You may freely visit our Websites anonymously and without being required to provide us with any personal information. However, certain requests and features do require that you provide us with some personally identifying information as more particularly described below. Personal information is data that can be used to identify or contact you. We only collect the personal information you willingly provide to use. Please do not send confidential information to us directly through this Websites, or by email to any of the contact email addresses listed on this Websites.

Clover By Jo may collect personal information from you, including, but not limited to, your name, email address, postal address, phone number, or credit card number when you visit our Website, place an order with us, save your information with us online, contact us with a question or concern, or participate in a contest, promotion, or survey. We also maintain a record of the purchases you make online or by phone. We do not store or share credit card information. Please note that we work with third parties to host and administer the shop, and to process your payment transactions, and any information you share may also be shared with such third parties. We may also collect information you provide about others, such as when you purchase products to be shipped to someone else. We will use this information to fulfill your requests and will not send marketing communications to those individuals unless they separately opt in to receive communications from us. We may disclose information when you tell us to do so, to identify or contact you, to protect your rights or the rights of Clover By Jo or as otherwise required or permitted by law.

To serve you better, we may combine information you give us online, in our stores or through direct mailers. We may also combine that information with publicly available information and information we receive from or cross-reference with our “Select Partners” and others, including providers of third-party cookie and other third-party browsing and use data. We use that combined information to enhance and personalize the shopping experience of you and others with us, and to recognize our customers so that we can communicate with you directly about our products and events that may be of interest to you, and for other promotional purposes.

We also collect certain non-personal information (data in a form that does not support direct association with any specific person or individual) by automated means when you visit the Websites. Much of this information is collected through the use of third-party tracking services, which includes Google Analytics. The information collected may include usage information, such as the numbers and frequency of users to the Websites, websites visitors come from and go to and from our Website, pages visited, web browsing histories, online purchases and searches, demographic segmentation, social networking activities and similar data. When gathered, this data, if used, is used in the aggregate, and not in a manner that is intended to identify you personally. This type of aggregate information may be shared with third parties at any time. In addition to the third-party tracking services mentioned above, we also collect this information through various other means, including "cookies” and IP addresses, as further explained below.

Login Information - As further detailed below, we collect information about your use of our websites, such as the type of browser you use, access times, pages viewed, your IP address and the referring link through which you accessed our Website.

IP Addresses - When you visit and interact with the Websites, we or third parties with whom we have contracted to provide services for us may collect Internet Protocol addresses (each an "IP Address"), as well as browser type, Internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and page navigation. An IP Address is a unique identifier number that certain electronic devices use to identify and to communicate with each other on the Internet; your Internet Service Provider automatically assigns an IP Address to the computer that you are using. We gather this information to track Websites visitor movement in the aggregate, and to gather broad demographic information for aggregate use. Our goal in gathering this information is to learn how our customers and the public are using our Websites. We may use this information to enhance our Websites or for other lawful purposes.

Cookies - A cookie is a piece of information that a web server may place on your computer when you visit a Websites. Cookies are commonly used by websites to improve the user experience. Many cookies last only through a single Websites session, or visit. Others may have an expiration date, or may remain on your computer until you delete them. We may use "session cookies" in order to enhance the user experience and for other web-related purposes. These session cookies are not linked to personally identifiable information. We may also use cookies for other purposes, including to maintain continuity during a user session, to gather data about the usage of our Websites for research and other purposes, or to store a user name or related login credentials so that you do not have to provide this information every time you return to our Websites. Most browsers will tell you how to stop accepting new cookies, how to be notified when you receive a new cookie, and how to disable existing cookies. Please note, however, that without cookies you may not be able to take full advantage of all the features on our Websites.

Transaction Information - When you purchase or return a product, we collect information about the transaction, such as product details and the date and location of the purchase/return.

Web Beacons – Our Websites may contain "web beacons" (also known as Internet tags, pixel tags and clear GIFs). These web beacons allow third parties to obtain information such as the IP address of the computer that downloaded the page on which the beacon appears, the URL of the page on which the beacon appears, the time the page containing the beacon was viewed, the type of browser used to view the page, and the information in cookies set by the third party. Web beacons also may be used to track whether you have opened an HTML email. When the email is opened, a part of the code that makes up the HTML page calls a web server to load the web beacon that then generates a record showing that the email has been viewed. Web beacons may also recognize when the email was opened, how many times it was forwarded and which URLs (links within the email) were clicked.

