You have the right to request:

• Access to your personal data.
• Rectification or deletion of your personal data.
• A restriction on the processing of your personal data.
• Object to the processing of your personal data.
• A transfer of your personal data (data portability).

You can make a request in relation to any of the above rights by contacting us as set out at the end of this Privacy Policy. We will respond to such queries as soon as possible, but not later than 30 days.

If you do not want your personal information to be used by us for marketing purposes, you may opt out by choosing of such disclosures via our cookie manager.

Rights of individuals in the EEA

If you are located in the European Economic Area, you have the following additional data protection rights:

• You can object to processing of your personal data,
• You can ask us to restrict processing of your personal data,
• You can request portability of your personal data or
• A transfer of your personal data (data portability).

You can exercise these rights by contacting us using the contact details provided under the “CONTACT INFORMATION” heading below.

Similarly, if we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. You can withdraw your consent by using the go to the data subject access request page and submitting a request or by contacting us using the contact details provided under the “CONTACT INFORMATION” heading below.

‍You have the right to complain to a data protection authority about our collection and use of your personal information. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Economic Area are available here. We would, however, appreciate an opportunity to address your complaint before you approach the supervisory authority so please contact us in the first instance with any complaints you may have by sending an email.

We may send push notifications or emails from time to time in order to update you about any service updates, events and promotions we may be running. If you no longer wish to receive these communications, please disable these in the settings on your device or please opt out by clicking the “Unsubscribe” button at the bottom of any email. Once you do this, you will no longer receive any emails from us.

Legal Basis For Using EEA Personal Data

If you are located in the European Economic Area, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it. Usually, we rely on the following legal bases to process your personal information:

• Legitimate interest. We may process your personal data for our legitimate interests. For example, to provide or improve our Services, manage relationships with customers, or for security purposes and fraud prevention. We will also reach out to you about our service offerings to make sure you are aware of all of the available options. When we process personal information to meet our legitimate interests, we put in place safeguards to ensure that your privacy is protected and to ensure that our legitimate interests are not overridden by your interests or fundamental rights and freedoms.
• Consent. We will rely on your consent to use your personal data (including, without limitation, technical data, cookie data, usage information, and geo-location data), for personalized or interest based advertising purposes and to send you marketing information. When you first visit a website or application, we read cookies and similar technologies on the internet browser of your device or in connection with applications you use that allows us to identify browsers and devices that have previously interacted with our Service or customers. This initial reading of cookies and similar technologies allows us to determine whether you or the user(s) of your device, have previously given consent to the use of personal data. You may withdraw your consent at anytime by contacting us using the contact details provided under the Contact Information section of this Privacy Policy
• Performance of Contract. We will process your business contact information you provide when registering for our Service to provide the services and manage relationships.
• Legal obligation. In some cases, we may also have a legal obligation to collect personal information from you or may otherwise need the personal information to protect your vital interests or those of another person. If we ask you to provide personal information to comply with a legal requirement, we will make this clear at the relevant time and advise you whether the provision of your personal information is mandatory or not (as well as of the possible consequences if you do not provide your personal information).
• Vital Interest. We may process your information if it is necessary to protect your vital interests or the vital interests of a third party.

If you have questions about or need further information concerning the legal basis on which we collect and use your personal information, please contact us using the contact details provided under the Contact Information section of this Privacy Policy.

CCPA Privacy Notice
‍The California Code of Regulations defines a "resident" as:

• Every individual who is in the State of California for other than a temporary or transitory purpose and
• Every individual who is domiciled in the State of California who is outside the State of California for a temporary or transitory purpose

All other individuals are defined as "non-residents."

If this definition of "resident" applies to you, we must adhere to certain rights and obligations regarding your personal information.

We have collected the following categories of personal information in the past twelve (12) months:

We will use and retain the collected personal information as needed to provide the Services or for:

• Category A - 1 year
• Category B - 6 months
• Category F - 1 year
• Category G - 1 year
• Category I - 1 year

We may also collect other personal information outside of these categories through instances where you interact with us in person, online, or by phone or mail in the context of:

• Receiving help through our customer support channels;
• Participation in customer surveys or contests; and
• Facilitation in the delivery of our Services and to respond to your inquiries.

How do we use and share your personal information?

www.crazeandfriends.com collects and shares your personal information through:

• Targeting cookies/Marketing cookies
• Social media cookies

More information about our data collection and sharing practices can be found in this privacy notice.
You may contact us by email at office@crazeandfriends.com, or by referring to the contact details at the bottom of this document.
If you are using an authorized agent to exercise your right to opt out we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf.

Will your information be shared with anyone else?

‍We may disclose your personal information with our service providers pursuant to a written contract between us and each service provider. Each service provider is a for- profit entity that processes the information on our behalf, following the same strict privacy protection obligations mandated by the CCPA.

We may use your personal information for our own business purposes, such as for undertaking internal research for technological development and demonstration. This is not considered to be "selling" of your personal information.www.crazeandfriends.com has not sold or shared any personal information to third parties for a business or commercial purpose in the preceding twelve (12) months. www.crazeandfriends.com has disclosed the following categories of personal information to third parties for a business or commercial purpose in the preceding twelve (12) months:

• The categories of third parties to whom we disclosed personal information for a business or commercial purpose can be found under "WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?".

