This Privacy Policy ("Privacy Policy" or "Policy") applies to the Personal Information House of Brands LLC. and its subsidiaries (collectively, "Company", "we", "us" or "our") obtains via your transactions and interactions with us, including through your use of websites, mobile applications, registration as a Key Club member, social media pages, and other platforms that reference this Privacy Policy (“Online Channels”); when you connect with us via telephone, at our events, and through surveys (“Support Channels”); through our text message marketing program (“Messaging Service”); and through our third-party sources, including advertising and social media networks (collectively, the “Channels”).

This Policy is an integral part of our Terms at: https://www.oakandluna.com/articles/terms-and-conditions (“Terms”). Any capitalized terms not defined herein shall have the meaning ascribed to them in the Terms. Your access and use of the website or any Channel constitutes your agreement to the Terms and policies, including to the extent applicable this Privacy Policy. If you have any questions, please contact our customer service.

This is a global privacy policy. Certain jurisdictions may have additional requirements, which are addressed in Section 14 of this Policy under Additional Disclosures.

We reserve the right to amend this Policy (or any policies referred to) from time to time, at our sole discretion. The most recent version of this Policy will always be posted on the website, and the update date will be reflected in the “Last Updated” heading. We will provide notice to you if these changes are material, and, where required by applicable law, we will obtain your consent. Any amendments to the Policy will become effective immediately, unless we notify otherwise. We recommend you review this Policy periodically to ensure that you understand our most updated privacy practices

CONTROLLER CONTACT INFORMATION:

House of Brands LLC is the data controller, or equivalent responsible entity under applicable law, with respect to the Personal Information processed through various Channels. Our physical address is 108 West 13th Street, Wilmington, Delaware 19801, USA. You may contact us regarding privacy matters at support@oakandluna.com.

“Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identified or identifiable individual. Personal Information does not include information that has been anonymized or aggregated so that it can no longer reasonably identify an individual. The Personal Information we collect varies depending on how you interact with us and the Channels, as described below. We treat Non-personal Information that is linked or reasonably linkable to Personal Information as Personal Information for as long as that link exists.

“‍Non-personal Information” means information that does not identify, and cannot reasonably be used to identify, an individual. This may include aggregated, anonymized information, as well as certain technical information, such as device and browser information, operating system, keyboard language, and Wi-Fi network information, where such information is not reasonably linkable to an individual. We may use and disclose Non-personal Information for statistical, research, analytics, product development, and other lawful business purposes.

Personal Information Collected Directly from You

We collect the following categories of Personal Information that you provide directly to us:

• Account and Contact Information: Full name, date of birth, address, email address, telephone number, password, and other account registration details that you provide when registering for our Key Club, subscribing to receive exclusive offers, gifts, and other benefits, including an annual promotional code during your birth month (“Key Club”), or signing up to receive our marketing materials and newsletter.

We collect this information for the following purposes:

• Account registration and authentication.
• Providing, operating and improving our products, services, and the Channels.
• To send you needed service, operation, or transaction information related to our engagement (e.g., billing and invoicing, technical updates, etc.).
• To send you marketing communications about our products and services, where we have your consent for our Messaging Service or where otherwise permitted by applicable law.
• Providing support and troubleshooting through our Support Channels.
• Security, abuse prevention, and service integrity.

• Communications: Feedback, testimonials, reviews, and other information you share with us, including any inquiries, request for information regarding our product, communications with our customer support, or otherwise communicate with us, whether through an online form available on our website, by sending us an email, or by any other Channels. We may ask you to provide your feedback through third-party integrations (such as Trustpilot), or you may voluntarily do so on social media. These reviews may include rating, free-text comments, your name, and picture, and will be displayed by Company on its website, landing pages, or social media. Company further processes communications with the customer support team, sales team, communications with us through social media, including information, you provide to us through the automated virtual assistant and live chat features on our Online Channels, client care information (such as client service inquiries, comments, and repair history).

We collect this information for the following purposes:

• To have records of our communications and to improve our support.
• To improve our services and allow others to make informed decisions.
• Display your reviews.
• Provide support.
• Communicate with you.
• Advertising.
• To have internal analytics and statistics, used by us to enhance and improve our products, services and the Channels.
• To maintain bookkeeping records and to comply with any regulatory requirement (e.g., tax related, etc.)

