Rowan, Inc. Privacy Policy

Changes to our Privacy Policy

From time to time, we may clarify, revise or update this Privacy Policy to reflect changes in the law, our data collection and use practices, the features of our Services, or advances in technology. If we make such a change, we will revise the effective date listed at the top of this Privacy Policy and the change will become effective once posted. If we make a material change to the Policy, you will be provided with appropriate notice in accordance with legal requirements. By continuing to use the Services, you are confirming that you have read, understood and agreed to the latest version of this Privacy Policy.

Privacy Policy Table of Contents

What This Privacy Policy Covers

This Privacy Policy covers how we treat Personal Data that we gather when you access or use our Services. "Personal Data" means any information that identifies or relates to a particular individual and also includes information referred to as "personally identifiable information" or "personal information" under applicable data privacy laws, rules or regulations. This Privacy Policy does not cover the practices of companies we don't own or control or people we don't manage.

Collection Of Personal Data

Categories of Personal Data We Collect

This chart details the categories of Personal Data that we collect and have collected over the past 12 months:

Sources of Personal Data

Directly From You.

• Make a piercing appointment on our Site or while visiting our studios;
• Purchase a product or sign up for an account on heyrowan.com or in our stores;
• Contact customer service via email, call or chat or otherwise make use of our customer support tools, including before or after a piercing appointment;
• Connect, link, message, or "share" our Site via social networking sites;
• Post comments or product reviews in public areas of our Site;
• Sign up for emails;
• Fill out forms or surveys or sign-up for and participate in events, contests, promotions and special programs we may provide;

Automatically.

• Through Cookies (as defined in the "Tracking Tools, Advertising and Opt-Out" section below).
• If you use a location-enabled browser, we may receive information about your location.
• Through closed circuit video surveillance camera installed in our studios;

Social Networking Platforms.

Shopify.

Vendors, Advertising Partners and other Third Parties.

Use of Personal Data

We use your Personal Data in ways that are compatible with the purposes for which it was collected or authorized by you.

Providing, Customizing and Improving the Services.

• Creating and managing your account or other user profiles.
• Processing orders or other transactions; billing.
• Providing you with the products, services or information you request.
• Meeting or fulfilling the reason you provided the information to us.
• Providing support and assistance for the Services.
• Improving the Services, including testing, research, internal analytics and product development.
• Personalizing the Services, website content and communications based on your preferences.
• Doing fraud protection, security and debugging.
• Carrying out other business purposes stated when collecting your Personal Data or as otherwise set forth in applicable data privacy laws, such as the California Consumer Privacy Act, as amended by the California Privacy Rights Act of 2020 (the "CCPA").

Marketing the Services

• Marketing and selling the Services.
• Showing you advertisements, including interest-based or online behavioral advertising.

Corresponding with You

• Responding to correspondence that we receive from you.
• Contacting you when necessary or requested.
• Sending you information about Rowan or the Services.
• Sending emails and other communications according to your preferences or that display content that we think will interest you.

Meeting Legal Requirements and Enforcing Legal Terms

• Collecting necessary forms of identification or other paperwork prior to piercing;
• Fulfilling our legal obligations under applicable law, regulation, court order or other legal process, such as preventing, detecting and investigating security incidents and potentially illegal or prohibited activities.
• Protecting the rights, property or safety of you, Rowan or another party.
• Enforcing any agreements with you.
• Responding to claims that any posting or other content violates third-party rights.
• Resolving disputes.

If you are a California resident, please note that we do not collect your "sensitive personal information" as defined under the CCPA.

Disclosure Of Personal Data

We disclose your Personal Data to the categories of service providers and other parties listed in this section. Depending on state laws that may be applicable to you, some of these disclosures may constitute a "sale" of your Personal Data. For more information, please refer to the state-specific sections below.

Service Providers.

• Hosting, technology and communication providers.
• Security and fraud prevention consultants.
• Support and customer service vendors.
• Product fulfillment and delivery providers.
• Payment processors.
  • Our payment processors collect your voluntarily-provided payment card information necessary to process your payment. Our payment processing partner is Shopify Payments whose subprocessor is Stripe, Inc. ("Stripe"). Please see Stripe's terms of service and privacy policy for information on its use and storage of your Personal Data as well as the subsection above titled "Shopify."