Do Not Track - Every time your computer sends or receives information over the Web, the request begins with some short pieces of information called “headers.” These headers include information like what browser you are using, what language your computer is set to, and other details. The Do Not Track technology provides individual users with the ability to include a simple, machine-readable header indicating that they don't want to be tracked, and sends a signal to Web sites' visited requesting that the website disable either its tracking or cross-site user tracking of an individual user. Currently, various browsers – including Internet Explorer, Google Chrome, Firefox, Opera and Safari – offer a “do not track” option. Presently, there is no consensus on how Do Not Track should be interpreted, and no common or accepted industry standard for implementing. Consequently, please note that CBJ’s Websites does not currently respond to browsers' Do Not Track signals, and as such your activities will be tracked, regardless of whether you have opted to enable the Do Not Track option offered by your browser.

At Clover By Jo, we use the information which we gather from you to provide and improve our services, and to communicate with you, including, but not limited to:

• Facilitate and improve your online shopping experience;

• Provide the products and services you request, process transactions and send you related information, including confirmations and receipts;

• To communicate with you and to send you information by email, postal mail, telephone, text message, or other means about our products, services, contests, and promotions, unless you direct us not to contact you with promotional communications;

• Respond to your comments, questions and requests and provide customer service;

• Monitor and analyze trends, usage and activities;

• Help understand your needs and provide you with better service; and

• Carry out any other purpose for which the information was collected.

From time to time we might establish a business relationship with other persons or entities whom we believe trustworthy and whom we have asked to confirm that their privacy policies are consistent with ours. These are known as our “Select Partners.” In such cases we might exchange, share and/or cross-reference information, including contact information about you that will enable such persons or entities to contact you regarding products and services that may be of interest to you.

We may share information about you as follows:

• With vendors, consultants and other service providers who need access to such information to carry out work on our behalf; We may share your information with third parties including our agents, service providers, and consultants as needed for them to provide business-related services to us. Such third parties may manage our customer information and perform services on our behalf, such as website hosting, payment processing, order fulfillment, fraud monitoring, identity verification, processing credit card payments, email or mail delivery and administration, promotion fulfillment, surveys or data analysis, etc. We ask third parties with whom we share your information to confirm that their privacy practices are consistent with ours and applicable law and we provide them with only the information they need in order to perform their services for us.

• We may share your information or combine your information with publicly available information when we team up with other promotional partners to jointly offer or provide products, services, contests, or promotions to our customers, or otherwise to enhance and personalize your shopping experience.

• We may work with third-party companies that use their tracking technologies (including cookies and pixel tags) on our Website in order to provide tailored advertisements on our behalf. These companies may collect information about your activity on our site and your interaction with our advertising and other communications, may use this information to determine which ads you see on third-party websites and applications, and may also be used to track your activity across multiple devices.

• We may share information with third party marketing partners for commercial and advertising purposes to serve specific types of materials including marketing and promotional material distribution (such as direct mail marketing), promotions fulfillment and website evaluation.

• From time to time we may share, exchange and/or cross-reference our postal mailing list with selected providers of goods and services that may be of interest to you. If you prefer not to receive mailings from these providers, you can notify us at any time by emailing us at hello@cloverbyjo.com. You will need to provide your full name and mailing address to be added to our DO NOT MAIL list.

• In response to a request for information if we believe disclosure is in accordance with any applicable U.S. law, regulation or legal process, or as otherwise required by any applicable law, rule or regulation;

• If we believe your actions are inconsistent with our user agreements or policies, or to protect the rights, property and safety of us or any third party; and

• With your consent or at your direction.

• It is necessary in connection with a sale of all or substantially all of the assets of CBJ or the merger of CBJ into another entity or any consolidation, share exchange, combination, reorganization, or like transaction in which CBJ is not the survivor,

• CBJ is required or permitted to do so for any or all of the following reasons: (i) to comply with a subpoena, legal process, government request or any other legal obligation, or (ii) to prevent, investigate, detect, or prosecute criminal offenses or attacks on the technical integrity of the Websites or our network.

