Welcome

This Privacy Policy (“Policy”) explains how we collect, use, store, protect, and share your personal information through our services. Based, Inc. is the data controller of the personal information collected through the services (as defined in our Terms of Service (“Terms”). Based, Inc. is referred to in this Policy as “Based”, “we”, “our” or “us”.

How we handle your information depends on which services you use, and how you use them. This Policy is grouped into these sections:

• about us and this Policy;
• information we collect & why we use it;
• our disclosures of information to others;
• how to control your privacy; and
• information about local privacy laws.

We encourage you to read this Policy carefully. If you have questions, please contact us. To exercise your privacy rights online, use our Data Subject Request form.

About Us and this Policy

This Policy is designed to explain how we process your personal information and how you can exercise control over our processing. Capitalized terms that are used but not defined in this Policy are defined in our Terms. The Terms describe how the Services work in general, and establish a contract between you and us governing your use of the Services.

Contact Us

If you have any questions or feedback about this Policy, contact us write to us at: Based Bodyworks, Inc. at 11750 Wilshire Boulevard, Los Angeles, CA, 90025. To exercise your privacy rights online, use our Data Subject Request form.

Changes to this Policy

Because the Services change often, this Policy may change over time. Anytime we modify the Policy, we post a revised version on the Services, as noted at Last Update above.

If we intend to materially change our collection or use of your information, we will notify you before the material changes to this Policy take effect, so you have time to review them. If we have your contact information (such as your email), we’ll try to notify you that way. We may also post a temporary notice on the Services, or notify you by other means to the extent required by law.

Check the Last Update periodically to ensure you’re aware of the current Policy. By using or accessing the Services, you signify that you have read, understand and agree to be bound by this Policy and the Terms.

When this Policy applies

This Policy applies to you when you use the Services, effective as of the Last Update. However, some collection and use of information falls outside this Policy:

• Outside services: The Services link to, embed, integrate or otherwise connect you with third-party websites, services or other events or activities that are not owned or controlled by Based (“Outside Materials”). Outside Materials are not part of the Services. This Policy doesn’t apply to any information you may exchange with providers of Outside Materials. Those third parties have their own policies and practices about data. We encourage you to familiarize yourself with their privacy notices and applicable contractual terms.
• Our personnel: If you are a current or former employee or contractor of ours, this Policy does not apply to you. Reach out to hr@based.com with any inquiries about your personal information.
• When we don’t control your information: If we receive your information in our role as a service provider to another business, our agreement with that business governs our use of your information. We will refer any questions or concerns of yours to that business.

Information we collect & why we use it

We and our third-party service providers collect and process information when you interact with the Services. This includes:

• information you submit or provide directly,
• data collected automatically by various technologies (which we call “Usage Data”), and
• information we receive or infer from other sources.

The following tables describe, comprehensively, how the services collect and use your information, and the purpose behind that processing.

Information You Submit

What we collect

Account management data — login credentials, permissions, and account actions (such as when you create and log into your account, service requests you make, and your changes to your account).

How we use it

We collect, analyze, process, and store your account management data.

Why we process it

To create and maintain an account at your direction.

Legal basis

Account management data is processed as part of the performance of a contract.

Retention

Account lifetime, or as applicable law requires

What we collect

Product & order data — products you’ve purchased, browsed or put in your cart

How we use it

We collect, analyze, and store your product & order data.

Why we process it

To create and maintain an account at your direction.

Legal basis

Product & order data is processed as part of the performance of a contract.

Retention

Account lifetime, or as applicable law requires

What we collect

Communication data — interactions with or through Based, via our SMS, support, or email service providers

How we use it

We collect, analyze, process, profile and store your communication data.

Why we process it

To send you relevant marketing emails. To improve our Services.

Legal basis

Our legitimate interests in providing a valid and relevant service to our users and in continuing to improve our products and services. We provide an opt-out so you can object to marketing messages.

Retention

Account lifetime

What we collect

Product survey, feedback and satisfaction data — including surveys, ratings and plain text feedback on how we can improve our Services.

How we use it

We process, review, store, and analyze feedback and satisfaction data.

Why we process it

To tailor product and routine recs to your preferences and needs. To inform our product roadmap and services with user feedback.

Legal basis

Our legitimate interest in operating, managing, and improving our Services.

Retention

Account lifetime

Usage Data

What we collect

Device information — IP address, device identifiers, user agent.

