This privacy policy explains how TerrAscend and its affiliates (together, “us,” or “we”) collect, use, disclose, and protect personal information of customers (“you” or “users”) that utilize our cannabis product ordering and delivery service, where available (the “Service”), access our website (the “Website”), utilize our mobile application (the “App”), utilize our third-party e-commerce platform (the “Commerce Platform”), or who engage in in-person transactions at a store (“In-Store”). The Service, the Website, the App, and the Commerce Platform, and In-Store Collection are collectively referred to as the “Solution.”

Collection of Personal Information

Personal information is data that can be used to identify or contact an individual person. We set forth below the categories of personal information that we collect and the reason for doing so.

Collection by the Service

What Personal Information We Collect	How We Collect the Personal Information	Why We Collect the Personal Information
Personal identifiers including name, physical address, email address, telephone number, and date of birth.	You provide this information directly as part of using the Service.	We use this information to create and maintain a user profile and to complete transactions initiated by the Service.
Identify verifying information, such as information related to state or federal identification.	We may collect and temporarily retain images of identity verification documents uploaded by the user.	We use this information to ascertain a user’s eligibility to utilize the Service.
IP address, browsing and search history, geolocation data, and information related to interaction with the Service.	The Service automatically records these data elements through use of the Service.	We use this information to understand, maintain, and improve users’ interaction with the Service.
Products purchased or considered.	The Service automatically records products purchased by a user or about which a user sought additional information.	We use this information to determine user preferences and to maintain and improve our product selection.

Collection by the App

What Personal Information We Collect	How We Collect the Personal Information	Why We Collect the Personal Information
Personal identifiers including name, physical address, email address, telephone number, and date of birth.	You provide this information directly as part of using the App.	We use this information to create and maintain a user profile and to complete transactions initiated by the App.
Identify verifying information, such as information related to state or federal identification.	We may collect and temporarily retain images of identity verification documents uploaded by the user.	We use this information to ascertain a user’s eligibility to utilize the App.
IP address, browsing and search history, geolocation data, and information related to interaction with the App.	The App automatically records these data elements through use of the App.	We use this information to understand, maintain, and improve users’ interaction with the App.
Products purchased or considered.	The App automatically records products purchased by a user or about which a user sought additional information.	We use this information to determine user preferences and to maintain and improve our product selection.

Collection by the Website

What Personal Information We Collect	How We Collect the Personal Information	Why We Collect the Personal Information
Personal information provided directly.	You may provide information directly as part of using “Contact Us” features on the Website.	We use this information to answer questions and inquiries submitted through the Website.
IP address, browsing and search history, geolocation data, and information related to interaction with the Website.	The Website automatically records these data elements through use of the Service.	We use this information to understand, maintain, and improve users’ interaction with the Website.

Collection by the Commerce Platform

What Personal Information the Commerce Platform Collects	How the Commerce Platform Collects the Personal Information	Why the Commerce Platform Collects the Personal Information
Personal identifiers including name, physical address, email address, telephone number, and date of birth.	You provide this information directly as part of using the Commerce Platform.	The Commerce Platform uses this information to complete transactions.
Reservation time, delivery location, and the specific products and the quantities you ordered.	You provide this information directly as part of using the Commerce Platform.	The Commerce Platform uses this information to complete transactions.

Collection In-Store

What Personal Information We Collect	How We Collect the Personal Information	Why We Collect the Personal Information
Proof of age.	We require customers to exhibit proof of age as required by state law.	We are required by state law to confirm that customers are of legal age to participate in an adult use or medical use cannabis program.
Contact information as you may choose to supply.	We may permit customers to supply contact information – such as an email address – in the event that they wish to be further contacted.	We collect this information to provide further information to customers in accordance with their preferences.

Compliance with State Law and Regulation

Please note that the Solution is offered in multiple jurisdictions in which cannabis is legal under state law and regulation. Our collection, use, disclosure, and protection of Personal Information may differ as between such jurisdictions in order to comply with state law and regulation. In the event of a conflict between this Policy and any state law or regulation, we will act in accordance with state law and regulation.

Non-Personal Information

We may also collect data in a form that does not, on its own, identify a specific individual (“non-personal information”). We may collect, use, transfer, and disclose non-personal information to improve the Solution and customize the user experience, or for any other legitimate purpose. We also may aggregate non-personal information in order to track trends and analyze use patterns on the Solution. The following are some examples of non-personal information that we collect and how we may use it:

We may collect information such as zip code, area code, unique device identifier, referrer URL, or location so that we can better understand customer behavior and improve our Solution.
We may collect information regarding customer activities on our Website. This information is aggregated and used to help us provide more useful information to our customers and to understand which parts of the Solution are of most interest. Aggregated data is considered non-personal information for the purposes of this Policy.
We may collect and store details of how you use the Service, including search queries. This information may be used to improve the relevancy of results provided by the Solution. Except in limited instances to maintain quality of Solution over the Internet, such information will not be associated with your IP address.

