7. YOUR STATE PRIVACY RIGHTS

Depending on the state in which you reside, you may have certain privacy rights regarding your personal data. Please review the sections below if you are a California, Colorado, Connecticut, Nevada, Utah or Virginia resident. For other state residents, your privacy rights may include (if applicable):

•The right to confirm whether or not we are processing your personal data and to access such personal data.

•The right to obtain a copy of your personal data that we collected from and/or about you in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the information to another controller without hindrance, where the processing is carried out by automated means.

•The right to delete personal data that we collected from and/or about you, subject to certain exceptions.

•The right to correct inaccurate personal data that we maintain about you, subject to certain exceptions.

•The right, if applicable, to opt out of the processing of your personal data for purposes of (a) targeted advertising; (b) the “sale” of your personal data (as that term is defined by applicable law); and (c) profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

•If we are required by applicable law to obtain your consent to process sensitive personal data, the right to withdraw your consent.

•The right not to receive discriminatory treatment by us for the exercise of your privacy rights.

We use Cookies and other tracking technologies to display advertisements about our products to you on nonaffiliated websites, applications, and online services. This is “targeted advertising” under applicable privacy laws. When we engage in those activities, we sell personal data (i.e., information from Cookies) to third-party advertisers and analytics companies. We may transfer your personal data (e.g., name, email address, and year of birth) to joint marketing partners. Under applicable privacy laws this may be considered a “sale” of personal data to third parties. We do not use personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning individuals.

To exercise your rights, please submit a request by emailing us at [email protected].

If legally required, we will comply with your request upon verification of your identity and, to the extent applicable, the identity of the individual on whose behalf you are making such request. To do so, we will ask you to verify data points based on information we have in our records. If you are submitting a request on behalf of another individual, please use the same contact methods described above. If we refuse to take action regarding your request, you may appeal our decision by emailing us at [email protected].

If you would like to opt out of targeted advertising, you may alter your Cookie preferences by toggling off the Cookie options in the Cookie Management Tool here.

If you enter into a Loyalty Program with us, we will collect your name, email address, and you may choose to provide us with your birth date and gender. We do not provide your personal data to data brokers. If you ask us to delete your personal data, we will not be able to provide you with the benefits of our Loyalty Program because we will delete your account.

INDIVIDUAL STATES

This section contains additional information relevant to residents of certain US states that have their own data privacy laws and regulations, and associated rights.

CALIFORNIA RESIDENTS

This notice to California residents is provided under California law. It provides our “Notice at Collection,” provides certain mandated disclosures about our treatment of California residents’ information, both online and offline, explains your privacy rights, and provides our “Notice of Financial Incentives.”

NOTICE AT COLLECTION

We may collect the following categories of personal information (as defined in the California Consumer Privacy Act (CCPA) and the California Customer Records statute), including sensitive personal information (as defined in the CCPA):

•Identifiers, such as name, email address, username and password, postal address, telephone number, signature, government-issued identifier, IP address, and other similar identifiers.

•Characteristics of protected classifications and demographic information, such as gender, age, race, disability status, sexual orientation, gender identity, military/veteran status, marital status, national origin, and medical information.

•Commercial information, including information about your interests and consuming history or tendencies, such as products or services considered; transaction information when you request information, contact customer service, or purchase, return, request or exchange a product or service, including payment card information or other financial information; information provided in response to surveys or other research conducted on our behalf; and information you provide in public forums.

•Internet or other electronic network activity information, including information regarding your interactions with us online and information we obtain from third parties about use of our applications on third-party platforms or devices.

•Geolocation data, including precise or approximate location information provided by a mobile device or other device or product interacting with or detected by our sites, applications, or physical properties, where we are permitted by law to process this information.

•Audio, electronic, visual, or similar information, including telephone call recordings, other voice recordings, and still or video images captured by cameras or readers on or around our physical properties.

•Inferences based on the above.