The Websites do not intentionally or knowingly collect, use, or disclose personally identifiable information about visitors to our Websites that are less than 13 years of age. If a child under the age of 13 submits information to us through any part of the Websites and CBJ becomes aware that the user submitting the information is under the age of 13, the information provided will be deleted as soon as it is discovered and not used for any purpose. If you are the parent or guardian of a child under 13 years of age and believe that they have disclosed personally identifiable information to us, please contact us at the address below and be sure to include in your message the same user name and password and/or email address that you believe your child submitted, if applicable: hello@cloverbyjo.com

Please note, if you reside in the European Economic Area, Switzerland or the United Kingdom, users must be 16 years of age or older, and any registration by, use of or access to the Website by anyone under 16 is unauthorized, as further clarified below.

We may also provide links to a variety of third-party social media sites and/or websites – such as Facebook, Twitter, YouTube and Instagram - as a service to you, and in order to provide you i) additional information and/or content related CBJ, or ii) additional venues in which you can learn about and discuss the activities of CBJ. Please note that we have no affiliation with any of these other parties and/or websites, and cannot control and are not responsible for the information collection, use, and disclosure practices of such third parties; we encourage you to review and understand their privacy practices and policies, if any, before using providing any personally identifying information to them. We are not responsible for the content or information of these websites, or any other use of the linked website.

We maintain – and request that any third-party partners who may store information on our behalf to maintain – administrative, technical and physical safeguards for the Websites designed to protect your personal information against theft, loss, misuse or unauthorized access, disclosure, alteration or destruction of the personal information that we collect from you. However, no website, application or transmission can guarantee security. Thus, while we have established and maintain what we believe to be reasonable procedures to protect the confidentiality, security, and integrity of personally identifying information obtained through the Websites and we strive to protect your personal information, we cannot ensure or warrant the security of any information you transmit to us. When you link to one of the social media venues provided on the Websites, the personal information you share is visible to other users and can be read, collected, or used by them. You are responsible for the personal information you choose to submit in these instances, and understand, acknowledge, and agree that you transmit certain personal information over this Websites at your own risk.

We do not represent or warrant that the Websites, or any part thereof, is appropriate or available for use in any particular geographic location. If you choose to access our Websites, you do so on your own initiative and at your own risk, and are responsible for complying with all local laws, rules, and regulations applicable in your jurisdiction. Please note that the Websites is hosted in the United States and is governed by United States law. If you are visiting the Websites from outside the United States, please be aware that your information will be transferred to, stored and processed in the United States where our servers are located and our central database is operated. The data protection and other laws of the United States and other countries might not be as comprehensive as those in your country. By using the Websites, you consent to your information being transferred to our facilities and to the facilities of those third parties with whom we share it as described in this Privacy Policy.

Clover By Jo reviews this Privacy Policy periodically to make sure it complies with applicable law and conforms to changes in our business. We may update or change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the bottom of this Privacy Policy. In some cases, we may provide you with additional notice (such as adding a statement to the homepages of our websites or sending you an email notification). We encourage you to review the Privacy Policy whenever you interact with us to stay informed about our information practices and the ways you can help protect your privacy. By continuing to use the Website after those changes become effective, you agree to be bound by - and understand that the information we have collected shall be subject to - the terms of the revised Privacy Policy.

We want to communicate with you only if you want to hear from us. If you prefer not to receive direct marketing from us or from our Select Partners, or if you would like to opt out of our rental or exchange of your information with other marketers, please let us know. In the U.S., please send us an email at hello@cloverbyjo.com. Please be sure to include your full name, email address, mailing address, and specifically what information you do not want to receive. If you would like to update or correct your email address, mailing address or other contact information with us please contact us the same way.

If you like, you may use one of the following statements in your message to us:

• I prefer not to receive email advertisements, such as updates regarding products and services, special promotions

or upcoming events.

• I prefer not to receive direct mail advertisements, such as periodic catalogs and mailings regarding products and

services, special promotions or upcoming events.

• I prefer not to have my contact information provided to third parties for their marketing purposes.

You may also click the designated link at the bottom of all email advertisements to be removed from future email

updates.

Please note that any requests to remove or update your contact information may take up to five days for your email request and 6–8 weeks to process your postal mail request.