Advertising Partners.

• Ad networks.
• Data brokers.
• Marketing providers.

Analytics Partners.

• Companies that track how users found or were referred to the Services.
• Companies that track how users interact with the Services.

Parties You Authorize, Access or Authenticate

• Third parties you access through the services.
• Social media services.
• Other users.

Legal Obligations.

Business Transfers.

Data that is Not Personal Data.

Tracking Tools, Advertising And Opt-Out

The Services use cookies and similar technologies such as pixel tags, web beacons, clear GIFs and JavaScript (collectively, "Cookies") to enable our servers to recognize your web browser, tell us how and when you visit and use our Services, analyze trends, learn about our user base and operate and improve our Services. Cookies are small pieces of data- usually text files - placed on your computer, tablet, phone or similar device when you use that device to access our Services. We may also supplement the information we collect from you with information received from third parties, including third parties that have placed their own Cookies on your device(s). Please note that because of our use of Cookies, the Services do not support "Do Not Track" requests sent from a browser at this time.

We use the following types of Cookies:

• Essential Cookies. Essential Cookies are required for providing you with features or services that you have requested. For example, certain Cookies enable you to log into secure areas of our Services. Disabling these Cookies may make certain features and services unavailable.
• Functional Cookies. Functional Cookies are used to record your choices and settings regarding our Services, maintain your preferences over time and recognize you when you return to our Services. These Cookies help us to personalize our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our Services. They do this by collecting information about the number of visitors to the Services, what pages visitors view on our Services and how long visitors are viewing pages on the Services. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the Services' content for those who engage with our advertising. For example, Google LLC ("Google") uses cookies in connection with its Google Analytics services. Google's ability to use and share information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google's use of Cookies by visiting the Google advertising opt-out page at www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.
• Performance/Analytical Cookies. Performance/Analytical Cookies allow us to understand how visitors use our Services. They do this by collecting information about the number of visitors to the Services, what pages visitors view on our Services and how long visitors are viewing pages on the Services. Performance/Analytical Cookies also help us measure the performance of our advertising campaigns in order to help us improve our campaigns and the Services' content for those who engage with our advertising. For example, Google LLC ("Google") uses cookies in connection with its Google Analytics services. Google's ability to use and share information collected by Google Analytics about your visits to the Services is subject to the Google Analytics Terms of Use and the Google Privacy Policy. You have the option to opt-out of Google's use of Cookies by visiting the Google advertising opt-out page at www.google.com/privacy_ads.html or the Google Analytics Opt-out Browser Add-on at https://tools.google.com/dlpage/gaoptout/.
• Retargeting/Advertising Cookies. Retargeting/Advertising Cookies collect data about your online activity and identify your interests so that we can provide advertising that we believe is relevant to you. For more information about this, please see the section below titled "Information about Interest-Based Advertisements."

Universal Opt-Out Signals.

You can decide whether or not to accept Cookies through your internet browser's settings. Most browsers have an option for turning off the Cookie feature, which will prevent your browser from accepting new Cookies, as well as (depending on the sophistication of your browser software) allow you to decide on acceptance of each new Cookie in a variety of ways. You can also delete all Cookies that are already on your device. If you do this, however, you may have to manually adjust some preferences every time you visit our website and some of the Services and functionalities may not work.

To explore what Cookie settings are available to you or to modify your preferences with respect to Cookies, you can access your Cookie management settings by clicking on the link titled "Your Privacy Choices." To find out more information about Cookies generally, including information about how to manage and delete Cookies, please visit http://www.allaboutcookies.org/.

Information about Interest-Based Advertisements:

We may serve advertisements, and also allow third-party ad networks, including third-party ad servers, ad agencies, ad technology vendors and research firms, to serve advertisements through the Services. These advertisements may be targeted to users who fit certain general profile categories or display certain preferences or behaviors ("Interest-Based Ads"). Information for Interest-Based Ads (including Personal Data) may be provided to us by you, or derived from the usage patterns of particular users on the Services and/or services of third parties. Such information may be gathered through tracking users' activities across time and unaffiliated properties, including when you leave the Services. To accomplish this, we or our service providers may deliver Cookies, including a file (known as a "web beacon") from an ad network to you through the Services. Web beacons allow ad networks to provide anonymized, aggregated auditing, research and reporting for us and for advertisers. Web beacons also enable ad networks to serve targeted advertisements to you when you visit other websites. Web beacons allow ad networks to view, edit or set their own Cookies on your browser, just as if you had requested a web page from their site.

