriate physical, electronic, and managerial procedures to safeguard and protect Personal Information from unauthorized access, use, alteration and disclosure. We use Secure Socket Layer (SSL) encryption technology for the transmission of Personal Information. To take advantage of this technology, your browser software must support 128- bit encryption. American Licorice Company will retain your personal information for the period necessary to fulfill the purpose for which it was collected and as outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. American Licorice Company will delete Personal Information that is no longer useful or relevant to the Company’s business operations. You may request removal of Personal Information that you have provided to us by the methods described in this Privacy Policy. American Licorice Company will remove your Personal Information from our database on your request, but this information may remain in our server logs as part of our standard backup procedures, unless prohibited by contract or law. 17. VISITOR'S RESPONSIBILITY Visitors must also take precautions to prevent unauthorized access and use of Personal Information including but not limited to login names and passwords. For example visitors should not disclose or allow others to use their personal passwords or other personal identification information used to access and/or conduct transactions on this site. Visitors are solely responsible for all results (claims, liabilities and damages of any kind) arising from or related to their disclosure of Personal Information to another person or entity, whether the disclosure was intentional or not. Visitors agree not to use anyone else's personal identification information without proper authorization. 18. VISITOR'S RISK AND LIMITATION OF COMPANY'S LIABILITY FOR FAILURE OF SECURITY MEASURES DUE TO THE NATURE OF ELECTRONIC COMMUNICATIONS AND STORAGE, THE COMPANY’S SECURITY MEASURES MAY NOT PREVENT ALL LOSS, MISUSE, THEFT OR ALTERATION OF PERSONAL INFORMATION COLLECTED FROM A SITE OR ONLINE SERVICE. THEREFORE, THE VOLUNTARY SUBMISSION OF PERSONAL IDENTIFICATION INFORMATION VIA THIS SITE IS AT THE VISITOR'S SOLE RISK AND EXCEPT AS PROHIBITED BY LAW, EACH VISITOR AGREES THAT AMERICAN LICORICE COMPANY, IT’S AFFILIATES AND AGENTS SHALL NOT BE LIABLE FOR ANY FAILURE OF SECURITY MEASURES OR FOR ANY UNAUTHORIZED ACCESS, USE, DISTRIBUTION, ALTERATION OR THEFT OF PERSONAL INFORMATION ARISING FROM OR RELATED TO THE SUBMISSION OF PERSONAL INFORMATION VIA A COMPANY SITE OR ONLINE SERVICE. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL AMERICAN LICORICE COMPANY BE LIABLE FOR ANY DIRECT, INDIRECT, SPECIAL, INCIDENTAL, PUNITIVE OR CONSEQUENTIAL DAMAGES ARISING FROM OR RELATED TO ANY FAILURE OF SECURITY MEASURES OR ANY UNAUTHORIZED ACCESS, USE, DISTRIBUTION, ALTERATION OR THEFT OF PERSONAL INFORMATION. EACH VISITOR ACKNOWLEDGES, CONSENTS AND AGREES TO THE EXTENT LEGALLY PERMISSIBLE IN THEIR JURISDICTION TO ALLOW AMERICAN LICORICE COMPANY TO ACCESS, PRESERVE AND OR DISCLOSE THE INFORMATION COLLECTED AND/OR CONTENT PROVIDED TO COMPANY (INCLUDING INFORMATION YOU MAY HAVE POSTED ON BULLETIN BOARDS OR INTERNAL SITE COMMUNICATION SYSTEMS) TO A LAW ENFORCEMENT AGENCY OR OTHER THIRD PARTIES IF REQUIRED TO DO SO BY LAW OR WITH A GOOD FAITH BELIEF THAT SUCH ACCESS, PRESERVATION, OR DISCLOSURE IS REASONABLY NECESSARY TO: (I) COMPANY WITH LEGAL PROCESS; (II) ENFORCE THE TERMS OF SERVICE OF THE RESPECTIVE CHILDREN’S SITES; (III) RESPOND TO CLAIMS THAT THE CONTENT VIOLATES THE RIGHTS OF THIRD PARTIES; (IV) RESPOND TO YOUR REQUESTS FOR CUSTOMER SERVICE OR (V) PROTECT THE RIGHTS, PROPERTY OR PERSONAL SAFETY OF THE OWNERS OF THE WEBSITE, A THIRD PARTY OR THE GENERAL PUBLIC. WE MAY ALSO DISCLOSE USER INFORMATION WHENEVER WE BELIEVE DISCLOSURE IS NECESSARY TO LIMIT OUR LEGAL LIABILITY; TO PROTECT OR DEFEND OUR RIGHTS OR PROPERTY; OR PROTECT THE SAFETY, RIGHTS OR PROPERTY OF ANOTHER. 19. TERMINATION OR SUSPENSION OF ACCESS / PARTICIPATION American Licorice Company reserves the right to suspend or terminate access or participation in any and all transactions, promotions, contests or other activity offered or made available through a company site or online service in the event of a suspected or threatened breach of security or the terms of this Privacy Policy. 20. INTERNATIONAL TRANSFERS OF INFORMATION / DATA If you are visiting an American Licorice Company site or SERVICE from outside of the United States, please be aware that visitor’S Personal Information / DATA will be transferred to, and maintained on, computers located within the United States governed by U.S. laws. By providing Personal Information / DATA, you consent to the collection, use, retention and any other processing of your personal information / data on computers located within the United States and outside the country of your residence or from which you accessed the company website or service. 