TERMS

If you have any questions or concerns regarding how Clover By Jo manages, accesses or uses your personal information, please e-mail us at hello@cloverbyjo.com

SPECIAL NOTICE TO EUROPEAN ECONOMIC AREA, SWITZERLAND AND UNITED KINGDOM USERS:

The following provisions applies only to users residing in the European Economic Area (EEA), Switzerland and the United Kingdom. In May of 2018 a new data privacy law known as the EU General Data Protection Regulation (“GDPR”) went into effect. Pursuant to GDPR, we are required to provide those residing in the EEA, Switzerland and the United Kingdom (hereinafter, the “EU Users”) additional information and rights related to the Personal Information we collect about them. For the purposes of this GDPR Privacy Notice section, "Personal Information" means any information relating to an identified or identifiable person. We summarize such information and rights below.

Clover By Jo, Inc. (the Data Controller) is the owner and operator of the Website. If you need to contact us for any reason related to this Privacy Policy or your use of the Website, please contact us at the following email address: hello@cloverbyjo.com

As noted in this Privacy Policy, you may visit our Website without being required to provide us with any Personal Information. However, should you decide to provide such information, the information we collect will be used to meet your requests, or to provide you with the applicable information or service requested, and as further described herein.

LEGAL GROUNDS FOR PROCESSING PERSONAL INFORMATION:

CBJ will process Personal Information that we receive from EU Users on the ground that it is in our legitimate interest for the effective administration of the Website, or to fulfill and/or address your requests.

YOUR PERSONAL INFORMATION AND YOUR CHOICES; WITHDRAWAL OF CONSENT:

GDPR provides EU Users with additional rights in respect to the Personal Information we hold about you, including

How to access your information and your other rights:

• The right of access: If you ask us, we will confirm whether we are processing your Personal Information and, if necessary, provide you with a copy of that Personal Information (along with certain other details).

• Your right to correction (rectification): If the Personal Information we hold about you is inaccurate or incomplete, you are entitled to request to have it corrected.

• Your right to erasure: You can ask us to delete or remove your Personal Information in some circumstances, such as where we no longer need it or if you withdraw your consent (where applicable).

• Your right to data portability: You have the right, in certain circumstances, to receive a copy of Personal Information we've obtain from you.

• Your right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your Personal Information, you have the right to withdraw that consent at any time.

• Your right to lodge a complaint with the supervisory authority: If you have a concern about any aspect of our privacy practices, including the way we've handled your Personal Information, you can report it to the relevant supervisory authority.

We will respond to any such above requests within a reasonable timeframe. Some of these rights may be in circumstances in which we are not legally required to comply with your request because of the laws in your jurisdiction or because of exemptions provided in data protection legislation in general, and GDPR in particular, or where the Personal Information may be exempt from disclosure due the applicable rules of professional conduct, attorney-client privilege, legal professional privilege, other applicable privileges or protections, or professional secrecy obligations.

Please also note we may need to retain certain Personal Information for record keeping purposes, and there may also be residual Personal Information that will remain within our databases and other records, which will not be removed from such locations. Additionally, please note that we are not responsible for removing or deleting information from the databases of third parties (such as service providers) with whom we have shared information about you, but we will make the request on your behalf for such removal/deletion.

DATA RETENTION:

We will retain your information for as long as needed to provide you services, or otherwise as is reasonable and customary given the nature of the relationship you have with CBJ. We may need to retain certain information for record keeping purposes, and there may also be residual information that will remain within our databases and other records, which will not be removed from such locations. Otherwise, we will retain and use your information as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements. We have a data retention and destruction plan that dictates the policies and procedures related to deletion and/or destruction of all information/data

THIRD PARTY CONTRACTORS AND OTHER DATA PROCESSORS:

We may appoint subcontractor data processors as required to deliver the services, such as, without limitation, IT systems or software providers, IT Support service providers, and document and information storage providers, who will process PII on our behalf and at our direction. We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process PII appropriately and according to our legal and regulatory obligations.

CHANGES TO THIS GDPR PRIVACY NOTE:

We may make changes to this GDPR Privacy Notice from time to time, to reflect changes in our practices. We may also make changes as required to comply with changes in applicable law or regulatory requirements. Where we materially change this Privacy Notice, we will take steps to notify you (such as by posting a notice on the Website or via email), and where required by applicable law to obtain your consent.

By visiting this Website, you are accepting the terms of this Privacy Policy. Any external links to other websites are clearly identifiable as such, and we are not responsible for the content or the privacy policies of these other websites.

CURRENT POLICY PUBLISHED: MARCH 4, 2022