The following disclosures supplement this Privacy Policy and apply only to consumers of particular jurisdictions (this “Supplemental Notice”). Specifically, this Supplemental Privacy Notice applies only to information collected about consumers in the following jurisdictions: (1) California, (2) Colorado, (3) Connecticut, (4) Nevada, (5) Utah, and (6) Virginia, as well as (7) Israel and (8) Europe. This Supplemental Notice describes our practices regarding the collection, use, and disclosure of Private Information and provides instructions for submitting data subject requests.

To the extent terms used in this Supplemental Notice are defined terms under the applicable US State Privacy Law, they shall have the meanings afforded to them in those statutes, whether or not capitalized herein. As there are some variations between such definitions in each of the state statutes, the definitions applicable to you are those provided in the statute for the state in which you are a consumer. For example, if you are a Virginia consumer, terms used in this Supplemental Notice that are defined terms in the VCDPA shall have the meanings afforded to them in the VCDPA as this Supplemental Notice applies to you.

Supplemental Notice for California Residents. 

This Supplemental Notice for California Residents applies to our processing of Personal Information that is subject to the California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act (“CPRA”), effective as of January 1, 2023 (collectively, the “California Privacy Laws”). The California Privacy Laws provides California residents with the right to know what categories of Personal Information Pattern Brands has collected about them, the right to have Personal Information deleted, the right to opt out of the sale of Personal Information (if applicable), the right to opt in of the sale of Personal Information of consumers under the age of 16 (if applicable), the right to nondiscriminatory treatment for exercising any rights, the right to initiate a private cause of action for data breaches, the right to correct inaccurate Personal Information and the right to limit use and disclosure of sensitive Personal Information.

Disclosure for California Consumers 

Unless specifically stated, we have not sold or shared Personal Information about California consumers to third parties for their own use in the past twelve (12) months. Relatedly, we do not have actual knowledge that we sell or share Personal Information of California consumers under 16 years of age. However, we may share your Personal Information with our affiliates and trusted partners in arrangements that may meet the broad definition of “sale” or “share” under California law. In these arrangements, use of the information we share is limited by policies, contracts, or similar restrictions. That said, we may share information with third-party advertising partners or analytics providers for the purpose of promoting our Services as described above, including for cross-context behavioral advertising. To the extent that such sharing is considered a “sale” under the CCPA, you may opt-out of having your Personal Information shared with such advertising partners or analytics providers by emailing us here: privacy@eko.com. For purposes of California law, a “sale” is the disclosure of Personal Information to a third party for monetary or other valuable consideration, and a “share” is the disclosure of Private Information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration.

Additional Privacy Rights for California Residents

• Right to Access. If you are a California consumer, you have the right to ask us to send you the following information up to two times in a twelve-month period: (i) categories of Personal Information we have collected about you; (ii) categories of sources from which we collected the Personal Information; (iii) our business or commercial purpose for collecting Personal Information; (iv) categories of third parties with whom we share Personal Information; (v) categories of Personal Information we disclose about you for business purposes; (vi) categories of Personal Information we sell or exchange for consideration about you; and (vii) the specific pieces of Personal Information we have collected about you.

• Right to Delete. If you are a California consumer, you have the right to ask us to delete the Personal Information about you we have collected. We may deny the request if the information is necessary to: (i) complete a transaction, including providing a requested or reasonably anticipated good or service, or fulfill a contract between the consumer and Pattern ; (ii) detect and protect against security incidents, malicious, deceptive, fraudulent, or illegal activity, or take against those responsible for such activity; (iii) debug to identify and repair errors impairing intended functionality; (iv) comply with the California Electronic Communications Privacy Act; (v) engage in research in the public interest adhering to applicable ethics and privacy laws where the consumer has provided informed consent; (vi) enable solely internal uses reasonably aligned with the consumer’s expectations based on the consumer’s relationship with Pattern; (vii) comply with a legal obligation; or (viii) otherwise use the information internally in a lawful manner compatible with the context in which the consumer provided the information.

• Right to portability. A consumer has the right to request Personal Information about the consumer be disclosed in a common file format.

