Privacy Policy

Effective Date: March 2026  |  Last Updated: March 2026

Table of Contents

1. Introduction and Scope
2. Information We Collect
3. How We Use Your Information
4. Mobile Messaging (SMS/MMS)
5. Email Marketing (CAN-SPAM)
6. How We Share Your Information
7. Data Retention
8. Cookies and Tracking Technologies
9. Security of Your Information
10. Children's Privacy
11. Call Center Recording
12. Website and Mobile Application Session Recording
13. Links to Third-Party Websites
14. Your Choices and Rights
15. Other U.S. State Privacy Rights
16. Changes to This Policy
17. Contact Us
18. Supplemental California Privacy Notice (CCPA/CPRA)
19. Supplemental Oregon Privacy Notice (OCPA)

1. Introduction and Scope

Garden Winds, Inc. ("Garden Winds," "we," "us," or "our") is committed to protecting your privacy and handling your personal information responsibly. This Privacy Policy ("Policy") describes how we collect, use, disclose, retain, and safeguard personal information when you interact with our website at https://gardenwinds.com/, our mobile applications, our call centers, and any other products or services we offer (collectively, the "Services").

This Policy applies to all users of our Services, including residents of California, Oregon, and all other U.S. states with applicable consumer privacy laws. California residents are entitled to additional rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 and all implementing regulations issued by the California Privacy Protection Agency (collectively, "CCPA/CPRA"), which are described in the California Supplemental Privacy Notice below. Oregon residents are entitled to additional rights under the Oregon Consumer Privacy Act ("OCPA"), described in the Oregon Supplemental Privacy Notice below. Residents of other states should refer to Section 15.

By using our Services, you acknowledge that you have read and understand this Policy. If you do not agree with the practices described in this Policy, please do not use our Services.

2. Information We Collect

We may collect the following categories of personal information, depending on how you interact with our Services. We collect only the information reasonably necessary for the purposes described in this Policy.

2.1 Information You Provide Directly

• Identifiers: Full name, postal address, email address, mobile phone number, landline phone number, and similar contact information.
• Payment and Financial Information: Credit card numbers, debit card numbers, billing address, and other financial details necessary to process transactions. Payment card data is processed by our PCI-DSS-compliant payment processor; we do not store full card numbers.
• Account Credentials: Usernames, passwords, and security questions or answers.
• Communications: Messages, inquiries, and other content you submit through forms, email, live chat, or when contacting our customer service team, including call recordings (see Section 11).
• Reviews and Feedback: Product reviews, survey responses, and other content you voluntarily submit.

2.2 Information Collected Automatically

• Device and Network Information: Internet Protocol (IP) address, session ID, browser type and version, operating system, device identifiers, and referring URLs.
• Usage and Behavioral Data: Click-stream data, movement activity on our web pages, scroll activity, time spent on pages, and, in limited circumstances, keystroke activity used solely for fraud prevention purposes.
• Cookies and Tracking Technologies: Data collected through cookies, web beacons, pixel tags, scripts, and similar technologies. See Section 8 for more information.
• Location Data: We collect city- or region-level location derived from your IP address. We do not collect precise GPS-level geolocation unless you explicitly grant location permission through your device settings while using a Garden Winds mobile application. Precise geolocation is treated as sensitive personal information and will only be collected with your prior consent.

2.3 Information Collected From Third Parties

• Advertising Platforms: We may receive browsing interest segments or audience data from advertising partners, including Meta (Facebook/Instagram), Google, and TikTok, to improve the relevance of advertisements shown to you on their platforms.
• Shipping and Fulfillment Partners: We may receive delivery status and address verification data from our shipping carriers (e.g., UPS, FedEx, USPS) to fulfill and confirm your orders.

2.4 Sensitive Personal Information

We collect the following categories of sensitive personal information only where necessary for our Services and as disclosed at the point of collection:

• Audio, electronic, visual, or similar data, including recordings of customer service calls (see Section 11).
• Precise geolocation data, only where you have provided explicit consent through your device settings.
• Professional or employment-related information and education information, solely in connection with employment applications.
• Financial account information provided by you for payment processing purposes.

We do not use or disclose sensitive personal information for purposes beyond those expressly permitted under applicable law, including the CCPA/CPRA.

