Last Updated: January 1, 2023 This section applies only to California residents and does not apply to personal information collected about Thorntons personnel, job applicants or business partners. This section uses certain terms that have the meanings given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations (collectively, the “CCPA”). For more information about the personal information we collect and how we collect it, please refer to sections 1 and 2 above.

1. 1. Personal information categories collected. We may collect (and may have collected during the 12-month period prior to the Last Updated date of this section 9) the following categories of personal information when you use our Services:
      • identifiers such as a name, postal address, date of birth, unique personal identifier, online identifier, email, account name, phone number, your device’s IP address, software, and identification numbers associated with your devices;
      • commercial information such as records of products or services purchased, obtained, or considered by you;
      • online activity, such as internet or other electronic information regarding your browsing history, search history, the webpage visited before you came to our Site, length of visit and number of page views, click-stream data, locale preferences, your mobile carrier, date and time stamps associated with transactions, and system configuration information;
      • your geolocation, to the extent you have configured your device to permit us to collect such information;
      • sensory information, such as audio recordings of your voice to the extent you call us, as permitted under applicable law; and
      • inferences about your preferences, characteristics, behavior and attitudes.

1. 2. Purposes for processing personal information. We may use (and may have used during the 12-month period prior to the Last Updated date of this section 9) your personal information for the purposes described in section 3 and for the following business purposes:
      • Performing services, maintaining or servicing accounts, providing customer service and verifying customer information;
      • Providing advertising and marketing services;
      • Auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance;
      • Short-term, transient use, such as nonpersonalized advertising shown as part of your current interaction with us;
      • Helping to ensure security and integrity;
      • Undertaking activities to verify or maintain the quality or safety of our services or devices and to improve, upgrade, or enhance them;
      • Debugging to identify and repair errors; and
      • Undertaking internal research for technological development and demonstration.
      • To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless

 

1. 3. Retention of Personal Information. We will retain your personal information in accordance with section 6 above, but in no case longer than the time period reasonably necessary to achieve the purposes described in section 3 and section 9(b), or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.

1. 4. Sources of Personal Information. We may obtain your personal information from the following sources:

• • • Directly from you, such as when you register for the Thorntons App or Site, when you contact us at by email, when you call us, when you use any of our social media channels
    • Your devices, such as when you use our Services
    • Our affiliates and subsidiaries
    • Service providers, contractors and other vendors who provide services on our behalf
    • Online advertising services
    • Data analytics providers
    • Operating systems and platforms
    • Social networks

1. 5. Sale or Sharing of Personal Information. We do not sell your personal information in exchange for monetary compensation. We may share your personal information by allowing certain third parties (such as online advertising services and social networks) to collect personal information via automated technologies on our Services for social networking and cross-context behavioral advertising purposes. This kind of sharing may be considered a “sale” under California law when the personal information is exchanged for non-monetary consideration. You have the right to opt out of these types of disclosures of your information.

We may sell or share for cross-context behavioral advertising purposes (and may have sold or shared during the 12-month period prior to the Last Updated date of this section 9), the following categories of personal information about you to online advertising services and social networks:

1. 5. • Identifiers
      • Commercial information
      • Online activity
      • Inferences

You have the right to opt-out of this disclosure of your information, as detailed below. We do not have actual knowledge that we sell or share the personal information of minors under 16 years of age.

1. 6. Disclosure of Personal Information. During the 12-month period prior to the Last Updated date of this section 9, we may have disclosed the following categories of personal information about you for a business purpose to the following categories of third parties:

Categories of Personal Information	Categories of Third Parties
Identifiers	Our affiliates and subsidiaries Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks Social networks
Commercial Information	Our affiliates and subsidiaries Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks
Online Activity	Our affiliates and subsidiaries Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks
Geolocation Data	Our affiliates and subsidiaries Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks
Sensory Information	Our affiliates and subsidiaries Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms
Inferences	Our affiliates and subsidiaries Vendors who provide services on our behalf Professional services organizations, such as auditors and law firms Data analytics providers Internet service providers Operating systems and platforms Online advertising services and advertising networks Co-sponsors of contests, sweepstakes, or other promotions

1. 7. California Consumer Privacy Rights. You have certain choices regarding your Personal Information, as described below personal information.
      • Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal information we have collected, used, disclosed, and sold or shared about you.
      • Correction: You have the right to request that we correct the personal information we maintain about you, if that information is inaccurate.
      • Deletion: You have the right to request that we delete certain personal information we have collected from you.
      • Opt-Out of Sale or Sharing: You have the right to opt-out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising purposes.
      • Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties.

How to Submit a Request. To submit an access, correction or deletion request please contact us by phone at 1-866-473-0017or by email guestservices@mythorntons.com. To opt out of the sale or sharing of your Personal Information, click here. To submit a request as an authorized agent on behalf of a consumer, please guestservices@mythorntons.com with the subject line Authorized Agent Request”. To submit a Shine the Light request, please contact us at guestservices@mythorntons.com.  In your request, please specify that you want a “California Privacy Rights Notice.” Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your deletion or correction request. If you have an online account with us, we may verify your identity by requiring you to sign into your account. If you do not have an online account with us and you request access to, correction of or deletion of your personal information, we may require you to authenticate your email address on record with us or to provide information about your transactions or prior interactions with us.  In addition, if you ask us to provide you with specific pieces of Personal Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us. To the extent permitted by applicable law, we may charge a reasonable fee to comply with your request. Notice of Financial Incentive: The Site and App offer users certain loyalty promotions and benefits in connection with their disclosure of personal information to Thorntons. To participate in our loyalty program, or other offerings contained in the Services, we require your first and last name, email, phone number, date of birth, and zip code.  We also collect the personal information mentioned in Sections 1 and 9(a) above in connection with your participation in the Services. Subject to certain restrictions, we offer users who create an account and who participate in the Refreshing Rewards program, the opportunity to be eligible for certain loyalty benefits, discounts, promotions, and giveaways.  These offers include 3 cents to 25 cents off each gallon of fuel as well as convenience store food and drink discounts and giveaways.  For more information on the terms of the Services, please click here. To participate in the Services, you must first consent to the Refreshing Rewards Terms and Conditions and create an account on the App or Site.  You may withdraw from the Program at any time by accessing the deletion option in the App or by emailing us at guestservices@mythorntons.com. Because the Services offer loyalty benefits, discounts, promotions, and giveaways in exchange for the collection, retention, and the potential sale and sharing of the personal information required for your participation in the Services, they may be interpreted as a “financial incentive” program under California law.  The loyalty benefits, discounts, promotions, and giveaways offered in connection with the Services are reasonably related to our good faith estimate of the value provided to Thorntons by your personal information. We estimate that the value to Thorntons of the personal information you provided to facilitate participation in the Services is reasonably related to the financial incentives less the expenses related to offering these financial incentives.