The California Privacy Rights Act ("CPRA") grants residents of the State of California ("consumers") and households located in California certain rights regarding their Personal Information. This Notice (the "CPRA Notice") applies to the Personal Information of consumers and/or households that is collected and/or processed (online and/or off-line) by or on behalf of iMemories LLC ("iMemories," "we," "us" or "our") and supplements our Privacy Policy (https://www.imemories.com/privacy). All capitalized terms herein have the meanings given in the CPRA or the Privacy Policy. We address Personal Information associated with our employees and job applicants separately. In the event of any conflict between this CPRA Notice and terms in the Privacy Policy, the provision that is more protective of your Personal Information shall control to the extent of such conflict. If you are located outside of the State of California, this CPRA Notice does not apply to you and you should refer to our Privacy Policy.

We may collect the categories of Personal Information listed in the tables below for the specific business purposes listed next to them.

iMemories determines the retention periods of each category of Personal Information based on the following criteria:

• The purposes for which iMemories processes the Personal Information (iMemories needs to retain the data as long as necessary to complete such purposes); and
• Tax, legal and regulatory obligations and requirements (laws or regulation may set, or recommend, a minimum period for retention of your Personal Information).

We receive your Personal Information directly from you, as well as from the following categories of sources:

• Directly from you;
• Internet or other electronic network activity;
• Third-party analytics services; and
• Social Media Platforms.

We may disclose the following categories of Personal Information to the following categories of service providers and/or contractors for a business purpose.

The CPRA provides consumers and households with specific rights regarding their Personal Information. iMemories will usually be considered a "business" processing your Personal Information as that term is defined under CPRA. If iMemories is acting as a service provider or contractor on behalf of another business, please contact the business that collected your Personal Information in the first instance to address your rights with respect to such data.

a) Right to Know About Your Personal Information

You have the right to request that we disclose the following kinds of information to you about our collection, disclosure, sale, sharing, and use of your Personal Information:

• Categories of Personal Information, sources, business or commercial purposes, and to whom the information was disclosed. Please see Sections 1-3 of this CPRA Notice.
• Specific Pieces of Personal Information: If you would like to know and access the specific pieces of Personal Information that we have collected about you, please contact us as described in Section 9 below. You may exercise this right up to two times in any 12-month period.
• Categories of Personal Information Sold: We do not sell any Personal Information obtained about you, nor have we done so in the past.
• Categories of Personal Information Shared: The categories of Personal Information shared for the purpose of cross-context behavioral advertising in the last twelve months are: Identifiers and Internet or other electronic network activity information.

b) Right to Request Deletion

You have the right to request deletion of your Personal Information. We will honor such request but might not be able to fulfill your request if we (or our service providers) are required to retain your Personal Information. Examples of such exceptions are:

• Completing a transaction or performing a contract we have with you;
• Detecting and addressing data security incidents, and repairing or upkeep of our IT systems;
• Protecting against fraud or other illegal activity;
• Complying with applicable law or a legal obligation, or to exercise rights under the law (e.g., the right to free speech); or
• Using your Personal Information internally to improve our Website.

c) Right to Request Correction

You have the right to request that we correct inaccurate Personal Information that we maintain about you. We will honor such request but might not be able to fulfill your request if it is impossible to do so or would involve disproportionate effort, or if we have a good-faith, reasonable, and documented belief that a request to correct is fraudulent or abusive.

d) Right to Opt-Out of the Sale and/or Sharing of Personal Information

You have the right to opt-out of the sale and/or sharing of your Personal Information. Please exercise your rights as set forth in Section 5 below.

e) Right to Limit the Use and Disclosure of Sensitive Personal Information

You have the right to limit certain ways in which a business uses and discloses sensitive Personal Information. Please note, however, that we only collect the information mentioned in this CPRA Notice, and do not use or disclose it for any purposes that are covered by this right (nor have we done so in the past).

f) Right to Designate an Authorized Agent

You have the right to submit a request through the use of an authorized agent. If you choose to do so, we may require that you (i) provide the authorized agent written permission to act on your behalf, and (ii) verify their identity directly with us. We may deny a request from an authorized agent that does not submit proof of authorization.

g) Right to Non-Discrimination

We will not discriminate against you for exercising any of your CPRA rights. We will not (i) deny you products or services, (ii) charge you different prices or rates for products or services, including through granting discounts or other benefits, or imposing penalties, (iii) provide you a different level or quality of products or services, and (iv) suggest that you may receive a different price or rate for products or services or a different level or quality of products or services.

a) Rights to Know, to Request Deletion, and to Request Correction of Personal Information

To exercise these rights, please submit a verifiable consumer request to us entitled "California Privacy Request," by using the following methods:

• Email us at privacy@iMemories.com; or
• Visit the following Internet Web page link https://www.imemories.com/cpra_request.

What we need to know to fulfill your request

The verifiable consumer request must: (i) provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative; and (ii) describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information related to you. Making a verifiable consumer request does not require you to create an account with us.

How you will hear back from us

We will confirm receipt of a verifiable consumer request within (10) business days of its receipt. We will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. If we require more time, we will notify you of the extension and provide an explanation of the reason for the extension in writing, and we will provide you with a response no later than ninety (90) calendar days of receipt of the request. If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We may charge a reasonable fee to process or respond to your verifiable consumer requests if they are excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will inform you of the reasons for this decision and provide you with a cost estimate before completing your request.

b) Right to Opt-Out of the Sale and/or Sharing of Personal Information

If you are 18 years of age or older, you have the right, at any time, to direct us to not sell/share your Personal Information (the "right to opt-out"). We do not knowingly sell/share the Personal Information of children under the age of 18. Consumers who opt-in to Personal Information sales/sharing may opt-out of future sales/sharing at any time. To exercise the right to opt-out, you (or your authorized representative) may submit a request to us by visiting the following Internet Web page link:

https://www.imemories.com/cpra_request

Once you make an opt-out request, we will not ask you to reauthorize Personal Information sales/sharing for at least twelve (12) months. However, you may change your mind and opt back in to Personal Information sales/sharing at any time by contacting us at privacy@iMemories.com.

You do not need to create an account with us to exercise your opt-out rights. We will only use Personal Information provided in an opt-out request to review and comply with the request.

iMemories does not offer any financial incentives.

Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to obtain certain information about the types of Personal Information that companies with whom they have an established business relationship (and that are not otherwise exempt) have shared with third parties for direct marketing purposes during the preceding calendar year, including the names and addresses of those third parties, and examples of the types of services or products marketed by those third parties. In order to submit such a request, please write to us at:

iMemories, LLC
9160 E. Del Camino Drive Suite B1
Scottsdale, AZ 85258

This CPRA Notice is effective as of the date of the Last Update stated at the top of this CPRA Notice. We may change this CPRA Notice from time to time with or without notice to you. By visiting or accessing the Website or otherwise engaging or interacting with us after we make any such changes to this CPRA Notice, you are deemed to have accepted such changes. Please be aware that, to the extent permitted by applicable law, and without prejudice to the foregoing, our use of your Personal Information is governed by the CPRA Notice in current effect. Please refer back to this CPRA Notice on a regular basis.

If you have any questions or comments about this CPRA Notice, the ways in which we collect and use your information, or your choices and rights regarding such use, please do not hesitate to contact us at:

• Email: privacy@iMemories.com
• Mail:
  iMemories, LLC
  9160 E. Del Camino Drive Suite B1
  Scottsdale, AZ 85258