We comply with the Digital Advertising Alliance ("DAA") Self-Regulatory Principles for Online Behavioral Advertising. Through the DAA and Network Advertising Initiative ("NAI"), several media and marketing associations have developed an industry self-regulatory program to give consumers a better understanding of, and greater control over, ads that are customized based a consumer's online behavior across different websites and properties. To make choices about Interest-Based Ads from participating third parties, including to opt-out of receiving behaviorally targeted advertisements from participating organizations, please visit the DAA's or NAI's consumer opt-out pages, which are located at http://www.networkadvertising.org/choices/.

Data Security

We seek to protect your Personal Data from unauthorized access, use and disclosure using appropriate physical, technical, organizational and administrative safeguards based on the type of Personal Data and how we are processing that data.

Although we undertake reasonable steps designed to protect your Personal Data, no security system or means of transmitting data over the Internet can be guaranteed to be entirely secure (including without limitation with respect to computer viruses, malicious software and hacker attacks). We cannot and do not guarantee or warrant the security of your Personal Data or any information you disclose or transmit to us. We are not responsible for the acts of those who gain unauthorized access, and we make no warranty, express, implied or otherwise, that we will prevent such access, and we are not responsible for any damages or liabilities relating to any such incidents to the fullest extent permitted by law.

For your own privacy protection, we urge you to keep all passwords confidential. We also recommend that you do not include sensitive information such as passwords or payment information, in any emails that you send to us. If you become aware of any breach of the terms of this Privacy Policy or of the security of our Site or services, please notify us by email at support@heyrowan.com.

Data Retention

We retain Personal Data about you for as long as necessary to provide you with our Services or to perform our business or commercial purposes for collecting your Personal Data. In some cases we retain Personal Data for longer, if doing so is necessary to comply with our legal obligations, resolve disputes or collect fees owed, or is otherwise permitted or required by applicable law, rule or regulation. We may further retain information in an anonymous or aggregated form where that information would not identify you personally.

Personal Data Of Children

We do not knowingly collect or solicit Personal Data directly from children under 16 years of age. Our Services are intended for general audiences and any information we collect about minors is provided directly by the parent or legal guardian. If you are a child under the age of 16, please do not attempt to register for or otherwise use the Services or send us any Personal Data. If we learn we have collected Personal Data from a child under 16 years of age that was not provided directly by the parent or legal guardian, we will delete that information as quickly as possible. If you are a parent or legal guardian and you believe that your child has provided us with personal data without your consent, please contact us at support@heyrowan.com.

Additional Protections for Minors. We do not knowingly sell or share Personal Data of consumers under 18 years of age for cross-context behavioral advertising where prohibited by applicable law. If we learn that we have collected Personal Data from a minor in a manner not permitted by law, we will take steps to delete or de-identify that information as required. If you are a parent, legal guardian, or eligible minor and believe we have collected Personal Data in violation of applicable law, please contact us using the information below.

Additional State-Specific Information; California Notice At Collection

If you reside in California or any other state that has enacted consumer privacy laws that grant their residents certain rights and require specific disclosures ("State Privacy Laws"), this section applies to you. This section also serves as our California Notice at Collection.

• Access. You can request that we provide you access to the information we collected about you, including the specific pieces of information and details about that information.
• Portability. You can ask us to transfer your Personal Information to another party.
• Correction. You can request to update or change your Personal Information when it is incorrect.
• Deletion. You can ask us to delete your Personal Information that we have about you.
• Opt Out of Sale or Targeted Advertising (or "sharing" under California privacy law). You can request that we do not sell your Personal Information or use it for targeted advertising.
• Opt Out of Profiling with Legal or Similarly Significant Effects. Rowan does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects, so this right does not apply.

Exercising Your Rights.

