Last updated January 9, 2020

This Web site is owned and operated by Diamond Crystal Brands (“Diamond Crystal Brands,” “we,” “us,” and “our”). Your privacy is important to us. This Privacy Policy explains how Diamond Crystal Brands protects your privacy when you visit this Web site and the other Diamond Crystal Brands Web sites that display this Privacy Policy (our “Site(s)”). This Privacy Policy describes what types of information we gather and track when you use our Sites, how this information is used and with whom it is shared. If you have any questions about this Privacy Policy, please write to us at Diamond Crystal Brands, P.O. Box 9177, Savannah, GA 31412.

This Privacy Policy covers the “personal information” we collect through our Sites. “Personal information” is information that identifies you personally, either alone or in combination with other information available to us. Examples of personal information include your name, address, email address, credit card information, and the information you provide when you use one of our Sites to create an account or a personal profile. Your Consent Please take a few minutes to review this Privacy Policy. By accessing or using one of our Sites you are consenting to the collection, use and disclosure of your personal information as set forth in this Privacy Policy. IF YOU DO NOT CONSENT TO THE COLLECTION, USE AND DISCLOSURE OF YOUR PERSONAL INFORMATION AS SET FORTH IN THIS PRIVACY POLICY, PLEASE EXIT AND DO NOT USE THIS SITE. Changes to This Privacy Policy As we add new features and functionality to our Sites, we may need to update or revise this Privacy Policy. We reserve the right to do so, at any time and without prior notice, by posting the revised version on our Sites. These changes will be effective as of the date we post the revised version on our Sites. They will apply only to the personal information we collect after we have posted the revised version. Your use of one of our Sites following any such change constitutes your consent to the terms of the revised Privacy Policy. For this reason, it is important to review this Privacy Policy regularly. If we modify this Privacy Policy, we will provide a notice at the top of this Privacy Policy for at least 30 days after the new effective date. You may access the current version of this Privacy Policy at any time by clicking on the link marked “Privacy Policy” at the bottom of each page of our Sites. For your convenience, we post the effective date of this Privacy Policy at the top of this page, so that you can see at a glance whether this Privacy Policy has changed since your last visit. 2 Privacy Notices This Privacy Policy may be supplemented or amended from time to time by “Privacy Notices” posted on our Sites. Generally, Privacy Notices provide details about the personal information we collect on particular pages or particular areas of a Site, why we need that information, and choices you may have about the ways we use that information. Agreements Governing Your Use of Special Features and Password-Protected Areas of Our Sites Some of our Sites include special features and password-protected areas. For example, you may be able to use our Sites to apply for a job, to share recipes, or to design and email a “gram” to a friend. When you sign up to use a special feature or password-protected area, you may be asked to agree to special terms governing your use of the special feature or password-protected area. In such cases, you will be asked to expressly consent to the special terms, for example, by checking a box or clicking on a button marked “I agree.” This type of agreement is known as a “click-through” agreement. If any of the terms of the click-through agreement are different than the terms of this Privacy Policy, the terms of the click-through agreement will supplement or amend this Privacy Policy, but only with respect to the matters governed by the “click-through agreement.”