How we use it

We collect, process and store your device information.

Why we process it

For fraud prevention. To administer your account and tailor the Services based on your geography.

Legal basis

Our legitimate interests in keeping our services safe and secure and to provide a valid and relevant service to our users. We only collect imprecise location data, and only when you have not indicated that you do not wish to share it.

Retention

Account lifetime; otherwise, deleted in the ordinary course

What we collect

Activity data — the Web page you came from, the URL you go to next, your interactions with content or advertising on the Services, and the time and duration of the activity.

How we use it

We collect, analyze, process, and store activity data, including via automated means.

Why we process it

For fraud prevention. To improve our Services.

Legal basis

Our legitimate interests in understanding how users interact with and use our Services; and keeping our Services safe and secure. Activity data is monitored to prevent malicious and fraudulent activity and unauthorized use on our Services as part of the performance of a contract.

Retention

Account lifetime; otherwise, periodically deidentified and/or deleted in the ordinary course

Information We Receive From Others

What we collect

Social Login data — if you use a Social Login (like an external Shop account) to log into your Based account we collect name, profile picture, public profile information, and email address

How we use it

We process and store information collected from your Social Login account

Why we process it

To make signing into and using the Services easier and more secure. To authenticate you as a user of both Based and the third party, and to populate your account or profile as you instruct

Legal basis

Consent — If you no longer wish to share data with Based from your Social Login account, you can adjust what your Social Login communicates to the Services or, in most circumstances, migrate to direct, Based-based authentication.

Retention

Account lifetime, or until you unlink your accounts

What we collect

Analytics and advertising data — we receive unique identifiers and demographic, location and interest-based info

How we use it

We receive and process analytics and advertising data from providers of advertising, analytics and technical services. In many cases, Based cannot, or does not, associate this data with information you’ve provided

Why we process it

To present advertising relevant to your interests. To develop and enrich datasets about visitors, users and others

Legal basis

Our legitimate interest in operating a low or no-cost service and presenting you with products and offers tailored to your preferences, history and/or demography.

Retention

Advertising and analytics data collected by third parties and Outside Materials are, in general, periodically deleted in the ordinary course of business

What we collect

Affiliate & Referral Data — Referral links, affiliate identifiers, reward or commission status, and payout information.

How we use it

We track and attribute referrals, manage rewards or commissions, and prevent fraudulent referrals.

Why we process it

To administer our loyalty and referral programs. To verify legitimate referrals and rewards.

Legal basis

Our legitimate interests in operating promotional and referral programs, and performance of a contract with participants.

Retention

Periodically deleted in the ordinary course of business

What we collect

Purchase & Delivery Data — we receive information about your payments, such as partial payment-card details, and the shipment and delivery of orders, from payment processors and logistics partners

How we use it

We receive purchase data from providers of technical, payment and delivery services

Why we process it

To associate purchases with your account or profile. To validate purchases and interactions attributable to activity on the Services

Legal basis

As part of the performance of a contract and our legitimate interest in operating, managing, and improving our Services.

Retention

Account lifetime, or as long as applicable law requires

Any personal information that Based obtains from other third-party sources will be processed by Based in accordance with this Policy and all applicable laws. For example, our use and transfer of information via Google APIs will adhere to the Google API Services User Data Policy, including its Limited Use requirements.

Technologies we use

When you use and interact with the Services, software automatically collects Usage Data. To give you more insight, this section summarizes the main types of technologies the Services to generate and collect Usage Data:

Cookies and Local Storage

Cookies and local storage may be set and accessed on your device. Upon your first visit to the Services, a cookie or local storage will be sent to your device that uniquely identifies your browser. “Cookies” and local storage are small files containing a string of characters that is sent to your computer’s browser and stored on your device. Cookies map predetermined fields to custom values based on your visit or interactions with the web service that writes the cookie. Most web services use cookies to provide useful features for their users, like remembering you when you return to a website.

Most browsers are initially set up to accept cookies. You can configure your browser to refuse some or all cookies or to indicate when a cookie is being sent; however, if you reject cookies, the Services may not remember you when you visit, and you may be unable or take full advantage of our Services.

Pixel Tags

The Services also use “pixel tags,” which are small graphic files that allow us and third parties to monitor the use of the Services and collect Usage Data. A pixel tag can collect information such as the IP address of the device that downloaded the page on which the tag appears; the URL of the page on which the pixel tag appears; the time (and length of time) the page containing the pixel tag was viewed; the type of browser that retrieved the pixel tag; and the identification number of any cookie previously placed by that server on your device.

