Last Updated: August 7, 2026

Notice at Collection: Dutchie collects the categories of personal information listed in the below Privacy Policy, including the information that you are providing in a fillable field referencing this Privacy Policy. We collect this information to fulfill the purpose for which you are providing the personal information, to provide the Services, to communicate with you (including with information about products or services that may be relevant to you), or as otherwise necessary or appropriate in connection with the fulfillment of Dutchie's legitimate business purposes, and by submitting your personal information you agree to the processing of your information in this manner. To learn more, including how to exercise any rights that may be available to you, please review the below Privacy Policy.

Welcome to Dutchie!

This Privacy Policy explains how Courier Plus, Inc. and its affiliates (collectively, "Dutchie") collects, processes, uses and discloses your Personal Information as part of providing certain products and services developed and/or commercialized by Dutchie, including, without limitation, our point of sale systems, eCommerce offerings, mobile applications, self-service kiosks, in-store customer-facing devices, cashless payment offerings, AI-powered features (including conversational AI agents, voice-based AI assistants, personalized product recommendation engines, and sentiment analysis tools), Brand-facing software, hardware, APIs, developer accounts, Customer accounts created in connection with our eCommerce and cashless payment offerings, and the websites maintained by Dutchie (collectively, the "Services").

• Dispensaries: Dispensaries are cannabis retailers that have contracted with Dutchie for use of Dutchie's Services or have expressed an interest in using Dutchie's Services.

• Dispensary Employees: Dispensary Employees are employees of Dispensaries.

• Customers: Customers are actual or prospective customers of Dispensaries, including their primary caregivers, as applicable.

• Website Visitors: Website Visitors are individuals that visit our websites.

• Business Partners: Business Partners are third-party business partners of Dutchie, including, for example, third-party integration partners.

• Brands: Brands are cannabis product manufacturers, cultivators, or distributors that have contracted with Dutchie for use of Dutchie's Services, or have expressed an interest in using such products.

Dutchie plays two roles with respect to Personal Information depending on the context of the interaction. In most cases, when a Customer interacts with a Dispensary through the Services (for example, by browsing a Dispensary’s menu, placing a reservation, or interacting with AI-powered features on a Dispensary’s menu or phone line), Dutchie processes Personal Information on behalf of and at the direction of the Dispensary. In these cases, the Dispensary is responsible for addressing any privacy requests from their Customers and other applicable data subjects, and you should review the Dispensary’s privacy policy and contact them directly with any questions. In certain other instances, Dutchie processes Personal Information as a controller for its own purposes, such as when a prospective Dispensary customer submits their Personal Information to Dutchie in order to schedule a demo of the Services, when a Customer signs up for Pay by Bank, and when Dutchie conducts its own marketing or analytics activities.

Dutchie interacts with data subjects across North America, and certain areas in which we operate have laws requiring us to share specific information and provide certain rights to individuals in those locations. Accordingly, this Privacy Policy is structured as a generally applicable Privacy Policy with location-specific schedules. To the extent that you are a data subject within one of these locations, please refer to this Privacy Policy, as well as the location-specific schedule applicable to you.

Before using the Service or submitting any Personal Information to Dutchie, please review this Privacy Policy carefully and contact us if you have any questions. By using the Service, you agree to the practices and specifically the collection, processing, disclosure, use and retention of Personal Information described in this Privacy Policy. If you do not agree to this Privacy Policy, please do not access our website or otherwise use the Services.

• Personal Information We Collect

• How We Use Personal Information

• Sharing And Disclosure of Personal Information

• Children

• Links To Other Websites

• Security

• Your Choices

• Changes To the Privacy Policy

• Contact Us

• Schedule A – Users in California

• Schedule B – Users in Certain Other U.S. States

• Schedule C – Users in Canada

1. Personal Information You Provide.

When you interact with us through the Service, we collect and combine information and data from you, including information that may identify you or otherwise be considered to be "personal information", "personal data" or "personally identifiable information" under applicable laws that regulate privacy and data protection ("Personal Information") as follows:

Personal Information You Provide: We collect the following categories of Personal Information from you when you visit our website, sign up for and use the Services, place a reservation through the Services, complete a purchase through the Services, engage with us, or otherwise provide such information to us, provided that the actual Personal Information collected will depend upon the nature of your interaction:

• Identification Information: We may collect certain Personal Information including, without limitation, your name, email address, phone number, mailing/billing addresses, date of birth, and government identification documents (e.g., your driver's license, state or provincial identification card, or cannabis medical or license card).

