1. Privacy Policy Overview.

We at TruAge Solutions, LLC ("TruAge", "we", "us", "our") are committed to protecting your personal information and providing sufficient information for you to understand this Privacy Policy. We have developed this Privacy Policy to explain how we collect, process, use, share, retain, secure, and transfer your personal information when you enroll in and use the TruAge Program. You are referred to herein as "you", "your", or "user".

We are providing this Privacy Policy to help you understand our privacy practices and make informed decisions to consent when enrolling in and using the TruAge Program. This Privacy Policy is part of the End User License Agreement ("Consumer EULA") when you download and install our Program. When you enroll or participate in the TruAge Program, you acknowledge that you have read this Privacy Policy and understand and agree with its contents.

2. Personal Information We Collect.

You may provide us with certain information when enrolling and participating in the TruAge Program, referred to in this Privacy Policy as "Personal Information" which is limited to three pieces of information taken from your driver's license or other government-issued ID (i.e., ID number, expiration date, date of birth).

• Enrollment through the Application: To enroll in the TruAge Program, you must download and install the Application to create an online TruAge Account, which requires you to provide your email address and embed your photograph into the Application. Once you create a TruAge Account, you must provide TruAge with three pieces of Personal Information from your government-issued driver's license (or other similar form of identification), which information is limited to (i) the identification number from your driver's license (or other government-issued ID), combined with the name of the issuing authority (e.g., state); (ii) your date of birth; and (iii) the expiration date of the government ID. This information is then tokenized by TruAge so that any Personal Information is pseudonymized (i.e., a single-use token is substituted for any actual Personal Information) and thus is considered de-identified and no longer Personal Information. We are not responsible for any problems, interruptions in access, or liability that may arise if you do not give us complete and accurate information.
• Tokens: TruAge will provide you with tokens which you may store on the Application for use at any participating merchant location—once you receive Tokens, you will generally only have to allow a Participating Merchant to scan a Token to purchase age- or quantity-restricted products. The merchant who scans your Token does not receive any of your Personal Information because the activated digital token contains no personal information. When you present your single-use token via the Application on your Mobile Device to complete an age- or quantity-restricted purchase, no Personal Information is collected or stored by the merchant.
• Use of your photograph: The photograph you embed in the Application, either a selfie or the image from your photo ID, will never leave the Application on your Mobile Device, or be used by a merchant for any purpose other than to match you with the image in order to use the TruAge token. A merchant or its agent is not allowed to remove the photo into its own database or otherwise use or retain a copy of the photo.

3. How We Use Your Personal Information.

Your personal information is collected by TruAge for legitimate business purposes, specifically to help detect deceptive, fraudulent, or illegal actions in order to reduce underage sales of age-restricted products and to help prosecute those responsible for those actions, including, but not limited to, violations of state and federal laws regarding sales and purchases of age- and quantity-restricted products. Accordingly, to the extent the use of your personal information is reasonably necessary and proportionate for these purposes, TruAge is allowed to collect and use your Personal Information for this purpose, even without your affirmative consent; moreover, TruAge de-identifies your Personal Information by creating the tokens described above.

We use the information we collect from you in one or more of the following ways:

• to create your TruAge Account;
• to fulfill our contract with you pursuant to the Customer End User License Agreement;
• to operate and manage the TruAge Program, including customer support, and communication; and/or
• when required by law to do so, or to comply with and enforce legal requirements, agreements, and policies (e.g., under a valid law enforcement subpoena).

4. How We Share Your Personal Information.

We do not sell any Personal Information that we collect from you. We do not share Personal Information with any third parties who are unaffiliated with TruAge. Below are details of how we share Personal Information:

• with service providers, including contractors and agents who perform services and functions at our direction and on our behalf, such as to fulfill the TruAge Program operations and security. We require these service providers to have written contracts with us that include confidentiality, privacy, and security requirements;
• as permitted or required by law or for our legitimate business purposes, including: (a) to comply with a law, legal process, or regulations; (b) responding to or cooperating with law enforcement authorities, other government officials, or other third parties pursuant to a subpoena, a court order or other legal process; (c) to protect the vital interests of a person; (d) to protect our property, services, and legal rights; (e) to companies we plan to merge with or be acquired by; and (f) to support our audit, compliance and governance functions. In any such disclosure of information, your personal information would remain subject to this Privacy Policy; or
• when we have obtained your consent to disclose Personal Information;

Please note we may also use or disclose information about you that does not identify you personally. Your single-use token will be used by retailers who participate in the TruAge Program, including sharing your information with TruAge for pseudonymization, secure remote storage, and retrieval when necessary to confirm the retailer verified your age to complete a specific transaction.