App Technologies, Customization, and Usage

Our apps collect information about your installation, use, and updating of our apps as well as information about your device, including your unique mobile device identifier (“UDID”) and other technical identifiers. More specifically, these tracking technologies allow us to collect data about your device, your use of our apps, and the content you interact with.

These app-based technologies cannot be controlled by browser settings. For example, our apps may include third party SDKs, which is code that sends information about your use to a server, and is in effect the app version of a pixel. These SDKs allow us to track our conversions and communicate with you across devices, bring you advertising both on and off the Services, customize the app to your interests and preferences and link such across platforms and devices, and provide you with additional functionality, such as the ability to connect our Services with your Social Login.

Security

Based has implemented technical, administrative and physical security measures designed to protect your information from unauthorized access, use or disclosure. Still, no data transmission online is 100% secure, so we cannot guarantee or warrant the security of any information you provide, and you do so at your own risk. We cannot promise that your information will remain absolutely secure in all circumstances. We are not responsible for the circumvention of any privacy settings or security measures we may provide.

Our disclosures of information to others

This section describes how and why we exchange personal information with contractors and third parties. It also describes our disclosures for marketing and advertising efforts and for legal reasons. We also often disclose deidentified and/or anonymized data for these purposes.

Functional disclosures

We also contract with other businesses to provide certain services related to the functionality and features of the Services, including payment processing, email and hosting services, software development, shipping and fulfillment, data management, and administration of contests and other promotions. We refer to them as “contractors.”

Contractors may collect information about you on our behalf, such as Personal Identifiers, Commercial Information, Internet Activity and Device Information, as necessary for them to perform their services. At other times, we disclose information about you to contractors.

Contractors are not permitted to use information about you for any purpose other than performing their services for us. In the past twelve (12) months, we have disclosed these types of information to the following types of contractors:

• Analytics providers, namely TikTok Analytics and Merchant Center Analytics, to tell us how the Services is doing, such as which parts interest visitors and how long they visit before leaving. Among other data, they may receive your IP address.
• Various hosting services and data processors to provide the infrastructure of the Services, such as Shopify, which ensures that traffic is from real people, not computers. Among other data, they may receive your IP address.
• Payment providers, namely Shop Pay, PayPal, and Google Pay to process payments between you and us, such as for subscriptions or products. These providers receive information about your order in order to tie your payment process to your order. We don’t receive all of the information you may provide to them as part of that process (for instance, we don’t receive full payment-account numbers).
• Marketing providers, such as Google Dynamic Remarketing, to send marketing communications to the email or phone number you provide.
• Loyalty providers to power our rewards and loyalty programs.
• Support providers, namely Klaviyo and UserWay, to provide assistance to you when you request it. They are able to retrieve information about you that is relevant and necessary to your requests, such as account information and order details.

For marketing purposes

We use and disclose your information for marketing purposes in the following ways:

Direct marketing

We may disclose your contact information to trusted third party partners for their direct marketing purposes, including on a case-by-case opt-in basis. You may have the right to learn which third parties have received your information for direct-marketing purposes. For more, see Your Local Privacy Rights. We may share information about you with third party sponsors or partners who will use it for marketing purposes, but only if you opt in to such sharing (and will only do so until you opt out) or do not opt out when prompted. We will never share information in this manner without giving you one of these two options.

Targeted ads

We share information with advertising partners to make the advertising presented to you more relevant to you. We also market the Services to you through ads facilitated by marketing vendors.

For example, we use Google to serve ads on the Services and we may market the Services to you on third party services through Google. Google uses cookies or unique device identifiers, in combination with their own data, to show you ads based on your visits to our webpages and to other sites. You can opt out of the use of the Google cookie by visiting the related Google privacy policy.

We try to limit how our third-party advertising technology vendors use information they collect from you. Most providers require us to enter contracts that allow them to optimize their ad services and products. Essentially, they combine any information they may gather about you through our Services with information they receive from their other clients. This helps them target ads to you on behalf of their other clients, not just us. In the past twelve months, we have shared these categories of personal information with third parties to personalize advertising:

• Device Information (including Personal Identifiers)
• Commercial Information
• Internet Activity
• Geolocation

With your consent or at your request

We may periodically ask for your consent to share your contact information to third parties. Whenever we ask your consent for this reason, we will summarize the purpose and scope of the disclosure. For example, we may offer discounts to you if you consent to join our mailing list or participate in a promotion involving direct marketing communications.