To exercise the rights described above, you must send us a "Valid Request" that (1) provides sufficient information to allow us to verify that you are the person about whom we have collected Personal Data and (2) describes your request in sufficient detail to allow us to understand, evaluate and respond to it. We will only use Personal Data provided in a Valid Request to verify your identity and complete your request. If you request that we provide you with specific pieces of information about you, or that we delete sensitive personal information, we may apply heightened verification standards than what we would apply to other types of requests. The information you provide must match the information we have in our possession. This measure is in place to help ensure that personal information is not disclosed to any person who does not have the right to receive it. The information collected through this process will be used for verification purposes only.

We will work to respond to your Valid Request within the time period required by applicable law but may not respond if you don't meet both criteria described above.

You may submit a Valid Request using the following methods:

• Email us at: support@heyrowan.com
• Call us at: (347) 835-4289
• Write to us at: 1946 Palmer Ave, Larchmont, NY 10538

Authorized Agents

If you are a California resident, you may also authorize an agent (an "Authorized Agent") to exercise your rights on your behalf. To do this, you must provide your Authorized Agent with written permission to exercise your rights on your behalf, and we may request a copy of this written permission from your Authorized Agent when they make a request on your behalf.

No Discrimination

We will not discriminate against you for exercising your privacy rights.

Sale and Sharing of Personal Data

We do not sell consumers' personal information for the exchange of money. Instead, there are instances where we share personal information in order to provide our customers with personalized communications or customized offers to improve their shopping experiences through our Services or elsewhere. We may also share personal information with our third-party marketing partners that may use personal information for marketing and commercial purposes. Depending on the circumstances and the contractual obligations in place, this sharing may be considered a "sale" or "sharing" under applicable law and you may have the right to request that we stop such sharing as set forth above. Rowan does not use or disclose sensitive personal information or sensitive data, as defined in applicable laws, for any purposes other than those permitted by applicable law.

As described in the “Tracking Tools, Advertising and Opt-Out” section above, we have incorporated Cookies from certain third parties into our Services. These Cookies allow those third parties to receive information about your activity on our Services that is associated with your browser or device. Those third parties may use that data to serve you relevant ads on our Services or on other websites you visit. Under the CCPA, sharing your data through third party Cookies for online advertising may be considered a “sale” of information. You can opt out of data selling and/or sharing by following the instructions in this section.

We do not have actual knowledge that we sell or share the personal information of California Consumers under the age of 16 years.

Notice of Financial Incentives and Bona Fide Loyalty Programs

We may offer incentives in exchange for personal data (e.g., coupons or discounts on purchases when you sign up to our marketing emails and provide us your email address and/or phone numbers). We may also offer loyalty programs that provide special perks and benefits (e.g., rewards and access to exclusive events, products, and offers). Each and any of those incentives or programs (hereinafter "Programs") may be considered a "Financial Incentive" or a "Bona Fide Loyalty Program" established for the purpose of providing a superior price, rate, level, quality or selection of goods or services under one or more State Privacy Laws.

If you choose to participate in any of these Programs, the primary purpose for processing your personal data is to provide the benefits, perks and/or discounts of the Programs. To that end, you may provide the categories of data set forth above in the "COLLECTION OF PERSONAL DATA" section of this Privacy Policy. We may also collect other categories of personal data from you, such as preferences or inferences drawn about your preferences and similar categories of personal data. We may use and disclose your personal data as described in the sections "USE OF PERSONAL DATA" and "DISCLOSURE OF PERSONAL DATA" to provide you the benefits, perks and/or discounts of the Programs (e.g., expedited shipping). As described above, we may also disclose your personal data to our marketing and advertising partners so we can display ads that are targeted to your interests and preferences and to other third-party partners (e.g., fitness studios and other retailers).

You can opt into a Program by following the sign-up or participation instructions provided for in connection with such Program. We may provide additional terms and conditions for certain Programs, which we will provide to you when you sign up.

You can opt-out of our Programs at any time by following the instructions in the Program's terms and conditions, promotional emails, or text messages, or by contacting us at support@heyrowan.com. If you request that we delete personal data that is essential to providing you with the benefits, perks and/or discounts, we will not be able to provide you with such benefits going forward. For example, if you ask us to delete your email address, we will no longer be able to provide you with early access to sales or other benefits.

The value of your personal data is reasonably related to the value of the benefits, perks, and/or or discounts offered to you under the Programs.