• Service-Specific Information: To the extent that a Dispensary signs up for our cashless payments Services, we may collect certain Personal Information in order to underwrite and/or allow our third-party payment processing partners to underwrite the Dispensary, including, without limitation, the name, address, date of birth, Social Security number, email address, phone number, and government-issued identification of the Dispensary's beneficial owners in order to allow us or our third-party Business Partners to underwrite your use of cashless payments and to fulfill continuing KYC/AML obligations while you use the Services.

• Voice and Audio Information: If you interact with our voice-based AI features, we collect recordings of your calls and transcripts generated from those recordings. When you interact with a voice-based AI feature on a Dispensary’s menu or through a Dispensary’s phone line, we collect this information on behalf of that Dispensary. When you interact with a voice-based AI feature in connection with Dutchie’s own customer support operations or otherwise interact with us through a telephone or video call that is recorded, we collect this information as a controller for our own purposes. We use this information to provide the service, improve quality and accuracy, and, in de-identified or aggregated form, to train and improve our AI models. You will be notified that the call is being recorded. To the extent that sensitive personal information is incidentally provided during a recorded interaction, it is processed solely for the purpose of providing the applicable service and is not used for any other purpose. We do not use voice recordings for biometric identification purposes.

• Conversational Interaction Data: When you interact with our AI-powered features, we collect the content of your queries, messages, and conversational inputs, including product inquiries, descriptions of desired effects, stated preferences regarding product types or terpenes, and follow-up questions.

• Financial Information: For our Dispensaries in the United States, our payment processor(s) will collect and store the financial information necessary to process your payments for your subscription to our Services, such as your payment card number and authentication details. Please note, however, that we store only a tokenized version of such information and do not maintain payment card information on our servers. If you are a Customer that uses the Pay by Bank Service, we and our third-party payment partners (such as Plaid, Inc. and the ODFIs used in connection with the Pay by Bank Service) may collect bank account and routing numbers and related authentication credentials in order to facilitate ACH payments to Dispensaries. For our Users in Canada, we may process payments directly in compliance with Canadian law, and we only store a tokenized and encrypted version of such information for so long as reasonably required to comply with regulatory obligations and/or your preferences.

• Communication Information: We may collect information when you contact us with questions or concerns and when you voluntarily respond to questionnaires, surveys or requests for market research seeking your opinion and feedback. This may include responses to surveys, ratings, or feedback prompts delivered through the Services, including satisfaction surveys and product or experience ratings. Providing communication information is optional to you.

• Location Information: Our Services may use location-based services in order to locate you, such as using your zip or postal code or IP address, so that we may verify your location, deliver you relevant content based on your location, and share Customer location with the pre-registered delivery providers and Dispensaries. For example, when searching for Dispensaries close to you on our website, you will be prompted to provide your address.

• Commercial Information: We may retain a history of the products you browse, reserve and/or purchase using the Services.

• Health Information: If a Customer makes available a state issued cannabis medical card, registration document to possess cannabis for medical purposes in Canada, or other documentation, we may collect certain health information included within such materials (on behalf of and at the direction of the applicable Dispensary).

• Social Media Information: We have pages on social media sites like Instagram, Facebook, Medium, and Twitter ("Social Media Pages"). When you interact with our Social Media Pages, we will collect Personal Information that you elect to provide to us, such as your contact details. In addition, the companies that host our Social Media Pages may provide us with aggregate information and analytics regarding the use of our Social Media Pages. Your posts, comments, replies to and mention of Dutchie may be publicly visible, depending on privacy settings. We do not have control over the privacy and retention of your Personal Information on Social Media Pages which are governed by the privacy policies of the parties that operate the platforms that host the Social Media Pages. We have no responsibility or liability for the manner in which the operators of the Social Media Pages collect, use, disclose, secure or otherwise treat your personal information.

Internet Activity Information: When you visit, use, and interact with the Services, we may receive certain information about your visit, use, or interactions. For example, we may monitor the number of people that visit the Services, peak hours of visits, which page(s) are visited, the domains our visitors come from (e.g., google.com, yahoo.com, etc.), and which browsers people use to access the Services (e.g., Chrome, Firefox, Microsoft Internet Explorer, etc.), broad geographical information, and navigation pattern. In particular, the following information is created and automatically logged in our systems:

• Log Information: Information that your browser automatically sends whenever you visit our websites. Log Information includes your Internet Protocol address, browser type and settings, the date and time of your request, and how you interacted with the website.

• Cookie and Tracking Technology Information: Please see the "Cookies and Tracking Technologies" section below to learn more about how we use cookies and tracking technologies.