What Personal Information Do We Collect Through Our Sites? Information You Provide. We collect the personal information you knowingly provide (using your mouse and keyboard) when you use our Sites. The information we collect depends on how you use our Sites. For example, if you sign up to receive email communications from us, we collect your email address and any related information you provide. If you communicate with us using the “Contact Us” feature, we collect the information you provide when you complete the “Contact Us” form. Supplemental Information. From time to time, we may supplement the information you give us with information from other sources, such as information validating your address or information based on your zip code. We may also supplement the information you give us with information we collect from you through other Diamond C 3 Diamond Crystal Brands Web sites or other channels. Information Sent to Us by Your Web Browser. We collect information that is sent to us automatically by your Web browser. This information typically includes the IP address of your Internet service provider, the name and version of your operating system, the name and version of your browser, the date and time of your visit, and the pages you visit. Please check your browser if you want to learn what information your browser sends or how to change your settings. This information does not identify you personally. Generally, we use this information to improve our Sites and make them more compatible with the technology used by our visitors. In most cases, we do not link the information sent by your browser to information that identifies you personally. We do, however, review our server logs – which contain visitors’ IP addresses — for security purposes, such as detecting intrusions into our network. If we suspect criminal activity, we may share our server logs with the appropriate investigative authorities who could use that information to trace and identify individuals. Cookies and Similar Technologies. We use “cookies” and other Web technologies to collect information and support certain features of our Sites. For example, we may use these technologies to • collect information about the ways visitors use our Sites – which pages they visit, which links they use, and how long they stay on each page; • to manage and determine the effectiveness of our advertising campaigns; • to support the features and functionality of our Sites — for example, to save you the trouble of reentering information already in our database or to prompt the settings you established on previous visits to our Sites; and • to personalize your experience when you use our Sites. Generally, the information we collect using these Web technologies does not identify you personally. If, however, you have created a user identity, for example, by signing up to use a password-protected area on one of our Sites, we may link the information we collect using Web technologies to other information that identifies you personally. If you do not wish to receive cookies, you may set your browser to reject cookies or to alert you when a cookie is placed on your computer. You may also delete our cookies as soon as you leave a Site. Although you are not required to accept our cookies when you visit our Sites, if you set your browser to reject cookies, you will not be able to use all of the features and functionality of our Sites.

How Does Diamond Crystal Brands Use Your Personal Information? Generally. We use the personal information we collect through our Sites • to provide the products, information and services you request; • for security, credit or fraud prevention purposes; • to provide you with effective customer service; • to provide you with a personalized experience when you use our Sites; • to display personalized advertising when you visit our Sites; 4 • to contact you with special offers and other information we believe will be of interest to you (but only with your permission); • to contact you with information and notices related to your use of our Sites; • to invite you to participate in surveys and provide feedback to us; • to better understand your needs and interests; • to improve the content, functionality and usability of our Sites; • to improve our products and services; • to improve our marketing and promotional efforts; and • for any other purpose identified in an applicable Privacy Notice or other agreement between Diamond Crystal Brands and you. How Does Diamond Crystal Brands Share My Personal Information? Service Providers. We share personal information with companies and organizations that perform services on our behalf, for example, companies that provide support services to us (such as credit card processing services, data storage services, and web hosting services) or that help us market our products and services (such as third-party e-mail marketing companies). These third parties are required by contract to use the personal information we share with them only to perform services on our behalf and to treat your personal information as strictly confidential. Within Diamond Crystal Brands. We may share your personal information within Diamond Crystal Brands (that is, among the business divisions within Diamond Crystal Brands) for the purposes and as set forth in this Privacy Policy. For example, we may store the personal information we collect through our Sites in central database used by all of our business units and brands. We will not share your personal information with our affiliates (that is, subsidiaries and other business entities controlled by Diamond Crystal Brands), except as provided in a privacy notice or click-through agreement.