• Right to Opt-in or Opt-out of the sale of Personal Information. If a business sells Personal Information to third parties, California consumers have the right, at any time, to opt in or out of the sale or disclosure of their Personal Information to third parties. 

• Right to designate an authorized agent. You have the right to designate an authorized agent to make a request under the CCPA on your behalf. To designate an authorized agent, please contact us. Right to non-discrimination. The CCPA grants California consumers the right not to be discriminated against for exercising your privacy rights. If you exercise your privacy rights, we will not discriminate against you, for example, by denying you access to our shop or charging you different rates or prices for the same Services, unless that difference is reasonably related to the value provided by your data.

California Privacy Rights Act. In addition to the rights provided by the CCPA, California residents are provided with the following rights through the California Privacy Rights Act: (i) the right to request that incorrect or outdated Personal Information be corrected but not deleted; (ii) the right to restrict a business’s ability to process sensitive data about the consumer; and (iii) prohibition against a business making decisions about a consumer based solely on an automated process without human input.

California Shine the Light. The California “Shine the Light” law permits users who are California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their Personal Information (if any) for their direct marketing purposes in the prior calendar year, as well as the type of Personal Information disclosed to those parties.

Disclosure About Direct Marketing for California Residents. California Civil Code § 1798.83 permits California residents to annually request certain information regarding our disclosure of Personal Information to other entities for their direct marketing purposes in the preceding calendar year. We do not distribute your Personal Information to other entities for their own direct marketing purposes.

Supplemental Notice for Colorado Residents. The Colorado Privacy Act provides Colorado residents with the following rights: (i) the right to opt out of the processing of Personal Information concerning the consumer; (ii) the right to confirm whether a business is processing Personal Information concerning the consumer and to access the consumer's Personal Information; (iii) the right to correct inaccurate Personal Information collected from the consumer; (iv) the right to delete Personal Information concerning the consumer; (v) the right to restrict a business’s ability to process Personal Information about the consumer, specifically to opt-out of processing for profiling/targeted advertising purposes; (vi) a prohibition against a business making certain decisions about a consumer based solely on an automated process without human input; and (vii) the right to data portability.  When exercising the right to access Personal Information, a consumer has the right to obtain the Personal Information in a portable, and to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another entity without hindrance. A consumer may exercise this right no more than two times per calendar year. 

Supplemental Notice for Connecticut Residents. The Connecticut Data Privacy Act provides Connecticut residents with the following rights: (i) the right to confirm whether a business is processing Personal Information concerning the consumer and to access the consumer's Personal Information; (ii) the right to request that incorrect or outdated Personal Information be corrected but not deleted; (iii) the right to delete Personal Information concerning the consumer; (iv) the right to restrict a business’s ability to process sensitive data about the consumer- specifically to opt-out of processing for profiling/ targeted advertising purposes; (v) the right to request Personal Information about the consumer be disclosed in a common file format; (vi) the right to opt out of the sale of Personal Information about the consumer to third parties; and (vii) prohibition against a business making certain decisions about a consumer based solely on an automated process without human input.

Supplemental Notice for Nevada Residents. We generally do not disclose or share Personal Information for profit. If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Information to third parties who intend to license or sell that Personal Information. To exercise this right, if applicable, you or your authorized representative may submit a request to privacy@eko.com. If you have any questions, please contact us at privacy@eko.com. We will respond to your verified request as soon as reasonably practicable, but no later than sixty (60) days after receipt. If circumstances cause any delay in our response, you will be promptly notified and provided a date for our response.

Supplemental Notice for Utah Residents. The Utah Consumer Privacy Act provides Utah residents with the following rights: (i) the right to confirm whether a business is processing Personal Information concerning the consumer and to access the consumer's Personal Information; (ii) the right to delete Personal Information concerning the consumer; (iii) the right to restrict a business’s ability to process sensitive data about the consumer- specifically to opt-out of processing for profiling/ targeted advertising purposes; (iv) the right to request Personal Information about the consumer be disclosed in a common file format; and (v) the right to request to opt out of the sale of Personal Information about the consumer to third parties.