3. How We Use Your Information

We use the personal information we collect for the following business and commercial purposes. We will not use your personal information for purposes that are incompatible with those described below without first providing you notice and, where required, obtaining your consent.

• Providing, operating, and improving our products and Services.
• Processing transactions and sending related order confirmations, receipts, shipping updates, and account notifications.
• Communicating with you about your account, our products, promotions, and news via email, postal mail, telephone, or SMS/MMS messaging (where you have provided prior express written consent as required by the TCPA).
• Analyzing usage data and trends to improve user experience and our Services.
• Personalizing your experience and delivering interest-based advertising, subject to your opt-out rights.
• Detecting and preventing fraud, security incidents, and other illegal or harmful activity.
• Debugging and repairing errors that impair existing functionality.
• Conducting internal research, analytics, and quality assurance.
• Verifying your identity and processing privacy rights requests you submit to us.
• Complying with applicable legal obligations, responding to legal process, and enforcing our agreements and rights.
• Recruiting and processing employment applications (for employment-related information only).

We do not use your personal information to make fully automated decisions that produce legal or similarly significant effects on you without human review. We do not use inferences to predict insurance claims, assess creditworthiness, or make employment decisions.

4. Mobile Messaging (SMS/MMS)

Garden Winds offers SMS/MMS messaging services to keep you informed about orders, accounts, and promotional offers. The following terms govern our mobile messaging program and are intended to comply with the Telephone Consumer Protection Act ("TCPA"), applicable Federal Communications Commission ("FCC") regulations including the FCC's one-to-one consent rules effective January 27, 2025, the CAN-SPAM Act, CTIA Messaging Principles and Best Practices, and applicable state laws.

4.1 Consent to Receive Messages

By providing your mobile telephone number and affirmatively opting in to our messaging program (e.g., by checking a consent checkbox on our website, texting a keyword to our short code, or verbally consenting during a recorded call), you provide your prior express written consent, as that term is defined under the TCPA, to receive recurring automated marketing and informational text messages from Garden Winds specifically at the mobile number you provide, even if your mobile number is registered on any state or federal Do Not Call list. Consistent with the FCC's one-to-one consent requirements, your consent is specific to Garden Winds and does not authorize messages from any other company or marketer. Text messages may be sent using an automatic telephone dialing system or other technology. Standard message and data rates may apply. Message frequency may vary. Your participation in our mobile messaging program is completely voluntary.

4.2 Types of Messages

• Transactional messages: Order confirmations, shipping updates, account alerts, and service notifications.
• Marketing messages: Promotional offers, discounts, new product announcements, and special events.

4.3 Opting Out

You may opt out of receiving SMS/MMS messages at any time by texting STOP to +1 (844) 574-0969, or by clicking the unsubscribe link (where available) in any text message. Upon receipt of your STOP request, we will send you a single one-time confirmation message confirming your opt-out. No further marketing messages will be sent to your mobile device from that number or short code unless subsequently initiated by you.

You may continue to receive transactional or legally required messages even after opting out of marketing messages. If you have enrolled in multiple Garden Winds mobile messaging programs, you must opt out of each program separately. A STOP request sent to one program does not automatically cancel enrollment in any other Garden Winds messaging programs.

If you opt out via STOP and later wish to re-enroll, you may do so by texting START to the applicable short code or by contacting us at customerservice@gardenwinds.com.

4.4 Help and Support

Text HELP to +1 (844) 574-0969 at any time for assistance, or contact our customer service team at customerservice@gardenwinds.com or (877) 479-4637 (Monday through Friday, 8:00 a.m. to 3:00 p.m. PST).

4.5 Message and Data Rates

Garden Winds does not charge for the messaging service itself. However, standard message and data rates from your wireless carrier may apply. You are solely responsible for all such charges. Garden Winds is not responsible for any fees charged by your carrier. Wireless carriers are not liable for delayed or undelivered messages.

4.6 Sharing of SMS Opt-In Data

4.7 TCPA and FCC Compliance

Garden Winds's mobile messaging program is operated in compliance with the TCPA, applicable FCC rules and regulations (including the one-to-one consent rules effective January 27, 2025), and CTIA Messaging Principles and Best Practices. Each marketing or promotional message will include a clear and conspicuous opt-out mechanism. We maintain records of all consents obtained for a minimum of four (4) years from the date of consent, or such longer period as required by applicable law.