California "Shine the Light" Law

Under the California "Shine the Light" law, California residents may opt-out of our disclosure of Personal Information to third parties for their direct marketing purposes. You may choose to opt-out of the sharing of your Personal Information with third parties for marketing purposes. To make such a request you should (a) Email us at: support@heyrowan.com, (b) Call us at: (347) 835-4289 or © send a letter to us at Rowan, Inc. Attn: Privacy Team, 1946 Palmer Ave, Larchmont, NY 10538. In your request, please attest to the fact that you are a California resident and provide a current California address for our response. Please be aware that not all information sharing is covered by the California privacy rights requirements and only information on covered sharing will be included in our response. We reserve our right not to respond to requests submitted to addresses other than the addresses specified in this paragraph.

Nevada Resident Rights

If you are a resident of Nevada, you have the right to opt-out of the sale of certain Personal Data to third parties who intend to license or sell that Personal Data. You can exercise this right by contacting us at support@heyrowan.com with the subject line "Nevada Do Not Sell Request" and providing us with your name and the email address associated with your account. Please note that we do not currently sell your Personal Data as sales are defined in Nevada Revised Statutes Chapter 603A.

Employee Applicant Privacy Policy

The purpose of this Privacy Notice ("Notice") is to inform employees and employee applicants of Rowan ("Rowan" or "we" or "us") of the categories of Personal Information that we may receive and the purposes for which we may use such Personal Information. This notice is intended to comply with all applicable laws, such as the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA). If any provision below conflicts with a legal requirement, then Rowan will comply with the applicable law. Please also review our Privacy Policy, which is incorporated by reference into this Notice.

1. Collection and Use of Candidate Personal Information

Rowan receives, uses, and discloses Personal Information about job candidates for business purposes only and consistent with applicable laws. Where Rowan discloses Personal Information to third parties, it does so for the same business purposes described below and, where appropriate, requires that such parties maintain its confidentiality and maintain appropriate systems and processes to ensure its security and protection.

We may receive and use the following categories of Personal Information about you when you inquire about and/or apply for employment at Rowan:

2. Additional Purposes for Using Personal Information

In addition to the uses set forth above, Rowan may use and share the categories of Personal Information identified:

• To comply with applicable legal and regulatory requests and obligations (including investigations).
• To establish or defend legal claims and allegations.
• For security or the prevention, detection, or investigation of fraud, suspected or actual illegal activity, violations of company policy or rules, or other misconduct
• To seek advice from lawyers, auditors, and other professional advisers.

3. Sensitive Personal Information

Your sensitive personal information will not be used for any additional purposes that are incompatible with the purposes listed above, unless we provide you with notice of those additional purposes.

4. No Sale of Personal Information

We do not sell your personal information or your sensitive personal information, nor do we share it with third parties for cross-context behavioral advertising.

5. Record Retention

We may retain your personal information for as long as necessary to fulfil the purpose for which it was collected or to comply with legal or regulatory requirements.

6. Your Privacy Rights

Rowan complies with laws and regulations that permit certain requests related to your data in our files, including, but not limited to, the California Consumer Privacy Act (the "CCPA"). The California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides California residents with the following rights regarding their Personal Information:

• The right to know what personal information we have collected, used, disclosed, and sold about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom Rowan discloses personal information, and the specific pieces of personal information Rowan has collected about you.
• The right to correct inaccuracies in your personal information, taking into account the nature of the personal information and the purposes of the processing.
• The right to request deletion of personal information we have collected from you.
• The right to opt out of the selling or sharing of your personal information.

You may exercise these rights by contacting Rowan as described in the "Questions" section below or through the contact form available on our website. You may also designate an authorized agent to make a request on your behalf by contacting us as described below. In order to protect your data from unauthorized access or alteration by third parties, all requests regarding your personal information will be subject to verification of the identity of the requesting individual. We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to forty-five (45) days), we will inform you in writing.

7. Questions

If you have any questions about this Notice, or to request this Notice in another format, please contact support@heyrowan.com.

Contact Information

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Data or your choices and rights regarding such collection and use, please do not hesitate to contact us at:

• Email us at: support@heyrowan.com
• Call us at: (347) 835-4289
• Write to us at: 1946 Palmer Ave, Larchmont, NY 10538