• Device Information: Includes name of the device, operating system, and browser you are using. Information collected may depend on the type of device you use and its settings.

• Usage Information: We collect information about how you use our Services, such as the types of content that you view or engage with, the features you use, the actions you take, and the time, frequency, and duration of your activities.

• Email Open/Click Information: We may use pixels in our email campaigns that allow us to collect your email and IP address as well as the date and time you open an email or click on any links in the email.

• AI Interaction Metadata: We collect session duration, number and types of queries submitted, products viewed or recommended, cart additions resulting from recommendations, reservation completion data, order completion data, and other interaction-level events.

Personal Information Collected from Other Sources: We may receive Personal Information, such as contact information and marketing preferences, from other sources, such as Dispensaries, third-party Business Partners, service providers, and publicly available information.

Inferences and Derived Data: Based on your interactions with AI-powered features on a Dispensary’s menu, at a Dispensary’s retail location, or through a Dispensary’s voice-based AI phone line, we may generate inferences about your preferences, including preferred product categories, terpene and effect preferences, reservation patterns and purchase patterns. These inferences personalize your experience on behalf of the applicable Dispensary and are not used to make decisions producing legal or similarly significant effects concerning you.

Cookies and Tracking Technologies: When you visit or otherwise interact with our Services, we may automatically collect information about you using cookies, device identifiers, pixels and similar technologies. We use this information for various purposes, including to make the Services function properly, understand how you use the Services, personalize your experience, gather usage data on our Services, measure, manage, display and customize the advertisements you see within the Services or elsewhere and improve your overall experience while using the Services. A "cookie" is a piece of information sent to your browser by a website you visit. Cookies can be stored on your computer for different periods of time. Some cookies expire after a certain amount of time, or upon logging out (session cookies), others survive after your browser is closed until a defined expiration date set in the cookie (as determined by the third party placing it), and help recognize your computer when you open your browser and browse the Internet again (persistent cookies). For more details on cookies please visit All About Cookies.

On most web browsers, you will find a "help" section on the toolbar. Please refer to this section for information on how to receive a notification when you are receiving a new cookie and how to turn cookies off.

Please note that if you limit the ability of websites to set cookies, you may be unable to access certain parts of our websites and you may not be able to benefit from the full functionality of our websites.

Analytics: We use third-party analytics providers who may deploy cookies, pixels and similar technologies to the Services in order to allow us to understand usage of the Services as well as the performance of advertisements.. For example, we use Google Analytics, a web analytics service provided by Google, Inc. which uses cookies to help us analyze how users use the websites and enhance your experience when you use our Services. For more information on how Google uses this information, click here.

Personal Information We Process on Behalf of Dispensaries: When Dispensaries use our Services, they may collect Personal Information from their Customers, including, without limitation, Customers' names, phone numbers, email addresses, transactional information, payment information, reservation and transaction history, location information, identification card information and medical cannabis card information. We refer to that Personal Information as "Merchant Data" in our agreements with our Dispensary customers. We process the Merchant Data under our Dispensary customers' instructions and in accordance with our agreements with our Dispensary customers, which requires us to use the Merchant Data for the strict purpose of providing the Services to the corresponding Dispensary or as otherwise expressly set forth in the agreement. Dispensaries are responsible for the Personal Information they collect through use of the Services, complying with any applicable privacy requirements and fulfilling Customer requests with respect to their Personal Information.

Personal Information We Process as a Controller: In addition to the Personal Information we process on behalf of Dispensaries, there are contexts in which Dutchie determines the purposes and means of processing and therefore acts as a controller (or a "business," as applicable) with respect to Personal Information. These contexts include, without limitation: our sales, demonstration, onboarding, and account-management dealings with prospective and existing Dispensaries, Brands, and Business Partners; your use of our own websites, including the dutchie.com marketplace, such as when you search for and discover Dispensaries and interact with the related account, analytics, cookie, and log data described above; our own marketing and communications regarding our products and services; our own customer support operations, including telephone or video calls with Dispensaries, Brands, and Customers that are recorded; the Pay by Bank Service, including the collection of bank account and related information to facilitate ACH payments and the underwriting, KYC, and AML information we collect from Dispensaries and their beneficial owners in connection with that first-party service; the cross-network personalization and interest-based advertising activities described in the “Interest-Based Advertising and Personalization” section of this Privacy Policy; and the creation and use of de-identified or aggregated information for research, development, analytics, and the training and improvement of our models, as described in the "De-Identified Information" section below. When we act as a controller, the categories of Personal Information we process, the purposes for which we process it, the parties with whom we share it, and the rights available to you are described in this Privacy Policy and, where applicable, in the location-specific Schedule that applies to you. By contrast, when a Customer interacts with a Dispensary through the Services, including through AI-powered Services, we process that Personal Information as a processor on behalf of and at the direction of that Dispensary, as described above.