• Purchase and Transaction Information: Records of purchases, transaction history, payment-related details, including the last 4 digits of your payment method and the expiry date (as your payment is being processed by our third-party payment processor, we will not store or have access to your full payment information) (“Orders Information”). Company further collects registration status for your Key Club account, together with your Orders Information, to calculate your Key Club points (“Key Club Data”).

We collect Key Club Data and Orders Information for the following purposes:

• To create and designate your Key Club account, authenticate, enable log-in, and access and use the Channels.
• To calculate and manage your Key Club points.
• To send you information related to your Key Club account.
• Payment, fraud prevention, and billing.
• Providing our products and services.

Personal Information Collected Automatically

We collect the following categories of Personal Information automatically in connection with our Channels:

• Usage Data: Analytics data relating to our Online Channels and other marketing assets; clickstream data; and other information about your online activities, including information about your devices, browsing actions, interactions with our Online Channels, and usage patterns. This may include information about your activities and interactions across our Online Channels and third-party websites; your clicks, taps, inputs, and other interactions with our campaigns, Online Channels, and products; traffic to and from our websites; referral URLs to and from our Online Channels; web login and access log information; the pages or content you view and the duration of such views; related timestamps; and products added to your shopping cart.

We collect this information for the following purposes:

• Security, abuse prevention, and service integrity.
• Online Channels operation.
• Operate, maintain, and improve our Online Channels and develop new features. At times we aggregate or pseudonymize data to help us better understand our consumers, for example to measure our sales performance and identify audience segments. We also use this data to improve our products, train and fine-tune algorithms and data analytics models.
• Creating analytic information and insights.

We use your Personal Information to create profiles reflecting your preferences, browsing behavior, and purchasing patterns. This profiling is used to personalize the Messaging Service, recommend products, tailor marketing communications, and calculate your Key Club points. Profiling is based on your usage data, commercial information, and derived inferences as described above. We do not engage in automated decision-making that produces legal effects or similarly significant effects concerning you. Our profiling activities are limited to personalization and marketing optimization and do not result in decisions that affect your legal rights, access to services, or financial standing. You have the right to object to profiling at any time as detailed below.

• Device Information: Device identifiers, IP address, operating system, browser and keyboard language, Wi-Fi network information, and location information that may be derived from your IP address. We collect this information for the following purposes:

• Security, abuse prevention, and service integrity.
• Customer support and troubleshooting.
• Enabling the transaction.
• Support.

• Inferred Personal Information: We may collect, generate, or otherwise process Personal Information inferred from other Personal Information we collect or obtain from you. This may include inferences, assessments, recommendations, suggested analyses, and other insights generated through your use of the Channels, which may help us provide personalized outputs and functionality through the Support Channels and the Online Channels. We collect this information for the following purposes:

• Personalization, profiling.
• Providing the products, services and the Channels.
• Future developments and improvements.
• Creating analytic information and insights.

• Cookies and Tracking Technologies: Information collected through cookies, pixel tags, web beacons, and similar technologies (see Section 6 below).

Personal Information obtained from Third Parties

We may receive Personal Information about you from third parties, including:

• Third-Party Platform Information: We may receive Personal Information from payment service providers in connection with your payments, including information relating to the processing and confirmation of your transactions.

We collect this information for the following purposes:

• Providing our services and verifying your identity.
• Enabling payments and transactions.
• Fulfillment and shipping of products.
• Marketing and promoting the Online Channels and our products through marketing partners and social media.

Generally, we process, use and store Personal Information to provide customer support, fulfill orders, sell, deliver and promote the products, including offering jewelry and other available products and goods through our Online Channels, administer payments and billing, operate and maintain the Online Channels and our products, and operate, evaluate and improve our business including developing new products and services; enhancing and improving our services; managing our communications; analyzing our products and client base, including by generating customer profiles; generating insights about our customers and creating groups of similar customers; performing data analytics; and performing accounting, auditing and other internal functions. We further process the Personal Information to personalize the Online Channels, content, and recommendations based on your usage patterns and preferences, and to comply with applicable laws, regulations, legal processes, and governmental requests.

In addition, we process your Personal Information to comply with and enforce applicable legal requirements to which we are subject and for the establishment, exercise or defense of legal claims, whether in court proceedings or in an administrative or out-of-court procedure.

We also use the information in other ways for which we provide specific notice at the time of collection and obtain your consent to the extent required by applicable law, such as U.S. laws that require consent for secondary purposes.