We collect this information so that we can best serve you, including to fulfill your requests and to share offers or information that we think you may be interested in. As further described in How We Use Your Information section in our Policy, we generally collect and use the above-listed categories of personal information to provide and manage our sites, applications, products, and services, and for other business or commercial purposes, such as advertising, marketing, and to improve our products and services.

Certain data collection on our sites and applications by third parties for purposes of interest-based advertising and social media tools may be a “sale” or “sharing” under California privacy law. As defined by California law, we “sold” or “shared” certain data elements within the following categories of personal information: identifiers, demographic information, commercial information, Internet or other electronic network activity information, approximate geolocation, and inferences drawn from the above.

If you would like to opt out of the sharing of your personal information, you may click the Cookie Preferences Link. Please note that your opt-out choice is specific to the digital property and to the device and browser you are using.

We retain each category of personal information that we collect for as long as necessary to fulfill the purposes described in our Policy, including to satisfy legal or reporting requirements. What this means in practice will vary for different types of information, but the criteria assessed in the data retention analysis take into account ongoing business or legal needs for the information, for example in relation to tax, health and safety, and potential or actual disputes or investigations.

More information, including a description of your legal rights, can be found in the “California Privacy Rights” section below.

ADDITIONAL PRIVACY MANDATORY DISCLOSURES

We also make the following disclosures for purposes of compliance with California privacy law:

•We collected the following categories of personal information in the last 12 months: identifiers, characteristics of protected classifications and demographic information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above.

•The sources of personal information from whom we collected are: directly from our guests, third-party sites or platforms that you link with your registration account, analytics tools, social networks, advertising networks, and third-party services that update or supplement information we hold about you.

•The business or commercial purposes of collecting personal information are as summarized in our “Notice at Collection” section, and as described in more detail in our Policy under How We Use Your Information.

•We disclosed certain data elements within the following categories of personal information for a business purpose in the last 12 months: identifiers, characteristics of protected classifications and demographic information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. We disclosed each category to business partners, service providers, government entities, and other third parties as described in the Sharing Your Information With Third Parties section of the Policy.

•As defined by applicable law, we “sold” or “shared” certain data elements within the following categories of personal information in the last 12 months: identifiers, demographic information, commercial information, Internet or other electronic network activity information, approximate geolocation, and inferences drawn from the above. We “sold” or “shared” each category to or with entities who provide advertising, marketing, or audience measurement; other online third-party branded tools or functionality (such as maps or video players); and social networks.

•The business or commercial purposes of “selling” or “sharing” personal information is to assist us with advertising, marketing, audience measurement, and other functionality on our digital properties.

•We do not “sell” or “share” the personal information of known minors under 16 years of age.

•We do not use or disclose sensitive personal information for purposes other than those specified in Section 7027(m) of the CCPA regulations.

YOUR CALIFORNIA PRIVACY RIGHTS

Right to Know

You have the right to request that we disclose to you the categories of personal information we have collected about you, as well as the sources of such personal information, the purposes, and the categories of third parties with whom such personal information is shared.

Right to Access

You have the right to request, up to two times each year, access to categories and specific pieces of personal information about you that we collect, use, disclose, sell, and share.

Right to Delete

You have the right to request that we delete personal information that we collect from you, subject to applicable legal exceptions.

Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you, subject to applicable legal exceptions.

Right to Opt Out of Sale or Sharing of Personal Information

You have the right to “opt out” of the “sale” or “sharing” of your “personal information” to or with “third parties” (as those terms are defined by applicable law).

Removal of Content

If you are a California resident under the age of 18, and a registered user of any site where this policy is posted, California Business and Professions Code Section 22581 permits you to request and obtain removal of content or information you have publicly posted.

Shine the Light

California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by certain members of Reef to third parties for the third parties’ direct marketing purposes. Reef does not share guests’ personal information with other member companies or others outside Reef for those parties’ direct marketing use unless a guest elects that we do so.

Right Not to Receive Discriminatory Treatment

You have the right not to receive discriminatory treatment for the exercise of your privacy rights. If you choose to exercise any of these rights, you will not receive different prices or quality of services unless permitted by applicable law, including if those differences are reasonably related to your information. For example, if you exercise your right to opt out of “sale” or “sharing” of your ”personal information,” the ads you view may not be tailored to your interests.