Your rights with respect to your personal data

Right to request deletion of the data — Request to delete

You can ask for the deletion of your personal information. If you ask us to delete your personal information, we will respect your request and delete your personal information, subject to certain exceptions provided by law, such as (but not limited to) the exercise by another consumer of his or her right to free speech, our compliance requirements resulting from a legal obligation, or any processing that may be required to protect against illegal activities.

Right to be informed — Request to know

Depending on the circumstances, you have a right to know:

• Whether we collect and use your personal information;
• The categories of personal information that we collect;
• The purposes for which the collected personal information is used;
• Whether we sell or share personal information to third parties;
• The categories of personal information that we sold, shared, or disclosed for a business purpose;
• The categories of third parties to whom the personal information was sold, shared, or disclosed for a business purpose;
• The business or commercial purpose for collecting, selling, or sharing personal information; and
• The specific pieces of personal information we collected about you.

In accordance with applicable law, we are not obligated to provide or delete consumer information that is de-identified in response to a consumer request or to re-identify individual data to verify a consumer request.

Right to Non-Discrimination for the Exercise of a Consumer’s Privacy Rights

• We will not discriminate against you if you exercise your privacy rights.

Right to Limit Use and Disclosure of Sensitive Personal Information

• We do not process consumer's sensitive personal information

Verification process

Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us. For instance, depending on the type of request you submit, we may ask you to provide certain information so that we can match the information you provide with the information we already have on file, or we may contact you through a communication method (e.g., phone or email) that you have previously provided to us. We may also use other verification methods as the circumstances dictate.

We will only use personal information provided in your request to verify your identity or authority to make the request. To the extent possible, we will avoid requesting additional information from you for the purposes of verification. However, if we cannot verify your identity from the information already maintained by us, we may request that you provide additional information for the purposes of verifying your identity and for security or fraud-prevention purposes. We will delete such additionally provided information as soon as we finish verifying you.

Other privacy rights

• You may object to the processing of your personal information.
• You may request correction of your personal data if it is incorrect or no longer relevant, or ask to restrict the processing of the information.
• You can designate an authorized agent to make a request under the CCPA on your behalf. We may deny a request from an authorized agent that does not submit proof that they have been validly authorized to act on your behalf in accordance with the CCPA.
• You may request to opt out from future selling or sharing of your personal information to third parties. Upon receiving an opt-out request, we will act upon the request as soon as feasibly possible, but no later than fifteen (15) days from the date of the request submission.

To exercise these rights, you can contact us by email at office@crazeandfriends.com, or by referring to the contact details at the bottom of this document. If you have a complaint about how we handle your data, we would like to hear from you.

In Short: Yes, if you are a resident of Virginia, you may be granted specific rights regarding access to and use of your personal information.

Virginia CDPA Privacy NoticeUnder the Virginia Consumer Data Protection Act (CDPA):

• "Consumer" means a natural person who is a resident of the Commonwealth acting only in an individual or household context. It does not include a natural person acting in a commercial or employment context.
• "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable natural person. "Personal data" does not include de-identified data or publicly available information.
• "Sale of personal data" means the exchange of personal data for monetary consideration.

If this definition "consumer" applies to you, we must adhere to certain rights and obligations regarding your personal data.

The information we collect, use, and disclose about you will vary depending on how you interact with www.crazeandfriends.com and our Services. To find out more, please visit the following links:

• Personal data we collect
• How we use your personal data
• When and with whom we share your personal data

Your rights with respect to your personal data:

• Right to be informed whether or not we are processing your personal data
• Right to access your personal data
• Right to correct inaccuracies in your personal data
• Right to request deletion of your personal data
• Right to obtain a copy of the personal data you previously shared with us
• Right to opt out of the processing of your personal data if it is used for targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects ("profiling")

www.crazeandfriends.com has not sold any personal data to third parties for business or commercial purposes. www.crazeandfriends.com will not sell personal data in the future belonging to website visitors, users, and other consumers.
‍

Exercise your rights provided under the Virginia CDPA

More information about our data collection and sharing practices can be found in this privacy notice.You may contact us by email at office@crazeandfriends.com, by submitting a data subject access request, or by referring to the contact details at the bottom of this document.If you are using an authorized agent to exercise your rights, we may deny a request if the authorized agent does not submit proof that they have been validly authorized to act on your behalf.

Verification process

We may request that you provide additional information reasonably necessary to verify you and your consumer's request. If you submit the request through an authorized agent, we may need to collect additional information to verify your identity before processing your request. Upon receiving your request, we will respond without undue delay, but in all cases, within forty-five (45) days of receipt. The response period may be extended once by forty-five (45) additional days when reasonably necessary. We will inform you of any such extension within the initial 45-day response period, together with the reason for the extension.

Right to appeal

If we decline to take action regarding your request, we will inform you of our decision and reasoning behind it. If you wish to appeal our decision, please email us at office@crazeandfriends.com. Within sixty (60) days of receipt of an appeal, we will inform you in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions. If your appeal if denied, you may contact the Attorney General to submit a complaint.