21. EUROPEAN UNION AND EUROPEAN ECONOMIC AREA - GENERAL DATA PROTECTION REGULATION ("GDPR") COMPLIANCE It is the policy of American Licorice Company to comply with the General Data Protection Regulation (“GDPR”) as applicable and fully enforceable in all European Union (“EU”) Members States and the European Economic Area (“EEA”) Member States, when applicable to American Licorice Company’s activities, alone or jointly with others, to control or process personal information/data of persons located in the EU/EEA (“Data Subjects”). In accordance with the GDPR, controllers and processors of certain personal information/data have a duty to provide Data Subjects with specific information and disclosures concerning how American Licorice Company handles personal data and your data rights. a. Identity of the Controller: American Licorice Company ATTN: Consumer Privacy Request 1914 Happiness Way La Porte, IN 46350 Telephone: 1-800-222-2399 Hours:8 a.m. - 5 p.m. Central Time, Monday through Friday Email: privacyrequest@amerlic.com b. Purposes of the Processing of Personal Information / Data - Your Consent or Agreement Your personal data is collected and processed in accordance with this Privacy Policy. To the extent you provide us with your personal data to enroll in a service or promotion, you expressly consent to our collection, processing and use of your personal data to render the requested services or promotion to you. If we collect personal data from you and indicate that such data is required for a given feature, function or service of the Sites, the basis for processing the personal data is either by your consent or contract. c. Recipients of Categories of Personal Data We provide personal data to our third-party service providers in accordance with this Privacy Policy. Among such third-party service providers are marketplace service providers, web and data storage providers, payment card processors, and marketing services providers. d. Data Transfers Personal Information / Data provided to us resides in the United States. If a transfer of your Personal Information / Data is required to be transmitted to a third country or international organization, the transfer shall be pursuant to appropriate and suitable safeguards, including execution of the Standard Contractual Clauses as approved by the European Commission. e. Retention Schedule for Personal Data We maintain the personal information/data that you provide for the period necessary to fulfill the purposes outlined in this Privacy Policy unless a longer retention period is required or permitted by law. f. Data Rights If you are an EU/EEA Data Subject, you have the following data rights: A right to access the personal data we have for you; A right to rectification of incorrect personal data; A right to erasure of the personal data we have for you; A right to restriction of processing concerning you; A right to object to our processing of your personal data; A right to data portability, that is, a copy of the data we have on you; A right to withdraw consent at any time to our processing of such data subject’s personal data; and A right to lodge a complaint with a supervisory authority. You may exercise your GDPR data rights by contacting us, in writing, by telephone or email at the contact information provided above. We believe that we can resolve any concerns or you may have directly between us; however, under the GDPR you have the right to lodge a complaint with a supervisory authority in the EU or EEA state where you normally reside or work, or where any alleged infringement of your rights have occurred. 22. UPDATES AND MODIFICATIONS American Licorice Company reserves the right to change this Privacy Policy from time to time without prior notice. When we make changes to this Policy, the revised Policy will be posted to each site and we will revise the Effective Date at the top of the page. Please check back here periodically for changes. Your access and use of a company site or online service indicates your acceptance of this Policy. 23. CONTACT US Please address any questions or comments regarding this Privacy Policy or the security practices of American Licorice Company and its business affiliates to: Email: privacyrequest@amerlic.com Mail: American Licorice Company Attn: Consumer Privacy 1914 Happiness Way La Porte, Indiana 46350 Phone: 1-800-222-2399 Hours: 8 a.m. - 5 p.m. Central Time, Monday through Friday. 24. HOW'S OUR DRIVING? CONTACT CARU As mentioned above, American Licorice Company is a participating member of the CARU Safe Harbor Program. If you believe that we have not responded to your privacy inquiry or your inquiry has not been satisfactorily addressed, please contact CARU at: CARU Safe Harbor Attn: Director 1676 International Drive, Suite 550 McLean, VA 22102 infocaru@bbbnp.org ABOUT CSR CONTACT CAREERS BLM DIVERSITY & INCLUSION CALIFORNIA TRANSPARENCY IN SUPPLY CHAIN ACT TERMS AND CONDITIONS PRIVACY POLICY