To the extent applicable under data protection jurisdictions, such as the General Data Protection Regulation (“GDPR”) we will detail the lawful basis for processing Personal Information, as follows:

• Consent: Where you have given us specific, informed, and unambiguous consent to process your Personal Information for specified purposes (e.g., processing Personal Information through cookies, to the extent consent is required under applicable laws, etc.).
• Performance of Contract: Where processing is necessary for the performance of our contract with you (e.g., to provide the products and services you have requested, support, etc.).
• Legitimate Interests: Where processing is necessary for our legitimate interests or those of a third party, provided such interests are not overridden by your rights and freedoms (e.g., fraud prevention, service improvement, direct marketing, etc.).
• Legal Obligation: Where processing is necessary for compliance with a legal obligation to which we are subject.

As detailed above, we collect Personal Information through the following methods:

• Directly from you: When you create an account, make purchases, participate in the Key Club, or contact our support team.
• Automatically: Through cookies, tracking technologies and server logs when you interact with the Channels.
• From third parties: From payment processors, ad and attribution partners and vendors, third-party analytics providers, customer feedback platforms, and other sources where you have given permission or where information is publicly available.

We may share, disclose, or otherwise allow access to Personal Information we collect with third parties, as described below:

• Advertising Partners: We may share certain data with advertising partners to enhance your experience, provide personalized advertising, measure advertising effectiveness, and improve the products and services and Online Channels content. The information shared may include usage data, device identifiers, and other information necessary to serve targeted advertisements and help us run and optimize the Online Channels and products. Our advertising partners use this information in accordance with their respective privacy policies, to serve targeted advertisements, measure the effectiveness of advertising campaigns, and improve user experience.
• Authorities and Law Enforcement: We may disclose Personal Information to satisfy any applicable law, regulation, legal process, subpoena, or governmental request. We may also share Personal Information to enforce this Policy or the Terms, including investigation of potential violations thereof; to detect, prevent, or otherwise address fraud, security, or technical issues; to respond to claims that any content available on the Online Channels violates the rights of third parties; or otherwise if we believe in good faith that this will help protect the rights, property or personal safety of us, any of our users, or any member of the general public.
• Our Affiliated Companies: We may share Personal Information internally with our affiliated companies for the purposes described in this Policy. In addition, when we or any of our affiliated companies is undergoing any change in control, including by means of merger, acquisition, or purchase of all or substantially all of its assets, we may share Personal Information with the parties involved in such event. If we believe that such change in control might materially affect your Personal Information then stored with us, we will notify you of this event and the choices you may have via e-mail and/or prominent notice on our websites and mobile applications. In addition, we are part of an affiliated group. We share your Personal Information with our affiliated organizations, MYKA, Theo Grace, Lime & Lou, and SETT&Co., for their own purposes.
• Third Party Service Providers: We are partnering with several selected service providers whose services and solutions complement, facilitate, and enhance our own. Such third-party service providers may have access to, or process on our behalf, Personal Information that we collect, hold, use, analyze, process, and/or manage. These service providers assist us with hosting, database and server co-location services, data analytics, payment processing, data analytics services, customer support, session replay records for analytic purposes such as crashes, functionality and usability, and other operational, business, legal and financial functions. We remain responsible for any Personal Information processing done by third-party Service Providers on our behalf not in accordance with the terms hereof, except for events outside of its reasonable control and except for such third-party.

In the 12 preceding months, we have collected or disclosed the following categories of Personal Information:

When you use our Online Channels, both we and certain third parties (such as our advertising networks, digital advertising partners and social media platforms) collect information about your online activities, over-time and across third-party websites (such as on websites that serve our ads). We may use such information to provide you with advertising about products and services tailored to your individual interests. We also may obtain information for this purpose from third-party websites on which our ads are served. You may see certain ads on other websites because we engage third-party ad buying networks (such as Facebook and TikTok). Through such buying networks, we can target our messaging to users through demographic, interest-based and contextual means. The information our ad networks may collect on our behalf includes data about your visits to websites that serve Oak and Luna ads, such as the pages or advertisements you view and the actions you take on the websites. This data collection takes place both on our websites and on third-party websites that participate in these ad networks. This process helps us track the effectiveness of our marketing efforts.