2. How We Use Personal Information.

We may use Personal Information for the following purposes:

• To provide, operate, support and improve the Services and our business;

• To determine your or a Dispensary's eligibility to use the Services

• For the specific purpose for which you provided it;

• To respond to your inquiries, comments, feedback, or questions or otherwise communicate with you;

• To send administrative or transactional information to you;

• To send you information regarding products or services that we believe may be of interest to you;

• To analyze how you interact with our Service;

• To provide, operate, and improve AI-powered features, including personalized product recommendations, natural language query responses, voice-based assistance, and sentiment analysis;

• To train, develop, and improve AI and machine learning models using data that has been de-identified or aggregated in accordance with applicable law;

• To aggregate and analyze review and sentiment data from third-party sources for reputation monitoring services;

• To collect, process, and analyze first-party survey and feedback data on behalf of Dispensaries, and to generate AI-powered responses to survey feedback.

• To develop new products and services;

• To prevent fraud, criminal activity, or misuses of our Service, and to ensure the security of our IT systems, architecture, and networks; and

• To comply with legal obligations and legal process and to protect our rights, privacy, safety, or property, and/or that of our affiliates, you, or other third parties.

Research and Development: We may aggregate Personal Information and use the aggregated and de-identified information to analyze the effectiveness of the Services, to improve and add features to the Services, gain anonymous insights into product and brand performance on the Services, and for other similar purposes. In addition, from time to time, we may analyze the general behavior and characteristics of data subjects and share aggregated information like general statistics with Dispensaries, brands, and other prospective business partners.

Interest-Based Advertising and Personalization: To make your experience on the Services more engaging, we may serve your interest-based advertisements and personalized recommendations using cookies, pixels and other tracking technologies. This means that you may see advertisements and personalized recommendations while using the Services that are tailored to you. The personal information used in furtherance of serving interest-based advertising does not include information which on its own identifies you, such as your name or e-mail address. Interest-based advertising on the Services is delivered using third-party service providers acting on our behalf and subject to contractual restrictions prohibiting use of your data for their own purposes. Depending on your location, applicable law may give you the right to opt out of targeted advertising via the preference controls on the Services or by contacting us at [email protected].

Automated Decision-Making and Personalization: Certain AI-powered features use automated processing to generate personalized product recommendations and tailored responses. When you interact with these features on a Dispensary’s menu or at a Dispensary’s store location, these processes personalize your shopping experience on behalf of the applicable Dispensary and are not used to make decisions producing legal or similarly significant effects concerning you. Some recommendations may be influenced by a Dispensary’s configurations and may be identified as such.

Communications and Marketing: We and the Dispensaries you interact with through the Services may use your Personal Information, such as your email address and telephone number, to contact you to provide the Service and tell you about products or services we believe may be of interest to you.

By providing your telephone number, you acknowledge and agree that we and/or our Dispensaries may contact you, including but not limited to for promotional, informational and other purposes, using SMS text messages, cellular or telephone calls, and push notifications (if applicable) even if you have opted in to the US or Canada National Do Not Call List, any state equivalent Do Not Call List or the internal Do Not Call List of any company, and that such messages and calls may be sent using automatic dialing systems or artificial or prerecorded voice messages.

If you would like to opt-out of receiving certain communications, see the "Your Choices" section below.

3. Sharing and Disclosure of Personal Information.

In certain circumstances we may share the categories of Personal Information described above without further notice to you, unless required by the law, with the following categories of third parties:

• Dispensaries: To provide the Services, we share certain Personal Information with Dispensaries and their service providers to enable Dispensaries to make their products available to Customers and for the Dispensaries' own uses, including marketing, referrals, or promotions (such uses will be governed by a Dispensary's own privacy policy).

• Co-branded Areas: Certain areas of the Services may be provided to you in association with third parties ("Co-Branded Areas") such as promotional partners. If you elect to register for products and/or services in Co-Branded Areas, communicate with such third parties or download their content or applications through the Services, your Personal Information will be shared with the relevant third party. Further, if you sign-in to a Co-Branded Area with your Dutchie account, your Personal Information may be disclosed to the identified third parties for that Co-Branded Area. We are not responsible for such third party's data collection or practices and you should look to such third party privacy policies for more information.