4.8 10DLC Registration

Where applicable, Garden Winds's messaging campaigns are registered through the 10-Digit Long Code (10DLC) carrier registration system in accordance with wireless carrier requirements. Our registered use cases include transactional notifications and marketing messages as described in Section 4.2.

4.9 Number Changes and Your Obligations

We may change any short code or telephone number we use to operate the messaging service at any time and will notify you of such changes. You acknowledge that messages sent to a discontinued number may not be received. You agree to provide us with a valid mobile phone number and must re-enroll using your new number if your mobile number changes.

4.10 Limitation of Liability for Mobile Messaging

To the extent permitted by applicable law, Garden Winds will not be liable for failed, delayed, or misdirected delivery of any information sent through the Service, any errors in such information, or any action you may or may not take in reliance on the information or Service.

5. Email Marketing (CAN-SPAM)

Garden Winds sends promotional and transactional emails in compliance with the CAN-SPAM Act and applicable state laws. Our commercial email communications will: (a) clearly identify Garden Winds as the sender; (b) include our physical mailing address (4950 East Second Street, Benicia, CA 94510); (c) include a clear and conspicuous mechanism to opt out of future commercial email messages; and (d) honor opt-out requests within 10 business days of receipt.

You may opt out of marketing emails at any time by clicking "Unsubscribe" in any marketing email or by contacting us at customerservice@gardenwinds.com. Even after opting out of marketing emails, you may continue to receive transactional or account-related emails (such as order confirmations, shipping notifications, and account security alerts) as necessary to complete your transactions or fulfill our contractual obligations to you.

6. How We Share Your Information

We do not sell your personal information in exchange for monetary consideration. We may share your personal information in the following circumstances:

6.1 Service Providers

We share personal information with third-party vendors and service providers who perform services on our behalf, including customer service, account management, data analytics, advertising, payment processing, fraud detection, SMS/MMS messaging delivery, and website hosting. These service providers are contractually obligated to: (a) use your personal information only as directed by us; (b) implement appropriate security measures; and (c) delete or return your personal information when our engagement ends.

6.2 Advertising and Analytics Partners

We may permit third-party advertising networks, social networks, analytics providers, and email marketing platforms — including Meta (Facebook/Instagram), Google, TikTok, and Klaviyo — to use cookies and similar tracking technologies to collect information about your use of our Services and deliver interest-based advertisements. These disclosures may constitute a "sale" or "sharing" of personal information under the CCPA/CPRA.

6.3 Legal and Regulatory Disclosures

We may disclose your personal information to law enforcement agencies, regulatory bodies, courts, or other governmental authorities when required by law, to investigate suspected illegal activity, or to enforce our Terms of Service.

6.4 Business Transfers

In the event of a merger, acquisition, asset sale, or similar corporate transaction, your personal information may be transferred as part of the transaction. We will provide notice as required by applicable law. Any successor entity will be required to honor this Policy or provide you with a replacement policy offering at least equivalent protections.

6.5 Affiliates and Subsidiaries

We may share your personal information with our corporate affiliates and subsidiaries for purposes consistent with this Policy, subject to the same limitations and protections described herein.

6.6 With Your Consent

We may share your personal information for other purposes with your prior affirmative consent. You may revoke such consent at any time.

6.7 No Sharing of SMS Opt-In Data

Notwithstanding any other provision of this Policy, mobile opt-in data and consent information will not be shared with any third party or affiliate for their independent marketing or promotional purposes.

6.8 Children Under 16

We do not knowingly sell or share the personal information of consumers under 16 years of age. Consumers between the ages of 13 and 15 must affirmatively opt in before we will sell or share their personal information. Our Services are not directed to children under 13; if we learn we have collected personal information from a child under 13 without verifiable parental consent, we will delete it promptly.

7. Data Retention

We retain personal information for the periods set out below, or longer if required by applicable law, a legal hold, or a regulatory proceeding.

When you submit a deletion request, we will delete your personal information from our active systems within the timeframes required by law. Your personal information may remain in encrypted backup systems for up to 90 days following deletion from active systems, at which point it will be overwritten or deleted in our ordinary backup rotation cycle.