This Privacy Policy does not limit our use or disclosure of non-personal information and we reserve the right to use and disclose non-personal information to our partners, advertisers, product manufacturers and other third parties at our discretion (including aggregated and/or anonymized information about our users and their use of the Solution). We do not use or respond to “do not track” signals that may be sent from your web browser. If we do combine non-personal information with personal information, the combined information will be treated as personal information for as long as it remains combined.

Use of Personal Information

We use Personal Information in order communicate with you, provide you with information you have elected to receive, to maintain and operate the Solution, and to facilitate transactions initiated by users. For example, and subject to your stated preferences, we may use personal information to:

register and service your account;
solicit feedback and respond to your questions;
notify you of product availability;
notify you that your products are ready for pick up;
provide technical support; and
inform you about product or promotional offers.

Where a user makes an order to a dispensary, the Solution provides information on your name, email address, phone number, reservation time, delivery location, and the specific products and the quantities you ordered to the dispensary to facilitate the order.

Based on information that we gather about your shopping history or consumers with similar shopping histories, we may, subject to your stated preferences, suggest products to you. We also use personal information to operate our business, which includes analyzing our performance, meeting our legal obligations, and doing research. When we ask you to provide personal information, you can decline, but if you do, you may not be able to access the Website or use the Service or you may not be able to use certain features.

Cookies and other Technologies

The Solution uses third party analytic and tracking tools to better understand who and how people are using the Solution and how to improve the effectiveness of the Solution, and to help serve more targeted advertising to you. Third party companies may use cookies, pixel tags, or other technologies to collect, process, and store information, such as time of visit, pages visited, time spent using the Solution, device identifiers, type of operating system used and other website(s) you may have visited. They might combine information they collect from your interaction with the Solution with personal information they collect from other sources. We do not have access to, nor control over, third parties’ use of cookies or other tracking technologies. For instance, we use Google Analytics, a web analytics service provided by Google, Inc. (“Google”) to measure and optimize the Service. Google Analytics uses cookies to help us analyze how users use the Solution. The information generated by the cookie about your use of the Solution (including your IP address) will be transmitted to, and stored by, Google on their servers. Google will use this information for the purpose of evaluating your use of the Solution, compiling reports on website activity for us and providing other services relating to website activity and Internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google’s behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however, please note that if you do this you may not be able to use the full functionality of the Solution. By using the Solution, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

Disclosures of Personal Information

We do not disclose Personal Information except as provided below under “Third Party Contractors,” “Business Transitions,” and “Compliance with Law and Prevention of Harm.”

Third-Party Contractors – We may retain contractors (“Service Providers”) to perform limited services on our behalf, such as hosting websites and providing email services. Service Providers are required to obtain only the Personal Information necessary to perform the function for which they were retained, to maintain the confidentiality of Personal Information, and not to use Personal Information for any purpose other than the function for which they were retained.

Business Transitions – We may share information with businesses that are legally part of the same group as we are, or that become part of that group. We reserve the right – in the event of a business transition such as a merger – to transfer Personal Information to a new business owner, on the condition that such Personal Information must be treated in accordance with this Policy.

Compliance with Law and Prevention of Harm – We may disclose your Personal Information or any information submitted via the Solution if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce any applicable terms of service, including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to the rights, property or safety of us, our users, you or the public. We may be required to disclose Personal Information in response to a lawful request by public authorities, including to meet national security or law enforcement requirements.

No Sale of Personal Information

We do not sell Personal Information.

Messaging

You may be asked to consent to receive informational and marketing messages at the mobile phone number and/or email address you provide. If you consent, we may send you SMS messages and/or emails (consistent with state law and regulation) concerning orders, sales, product availability, and industry news and insights. Standard per minute call and message and data rates may apply. You may opt-out of receiving marketing messages at any time.

Protecting Your Personal Information

We follow generally accepted industry standards, including the use of appropriate administrative, physical and technical safeguards, to protect Personal Information. The appropriate administrative, physical, and technical safeguards employed by us may vary depending on the nature of Personal Information collected, with more stringent measures applied to information of a sensitive nature.

However, no method of transmission over the Internet, or method of electronic storage, is entirely secure. Therefore, while we strive to use commercially reasonable means to protect Personal Information, we cannot guarantee its absolute security or confidentiality. Please be aware that certain Personal Information and other information provided by you in connection with your use of the Solution may be stored on your device (even if that information is not collected by us). You are solely responsible for maintaining the security of your device from unauthorized access.

Personal Information will be retained for as long as is reasonably necessary to achieve the purposes set forth in this Policy, and to comply with all applicable laws.