• Vendors and Service Providers: To assist us in meeting business operations needs and to perform certain services and functions, we may share Personal Information with vendors and service providers, including providers of hosting services, cloud services, and other information technology services providers, email communication software and email newsletter services, advertising and marketing services, payment processors, customer relationship management and customer support services, and analytics services. Pursuant to our instructions, these parties will access, process, or store Personal Information in the course of performing their duties to us.

• Business Transfers: If we are involved in a merger, acquisition, financing due diligence, reorganization, bankruptcy, receivership, dissolution, sale of all or a portion of our assets, or transition of service to another provider (collectively and each a "Transaction"), your Personal Information and other information may be shared in the diligence process with counterparties and others assisting with a Transaction and transferred to a successor or affiliate as part of or following that Transaction along with other assets.

• Legal Requirements: If required to do so by law or in the good faith belief that such action is necessary to (i) comply with a legal obligation, including to meet national security or law enforcement requirements, (ii) protect and defend our rights or property, (iii) prevent fraud, (iv) act in urgent circumstances to protect the personal safety of users of the Services, or the public, or (v) protect against legal liability.

• Affiliates: We may share Personal Information with our current and future affiliates, meaning an entity that controls, is controlled by, or is under common control with Dutchie. Our affiliates may use the Personal Information we share in a manner consistent with this Privacy Policy. Affiliates may be located outside the United States of America and/or Canada.

• Brands: We may share aggregated or de-identified data derived from Customer interactions with the Services with cannabis Brands for analytics, advertising performance measurement, promotion management, and market insight purposes. This data does not identify individual Customers. We do not share identifiable Customer Personal Information directly with Brands.

Dutchie does not sell your Personal Information. As part of the Services, we display sponsored content and personalized recommendations within Dispensary menus powered by Dutchie based on your browsing activity and interactions across those menus. To deliver these features, we use tracking technologies to associate your interactions with a session identifier and share this information with our advertising and personalization technology providers. While your name, contact information, and IP address are not collected or shared for this purpose, this activity may constitute “sharing” of personal information for cross-context behavioral advertising as defined under the California Consumer Privacy Act, or "targeted advertising" as defined under certain other state privacy laws. Depending on your location, applicable law may give you the right to opt out of the sharing of personal information and targeted advertising via the preference controls on the Services or by contacting us at [email protected]. We honor the Global Privacy Control signal as a valid opt-out request where required by applicable law. If you opt out, you may continue to see sponsored content, but it will not be personalized based on your browsing activity.

4. Retention.

We retain Personal Information for as long as reasonably necessary to provide the Services and carry out the purposes described in this Policy. If necessary, we may retain Personal Information for longer periods of time, until set retention periods and deadlines expire, or for instances where we are required to do so in accordance with legal, tax and accounting requirements.

To determine the appropriate duration of the retention of Personal Information, we consider the amount, nature and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of Personal Information and if we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting and other applicable obligations.

Once retention of the Personal Information is no longer necessary for the purposes outlined above, we will either delete or de-identify the Personal Information or, if this is not possible (for example, because Personal Information has been stored in backup archives), then we will securely store the Personal Information and isolate it from further processing until deletion or deidentification is possible.

5. De-Identified Information.

We may at times receive or process Personal Information to create deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular data subject. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information, except as required by law.

6. Children.

Our Services are not directed to children who are under the age of 18 or adults under the minimum age of possession of cannabis in their jurisdiction. Dutchie does not knowingly collect Personal Information from children under the age of 18 or adults under the minimum age of possession of cannabis. If you have reason to believe that a child under the age of 18 or adults under the minimum age of possession of cannabis has provided Personal Information to Dutchie through the Service please contact us and we will endeavor to delete that information from our databases.

7. Links to Other Websites.

The Services may contain links to other websites and services not operated or controlled by Dutchie, including Dispensaries and social media services ("Third Party Services"). The information that you share with Third Party Services will be governed by the specific privacy policies and terms of service of the Third Party Services and not by this Privacy Policy. By providing these links we do not imply that we endorse or have reviewed these Third Party Services. Please contact the Third Party Services directly for information on their privacy practices and policies.