In those cases, the Services will display a tickbox near an email-entry field explaining that by submitting your information, you agree to share your email with the content provider.

To be clear, we only exchange information about you with third parties for direct marketing purposes if you opt in, and will only do so until you opt out.

For legal reasons

Finally, we may disclose personal information:

• In response to subpoenas, court orders, or other legal process; to establish or exercise our legal rights; to defend against legal claims; or as otherwise required by law. In such cases, we reserve the right to raise or waive any legal objection or right available to us;
• When we believe it is appropriate to investigate, prevent, or take action regarding illegal or suspected illegal activities; to protect and defend the rights, property, or safety of our company, our users, or others; and in connection with the enforcement of our Terms and other agreements; or
• In connection with a corporate transaction, such as a divestiture, merger, consolidation, or asset sale, or in the unlikely event of bankruptcy.

How long we retain your information

We retain your information only as long as we need it for the purposes described under Information we collect & how we use it, except when longer retention is required by our compliance policies and efforts toward applicable legal, tax, accounting and regulatory requirements.

How long we need information for those purposes varies by category, and even within categories. These retention determinations always consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from its unauthorized use or disclosure and whether we can achieve those purposes without using the personal information.

• For example, we delete some Usage Data as soon as you exit the Services, whereas we may retain records of your orders for services and products for several years as required by law or contract, such as agreements with our payment processors or under our accounting standards.

Use by minors

The Services are intended for adult users. We do not knowingly collect information from anyone under the age of 16, and we do not share or sell information about anyone under 16 without affirmative authorization. If we learn that we have collected information from a person under age 16, we will delete that information as quickly as possible.

• If you are under 16: sorry, but please leave the Services. If you’ve already sent us information, please contact us first so we can delete it.
• If you are a parent or guardian of a person under 16 years of age and you believe that person provided information to us, please contact us.

How to control your privacy

In General

As a user of the Services, you have rights and choices about your personal information. We want you to be in control of your information, so we want to remind you of the following options and tools available to you:

• Account controls: You can update the personal information in your Account through the account settings made available on the services. Any updated information will be reflected in our records and throughout the services promptly.
• Marketing opt-outs: you may opt-out of any marketing communications from us by following the unsubscribe instructions in the communication you receive. We may continue to send you communications regarding the Services, such as notices about administrative updates, transaction reports, and changes to the Services, this Policy or the Terms.
• Exercising rights: If any of the local privacy laws listed below apply to you, see Requesting information to exercise your rights. These rights are provided only to human account holders, and are not available to employers or other legal entities, except as required by law.
• Disallowing Location Data Collection: When you access certain Services, you may consent to share your precise (GPS level) geolocation with us so we can customize your experience and the content you receive. You may change your location sharing settings at the browser or device level at any time.
• Personalized ads: In addition to any choices the services offer you, there are several ways to exercise choice regarding technologies that are similar to cookies, such as browser storage and plugins (for example, HTML5, IndexedDB, and WebSQL). For example, many popular browsers provide the ability to clear browser storage, typically in the settings or preferences area. See your browser’s help function or support area to learn more. For more about targeted advertising, go to the DAA Webchoices Browser Check or the NAI Opt Out of Interest-Based Advertising page. You can download the AppChoices app to opt out in mobile apps.

International Data Transfers

If you reside outside the United States, we transfer information about you for processing in the United States. By providing your information to us, you consent to the processing of the information in the United States. The transfer of this information to the United States is necessary for the performance of our contract for use of the Services.

• When we transfer personal data subject to GDPR outside of Based, we use standard contract clauses approved by the EU for this purpose, or another appropriate transfer mechanism.
• U.S. law is not equivalent to laws in other countries, such as GDPR in Europe or PIPEDA in Canada. As of the Last Update, the U.S. has not been deemed an ‘adequate’ jurisdiction under GDPR for the purposes of international data transfers.

Information about local privacy laws

The Services operate from the United States, but this Policy applies worldwide. Our practices generally do not differ based on your location, but your rights and choices depend in part on the law where you live.

If any of these local privacy laws apply to you, that section overrides any contrary descriptions elsewhere in the Policy as they relate to you. If you have questions about your rights under other data privacy laws, please contact us.