Supplemental Notice for Virginia Residents. The Consumer Data Protection Act provides Virginia residents with the following rights: (i) the right to confirm whether or not a controller is processing the consumer's Personal Information and to access such Personal Information; (ii) the right to delete Personal Information provided by or obtained about the consumer; (iii) the right to obtain a copy of the consumer's Personal Information that the consumer previously provided to the business in a portable and, to the extent technically feasible, readily usable format; (iv) the right to opt out of the processing of the Personal Information for purposes of, targeted advertising, the sale of Personal Information, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer; and (v) the right to restrict a business’s ability to process Personal Information about the consumer, specifically to opt-out of processing for profiling/targeted advertising purposes.

Disclosure for Colorado, Virginia, Utah, and Connecticut Consumers: Unless specifically stated, we do not sell or share Personal Information to third parties for their own use. However, we may share or process one or more of the above categories of Personal Information with our affiliates and trusted partners in arrangements for purposes of targeted advertising, as the terms “sell,” “share,” “process,” and “targeted advertising” are defined in the CPA, VCDPA, UCPA, and CTDPA. In these arrangements, use of the information we share is limited by policies, contracts or similar restrictions.

Supplemental Notice for Israeli Residents

These additional disclosures apply only to Israeli residents. By entering, connecting to, accessing or using the services, you consent to the collection, processing, transfer and use of your personal information. You also acknowledge and confirm that you are not legally required to provide us with your personal information and that such information is voluntarily provided to us. 

 If for any reason you wish to delete or modify your personal information, please send us an email with adequate details of your request to: privacy@eko.com, and we will make reasonable efforts to modify or delete any such personal information pursuant to any applicable privacy laws. Note that we may retain your personal information for as long as reasonably required for the purposes of which such personal information was collected or as long as we have a legitimate business purpose to retain it, all as permitted under any applicable privacy laws.

Supplemental Notice for European Residents - These additional disclosures apply only to data subjects in Europe. 

Roles

Data protection laws in Europe distinguish between organizations that process personal data for their own purposes (known as “controllers”) and organizations that process personal data on behalf of other organizations (known as “processors”). eko acts as a controller with respect to personal data collected as you interact with our Services.

Lawful Basis for Processing

• Data protection laws in Europe require a “lawful basis” for processing personal data. Our lawful bases include where: (a) you have given consent to the processing for one or more specific purposes, either to us or to our service providers or business partners; (b) processing is necessary for the performance of a contract with you; (c) processing is necessary for compliance with a legal obligation, such as disclosure of information to authorities where we are obligated to do so; or (d) processing is necessary for the purposes of the legitimate interests pursued by us or a third party, where your interests and fundamental rights and freedoms do not override those interests. 

Data Transfer outside the EEA

• The personal data collected from you by eko, as detailed in this Privacy Policy, may be transferred to, and stored at, servers which may be located in countries outside the European Economic Area (EEA). We apply strict safeguards when transferring it outside of the EEA, which may include the following: 

  • Transferring your personal data to countries approved by the European Commission as having adequate data protection laws, such as Israel;

  • Entering into standard contracts that have been approved by the European Commission and which provide an adequate level of high quality protection, with the recipients of your personal data; and 

  • Transferring your personal data to U.S. organizations that are Privacy Shield certified, as approved by the European Commission.

Your Data Subject Rights

• You have the right to access, rectify, or erase any personal data we have collected about you. You also have the right to data portability and the right to restrict or object to our processing of personal data we have collected about you. In addition, you have the right to ask us not to process your personal data (or provide it to third parties to process) for marketing purposes or purposes materially different than for which it was originally collected or subsequently authorized by you. You may withdraw your consent at any time for any data processing we do based on consent you have provided to us. 

Please note that we retain information as necessary to fulfill the purposes for which it was collected, and may continue to retain and use information even after a data subject request for purposes of our legitimate interests, including as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements. 

If you have any issues with our compliance, you may contact us at privacy@eko.com. You have the right to lodge a complaint with the data protection regulator in your jurisdiction.