8. Security.

You use the Service at your own risk. We implement commercially reasonable technical, administrative, and organizational measures to protect Personal Information both online and offline from loss, misuse, and unauthorized access, disclosure, alteration, or destruction. However, no Internet or e-mail transmission is ever fully secure or error free. In particular, e-mail sent to or from us may not be secure. Therefore, you should take special care in deciding what information you send to us via the Services or e-mail. Please keep this in mind when disclosing any Personal Information to Dutchie via the Internet. In addition, we are not responsible for circumvention of any privacy settings or security measures contained on the Services, or Third Party Services. To learn more about Dutchie's security efforts, please visit https://trust.dutchie.com.

9. Your Choices.

In certain circumstances providing Personal Information is optional. However, if you choose not to provide Personal Information that is needed to use some features of our Services, you may be unable to use those features. You can also log in to your Dutchie account or contact us to request updates or corrections to your Personal Information. If you have questions or concerns about other Personal Information collected by us or are unable to use your Dutchie account and would like assistance accessing that information, please contact our Privacy Officer at [email protected].

You may opt out of marketing-related communications by following the opt out or unsubscribe instructions contained in the marketing communication we send you, or by updating your settings through your account. If you unsubscribe from our marketing lists, you will no longer receive marketing communications from us but we will continue to contact you to provide the Services, regarding management of your account, other administrative matters, and to respond to your requests.

10. Changes to the Privacy Policy.

The Services and our business may change from time to time. As a result, we may change this Privacy Policy at any time. When we do, we will post an updated version on this page, unless another type of notice is required by applicable law. By continuing to use our Services or providing us with Personal Information after we have posted an updated Privacy Policy, you consent to the revised Privacy Policy and practices described in it.

11. Contact Us.

If you have any questions or complaints about our Privacy Policy or information practices, or would like to request a version of this notice in an accessible format, please feel free to contact us at our designated request address: [email protected].

SCHEDULE A

Users in California

This Schedule A supplements the information provided in the generally applicable portion of our Privacy Policy and applies to individuals that are residents of the State of California and qualify as a "Consumer" under the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) ("CCPA"). Any terms defined in the CCPA or as otherwise defined in our Privacy Policy have the same meaning as used in this Schedule A. For the avoidance of doubt, when we use the term "Personal Information," it means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.

1. Personal Information Table.

The below table summarizes the categories of Personal Information collected by Dutchie in the past 12 months, the sources of collection of the Personal Information, how we use the Personal Information, and the categories of Personal Information disclosed by Dutchie for business purposes in the past 12 months. Note that this is an aggregate view of all Personal Information, and the Personal Information applicable to you will depend upon how you have interacted with Dutchie, the Services, and our Dispensary customers.

2. Sensitive Personal information.

As part of the Services, Dutchie collects "sensitive personal information" as defined by the CCPA as part of our operations. As mentioned elsewhere in the Privacy Policy, Dutchie may process certain sensitive personal information on behalf of a Dispensary, which is not considered for the purpose of this section. Dutchie's practices with respect to collected sensitive personal information are described below:

3. Sales of Personal information.

Dutchie does not sell Personal Information. However, certain personalization and interest-based advertising activities described in this Privacy Policy may constitute the sharing of personal information for cross-context behavioral advertising as defined by the CCPA. You may opt out of such sharing through the preference controls on the Services, by contacting us at [email protected], or by using a Global Privacy Control signal.

4. Rights Available to Consumers.

The CCPA affords eligible data subjects with certain individual rights with respect to Personal Information that we have collected, subject to certain limitations, including:

• Right to Know: You have the right to request that a business that collects Personal Information from you disclose the following datapoints in relation to you in the preceding 12 month period: (a) the specific pieces of Personal Information collected; (b) the Personal Information categories collected; (c) the source of categories from which the business collected the Personal Information; (d) the Personal Information categories disclosed for a business purpose, if any, and the categories of persons receiving that Personal Information; and (e) the business or commercial purpose for collecting, selling, or sharing such Personal Information.

• Right of Portability: You have the right to receive the specific pieces of Personal Information the business has collected about you.

• Right of Deletion: You have the right to request that a business delete your Personal Information.

• Right of Correction: You have the right to request that a business correct any inaccuracies in the Personal Information it holds about you, considering both the Personal Information's nature and processing purposes.

• Right to Opt-Out of the Sale or Sharing of Personal Information: You have the right to opt out of the sale or sharing of Personal Information to third parties. Dutchie does not sell your Personal Information but may share personal information for cross-context behavioral advertising as described in this Privacy Policy. You may exercise this right through the preference controls on the Services, by contacting us at [email protected], or by using a Global Privacy Control signal.

• Right to Limit Sensitive Personal Information: You have the right to limit how a business uses and discloses your sensitive personal information to the extent it is used for the purpose of inferring characteristics about you.