Requesting information

Submitting requests

To exercise any rights described in this Policy, please contact us. Your request must:

• provide sufficient information to identify you and the law that applies to you, such as your name, e-mail address, home or work address, or other information we maintain.
• not include social security numbers, driver’s license numbers, third-party account numbers, credit or debit card numbers, or health information.

Verifying requests

We verify requests by attempting to match information in the request to information we maintain. We may require you to confirm your identity by authenticating via your account or other access method.

• If your request is unclear or we are unable to authenticate your identity, we may ask for more information, in accordance with the law that applies to you.
• If you are an authorized agent submitting a request on a user’s behalf (where permitted), we may require proof of the user’s written authorization before processing the request.
• If we cannot verify the identity of the data subject in the request, we may deny it, in full or in part.

Responses to requests

We will respond to your request as quickly as we can, taking into account the nature of your request and the volume of pending requests. The content of our response will vary with the nature of your request, but we will always respond in accordance with any deadlines or requirements specified by the laws that apply to you.

• At times, we may be unable to provide responsive personal information, such as when disclosure would create a substantial, articulable and unreasonable risk to the security of the information, user accounts, or the security of our systems or networks. We do not disclose account passwords or any other non-personal information that enables access to an account.
• We reserve the right to retain an archive of any deleted information, to the extent permitted by law. We may also retain deidentified or aggregate data derived from personal information.

Appealing decisions

Residents of jurisdictions that provide for an appeal mechanism may appeal a decision we have made regarding their requests by contacting us.

Information for Users in Certain U.S. States

Exercising your rights: As described in the “How to control your privacy” section of the Policy, all users have control over their information and can limit what data we process. If you are a resident of California, Colorado, Connecticut, Utah, Virginia or another state with a similar data-privacy law, you may have additional rights that you (or, in certain states, an authorized agent acting on your behalf) can exercise by contacting us, including the right to:

• Access and/or receive a copy of certain personal information about the categories and specific pieces of personal information we have collected and disclosed for a business purpose in the last 12 months
• Access and/or receive a copy of certain personal information we hold about you
• Correct your personal information
• Delete certain personal information we hold about you
• Receive information about the financial incentives that we offer to you, if any
• Opt out of the processing of your personal information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects, if applicable

You also have the right to not be discriminated against for exercising your rights. You may also have the right to opt out of “sales” of your information and “sharing/processing of your information for targeted advertising.”

Certain information may be exempt from the requests above under applicable law. For example, we need to retain certain information in order to provide our services to you. We also need to take reasonable steps to verify your identity before responding to a request.

If you have any questions about these rights, wish to exercise them, or request an appeal, see Requesting information or contact us.

Additional Information for Users in California

In addition to the rights described above, consumers residing in California are afforded the right to certain additional information with respect to their personal information under laws like the California Consumer Privacy Act (“CCPA”). If you are a California resident, this section applies to you.

Our collection and use of personal information: Information we collect falls into these CCPA-defined categories of personal information:

• identifiers (such as your username and the identifiers you use to sign up, like your email address, social login and/or phone number);
• commercial information (a record of what you’ve bought from Based, if anything);
• financial data (payment records and your history of purchases from Based);
• internet or other network information (how you interact with the services);
• location information (for example: as inferred from your IP address, or your precise location, if you grant us access to precise location data);
• inference data about you (for example, what content you may be interested in); and
• other information that identifies or can be reasonably associated with you.

For more information about what we collect and the sources of such collection, please see the “Information we collect & why we use it” section of the Privacy Policy. To the extent we collect or use sensitive personal information as defined by law (such as the CCPA), we do so in accordance with applicable legal requirements, and we do not use or disclose it other than for purposes for which there is not a right to limit under the CCPA.

Disclosure of personal information: We may disclose and share your personal information with service providers and third parties as described in the “Our disclosures of information to others” section of the Policy. We disclose the categories of personal information mentioned in that section for business or commercial purposes.

• Sale or “share” of personal information: The CCPA sets forth certain obligations for businesses that sell or “share” personal information. We do disclose certain information as outlined in the “Our disclosures of information to others” section of the Policy.
• We disclose personal information for the following categories of purposes, as defined by CCPA:

• Advertising and Marketing
• Error Management
• Internal Research
• Provide Products or Services
• Quality Assurance
• Security
• Short-Term Transient Use
• We retain personal information as described in the “How long we retain your information” section of the Policy.