Third-Party and Advertising Partner Data

When you submit a deletion request, we will instruct our service providers and, where technically feasible, our advertising and analytics partners (including Meta, Google, and TikTok) to delete your personal information in accordance with our data processing agreements. However, Garden Winds cannot guarantee the timing or completeness of deletion by third-party advertising platforms. We encourage you to submit deletion requests directly to those platforms:

• Meta (Facebook/Instagram): https://www.facebook.com/privacy/center
• Google: https://myaccount.google.com/data-and-privacy
• TikTok: https://www.tiktok.com/legal/privacy-policy

Data already incorporated into aggregated or de-identified datasets by our advertising partners prior to receipt of your deletion request may not be individually retrievable or deletable, provided such data cannot reasonably be used to identify you.

8. Cookies and Tracking Technologies

8.1 What We Use

We use cookies, web beacons, pixel tags, scripts, and similar technologies ("Cookies") to operate and improve our Services, remember your preferences, analyze usage, deliver targeted advertising, and prevent fraud. We also use Google Analytics and Google Tag Manager; please review Google's privacy policy at policies.google.com/privacy.

• Strictly necessary cookies: Required for the website to function (e.g., shopping cart, login session). These cannot be disabled.
• Performance / analytics cookies: Help us understand how visitors interact with our website. Subject to your cookie preferences.
• Advertising / targeting cookies: Used by Meta (Facebook Pixel), Google (Google Ads), TikTok (TikTok Pixel), and Klaviyo to deliver relevant ads, measure campaign performance, and identify known subscribers. Subject to your opt-out rights.

8.2 Your Cookie Choices

You may manage your Cookie preferences through the Cookie Preference Manager, accessible via the banner displayed when you first visit our website, or at any time through the "Your Privacy Choices" link in our website footer. You may also opt out by enabling a Global Privacy Control ("GPC") signal in a supported browser. Garden Winds honors GPC signals as a valid opt-out, effective within 15 business days of receipt and as soon as feasibly possible.

Garden Winds's websites and apps do not respond to traditional "Do Not Track" browser signals. We do, however, respond to GPC signals as described above.

8.3 Interest-Based Advertising Opt-Out

You may opt out of interest-based advertising by: (a) using our Cookie Preference Manager; (b) enabling GPC in your browser; (c) using the "Do Not Sell or Share My Personal Information" link on our website; or (d) in our mobile applications, adjusting your preferences under Settings > Preferences > Privacy, or enabling "Limit Ad Tracking" or "Opt out of Ads Personalization" on your device. You may continue to see generic, non-targeted advertising after opting out.

9. Security of Your Information

We implement reasonable and appropriate administrative, physical, and technical safeguards to protect your personal information, including:

• Encryption of personal information in transit using industry-standard TLS/SSL protocols.
• Encryption of sensitive personal information at rest where appropriate.
• Access controls limiting employee and contractor access to personal information.
• Regular security assessments and vulnerability testing.
• Vendor security requirements incorporated into our data processing agreements.
• Incident response procedures for detecting, investigating, and responding to potential security breaches.

No method of transmission over the Internet is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. In the event of a data breach triggering notification obligations under applicable law, we will notify affected individuals and relevant authorities as required.

10. Children's Privacy

Our Services are not directed to, and we do not knowingly collect personal information from, individuals under the age of 13. If we learn that we have inadvertently collected personal information from a child under 13 without verifiable parental consent, we will delete that information promptly.

Under the CCPA/CPRA, we do not knowingly sell or share the personal information of consumers under 16 years of age. Consumers between 13 and 15 years of age must affirmatively opt in before we will sell or share their personal information. If you are a parent or guardian and believe your child has provided us with personal information without your consent, please contact us at customerservice@gardenwinds.com.

11. Call Center Recording

Garden Winds records telephone calls to and from our customer service call centers for purposes of improving customer service quality, training, authentication, and fraud investigation. Where required by applicable law — including California's Invasion of Privacy Act (Cal. Penal Code §§ 630–638.55) and similar state wiretapping or call recording statutes — we will provide notice of recording at the start of a call before any recording begins. By continuing a call after notice is provided, you consent to recording to the extent permitted by applicable law.

Call recordings are retained for 12 months from the date of the call, or longer if subject to a legal hold or active investigation (see Section 7). Call recordings are disclosed only to vendors providing customer service improvement, authentication, and fraud investigation services. Call recording data constitutes sensitive personal information under the CCPA/CPRA and is subject to all rights described in the California Supplemental Privacy Notice.