• Right Against Discrimination: You have the right to not be discriminated or retaliated against as a result of exercising any of your rights.

Your ability to exercise the rights described above are limited pursuant to the scope and limitations of the CCPA, including any available exceptions. If the exercise of these rights limits our ability to process Personal Information (for example, in the event of a deletion request), we may no longer be able to provide you with Services or engage with you in the same manner.

Individual rights requests can be submitted through the following channels:

• Account: If you have an account, you may exercise certain individual rights within your account settings.

• Post: 68 Harrison Avenue, Suite 605, PMB 49488, Boston, Massachusetts 02111

• Email: [email protected]

Once you have submitted an individual rights request, we may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of our Services. Where applicable, these requests can be submitted by an authorized agent. In these cases, in order to verify the authorized agent’s authority, we may require evidence of that individual’s authority to act on behalf of the individual.

In certain circumstances we may refuse to act or impose limitations on your rights, as permitted by the Applicable State Law. In the event we decline to take action on a request, we will notify you

SCHEDULE B

Users in Certain Other U.S. States

This Schedule B supplements the information provided in the generally applicable portion of our Privacy Policy and applies to individuals that are residents of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia (collectively, the “Applicable States”) and qualify as a “Consumer” or equivalent term, as required by the Colorado Privacy Act, Delaware Personal Data Privacy Act, Indiana Consumer Data Protection Act, Iowa Act Relating to Consumer Data Protection, Kentucky Consumer Data Protection Act, Maryland Online Data Privacy Act, Minnesota Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Privacy Act, New Jersey Data Protection Act, Oregon Consumer Privacy Act, Rhode Island Data Transparency and Privacy Protection Act, Tennessee Information Protection Act, Texas Data Privacy and Security Act, Utah Consumer Privacy Act and the Virginia Consumer Data Protection Act (collectively, “Applicable State Law”).

This Schedule B provides additional information about how we collect, use, disclose and otherwise process the personal information of these individuals within the scope of the Applicable State Law. Any terms defined in the Applicable State Law or as otherwise defined in our Privacy Policy have the same meaning as used in this Schedule B. When the term “personal information” is used in this Schedule B, it means “personal data” and equivalent terms used in the Applicable State Law, including information that is linked or reasonably linkable to an identified or identifiable natural person.

1. Categories of Personal Information Processed.

For the categories of personal information processed by us, please refer to the Privacy Policy. In addition, we may process “sensitive data” as defined by Applicable State Law as part of our operations and the Services provided to Dispensaries.

2. Purposes of Processing.

For the purposes of the processing of personal information by us, please refer to the Privacy Policy.

3. Categories of Information Disclosed to Third Parties and a Description of Those Third Parties.

For the categories of personal information disclosed to third parties and a description of those third parties, please refer to the Privacy Policy.

4. Categories of Third Parties with Which We Share Personal Information.

For the categories of third parties with which we share personal information, please refer to the Privacy Policy.

5. Consumer Rights.

Certain rights are available to individuals under Applicable State Law relating to personal information that we have collected (subject to certain limitations), depending on the Applicable State of residence. These may include:

• The Right to Correction: You may have the right to correct inaccuracies in your personal information, taking into account the nature of the personal information and purposes of the processing.

• The Right to Deletion: You may have the right to delete your personal information you have provided or that has been collected.

• Portability: You may have the right to obtain a copy of your personal information that was previously provided in a portable, and to the extent technically feasible, readily usable format that can be transmitted to another entity.

• The Right to Opt-Out: You may have the right to opt out of (as defined by the Applicable State Law): (a) targeted advertising, (b) the sale of personal information, and (c) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

• The Right to be Informed of Third Party Disclosures: You may have the right to obtain a list of specific third parties, other than natural persons, to which we have disclosed personal information.

• The Right to Question the Result of Profiling: If your personal information is profiled in furtherance of decisions that produce legal effects concerning you, you may have the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions you might have taken to secure a different decision and the actions that you might take to secure a different decision in the future. You may have the right to review your personal data used in the profiling. If the decision is determined to have been based on inaccurate personal information, taking into account the nature of the personal information and the purposes of the processing of the personal information, you may have the right to have the personal information corrected and the profiling decision re-evaluated based on the correct personal information.

• The Right to be Informed of Data Sale Recipients: You may have the right to obtain a list of third parties to whom your personal information has been or may be sold.

6. How to Invoke Your Rights.

Individual rights requests can be submitted through the following channels:

• Account: If you have an account, you may exercise certain individual rights within your account settings.

