Appendix A

Privacy Information for California Residents

Effective Date: August 21, 2020

This Appendix A relates to the Prolitec Aera System and Services ("Appendix") and describes information that Prolitec, Inc. and its subsidiaries and affiliates (collectively, "Prolitec") collect related to California residents. This Appendix applies solely to individuals who reside in the State of California (“consumers” or “you”). This Appendix complies with the California Consumer Privacy Act of 2018 (“CCPA”) and any terms defined in the CCPA have the same meaning when used in this Appendix. This Appendix does not apply to personal information outside the scope of the CCPA.

1. What Personal Information We Collect and How We Share it
The below chart lists the categories of personal information that we may collect and have collected in the past 12 months and how we share such information. We will also share information with others when you direct us to. For example, we will share information with additional users you authorize to access your account or when you sign up for programs with our partners.

Categories of Personal Information	Categories of Services Providers and Third Parties with whom Personal Information is Shared
Identity Data includes first name, maiden name, last name, username or similar identifier, title, date of birth, age, and gender.	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; ad networks; data analytics providers; prospective purchasers of our business; outside auditors, insurers, and lawyers; and social networks.
Contact Data includes home, billing, and shopping addresses, email address and telephone numbers.	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; ad networks; data analytics providers; prospective purchasers of our business; outside auditors and lawyers; and social networks.
Financial Data includes bank account (and routing number, if required) and payment card details, including the name on a credit card, the expiration date, the credit card number, the cvv number, associated address, and card provider.	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; prospective purchasers of our business; and outside auditors and lawyers.
Transaction Data includes details about the products and services you have purchased from us, including the order number, time of order, model, serial number or part number, quantity, price, shipping & handling, tax, and order management and other fees or charges, whether and what type of warranty applies to the product, the length of time since your purchase, the help topic that you select and any details that you provide about the circumstances of your request when requesting a repair, return, warranty service, or other customer service, and the date and time of our communications with you regarding such requests.	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; prospective purchasers of our business; and outside auditors, insurers, and lawyers.
Technical Data includes internet protocol (IP) address, geolocation data, your login data, browser type and version, mobile device type and operating system, unique mobile device identifier, time zone setting and location, browser plug-in types and versions, operating system and platform, and other technology on the devices you use to access the services we provide.	Service providers; our affiliates; ad networks; data analytics providers; prospective purchasers of our business; and social networks.
Profile Data includes your Aera® username and password, your profile photo, the location of an Aera device, your zip code, your interests, preferences, and feedback and survey responses.	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; and prospective purchasers of our business.
Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties, your communication preferences, information you submit to us, your communications with us, and inferences we make about you.	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; ad networks; data analytics providers; prospective purchasers of our business; lawyers; and social networks.
Aera Data includes data about the fragrance capsules used in the device (including volume, serial number, output, and other technical details), data about fragrance consumption, technical information about and from the device (including the model and serial number, software version, IP address, and Wi-Fi network name), and direct adjustments to the device (including changes to settings, so that an Aera algorithm can work to determine the scent intensity levels you prefer in different rooms and situations).	Entities that we are required to share with pursuant to law or for legal proceedings; service providers; our affiliates; prospective purchasers of our business; and lawyers.

2. Where We Collect Personal Information From
We may collect personal information from the following sources: you, your agent, our other customers, service providers, ad networks, data analytics providers, our affiliates, social media networks, online third party market places, and our products, such as your Aera system.

3. How We Use Personal Information
We may use personal information in the following ways:

• To provide you with information, products, or services;
• To process customer service requests or warranty information;
• To communicate with you;
• To advertise or market to you;
• To improve our services and products;
• To secure and monitor our websites;
• For consumer research and conducting surveys;
• To administer and protect our business and our services (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data);
• To conduct giveaways or contests; or
• For our own legal obligations.

4. Sale of Personal Information
CCPA defines a “sale” of personal information broadly to include more than exchanges for monetary purposes. A sale can include personal information shared with a third party for “valuable consideration,” or information shared with a third party (even if they are performing services on our behalf) if they are permitted to use the information for their own purposes. In the past 12 months, we have sold the following categories of personal information: Identity Data and Contact Data. We sell your personal information to the following categories of third parties: social media networks and ad networks.

5. Personal Information Sales Opt-Out
California residents over the age of sixteen (16) have the right to direct us to not sell their personal information (the “right to opt out”). To exercise the right to opt out, you (or your authorized representative) may submit a request to us at: Do Not Sell My Personal Information. You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.

6. California Residents’ Rights and Choices
The CCPA provides California residents with specific rights regarding their personal information, described below. Below are your CCPA rights and how to exercise those rights.
a. Access to Specific Information and Data Portability Rights You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. You could request:

• The categories of personal information we collected about you;
• The categories of sources of the personal information we collected about you;
• Our business or commercial purpose for collecting that personal information;
• The categories of third parties with whom we share that personal information; or
• The specific pieces of personal information we collected about you.
• Complete the Information Access Request Form

b. Deletion Request Rights You have the right to request that we delete some or all of the personal information that we have collected from you and retained, subject to a number of exceptions. We are not required to delete personal information that is: (a) necessary to complete a transaction with you or for warranty or product recalls; (b) used for security purposes, to prevent fraud, to fix errors, or to comply with law; (c) reasonable for us to use for internal purposes given our relationship with you; or (d) compatible with the context in which you provided the information. The list of exceptions above is not exhaustive, and we may also deny a deletion request as otherwise permitted by law. c. Exercising Your Rights To exercise your rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 1-844-588-2372; or
• Emailing us at privacy@prolitec.com.
• Completing the Deletion Request Form

Only you, or a person or entity that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. If you are making a request on behalf of another person, you must provide written legal documentation that you are authorized to act on behalf of that individual. You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may not be able to fulfill your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. To verify your identity, we may request up to up to three pieces of personal information about you, and we reserve the right to take additional steps as necessary to verify your identity if we have reason to believe a request is fraudulent. d. Response Timing and Format We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosures we provide will only cover the 12-month period preceding the date we receive your verifiable consumer request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. e. Non-Discrimination You have the right to not be discriminated against for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services;
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;
• Provide you a different level or quality of goods or services; or
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

7. Other California Privacy Rights
California's "Shine the Light" law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please contact us through the information provided below.

8. Changes to this Appendix
We reserve the right to amend this Appendix at our discretion and at any time. When we make changes to this Appendix, we will post the updated notice on our website and update the effective date on this Appendix. Your continued use of our website, products, or services following the posting of changes constitutes your acceptance of such changes.

9. Contact Information
If you have any questions or comments about this Appendix the ways in which we collect and use your information, your choices and rights regarding such use, or if you wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 1-844-588-2372
Email: privacy@prolitec.com
Postal Address: 1235 W Canal St.
Milwaukee, WI 53233 United States