12. Website and Mobile Application Activity

We collect certain usage and behavioral data automatically when you visit our website or use our mobile applications, including click-stream data, page views, scroll activity, and items you view. This data is collected through cookies and tracking technologies operated by our advertising and analytics partners, including Meta, Google, TikTok, and Klaviyo, and is used solely to improve website functionality, analyze user experience, and deliver relevant marketing. It is not used for purposes incompatible with this Policy.

This data is processed by our third-party service providers under data processing agreements that restrict their use and is subject to the retention periods in Section 7. You may opt out of this data collection by: (a) enabling a GPC signal in your browser; (b) adjusting your Cookie preferences through our Cookie Preference Manager; or (c) contacting us at customerservice@gardenwinds.com.

13. Links to Third-Party Websites

Our Services may contain links to third-party websites and applications, and we may include social media features that link to third-party platforms. These third parties operate independently of Garden Winds and have their own privacy policies. Garden Winds is not responsible for the privacy practices or content of any third-party websites or applications. We encourage you to review their privacy policies before providing any personal information.

14. Your Choices and Rights

Depending on your location, you may have certain rights with respect to your personal information. California and Oregon residents should refer to the supplemental notices below. Residents of other states should refer to Section 15. All users may exercise the following general choices:

• Right to Know / Access: You may request information about the categories and specific pieces of personal information we have collected about you.
• Right to Delete: You may request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You may request correction of inaccurate personal information we hold about you.
• Right to Opt Out: You may opt out of the sale or sharing of your personal information for cross-context behavioral advertising.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights.
• Marketing Opt-Out: You may opt out of promotional email at any time by clicking "Unsubscribe" in any marketing email. You may opt out of SMS/MMS marketing by texting STOP (see Section 4.3).

To exercise any of these rights, please contact us using the information in Section 17.

15. Other U.S. State Privacy Rights

This section applies to residents of U.S. states with comprehensive consumer privacy laws not separately addressed in this Policy, including but not limited to Texas, Virginia, Colorado, Connecticut, Montana, Indiana, Iowa, Tennessee, and Utah. Residents of California and Oregon should refer to the supplemental notices below.

15.1 Rights Available to You

Depending on the state in which you reside, and subject to applicable thresholds and exceptions, you may have some or all of the following rights:

• Right to Access / Confirm: The right to confirm whether we are processing your personal data and to access that data.
• Right to Correct: The right to request correction of inaccurate personal data.
• Right to Delete: The right to request deletion of personal data we have collected from or about you.
• Right to Data Portability: The right to obtain a copy of your personal data in a portable, readily usable format, to the extent technically feasible.
• Right to Opt Out of Targeted Advertising: The right to opt out of the processing of your personal data for targeted advertising.
• Right to Opt Out of Sale: Garden Winds does not sell personal data for monetary consideration.
• Right to Opt Out of Profiling: Garden Winds does not engage in profiling that produces legal or similarly significant effects.

15.2 Sensitive Personal Data

Garden Winds processes sensitive personal data only as described in Section 2.4, and only where you have provided appropriate consent or where processing is otherwise permitted under applicable law.

15.3 How to Exercise Your Rights

You or your authorized agent may submit a privacy rights request by:

• Phone: (877) 479-4637 (Monday–Friday, 8:00 a.m.–3:00 p.m. PST)
• Email: customerservice@gardenwinds.com
• Mail: Garden Winds, Inc., 4950 East Second Street, Benicia, CA 94510

We will respond within 45 days of receipt. If we require additional time (up to 45 additional days), we will notify you before the initial period expires. We do not charge a fee for processing requests unless they are manifestly unfounded, excessive, or repetitive.

15.4 Identity Verification

For most requests, providing your name, email address, and order number or account information is sufficient. We will not require government-issued ID numbers as part of standard verification.

15.5 Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf by providing written authorization signed by you. We will not reject a request from an authorized agent who provides valid authorization.

15.6 Right to Appeal

If we deny your request, you may appeal by emailing customerservice@gardenwinds.com with the subject line "Privacy Rights Appeal" within 45 days of our denial. We will respond within 60 days. If unsatisfied, you may contact your state's Attorney General or relevant privacy enforcement authority.