EXERCISING YOUR CALIFORNIA PRIVACY RIGHTS

Making Requests to Know, Access, Delete, or Correct Your Personal Information

To make a request to know or to make an access, deletion, or correction request, please reach out to [email protected]. To submit a request by phone, you may call 1-844-500-7333. Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.

Making Requests to Opt Out of the Sale or Sharing of Personal Information

To submit a request to “opt out” of the “sale” or “sharing” of your “personal information,” you may click this Cookie Preferences Link.

Instructions for Using an Authorized Agent to Make Requests

You may use an authorized agent to submit a request to know or an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests to [email protected].

Making Requests for Removal of Content

California residents under the age of 18 may make requests to remove content by sending an email with a detailed description of the specific content or information to be removed to [email protected]. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

Making Shine the Light Request

To make a request for information under the Shine the Light Act, please send an email to [email protected].

NOTICE OF FINANCIAL INCENTIVES

Members of Reef may offer various and different loyalty or promotional programs that provide certain benefits to our guests. For example, we may provide special offers or discounts to our guests as part of certain programs, promotional campaigns, subscriptions, or other offerings. We may also provide discounts when guests sign up to receive marketing messages or when guests claim a specific offer. In this Notice of Financial Incentives, we refer to these various programs and offerings as the “Programs.”

In general, we collect personal information to support and fulfill the Programs, which could include identifiers, demographic information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. For additional details on the types of information we may collect, please see The Information We Collect in our Policy. Because we collect personal information, the Programs may be considered to be “financial incentives” or “price or service differences” under California law.

To the extent the Programs are reasonably related to the value of guest personal information, the method for calculating this value would include the expenses related to our offer (such as the costs of providing discounts, free shipping, or other promotions, intellectual property or marketing costs, and other related expenses). The value of the guest personal information that we collect will vary depending on the engagement by each guest.

CONTACT INFORMATION

If you have a question about our privacy policies and information practices, please send an email to [email protected].

COLORADO RESIDENTS

Colorado law provides Colorado residents with the rights listed below.

Right to Access

You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete

You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Correct

You have the right to request that we correct inaccurate personal data.

Right to Opt Out of Targeted Advertising and Sale of Personal Data

You have the right to “opt out” of “targeted advertising” and the “sale” of your “personal data” (as defined under Colorado law).

EXERCISING YOUR COLORADO PRIVACY RIGHTS

Making Access, Deletion, and Correction Requests

To make an access, deletion, or correction request, please email [email protected]. To submit a request by phone, you may call 1-844-500-7333. Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.

Making Requests to Opt Out of Targeted Advertising or the Sale of Personal Data

To submit a request to “opt out” of “targeted advertising” or the “sale” of your “personal data,” you may click on the Cookie Preferences Link.

Instructions for Using an Authorized Agent to Make Requests

You may use an authorized agent to submit an access, deletion, correction, or opt-out request on your behalf. An authorized agent must have your signed permission to submit a request on your behalf or provide proof that they have power of attorney in accordance with applicable law. Before completing requests from authorized agents, we may contact you directly to confirm you’ve given your permission and/or to verify your identity. Authorized agents may submit requests to [email protected].

To appeal our decision regarding a request related to these rights, you may email us at [email protected].

NOTICE ABOUT OUR LOYALTY PROGRAMS

Members of Reef may offer various and different loyalty or promotional programs that provide certain benefits to our guests. For example, we may provide special offers or discounts to our guests as part of certain programs, promotional campaigns, subscriptions, or other offerings. We may also provide discounts when guests sign up to receive marketing messages or when guests claim a specific offer. In this Notice of Financial Incentives, we refer to these various programs and offerings as the “Programs.”