California’s ‘Shine the Light’ law. Under certain circumstances, Californians can request information about third parties who’ve received contact information and certain other types of personal information (as defined in the Shine the Light law), for their direct marketing purposes. We only share your personal information with third parties for their own direct marketing purposes with your consent and, if you have consented, only until you withdraw your consent. Consensual disclosures for direct marketing are generally exempt from Shine the Light’s disclosure requirement.

If you have any questions about these rights, wish to exercise them, or request an appeal, see Requesting information or contact us.

Information for Users in the U.K., European Union and Switzerland

Overview: As described in the “How to control your privacy” section of the Policy, all our users have control over their information and can limit what data we process. In addition to these rights, users residing in the European Union and Switzerland are afforded the right to certain additional information with respect to their personal information under the GDPR. If you reside in any of those jurisdictions, this section applies to you.

Data retention and destruction: We retain personal information until we determine it is no longer necessary for (1) the processing purposes justifying its collection or (2) legal compliance purposes.

Exercising your rights: All our users have control over their information and can directly edit or delete information from their account and limit what data we process. Users in the European Union and Switzerland have additional rights that you can exercise by contacting us. Those rights include:

• Right of access to your personal data
• Right to rectify your personal data if they are incorrect
• Right to erase your personal data
• Right to limit the processing of your personal data
• Right to the portability of your personal data
• Right to object to the processing of your personal data
• Right to withdraw consent. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.

If you have any questions about these rights, wish to exercise them, or request an appeal, see Requesting information or contact us. Additionally, you may contact Based’s Privacy Officer by emailing support@basedbodyworks.com.

Information for users in Brazil

Overview: As described in the “How to control your privacy” section of the Policy, all our users have control over their information and can limit what data we process. In addition to these rights, users residing in Brazil are afforded the right to certain additional information with respect to their personal information under the Lei Geral de Proteção de Dados (LGPD). If you are a Brazilian resident, this section applies to you.

Exercising your rights: All our users have control over their information and can directly edit or delete information from their account and limit what data we process. Users in Brazil have additional rights that you can exercise by contacting us. Those rights include:

• Right of access to your personal data
• Right to rectify your personal data if it is incorrect
• Right to erase your personal data
• Right to limit the processing of your personal data
• Right to the portability of your personal data
• Right to object to the processing of your personal data
• Right to withdraw consent. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal
• Right to the review of decisions based on the processing of personal data carried out exclusively by automated means

Questions or concerns about your privacy? You can email us at support@basedbodyworks.com.

Information for users in Canada

Overview: As described in the “How to control your privacy” section of the Policy, all our users have control over their information and can limit what data we process. In addition to these rights, users residing in Canada are afforded the right to certain additional information with respect to their personal information under the Personal Information and Electronic Documents Act (PIPEDA). If you are a Canadian resident, this section applies to you.

Exercising your rights: Users in Canada have additional rights that you can exercise by contacting us. Those rights include:

• Right of access to your personal data
• Right to rectify your personal data if they are incorrect
• Right to withdraw consent. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal
• Right to file a complaint regarding the processing of your personal data with the Office of the Privacy Commissioner of Canada

If you have any questions about these rights, wish to exercise them, or request an appeal, see Requesting information or contact us. Additionally, you may contact Based’ Privacy Officer by emailing support@basedbodyworks.com.

Information for Users in the Republic of Korea

Overview: As described in the “How to control your privacy” section of the Policy, all our users have control over their information and can limit what data we process. In addition to these rights, users residing in the Republic of Korea are afforded the right to certain additional information with respect to their personal information under the Personal Information Protection Act. If you are a Republic of Korea resident, this section applies to you.

Data retention and destruction: We retain personal information until we determine it is no longer needed for the processing purposes for which we collected or retain it or for legal compliance.

Exercising your rights: All our users have control over their information and can directly edit or delete information from their account and limit what data we process. Users in the Republic of Korea have additional rights that you can exercise by contacting us. Those rights include:

• Right of access to your personal data
• Right to rectify your personal data if they are incorrect
• Right to erase your personal data
• Right to limit the processing of your personal data
• Right to the portability of your personal data
• Right to object to the processing of your personal data
• Right to withdraw consent. Withdrawing consent does not affect the lawfulness of processing based on consent before withdrawal.