Company does not sell Personal Information to third parties for monetary consideration. However, our sharing of Personal Information with advertising partners for cross-context behavioral advertising, as described above, may constitute “sharing” or a “sale” under certain US state privacy laws, including the California Consumer Privacy Act (“CCPA”). California residents and residents of other applicable U.S. states may opt out of such sharing by emailing support@oakandluna.com with the subject line “Do Not Sell or Share.”

We use cookies, pixel tags (web beacons), and similar tracking technologies to collect information about your interactions with the Channels. These technologies help us: remember your information and preferences; recognize you when you return to our Online Channels; understand how you use our Online Channels and the products reviewed (analytics); deliver and measure the effectiveness of advertising; and provide functionality and personalization.

The providers of third-party apps, tools, widgets and plug-ins on our Online Channels, such as Facebook “Like” buttons, also may use automated means to collect information regarding your interactions with these features. This information is collected directly by the providers of the features and is subject to the privacy policies or notices of these providers. To the extent permitted by applicable law, Company is not responsible for these providers’ information practices.

There are different types of cookies, as applicable:

• Essential: Required for basic site functionality and cannot be disabled.
• Analytics: Help us understand how users interact with our Online Channels.
• Marketing: Used to deliver relevant advertisements and measure campaign effectiveness.
• Functionality: Remember your preferences and enhance your experience.

Where required by law, non-essential cookies (including analytics and marketing cookies) are deployed only after you provide affirmative consent through our cookie consent banner presented when you first visit our Online Channels. Essential cookies, which are required for basic site functionality, do not require consent and cannot be disabled.

We use information collected through cookies, web beacons (including pixels and tags), web server logs and other automated means for the purposes described in our Cookie Policy, which further details the cookies we use and their purposes

You may manage your cookie preferences at any time through the cookie consent banner (Update Privacy Preferences) or by adjusting your browser or removing cookies through your browser or Online Channels settings. Please note that disabling cookies may affect the functionality of certain features of our Online Channels.

We may use third-party review and customer feedback platforms, such as Trustpilot, to collect and display reviews about our products and services and to invite customers to provide feedback. Where permitted by applicable law, we may share limited Personal Information with such providers for these purposes, such as your name, email address, order details, and other information necessary to verify your experience with our products and services and send a review invitation. Reviews you submit through such third-party platforms may be publicly displayed together with the information you choose to include in your review or profile. These third-party platforms may process your personal information in accordance with their own privacy policies.

If we integrate Trustpilot content, widgets, tags, cookies, pixels, SDKs, or similar technologies into the Channels Trustpilot and related providers may automatically collect certain information from your device or browser, such as your IP address, device and browser information, pages viewed, usage data, and cookie or similar tracking information, in order to provide the review content, measure interactions, and improve their services. For more information about how Trustpilot processes Personal Information, please review Trustpilot’s privacy policy available at: https://corporate.trustpilot.com/legal/for-businesses/privacy-policy/jun-2026.

If you elect to receive automated marketing and support text messages from us either by signing up on our website or by sending a text message indicating your consent, you are confirming that you provided prior express written consent to receive automated, recurring marketing and support text messages from us (each, a “Text Message”) sent through an automatic telephone system. Text Messages may include updates about your order (i.e. shipped, out for delivery, etc.).

When you opt-in to the service, we will send you an SMS message to confirm your signup for Oak and Luna® notifications/alerts. In addition, when you sign up to receive Text Messages, we may send you information about promotions and other offers. These messages may use information automatically collected based on your actions on our Online Channels via cookies or other similar technologies and may prompt messaging such as cart abandon messages. For more information on how we use cookies or other similar technologies please see Section 6.

We collect various information you provide, including your name, telephone number and/or information about when you read a Text Message. We will also collect any information you provide to us in those Text Messages. The information we collect is used to enhance your experience with our services

Consent to receive these Text Messages is optional and not a condition of purchase. You can opt-out of receiving any further Text Messages from this program at any time by replying “STOP” (or equivalent keywords such as END, CANCEL, UNSUBSCRIBE or QUIT) to any Text Message you receive from us or. After replying "STOP" you will receive a Text Message confirming that you have been opted out. After this, you will no longer receive SMS messages from us. If you want to join again, just sign up as you did the first time and we will start sending SMS messages to you again.

For Service support or assistance, text HELP to +18446360538 or email support@oakandluna.com. After you send the SMS message "HELP" to us, we will respond with instructions on how to use our service as well as how to unsubscribe.

