Privacy Policy

1. INTRODUCTION

Slocalroots IP Holdings, LLC, a California company, respects your privacy and we are committed to protecting it through our compliance with this policy. The terms "we", "us" and "our" refer to Slo Cal Roots. The term "you" refers to the person visiting this website.

This privacy policy describes the types of information we may collect from you or that you may provide when you visit the "website" (https://www.Slocalroots.com), including any subdomains, and our practices for collecting, using, maintaining and organizing, protecting, deleting, and disclosing that information (collectively, "process" information). Some of this information may be considered "personal information" or "personal data" under applicable law, which is information that is about any individual, or from which any individual is identifiable ("personal information"). Some sections in this Privacy Policy apply only to persons subject to Regulation EU 2016/679 (the "GDPR"), namely residents of or persons located in the European Economic Area. Please read this policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, your choice is not to use our website. By accessing or using this website, you agree to this privacy policy. Capitalized terms not defined herein shall have the meaning ascribed to them in the Terms of Use.

2. PERSONS UNDER THE AGE OF 21

Our website is not intended for persons under 21 years of age. No one under age 21 may provide any information to or on the website. We do not knowingly collect personal information from persons under 21. If you are under 21, do not use or provide any information on this website or through any of its features, register on the website, or provide any information about yourself to us, including your name, address, telephone number, email address. If we learn we have collected or received personal information from a person under 21, we will delete that information. If you believe we might have any information from or about a person under 21, please contact us at info@slocalroots.com

3. TYPE OF INFORMATION WE COLLECT, PURPOSE AND LEGAL BASIS

3.1 WHAT PERSONAL INFORMATION DO WE COLLECT?

The categories of personal information and sources that we may collect are as follows:

Personal and contact details: We may collect identity data that you may provide to us, including your full name, email address, company name (if applicable), shipping address, telephone number, and date of birth.

Device Details: We may collect device type, operating system, browser type, browser settings, IP addresses, unique identifiers (such as VIN, MAC address and IDFA), language settings, dates and times of connection to our website and other technical communication.

Usage Details: We may collect records of your use of our website, including registration, details of content with which you interact, records f purchases made via the website, page views, clicked pages or links, your communication preferences. We may collect this information through use of cookies and other related technologies, as is further described in the "Cookies and Other Related Technologies" in section 9 below.

Payment details: We may collect credit card numbers, cardholder names, card security details, card expiry dates, and billing addresses that you provide to us or our third party payment processors.

Opinions, views and interests: We may collect comments, ratings, or reviews that you choose to send to us, post via our website, via a survey, or publicly post via social media platforms

Information collected from Third Parties: We may collect information from public sources, such as your public social media information; we may collect information about you directly from our vendors or our third party processors who collect information on our behalf.

Job Applicants: If you apply for a job with us, we may collect your name, contact details and other relevant information we request you provide to us, such as your demographics, past employment information, education and state ID.

Compassion Program applicants: If you apply for our Compassion Program, we may collect your name, date of birth, contact details, preferred store, whether you are applying as a patient or a caregiver, which medical document you hold (a doctor's recommendation or a county medical ID card), and whether cost makes it hard to get medicinal cannabis. We use this information only to review your application and contact you about it. We do not use it for marketing.

3.2 PURPOSE AND LEGAL BASIS

This section 3.2 only applies to data subjects that are protected under the GDPR. In processing your personal information in connection with the purposes set out in this policy, we rely on one or more of the following legal bases, depending on the circumstances:

• when processing is necessary for the performance of our contract with you or your designee.
• we have obtained your prior express consent to the processing (this legal basis is only used in relation to processing that is entirely voluntary – it is not used for processing that is necessary or obligatory in any way);
• in order to comply with applicable law and when necessary for the purposes of our legitimate interests;
• if we have a legitimate interest in carrying out the processing for the purpose of managing, operating or promoting our business, and that legitimate interest is not overridden by your interests, fundamental rights, or freedoms; or,
• the processing is necessary to protect the vital interests of any individual.