15.7 Nevada Residents

Nevada residents have the right to opt out of the sale of covered personal information under Nevada Revised Statutes Chapter 603A (SB 220) and Nevada SB 260. Garden Winds does not sell personal information for monetary consideration. To submit a Nevada opt-out request, contact us at customerservice@gardenwinds.com or (877) 479-4637. We will respond to verified requests within 60 days, with a possible 30-day extension where reasonably necessary.

16. Changes to This Privacy Policy

We may update this Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this Policy and post the revised Policy on our website. For significant changes, we will provide additional notice, such as a prominent website banner or, where required by law, email notification. Prior versions of this Policy are available upon request. Your continued use of our Services after the effective date of any changes constitutes your acknowledgment of the updated Policy.

17. Contact Us

If you have questions, concerns, or requests regarding this Policy or our privacy practices, please contact us:

• Mail: Garden Winds, Inc., 4950 East Second Street, Benicia, CA 94510
• Phone: (877) 479-4637 (Monday–Friday, 8:00 a.m.–3:00 p.m. PST)
• Email: customerservice@gardenwinds.com

For unresolved privacy concerns, you may also contact our U.S.-based third-party dispute resolution provider at no charge: https://feedback-form.truste.com/watchdog/request.

We acknowledge receipt of all privacy requests within 10 business days and aim to respond within 45 days.

Supplemental Privacy Notice for California Consumers (CCPA/CPRA)

This Supplemental California Consumer Privacy Notice ("California Notice") supplements the Garden Winds Privacy Policy above and applies exclusively to residents of the State of California. This California Notice also serves as a Notice at Collection as required by the CCPA/CPRA.

Last Updated: March 2026  |  Effective Date: March 2026

CA-1. Categories of Personal Information Collected

Over the preceding 12 months, Garden Winds may have collected the following categories of personal information from California consumers:

• Identifiers: Name, postal address, email address, mobile and landline phone numbers, IP address, session identifiers, cookie identifiers, and account username.
• Commercial Information: Products purchased or considered, purchase history, wish list items, and product reviews.
• Internet or Other Electronic Network Activity: IP address, session ID, click-stream data, movement activity, scroll activity, and keystroke activity (fraud prevention only).
• General Location Data: City- or region-level location derived from IP address. Not collected at precise GPS level without your explicit consent.
• Audio, Electronic, Visual, or Similar Information: Audio recordings of customer service calls; session replay data from our website and mobile applications.
• Inferences: Profiles reflecting product preferences and shopping interests, used to personalize your experience and marketing communications.
• Sensitive Personal Information (SPI): Precise geolocation (only with explicit opt-in consent); financial account information for payment processing. We do not collect health data, race/ethnicity, SSN, driver's license, biometrics, or genetic data in connection with our retail business.

CA-2. Sources of Personal Information

• Directly from you, through account registration, purchases, customer service interactions, call recordings, and SMS/MMS opt-in.
• Your authorized agent.
• Automatically from your device and browser through cookies, session replay tools, and tracking technologies.
• Advertising platforms, including Meta (Facebook/Instagram), Google, and TikTok.
• Shipping and fulfillment partners (e.g., UPS, FedEx, USPS).

CA-3. Purposes for Collecting and Using Personal Information

• Auditing interactions and transactions.
• Detecting and preventing security incidents, fraud, and illegal activity.
• Debugging to identify and repair errors.
• Short-term transient use not used to build a persistent consumer profile.
• Performing services including order processing, payment processing, and customer service.
• Internal research for product and Service development.
• Verifying quality and safety of our Services.
• Marketing via email, SMS/MMS (with prior express written consent), and other channels.
• Website and mobile application analysis and functionality improvement.
• Complying with legal obligations and responding to law enforcement requests.
• Processing employment applications (employment-related information only).

We do not use personal information to make fully automated decisions with legal or similarly significant effects without human review.