You must promptly notify us if you cancel your mobile plan or change or transfer the mobile number you provided to us, and you must opt out of the SMS program if you no longer wish to receive text messages.

We are able to deliver messages to the following mobile phone carriers: Major carriers: AT&T, Verizon Wireless, Sprint, T-Mobile, MetroPCS, U.S. Cellular, Alltel, Boost Mobile, Nextel, and Virgin Mobile. Minor carriers: Alaska Communications Systems (ACS), Appalachian Wireless (EKN), Bluegrass Cellular, Cellular One of East Central IL (ECIT), Cellular One of Northeast Pennsylvania, Cincinnati Bell Wireless, Cricket, Coral Wireless (Mobi PCS), COX, Cross, Element Mobile (Flat Wireless), Epic Touch (Elkhart Telephone), GCI, Golden State, Hawkeye (Chat Mobility), Hawkeye (NW Missouri), Illinois Valley Cellular, Inland Cellular, iWireless (Iowa Wireless), Keystone Wireless (Immix Wireless/PC Man), Mosaic (Consolidated or CTC Telecom), Nex-Tech Wireless, NTelos, Panhandle Communications, Pioneer, Plateau (Texas RSA 3 Ltd), Revol, RINA, Simmetry (TMP Corporation), Thumb Cellular, Union Wireless, United Wireless, Viaero Wireless, and West Central (WCC or 5 Star Wireless).

Please note that your mobile provider’s message and data rates may apply to our confirmation Text Message and any other subsequent Text Message sent to you from us and to us from you according to your mobile service carrier’s pricing plan. You will generally receive no more than one Text Message per week; however, message frequency may vary from time to time.

For questions about your text or data plan, please contact your wireless carrier. Carriers are not liable for delayed or undelivered Text Messages.

For more information on how we use telephone numbers, please read our Privacy Policy in its entirety.

Depending on the jurisdiction in which you reside, you may have certain rights under relevant applicable laws regarding the collection and processing of your Personal Information. To the extent these rights apply and concern you, you can contact us via the contact details available above and ask to exercise the following rights.

Right to Unsubscribe: We may use your Personal Information to send you direct marketing communications about our products, services, promotions, and events. We will obtain your consent before sending marketing communications where required by applicable law.

You may opt out of receiving marketing communications at any time by:

(a) Clicking the "unsubscribe" link in any marketing email;

(b) Adjusting your communication preferences; or

(c) Contacting us at support@oakandluna.com

Please note that even if you opt out of marketing communications, we may still send you transactional or service-related messages (e.g., account notifications, security alerts).

Right of Access. You may request confirmation of whether we process your Personal Information and, if so, request access to and a copy of such information.

Right to Correction. You may request that we correct inaccurate or incomplete Personal Information we hold about you.

Right to Deletion. You may request that we delete your Personal Information, subject to certain legal exceptions.

Right to Data Portability. You may request to receive your Personal Information in a structured, commonly used, and machine-readable format, and to transmit such information to another controller.

Right to Withdraw Consent. Where processing is based on your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing conducted prior to withdrawal.

Right to Object. You may object to the processing of your Personal Information where we rely on legitimate interests as the legal basis.

Right to Restriction. You may request that we restrict the processing of your Personal Information under certain circumstances.

Right to Lodge a Complaint with a Supervisory Authority. You have the right to file a complaint with a local data protection supervisory authority.

Right not to be subject to a decision based solely on automated processing. This includes profiling, which produces legal effects or similarly significantly effects you.

Right to Limit the Collection of Your Sensitive Personal Information. You have the right to limit the collection and use of your Sensitive Personal Information where required by applicable law.

Right not to be discriminated against for exercising your rights: You have the right to receive equal service and price and not be discriminated against for exercising any of your rights.

However, please note that these rights are not absolute, and may be subject to our own legitimate interests and regulatory requirements. Also, the exercise of some of these rights may make it impossible for us to continue to provide you with some or all of our services through the Channels.

When handling these requests, we may ask for additional information to confirm your identity and your request. Please note, upon request to delete your Personal Information, we may retain such data in whole or in part to comply with any applicable rule or regulation or response to or defend against legal proceedings involving us or our affiliates, or as we are otherwise permitted under such law applicable to you. If you have additional concerns, you can also lodge a complaint with your local data protection authority.