In general, we collect personal information to support and fulfill the Programs, which could include identifiers, demographic information, commercial information, Internet or other electronic network activity information, geolocation data, audio, electronic, visual or similar information, and inferences drawn from the above. For additional details on the types of information we may collect, please see The Information We Collect in our Policy. Because we collect personal information, the Programs may be considered to be “financial incentives” or “price or service differences” under Colorado law.

To the extent the Programs are reasonably related to the value of guest personal information, the method for calculating this value would include the expenses related to our offer (such as the costs of providing discounts, free shipping, or other promotions, intellectual property or marketing costs, and other related expenses). The value of the guest personal information that we collect will vary depending on the engagement by each guest.

CONTACT INFORMATION

If you have a question about our privacy policies, please send an email to [email protected].

CONNECTICUT RESIDENTS

Connecticut law provides Connecticut residents with the rights listed below.

Right to Access

You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete

You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Correct

You have the right to request that we correct inaccurate personal data.

Right to Opt Out of Targeted Advertising and Sale of Personal Data

You have the right to “opt out” of “targeted advertising” and the “sale” of your “personal data” (as defined under Connecticut law).

EXERCISING YOUR CONNECTICUT PRIVACY RIGHTS

Making Access, Deletion, and Correction Requests

To make an access, deletion, or correction request, please email [email protected]. To submit a request by phone, you may call 1-844-500-7333Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.

Making Requests to Opt Out of Targeted Advertising or the Sale of Personal Data

To submit a request to “opt out” of “targeted advertising” or the “sale” of your “personal data,” you may click on the Cookie Preferences Link.

Instructions for Using an Authorized Agent to Make Requests

You may use an authorized agent to submit a request to opt out of targeted advertising or the sale of personal data. Authorized agents may submit such requests to [email protected]. Authorized agents can make a request on your behalf if we are provided with verification of your identity and confirmation that you provided the agent authority to act on your behalf.

To appeal our decision regarding a request related to these rights, you may email us at [email protected].

NEVADA RESIDENTS

Nevada law allows Nevada residents to opt out of the sale of certain types of personal information. Subject to several exceptions, Nevada law defines “sale” to mean the exchange of certain types of personal information for monetary consideration to another person. We currently do not sell personal information as defined in the Nevada law. However, if you are a Nevada resident, you still may submit a verified request to opt out of sales and will record your instructions and incorporate them in the future if our policy changes. You may send opt-out requests to [email protected].

UTAH RESIDENTS

Utah law provides Utah residents with the rights listed below.

Right to Access

You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete

You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Opt Out of Targeted Advertising

You have the right to “opt out” of “targeted advertising” (as defined under Utah law). We do not “sell” personal data as defined under Utah law.

EXERCISING YOUR UTAH PRIVACY RIGHTS

Making Access and Deletion Requests

To make an access or deletion request, please email [email protected]. To submit a request by phone, you may call 1-844-500-7333. Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.

Making Requests to Opt Out of Targeted Advertising

To submit a request to “opt out” of “targeted advertising” you may click on the Cookie Preferences Link.

VIRGINIA RESIDENTS

Virginia law provides Virginia residents with the rights listed below.

Right to Access

You have the right to know and see what personal data we have collected about you in a usable format.

Right to Delete

You have the right to request that we delete the personal data we have collected about you, subject to applicable legal exceptions.

Right to Correct

You have the right to request that we correct inaccurate personal data.

Right to Opt Out of Targeted Advertising

You have the right to “opt out” of “targeted advertising” (as defined under Virginia law). We do not “sell” personal data as defined under Virginia law.

EXERCISING YOUR VIRGINIA PRIVACY RIGHTS

Making Access, Deletion, and Correction Requests

To make an access, deletion, or correction request, please email [email protected]. To submit a request by phone, you may call 1-844-500-7333. Before completing your request, we may need to verify your identity. We will send you a link to verify your email address and may request additional documentation or information solely for the purpose of verifying your identity.

Making Requests to Opt Out of Targeted Advertising

To submit a request to “opt out” of “targeted advertising” you may click on the Cookie Preferences Link.

To appeal our decision regarding a request related to these rights, you may email us at [email protected].