California Privacy Rights Policy

This California Privacy Rights Policy ("California Policy") supplements the FloraFlex Privacy Policy and applies only to residents of the State of California. It is provided by Cresthaven Agricultural Corp. ("Cresthaven," "we," "our," or "us"), which operates www.floraflex.com and related online services, in accordance with the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (together, the "CCPA"), and other applicable California law.

Terms defined in the CCPA have the same meaning when used in this California Policy. If there is a conflict between this California Policy and the Privacy Policy for California residents, this California Policy controls.

1. Personal Information We Collect

In the preceding twelve (12) months, we have collected the following categories of personal information. We do not collect every category about every person; what we collect depends on how you interact with us.

Category	Examples	Collected
Identifiers	Name, postal address, email address, telephone number, account username, IP address, online identifiers	Yes
Customer records (Cal. Civ. Code § 1798.80(e))	Name, business name, billing and shipping address, telephone number, payment or invoicing details	Yes
Protected classification characteristics	Age, gender, or similar characteristics	No
Commercial information	Products requested, quoted, or purchased; order and account history	Yes
Biometric information	Fingerprints, faceprints, voiceprints	No
Internet or other electronic network activity	Pages viewed, referring site, device type, interactions with the Site, error logs	Yes
Geolocation data	Approximate location derived from IP address or a ZIP code you provide	Yes (approximate only)
Sensory data	Recordings of customer-service calls or live chat transcripts	Yes (chat transcripts)
Professional or employment-related information	Business name, job title, reseller or wholesale application details	Yes
Education information	Non-public education records	No
Inferences	Preferences or interests drawn from the information above	Limited
Sensitive personal information	Account login credentials (username and password)	Yes, only to provide account access

2. Sources of Personal Information

We collect personal information from the following categories of sources:

• directly from you, for example when you create an account, request a quote, apply for a wholesale or reseller account, place an order, start a live chat, or contact us;
• automatically from your browser or device when you use the Site;
• from our distributors, resellers, and business partners in connection with orders or product inquiries; and
• from service providers that help us operate the Site and our business, and from publicly available business sources.

3. Purposes for Collecting and Using Personal Information

We use personal information for the business and commercial purposes described in the Privacy Policy, including to:

• provide, operate, and secure the Site and customer accounts;
• respond to inquiries, prepare quotes, and process, ship, and support orders;
• review wholesale, distributor, and reseller applications;
• communicate with you about your account, orders, and, where permitted, our products;
• detect and prevent fraud, abuse, and security incidents;
• debug, maintain, and improve the Site and our services;
• comply with legal, tax, accounting, and regulatory obligations; and
• exercise or defend legal claims.

We use sensitive personal information only for purposes permitted under the CCPA, such as providing the services you request and maintaining security. We do not use or disclose sensitive personal information to infer characteristics about you.

4. Disclosure of Personal Information

In the preceding twelve (12) months, we have disclosed each collected category of personal information for business purposes to the following categories of recipients:

• service providers and contractors, such as hosting, database, email delivery, security, payment, accounting, freight, and customer-support providers;
• distributors and resellers, where needed to fulfill or route your order or inquiry;
• professional advisors, such as accountants, auditors, and lawyers; and
• government authorities or other parties where required by law or to protect our rights.

5. Sale or Sharing of Personal Information

We do not sell personal information, and we do not share personal information for cross-context behavioral advertising. We have not done so in the preceding twelve (12) months. We do not knowingly sell or share the personal information of consumers under sixteen (16) years of age.

If our practices change, we will update this California Policy and provide a "Do Not Sell or Share My Personal Information" choice before any sale or sharing occurs. You may already record that preference through Your Privacy Choices, and we honor Global Privacy Control signals as described below.

6. Retention

We keep each category of personal information only as long as reasonably necessary for the purposes described above. In general:

• account and customer records are kept while your account is active and afterward for as long as needed for tax, accounting, warranty, and legal purposes;
• order, invoice, and transaction records are kept for the periods required by tax and accounting law;
• inquiry, quote, and live chat records are kept for as long as reasonably needed to respond and follow up, and then deleted or de-identified; and
• Site activity and security logs are kept for limited periods for security and troubleshooting.

7. Your California Privacy Rights

Subject to certain exceptions, California residents have the right to:

• Know and access the categories and specific pieces of personal information we have collected about you, the categories of sources, the purposes for collection, and the categories of third parties to whom we disclose it;
• Delete personal information we have collected from you;
• Correct inaccurate personal information we maintain about you;
• Opt out of the sale or sharing of personal information (we do not currently sell or share);
• Limit the use and disclosure of sensitive personal information to permitted purposes (we already limit our use as described above); and
• Not be discriminated or retaliated against for exercising any of these rights.

8. How to Submit a Request

You may submit a request to know, delete, or correct through Your Privacy Choices, or by contacting us at:

Email: accounting@cresthavenag.com

Mail:
Cresthaven Agricultural Corp.
Attn: Privacy
7901 4th St N, Suite 300
St. Petersburg, Florida 33702
United States

Verification. To protect your information, we will verify your identity before completing a request to know, delete, or correct. We will ask you to provide information that matches what we already have, such as your name, email address, and recent order or account details. If you have an account, we may ask you to sign in.

Authorized agents. You may use an authorized agent to submit a request on your behalf. We may require the agent to provide signed written permission from you and may ask you to verify your identity directly with us, unless the agent holds a valid power of attorney under California Probate Code sections 4121 to 4130.

Response timing. We will confirm receipt within ten (10) business days and respond within forty-five (45) calendar days. If we need more time, we may extend the response period by up to another forty-five (45) days and will tell you why.

9. Opt-Out Preference Signals

We treat a qualifying browser signal such as Global Privacy Control (GPC) as a valid request to opt out of the sale or sharing of personal information for that browser or device. You do not need to take any further action for the signal to apply.

10. Shine the Light

California Civil Code section 1798.83 permits California residents to request information about the disclosure of certain personal information to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their own direct-marketing purposes. Questions may be sent to the contact details below.

11. Minors

The Site is intended for businesses and adults and is not directed to children under sixteen (16). We do not knowingly collect personal information from children under sixteen (16).

12. Accessibility

This California Policy is available in alternative formats on request. Please contact us using the details below. See also our Accessibility Statement.

13. Changes to This California Policy

We review and update this California Policy at least once every twelve (12) months and whenever our practices change. The Effective Date above identifies the most recent version.

14. Contact

For questions about this California Policy or your rights, contact:

accounting@cresthavenag.com

Cresthaven Agricultural Corp.
7901 4th St N, Suite 300
St. Petersburg, Florida 33702
United States