Note, various rights can be exercised through the Channels without the need to contact us:

• You can update some of your Personal Information in your user account, or reach our customer support center.
• You can choose to opt-out of cookies tracking tools.
• You can stop getting our newsletter at any time by clicking the unsubscribe link in any newsletter message.

We will only use Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request. Making a verifiable consumer request does not require you to create an account with us.

We, along with our authorized affiliates and service providers who assist us in manage our business operations or provide our services, maintain, store and process Personal Information in the United States, where House of Brands LLC is incorporated, Europe, and other locations as reasonably necessary for the proper performance and delivery of our services and Channels, or as may be required by applicable law.

As a result, any information you provide us with may be transferred to and processed in countries other than the country from which you accessed our Channels. Where Personal Information is transferred outside your jurisdiction, we will take appropriate measures and ensure that appropriate safeguards are in place, including Standard Contractual Clauses approved by the European Commission (for transfers from the EU/EEA/UK); Adequacy decisions by relevant data protection authorities; Contractual protections requiring recipients to protect Personal Information to standards consistent with this Policy; and your explicit consent, where applicable.

We retain your Personal Information for as long as reasonably necessary to fulfill the purposes described in this Policy, including:

(a) Providing our services and maintaining your account;

(b) Complying with our legal and regulatory obligations;

(c) Resolving disputes and enforcing our agreements (including our Terms available at: https://www.oakandluna.com/articles/terms-and-conditions);

(d) Maintaining business records as required by applicable law; and

(e) Achieving legitimate business purposes, such as product improvement and analytics.

When Personal Information is no longer required for these purposes, we will delete or anonymize it in accordance with this Policy and applicable law. The specific retention period depends on the nature of the data, the purposes for which it was collected, and applicable legal requirements.

We implement and maintain industry-standard technical and organizational security measures designed to protect your Personal Information against unauthorized access, alteration, disclosure, or destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and employee training.

While we strive to protect your Personal Information, no method of transmission over the Internet or electronic storage is completely secure. We encourage you to use the strongest password combination available and to take appropriate measures to protect your account credentials.

In the event of a data breach affecting your Personal Information, we will notify you and relevant authorities as required by applicable laws.

Our Channels are intended for individuals over the age of 16. We do not knowingly collect Personal Information from children under 16 years of age. If you are under 16, you may not use our Channels. If we become aware that we have collected Personal Information from a child under 16, we will take steps to delete such information as soon as practicable.

If you are a parent or guardian and believe your child has provided us with Personal Information without your consent, please contact us at support@oakandluna.com.

• U.S. Specific Notice

These specific U.S. provisions supplement this Policy and describe additional Personal Information practices concerning data subjects to whom U.S. privacy laws apply. These specific U.S. provisions should be read in conjunction with this Policy, and, in the event of a conflict between these specific U.S. provisions and the Policy, these specific U.S. provisions will apply.

For our privacy practices where CCPA apply, please visit our CCPA Notice. To opt out of the sale or sharing of your Personal Information for targeted advertising purposes, please use the cookie consent banner available on our Online Channels.

Residents of certain U.S. states (depending on the applicable state law, acting as an individual or in the household context only and not in a commercial or employment context, as a job applicant or as a beneficiary of someone acting in an employment context or as representative of a business), may have additional rights under applicable privacy laws and be entitled to additional disclosures.

“Personal Information” under applicable US privacy laws, generally means any information that is linked or reasonably linkable to an identified or identifiable individual (and usually does not include publicly available information that is lawfully made available from government records, or that a consumer has otherwise made available to the public; de-identified or aggregated consumer information; or information excluded from the scope of applicable state laws).

“Sensitive Information” includes data revealing racial, ethnic or national origin; religious beliefs; information regarding an individual’s medical history, mental or physical health condition, diagnosis or medical treatment; neural data; status as transgender or non-binary; sex life or sexual orientation; status as a victim of a crime; citizenship or immigration status; genetic or biometric data; Personal Information collected from a known child; and precise geolocation data.

We are required to provide you with a clear and accessible privacy notice that includes the categories of Personal Information processed, including any Sensitive Information, the purpose of processing, the categories of Personal Information shared with third parties, the categories of third parties with whom Personal Information is shared, the categories of Personal Information that is sold or used for targeted advertising, if any, the categories of third parties to whom the Personal Information is sold, if any, a list of your data rights and instructions for exercising those rights and appealing decisions, and our contact information. This information is detailed under this Privacy Policy and further below.