Compliance With Laws and Protection of Our Rights and the Rights of Others. We may disclose personal information when we, in good faith, believe disclosure is appropriate to comply with the law, a court order or a subpoena. We may also disclose personal information to prevent or investigate a possible crime, such as fraud or identity theft; to enforce or apply our online Terms of Use or other agreements; or to protect our own rights or property or the rights, property or safety of our users or others. As Described in a Privacy Notice. We reserve the right to disclose your personal information as described in any Privacy Notice posted on the Web page (or area) where you provide that information. By providing your personal information on that Web page you will be consenting to the disclosure of your personal information as described in that Privacy Notice. As Described in a Click-Through Agreement. We reserve the right to disclose your personal information as described in any click-through agreement to which you have agreed. Your Choices In General 5 We respect your right to make choices about the ways we collect, use and disclose your personal information. In most cases, we will ask you to indicate your choices at the time we collect your personal information. We will also include an “opt-out” link in newsletter or promotional email we send you so that you can inform us that you do not wish to receive such communications from us in the future. If you have created an account or a personal profile on one of our Sites, you may be able to update some or all of your privacy choices by changing the settings on your account settings or profile page. Direct Marketing Before we use your personal information for direct marketing purposes (or permit our affiliates to do so), we will offer you the opportunity to choose whether to have your information used in this way. If at any time you wish to be taken off our direct marketing mailing lists, please send us an email at webinquirymarketing@www.dcbrands.com or write to us at Diamond Crystal Brands, P.O. Box 9177, Savannah, GA 31412. Please provide your full name, address and email address so that we can find you on our mailing lists. Once we have the information we need, we will remove you from our mailing lists. Please give us a reasonable amount of time to honor your request. How Does Diamond Crystal Brands Protect Personal Information? We take reasonable precautions to provide a level of security appropriate to the sensitivity of the personal information we collect. Although we use reasonable measures to help protect your personal information against unauthorized use or disclosure, we cannot guarantee the security of information provided over the Internet or stored in our databases. Links to Third-Party Web Sites This Site may also contain links to Web sites operated by other companies, including websites operated by our third-party service providers, our affiliates, and other third parties. This Privacy Policy does not apply to personal information collected on any of these third-party Web sites. When you access third-party Web sites through a link on this Site, please take a few minutes to review privacy policy posted on that site. Use of Cookies, Web Beacons and Similar Technologies by Third Parties Marketing Consultants. Our marketing consultants may use Web beacons, cookies and other Web technologies to collect information about visitors to our Sites. For example, our consultants may count how many visitors access our Sites, what links they use, and what pages they view. They may also track which Web sites and advertisements refer traffic to our Sites and the URLs of the sites to which our Sites refer traffic (that is, the Web sites on which our visitors land when they leave our Sites). Our consultants use this information to compile statistics and prepare reports that provide the feedback and analysis we need to understand the needs and interests of our visitors, improve the content, functionality and usability of our Sites, and improve the effectiveness of our advertising and marketing efforts. The information our consultants collect does not identify you personally. Children Our Sites are not directed nor targeted to children under the age of 13. We do not use our Sites to knowingly solicit data from or market to children under the age of 13. If you are under the 6 age of 13, do not provide us with any personal information. If we learn that someone under 13 has provided personally identifiable information through one of our Sites, we will use reasonable efforts to remove such information from our databases. Questions Concerning Our Privacy Practices If you have questions about this Privacy Policy or our privacy practices: •Send an email to webinquirymarketing@www.dcbrands.com and write “Privacy” in the subject line Write to us at Diamond Crystal Brands P.O. Box 9177 Savannah, GA 31412 Attention: Legal Department/Privacy

California Privacy Rights

The California Consumer Privacy Act (“CCPA”) provides consumers (California residents) with specific rights regarding their personal information. This section describes your CCPA rights and explains how to exercise those rights.

Access to Specific Information

You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• The specific pieces of personal information we collected about you.
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
• sales, identifying the personal information categories that each category of recipient purchased; and
• disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

Deletion Request Rights

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. One of these exceptions is data collected for employment purposes only, including but not limited data that collected during the employment application process. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another consumer to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).
6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.
7. Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us.
8. Comply with a legal obligation.
9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it; including but not limited data that collected during the employment application process.

Exercising Access and Deletion Rights

To exercise the access and deletion rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 800-654-5115.
• Visiting us at www.dcbrands.com/contact.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information. You may only make a verifiable consumer request for access or deletion once within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your password protected account sufficiently verified when the request relates to personal information associated with that specific account. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request. You do not need to create an account with us to exercise your opt-out rights. We will only use personal information provided in an opt-out request to review and comply with the request.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.
• However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. • Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

Other California Privacy Rights

California Civil Code Section § 1798.83 permits users of our Website that are California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please write us at Diamond Crystal Brands, P.O. Box 9177, Savannah, GA 31412, Attention: Legal Department/Privacy.

Contact Information

If you have any questions or comments about the ways in which we collect and use your information described in the Privacy Policy, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Phone: 800-654-5115
Website: www.dcbrands.com/contact
Email: info@dcbrands.com
Postal Address:
Diamond Crystal Brands
P.O. Box 9177
Savannah, GA 31412
Attention: Legal Department/Privacy