4. HOW WE USE YOUR INFORMATION

We may use, or disclose the personal information we collect for one or more of the following purposes:

Our website: operating and managing our website; providing content to you; displaying advertising and other information to you; and communicating and interacting with you via our website.

Provision of services to you: providing our website and other services to you, including fulfilling your purchase orders or other purposes for which you provided us the information; creating, maintaining, customizing and securing your account; improving and personalizing our content, products and services; providing you with support and respond to your inquiries.

Marketing communications: communicating with you via any means (including via email, telephone, text message, social media, mail) news items and other information in which you may be interested, subject to ensuring that such communications are provided to you in compliance with applicable law.

Communications and IT operations: communication with you; management of our communications systems; operation of IT security; and IT security audits.

Health, safety and legal compliance: to maintain the safety, security, and integrity of our website, products and services, databases and other technology assets, and business; compliance with legal obligations.

Analytics: to analyze and assess current and potential user markets; to create aggregated, de-identified and/or anonymized data.

Financial management: for sales, finance, corporate audit, and vendor management.

Surveys: engaging with you for the purposes of obtaining your views on our website, our services and products and industry views.

5. DISCLOSURE OF YOUR INFORMATION

We may disclose aggregated information about our users, and information that does not identify any individual, without restriction. We may disclose personal information that we collect or you provide as described in this privacy policy:

• To our subsidiaries and affiliates.
• To our trusted contractors and service providers we use to support our business, based on our instructions and in compliance with our privacy policy and any other appropriate confidentiality and security measures.
• To a buyer or other successor in the event of, or pursuant to negotiations in connection with, a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of Slo Cal Roots assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by Slo Cal Roots about our website users is among the assets transferred. We will notify you with any choices you may have regarding your information as a result of such events.
• With your consent.
• To comply with any court order, law, or legal process, including investigation of potential violations and to respond to any government or regulatory request.
• To detect, prevent or otherwise address fraud, security or technical issues.
• To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate to protect the rights, property, or safety of Slo Cal Roots, our customers, or others.
• For any other purpose disclosed by us when you provide the information.

6. HOW LONG WILL WE KEEP YOUR INFORMATION

To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, potential risk of harm from unauthorized use or disclosure of your personal information, purposes for which we process your personal information and whether we can achieve those purposes through other means, and applicable legal requirements.

We intend to keep your personal information for as long as necessary to fulfill the purposes set out in this privacy policy. We will retain and use your personal information to the extent necessary to provide the services to you, to improve and customize the services, to comply with our legal obligations (including retention and documentation obligations), resolve disputes and enforce our legal agreements and policies. In some circumstances we may anonymize your personal information (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

7. YOUR RIGHTS UNDER GDPR

This section 7 only applies to data subjects that are protected under the GDPR. You may exercise your rights by writing us an e-mail to info@slocalroots.com and simply informing us of the reason for your request and the right that you wish to exercise. We may request you to provide a copy of a document evidencing your identity if we deem necessary to be able to identify you. Subject to applicable law, you may have a number of rights regarding the processing of your personal information, including:

• the right to request access to, or copies of, your personal information that we process or control;
• the right to request rectification of any inaccuracies in your personal information that we process or control;
• the right to request, on legitimate grounds:
• erasure of your personal information that we process or control; or
• restriction of processing of your personal information that we process or control;
• the right to object, on legitimate grounds, to the processing of your personal information by us or on our behalf;
• the right to have your personal information that we process or control transferred to another controller, to the extent applicable;
• where we process your personal information on the basis of your consent, the right to withdraw that consent; and
• the right to lodge complaints with a Data Protection Authority regarding the processing of your personal information by us or on our behalf

8. LINKS TO THIRD PARTY WEBSITES

This website may also contain links to websites operated by other companies, including websites operated by our third-party service providers and distributors, and unrelated third parties. This privacy policy does not apply to personal information collected on any of these other websites. When you access third-party websites through a link on one of our websites, please review the privacy policy posted on that website.