CA-4. Disclosure of Personal Information

Over the preceding 12 months, Garden Winds may have disclosed the following categories of personal information:

• Identifiers: To vendors providing customer service, account management, data verification, and SMS/MMS messaging.
• Commercial Information: To vendors, advertising networks, and analytics providers.
• Internet/Network Activity: To vendors, advertising networks, analytics providers, and social networks.
• Sensory Data (call recordings and session replay): To vendors providing customer service improvement, authentication, and fraud investigation.
• Geolocation Data: To vendors, advertising networks, analytics providers, and social networks. Precise geolocation disclosed only to service providers delivering location-dependent features you requested.
• Inferences: To vendors providing marketing and analytics services.
• Financial Account Information: To payment processors solely to process your transactions.
• Employment Information: To vendors assisting with recruiting and HR (employment applicants only).

Garden Winds does NOT knowingly sell or share the personal information of consumers under 16 years of age.

CA-5. Sale and Sharing of Personal Information

Garden Winds does not sell personal information for monetary consideration. However, we permit third-party advertising networks, social networks, and analytics providers to use Cookies to collect identifiers, internet activity data, inferences, and general geolocation data. This may constitute a "sale" or "sharing" under the CCPA/CPRA. Over the preceding 12 months, categories sold or shared include: identifiers (cookie IDs, IP address); internet/browsing activity; inferences; and general geolocation data.

CA-6. Your California Privacy Rights

• Right to Notice: The right to know, prior to or at collection, the categories of personal information collected and the purposes for use.
• Right to Access: The right to know the specific pieces and categories of personal information collected, sources, business purposes, and categories of third parties.
• Right to Delete: The right to request deletion of personal information, subject to exceptions (see CA-8).
• Right to Correct: The right to request correction of inaccurate personal information.
• Right to Opt Out of Sale/Sharing: The right to direct us to stop selling or sharing your personal information (see CA-5).
• Right to Limit Use of Sensitive Personal Information: The right to limit use and disclosure of your SPI to permitted purposes. To exercise this right, click "Limit the Use of My Sensitive Personal Information" in our website footer or contact us.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA/CPRA rights.

CA-7. How to Exercise Your California Privacy Rights

You or your authorized agent may submit a request by:

• Phone: (877) 479-4637 (Monday–Friday, 8:00 a.m.–3:00 p.m. PST)
• Email: customerservice@gardenwinds.com

Response Timeframes: We will acknowledge receipt within 10 business days and respond within 45 days. If additional time is needed (up to 45 more days), we will notify you before the initial period expires.

Identity Verification: For most requests, your name, email address, and order number or account information are sufficient. We will not require SSNs, driver's license numbers, or financial account numbers. In exceptional circumstances for high-sensitivity requests, we may request a signed declaration under penalty of perjury (submitted electronically). Garden Winds will reimburse reasonable notarization fees if a notarized declaration is ever required.

Authorized Agents: You may designate an authorized agent via written authorization or power of attorney (Cal. Prob. Code §§ 4000–4465). For deletion and opt-out requests, valid agent authorization is sufficient. For access requests for specific pieces of information, we may contact you directly to confirm the request.

Access Requests: Your request and our response will be available for 30 days after completion, then deleted.

Correction Requests: Please provide supporting documentation via our secure online portal or by mail (copies only, not originals) to the address below.

Request Records Retention: We maintain records of all CCPA/CPRA requests for a minimum of 24 months.

Right to Appeal: If we deny your request, you may appeal within 60 days by emailing customerservice@gardenwinds.com with the subject line "CCPA Appeal." We will respond within 45 days. If unsatisfied, you may file a complaint with the California Privacy Protection Agency at cppa.ca.gov.

Mail: Garden Winds, Inc., 4950 East Second Street, Benicia, CA 94510

CA-8. Exceptions to the Right to Delete

We are not required to delete personal information that is necessary to:

• Complete the transaction for which it was collected or perform our contract with you;
• Detect and protect against security incidents, fraud, or illegal activity;
• Debug and repair errors in our systems;
• Exercise or protect free speech or another right provided by law;
• Comply with the California Electronic Communications Privacy Act;
• Engage in public interest scientific, historical, or statistical research (with your consent where required);
• Enable solely internal uses reasonably aligned with your expectations; or
• Comply with a legal obligation.

CA-9. Automated Decision-Making

We may use product recommendation algorithms and fraud detection systems that process your browsing and transaction data. These tools do not make decisions that produce legal or similarly significant effects on you without human review. We will update this California Notice as California law and CPPA regulations regarding automated decision-making develop.