Categories of Personal Information & Categories of Third Parties with Whom Personal Information is Shared:

Under the Privacy Policy, we describe our collection and processing of Personal Information, the categories of Personal Information that are collected or processed, and the purposes for which Personal Information is processed, stored or used. We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without obtaining your consent, unless we are otherwise entitled, required or permitted under applicable laws.

Additionally, this Privacy Policy details and discloses the categories of third parties we share Personal Information with for a business purpose.

“Sale” of Personal Information:

Under US privacy laws, in principle, the term “sale” refers to disclosing or making available Personal Information to a third party in exchange for monetary or other valuable consideration, including for targeted advertising purposes. We do not “sell” information as this term is commonly understood, meaning, we do not, and will not, disclose your Personal Information in direct exchange for money or some other form of payment. However, subject to the definition of the term “sale” under applicable US privacy laws, our practice of using “cookies” or other third party advertising services and sharing Personal Information for such purpose to third party advertising and marketing providers (e.g., providers of marketing tools and analytic tools, advertising networks, social media networks, media buying, search platforms) may be considered a “sale”.

Such practice includes the following Personal Information categories shared with these third parties:

• Identifiers – online identifiers such as IP and Cookie ID;
• Internet and electronic network activity information – such as your engagement with our website and ads.
• Geolocation data derived from IP address (country level).

You may exercise your right to opt out of the sale or sharing of your Personal Information at any time through our cookie consent banner.

Appeal Rights

Depending on your state of residency, you may be able to appeal a decision we have made in connection with your privacy rights request, by contacting us as instructed in our response. Please send your appeal request with a summary of the request and decision you want to appeal to: support@oakandluna.com.

Within 60 days after receipt of an appeal, and always in accordance with the timelines set by the applicable US Privacy Laws, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reason for the decision.

If you are not satisfied with our response, you may, depending on your jurisdiction, have the right to lodge a complaint with the relevant state Attorney General or other competent regulatory authority:

• Colorado Attorney General as follows: Colorado AG at https://coag.gov/file-complaint .
• Connecticut Attorney General at link: https://www.dir.ct.gov/ag/complaint /.
• Delaware Attorney General at https://attorneygeneral.delaware.gov/fraud/cmu/complaint/.
• Florida Attorney General at https://www.myfloridalegal.com/consumer-protection/consumer-complaint-form.
• Indiana Attorney General at https://www.in.gov/attorneygeneral/consumer-protection-division/file-a-complaint/.
• Iowa Attorney General at https://www.iowaattorneygeneral.gov/for-consumers/file-a-consumer-complaint.
• Kentucky Attorney General at https://secure.kentucky.gov/formservices/AttorneyGeneral/ConsumerMediationForm.
• Maryland Attorney General at https://www.marylandattorneygeneral.gov/Pages/CPD/Complaint.aspx.
• Minnesota Attorney General at http://www.ag.state.mn.us/.
• Montana Attorney General at https://dojmt.gov/consumer/consumer-complaints/.
• Nebraska Attorney General at https://ago.nebraska.gov/constituent-complaint-form.
• Nevada Attorney General at https://ag.nv.gov/Complaints/CSU_Complaints___FAQ/
• New Hampshire Attorney General at https://onlineforms.nh.gov/app/#/formversion/e0c5d644-c9d8-4056-a7cc-24d29c446fcb.
• New Jersey Attorney General at https://www.njoag.gov/contact/file-a-complaint/.
• Oregon Attorney General at https://www.doj.state.or.us/consumer-protection/contact-us/.
• Rhode Island Attorney General at https://riag.ri.gov/forms/consumer-complaint
• Texas Attorney General at https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.
• Tennessee Attorney General at https://www.tn.gov/attorneygeneral/working-for-tennessee/consumer/file-a-complaint.html
• Utah Attorney General at https://www.attorneygeneral.utah.gov/contact/complaint-form/.
• Virginia Attorney General at https://www.oag.state.va.us/consumercomplaintform .

• Israel Specific Notice

Notwithstanding the legal bases for processing Personal Information detailed above, where Israeli data protection laws apply the processing is based on your consent.

You are not legally required to provide us with Personal Information. However, we may need certain Personal Information to provide our services and enable you to use certain features of the Channels. If you choose not to provide such information, we may be unable to provide some or all of our services or the functionality of the Channels.