9. COOKIES AND OTHER RELATED TECHNOLOGIES

Cookies are small text files a website stores on your device. We use them, along with similar technologies such as pixels and scripts, for three things.

Necessary cookies keep the site working. They remember that you confirmed your age, and they remember your cookie choice so we are not asking you again on every page. These cannot be turned off. Without them the site does not function.

Analytics cookies tell us how people use the site: which pages get visited, where visitors came from, and what content people read. We use Google Analytics for this. Analytics is on when you arrive, and you can turn it off.

Advertising cookies would let us show ads to people who have visited our site, and measure whether those ads worked. They stay off unless you turn them on. We do not turn them on for you.

Your choices. The first time you visit, a banner gives you two options. Accept turns on advertising cookies along with analytics. Only necessary turns analytics off and leaves advertising off.

You can change your mind whenever you want. Your Privacy Choices, at the bottom of every page, reopens that banner and shows you what is currently set. If you switch to Only necessary, we also delete the analytics cookies already on your device rather than just stopping new ones.

Global Privacy Control. If your browser sends a Global Privacy Control signal, we read it as an instruction not to sell or share your personal information, and advertising cookies stay off. That happens automatically. You do not have to do anything, and it overrides Accept.

Do Not Track. Separately, our website is not configured to respond to "do not track" browser settings. Do Not Track and Global Privacy Control are two different signals. We act on the second one.

You can also block cookies in your browser settings, though parts of the site may stop working properly if you do.

10. INTERNATIONAL TRANSFERS OF PERSONAL INFORMATION

Because of the international nature of our business, we may need to transfer your personal information to third parties as noted above (subject to binding contractual obligations, also considered "standard contractual clauses" where required by applicable law), solely in connection with the purposes set out in this policy. For this reason, we may transfer your personal information to other countries that may have different laws and data protection compliance requirements to those that apply in the country in which you are located.

11. CHANGES TO THIS PRIVACY POLICY

We may update this privacy policy periodically. If we make material changes, we will update you via our website, by email, or other communication. We encourage you to stay up to date about our privacy practices by reviewing this policy periodically. Continued use of our website following notices of changes to this policy indicates your acceptance of such changes and agreement to be bound by the updated policy terms.

12. YOUR CALIFORNIA PRIVACY RIGHTS

If you live in California, the California Consumer Privacy Act gives you specific rights over the personal information we hold about you.

What we collect. The full list of categories is in section 3. For most people visiting this website it comes down to two things: contact details you give us yourself, such as your email address when you sign up for our newsletter or send us a message, and internet activity, such as which pages you looked at and what brought you here.

Who we share it with. We share personal information with the service providers described in section 5. For this website that means the company that hosts the site, our analytics provider, and the company that runs our online menu. Each of them is only allowed to use it to do the job we hired them for.

We do not sell your personal information. Under California law, "sharing" also covers handing information to advertising companies so they can show you ads on other websites. We do not currently do that. If that changes, we will say so here, and the control below will turn it off for you.

Your rights. You can ask us to:

• Tell you what we have. What personal information we collected about you, where it came from, why we have it, and who we shared it with.
• Delete it. We will, apart from the narrow cases the law lets us keep, such as records we are required to hold.
• Correct it, if something we hold about you is wrong.
• Stop selling or sharing it. See the control below.
• Treat you the same either way. We will not deny you service, charge you a different price, or give you worse service because you used any of these rights.

How to ask. Email info@slocalroots.com or call any of our three stores. We will confirm who you are before we act, which normally means matching details we already hold. Someone you authorize can make a request on your behalf.

Your Privacy Choices. To stop the sale or sharing of your personal information, use the Your Privacy Choices link at the bottom of any page and choose Only necessary. If your browser sends a Global Privacy Control signal, we treat that as the same request and act on it automatically.

Last updated: October 7, 2026

13. CONTACT INFORMATION

If you have questions or concerns regarding this privacy policy, please contact us at info@slocalroots.com