• Post: 68 Harrison Avenue, Suite 605, PMB 49488, Boston, Massachusetts 02111

• Email: [email protected]

Once you have submitted an individual rights request, we may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of our Services. Where applicable, these requests can be submitted by an authorized agent. In these cases, in order to verify the authorized agent’s authority, we may require evidence of that individual’s authority to act on behalf of the individual.

In certain circumstances we may refuse to act or impose limitations on your rights, as permitted by the Applicable State Law. In the event we decline to take action on a request, we will notify you.

7. Profiling.

We do not carry out any profiling, as defined by Applicable State Law, in furtherance of decisions that produce legal or similarly significant effects concerning consumers.

8. Deidentified Information.

We may receive or process personal information to create deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

9. Contact.

• Account: If you have an account, you may exercise certain individual rights within your account settings.

• Post: 68 Harrison Avenue, Suite 605, PMB 49488, Boston, Massachusetts 02111

• Email: [email protected]

SCHEDULE C

Users in Canada

This Schedule C supplements the information provided in the generally applicable portion of our Privacy Policy and applies to individuals that are residents of Canada or are otherwise covered under any applicable Canadian federal or provincial privacy laws or regulations, including, without limitation the Personal Information Protection and Electronic Documents Act ("PIPEDA").

1. Consent.

By using our Services, you accept the terms of this Privacy Statement and consent to the collection, use, processing, disclosure and retention of your Personal information as described in the Privacy Policy. Typically, we will provide notice of the purpose for collecting your Personal Information and/or seek your consent (which may be express or implied, depending on the nature and sensitivity of the Personal Information) in line with applicable law at the time that we collect your Personal information. In general, you may change or withdraw your consent at any time subject to legal or contractual obligations and by providing reasonable notice. Your withdrawal of consent may impact the ability of Dutchie to provide you with some or all of the Services. Upon receiving notice that you would like to withdraw your consent, we will inform you of the likely consequences of your withdrawal of consent.

Dutchie will not collect, use, or disclose your Personal Information except for the purposes identified in this Privacy Policy or as otherwise identified at the time of collection, unless we have received your consent (which may be express or implied, depending on the nature and sensitivity of the Personal Information) or the processing is authorized without consent.

2. Accessing and Correcting your Personal Information.

You may have the right to request access to and to correct the Personal Information that we hold about you, subject to certain conditions and limitations. Subject to applicable law and your relationship with us, this may include a right to review, correct, update, suppress, delete or otherwise limit our use of your Personal Information that has been previously provided to us. You may also have the right to access information about the ways in which your Personal Information is or has been used and the names of individuals and/or organizations to which your information has been disclosed.

You may submit individual rights requests by email to [email protected] or by post to 68 Harrison Avenue, Suite 605, PMB 49488, Boston, Massachusetts 02111. If you have an account, you may also exercise certain rights within your account settings.

We will respond to your request as soon as reasonably practicable, and within the time period required by law. You will not be charged to exercise these rights. Once an individual rights request has been submitted, Dutchie may ask you for additional information in order to verify your identity or to provide additional details to help us respond to your request. This may include your name, email address, phone number or other details related to your use of Dutchie's Services.

If we correct your information, we will also send the corrected information to organizations to which we disclosed the information during the year before the date the correction was made.

Please note that in certain circumstances, we may refuse to act or impose limitations on your rights, as permitted by applicable law. If we cannot provide you with access to your Personal Information or are unable to correct your Personal Information, we will inform you of the reasons why, subject to any legal restrictions, and outline further steps available to you. If we refuse to act on a request to correct your Personal Information, we will nonetheless annotate the information, noting the correction that was requested but not made.

In certain cases, depending on the nature of your request, there may also be residual information that will remain within our databases and other records, which, due to applicable law or as part of Services that are in the process of being carried out, will not be removed or changed. We will also retain information relating to your request for recordkeeping and compliance purposes.

3. Transfers.

We may process, store, and transfer your Personal Information in and to a foreign country, with different privacy laws that may or may not be as comprehensive as Canadian law, including the United States. In these circumstances, the governments, courts, law enforcement, or regulatory agencies of that country may be able to obtain access to your personal information through the laws of the foreign country. When you provide Personal Information to us through the Services, you consent to the transfer and processing of your Personal Information in this manner. Any international transfers made will be in accordance with applicable law.

We also impose appropriate safeguards for the transfer of Personal Information among our affiliates and to third-party service providers in various jurisdictions, and have implemented appropriate contractual arrangements or other measures for such purposes.