Your Choices Concerning Personal Information

You can make choices about our collection and use of your information. You can control certain personal data that we obtain, and exercise your data protection rights, by contacting us or using various tools we provide through the Website, Service, and App. For example, you can:

Use the “unsubscribe” links contained in our email messages to stop receiving product or promotional offers from us via email.
Prevent the Website from obtaining your location by disabling location services on your device. However, doing so means you may not be able to use the Website.

Not all personal information processed by us can be accessed or controlled via the tools above. If you want to access or control personal data processed by us that is not available via the tools above, you can always contact us at privacy@terrascend.com.

Additional Rights of California Residents

Users who reside in California have the right to request information about our collection, use, and disclosure of their information (a “Request to Know”), including:

the categories and specific pieces of Personal Information we have collected about the user;
the categories of sources from which we have collected the user’s Personal Information;
the business or commercial purpose for collecting or selling the user’s Personal Information;
the categories of Personal Information we have sold about the user; and
the categories of Third Parties with whom we have shared, disclosed for a business purpose, or sold the user’s Personal Information, and which categories of Personal Information we have sold to which categories of Third Parties.

Users of the Solution also have the right to request that we delete their Personal Information (a “Request to Delete”).

Requests to Know

Users may submit a Request to Know by mailing a letter with the request to 1201 Vine Street, Ste 201, Healdsburg, CA 95448, attn: CCPA with your name and contact information or by emailing us at privacy@terrascend.com.

Users may submit two types of Requests to Know: (1) A request for the specific pieces of Personal Information that we have collected about you in the past twelve months; or (2) a request for the categories of Personal Information that we have collected about you in the past twelve months, and we have used and disclosed that Personal Information.

When you submit a Request to Know, we may ask you to provide certain pieces of information in order to verify your identity, such as your name, email address, and phone number. If you submit a Request to Know for the specific pieces of information that we have collected about you, we may also require you to submit a signed declaration under the penalty of perjury stating that you are the consumer whose Personal Information is the subject of the Request to Know.

If we are able to verify your identity, we will respond to your Request to Know by: (a) providing the requested information; or (b) explaining why we are not required to provide the requested information. If we are unable to verify your identity, we will respond by explaining why we cannot verify your identity. We will confirm receipt of your Request to Know within 10 days and will respond to your Request to Know within 45 days. If a response requires additional time, we will notify you of the basis for the delay and may extend our response period up to an additional 45 days.

If we provide the information requested, we will provide the information free of charge and in a readily useable portable format. We have no obligation to provide Personal Information to you more than twice in a 12-month period. If a Request to Know or series of Requests to Know are manifestly unfounded or excessive, we may charge a reasonable fee for processing the Request(s) to Know, or may refuse to process the Request(s) to Know.

Requests to Delete

Users may submit a Request to Delete by mailing a letter with the request to 1201 Vine Street, Ste 201, Healdsburg, CA 95448, attn: CCPA with your name and contact information or by emailing us at privacy@terrascend.com. When you submit a Request to Delete, we may ask you to provide certain pieces of information in order to verify your identity, such as your name, email address, and phone number. If we are able to verify your identity, we will respond to your Request to Delete by (a) deleting your Personal Information and, if applicable, directing any of our Service Providers to delete your Personal Information; or (b) explaining why we are not required to delete your Personal Information. We may choose to delete Personal Information by de-identifying, aggregating, or completely erasing the Personal Information. We will specify the manner in which we delete your Personal Information.

If a Request to Delete or series of Requests to Delete are manifestly unfounded or excessive, we may charge a reasonable fee for processing the Request(s) to Delete, or may refuse to process the Request(s) to Delete.

Our Policies Concerning Children

In order to utilize the Solution, a user must be 18 years of age, subject to any additional legal requirements as may vary from state to state. This may include users accessing the Solution on their own behalf or, as permitted under state law, a parent, guardian, or other authorized caretaker accessing the Solution on behalf of a minor child permitted to take part in a medical cannabis program. Our collection of Personal Information of individuals under age 18 is limited to situations in which a parent, guardian, or other authorized caregiver acts consistently with state law to provide the Personal Information of a minor child who is permitted to take part in a medical cannabis program. If we become aware that we have collected the Personal Information of an individual under age 18 in any other situation, we will delete it.

Users Outside of The United States

The Solution and the servers upon which the Solution are hosted are located in the United States and are intended only to be used by individuals in the United States. Personal Information you submit using the Solution will be transferred to and stored in the United States. By using the Solution and submitting Personal Information, you authorize this transfer. For the avoidance of doubt, the Solution is not designed for, or targeted to, or in any way offering goods or services to users who are in the European Union.

Changes to our Privacy Policy

We may occasionally update this Privacy Policy. When we do update this Privacy Policy, post the updated Privacy Policy and we will revise the “Last Updated” date at the top of the Privacy Policy. Please review this Privacy Policy periodically to stay informed about how we are protecting the Personal Information we collect. If you continue to use the Solution after we post an update to this Privacy Policy, you are indicating your acceptance of the updated Privacy Policy.