Supplemental Privacy Notice for Oregon Consumers (OCPA)

This Supplemental Oregon Consumer Privacy Notice ("Oregon Notice") supplements the Garden Winds Privacy Policy above and applies exclusively to residents of the State of Oregon under the Oregon Consumer Privacy Act ("OCPA"), ORS Ch. 646A, effective July 1, 2024.

Last Updated: March 2026  |  Effective Date: July 1, 2024

OR-1. Categories of Personal Data Processed

• Identifiers: Name, postal address, email address, mobile and landline phone numbers, IP address, account username, session identifiers, and cookie identifiers.
• Commercial Information: Products purchased or considered, purchase history, wish list items, and product reviews.
• Internet or Other Electronic Network Activity: IP address, session ID, click-stream data, movement activity, scroll activity, and keystroke activity (fraud prevention only).
• General Location: City- or region-level location derived from IP address.
• Audio, Electronic, Visual, or Similar Information: Audio recordings of customer service calls; session replay data from our website and mobile applications.
• Inferences: Profiles reflecting product preferences and shopping interests.
• Professional or Employment-Related Information and Education Information: Collected solely in connection with employment applications.
• Financial Account Information: Provided by you for payment processing purposes.

OR-2. Sensitive Personal Data

Garden Winds does not collect sensitive personal data as defined under OCPA (racial or ethnic origin, health conditions, sexual orientation or gender identity, immigration status, precise geolocation, genetic or biometric data, personal data of known children) in connection with our retail business, with the exception of precise geolocation, and only if you have explicitly granted location permission through your mobile device settings.

You may withdraw consent for precise geolocation collection at any time by revoking location permission in your device settings or by contacting customerservice@gardenwinds.com. We will obtain affirmative opt-in consent before processing any sensitive personal data, consistent with ORS 646A.572(5).

OR-3. Purposes for Processing

We process your personal data for the same purposes described in Section 3 of the main Privacy Policy, consistent with OCPA's data minimization principle. We will not process your personal data for incompatible purposes without your consent.

OR-4. Disclosure of Personal Data

We disclose personal data to service providers, advertising partners, and others as described in Section 6 of the main Privacy Policy. We do not sell personal data for monetary consideration. We engage in cross-context behavioral advertising, constituting "processing for targeted advertising" under the OCPA. You have the right to opt out as described in OR-5.

OR-5. Your Oregon Privacy Rights

• Right to Access: Confirm whether we process your personal data and access that data.
• Right to Correct: Correct inaccurate personal data we maintain about you.
• Right to Delete: Request deletion of personal data you provided or we collected about you.
• Right to Data Portability: Obtain a copy of your personal data in a portable, readily usable format, to the extent technically feasible.
• Right to Opt Out of Targeted Advertising: Opt out of the processing of your personal data for targeted (behavioral) advertising.
• Right to Opt Out of Sale: We do not sell personal data for monetary consideration.
• Right to Opt Out of Profiling: We do not engage in profiling producing legal or similarly significant effects.

OR-6. How to Exercise Your Oregon Privacy Rights

You or your authorized agent may submit a request by:

• Phone: (877) 479-4637 (Monday–Friday, 8:00 a.m.–3:00 p.m. PST)
• Email: customerservice@gardenwinds.com

Response Timeframes: We will respond within 45 days of receipt. If additional time is needed (up to 45 more days), we will notify you in writing prior to the end of the initial period, consistent with ORS 646A.576(5).

Identity Verification: For most requests, your name, email address, and order number or account information are sufficient. We will not require government-issued ID numbers. In exceptional circumstances, we may request a signed declaration under penalty of perjury, submitted electronically.

Authorized Agents: You may designate an authorized agent with written authorization. We will not reject a request from an authorized agent who provides valid authorization.

Fees: We do not charge a fee for privacy rights requests. We may decline requests that are manifestly unfounded, excessive, or repetitive.

OR-7. Right to Appeal

If we deny your request, you may appeal by emailing customerservice@gardenwinds.com with the subject line "OCPA Appeal" within 45 days of our denial. We will respond within 60 days, consistent with ORS 646A.576(6). If unsatisfied, you may submit a complaint to the Oregon Attorney General at oregonconsumer.gov.

Garden Winds, Inc.  |  4950 East Second Street, Benicia, CA 94510  |  customerservice@gardenwinds.com  |  (877) 479-4637