5. How We Protect Your Information.

We use physical, technical, organizational, and administrative security safeguards for the TruAge Program designed to protect against loss, misuse, unauthorized access, disclosure, alteration, or destruction of the information we collect. Our security controls are designed to maintain data confidentiality, integrity, and an appropriate level of availability for authorized users. However, we cannot ensure or warrant the security of any information you transmit through the Site, the TruAge Program, or the CA DMV Application.

Messages that you send us by email may not be secure, and use of email is not recommended for sending us confidential or sensitive information. Please note: Do not email TruAge a picture or any information from your government ID; you must only have a Participating Merchant scan your ID or scan it using the Application to upload to TruAge.

You are responsible for notifying us immediately of any known or suspected unauthorized use(s) of your tokens or any known or suspected breach of security, including loss, theft, or unauthorized disclosure of your Application access or any other Personal Information. Any fraudulent, abusive, or otherwise illegal activity of your tokens may be reported to appropriate law enforcement agencies by us. In the event of a confirmed security incident that involves Application user's Personal Information, we will notify you, the respective regulator, law enforcement, and/or individuals of such incident as required by applicable law or where TruAge deems appropriate.

6. Your Choices and Rights.

Any Personal Information collected by or through the TruAge Program will be used only for the purpose it was provided and as described in this Privacy Policy. Once Personal Information is no longer reasonably necessary for business purposes, we will destroy the Personal Information in accordance with our record retention and destruction policies.

We also respect your rights related to your Personal Information under applicable laws, such as California and other jurisdictions. Depending on where you reside, you may have the right: (1) to be informed about our collection, use, and disclosure of your Personal Information; (2) to know if we maintain your Personal Information, and, if we do, to receive a copy (subject to the rights of others) and to update it if it is inaccurate or out of date; (3) to object to our processing of your Personal Information, and, if we are processing your Personal Information based on your consent, to withdraw that consent at any time; (4) to ask us to delete or restrict your Personal Information; and (5) to not be subjected to any discriminatory treatment for the exercise of your privacy rights. We do not sell your Personal Information.

By contacting us as described below, you can send us your requests related to your Personal Information. We may require that you verify your identity before exercising your individual rights. Additionally, please note that these rights are not absolute, for example, your deletion request does not ensure complete deletion or comprehensive removal, where the content or information may be retained subject to applicable law or where we have a legitimate interest to retain the information.

Shine the Light Law: TruAge does not share information that identifies you personally with non-affiliated third parties for their own marketing use without your permission.

Do not track signals and requests: Do not track signals and requests are sent from your browser to websites you visit, indicating you do not want to be tracked or monitored. Websites are not required to accept these requests, and many do not. At this time, the TruAge Application does not honor do not track signals or requests.

7. Cookies and Similar Technologies.

When you use the TruAge program, we may send a cookie to the browser on your mobile device. A cookie is a text file which is stored on your computer or other device and allows us to distinguish you from other users of the enrollment site. Session-based cookies last only while your browser is open and are automatically deleted when you close your browser. Persistent cookies last until you or your browser delete them, or they expire.

Cookies we may use include:

• Strictly Necessary – Some cookies are essential to enable you to move around our Site or Application and use their features, such as accessing secure areas of the Application via a personal log-in. Strictly Necessary cookies are also used to manage technical processes like server load balancing, caching, and security; to anonymize user sessions; and to store your cookie preferences so that we can honor them. Without these cookies, we cannot enable appropriate content based on your permission level.
• Functional – Functional cookies store data for essential Site or Application services such as account creation or online learning modules. They may also be used to customize the user interface and to store settings and other user-based preferences. These cookies may be set by us or by third-party providers whose services are used on our pages. If you do not allow these cookies, then some or all of these services may not function properly.

Other Ways to Manage Cookies:

There are several ways to manage cookies on our cookie banner. You may instruct your browser to refuse all cookies or to indicate when a cookie is being sent. The Help feature on most browsers provides you with information on how to accept cookies, disable cookies, or to notify you when receiving a new cookie. Please note, however, that many of the cookies we use are "strictly necessary" cookies. If you block or delete them, you will not be able to access certain features of the Site. For more information about cookies and how to block them, please visit allaboutcookies.org.

8. International transfer of Personal Information.

We store information received through or by our Site and the TruAge Program in the United States. If you are a resident of another country or are providing the information from an ID issued by another country, you give affirmative consent to this transfer and understand that the information will be transferred, stored, and used in the United States.

9. Lawful Bases of Processing.

We rely on one or more of the following legal bases to process data:

• the processing is necessary to perform our contractual obligations in our Consumer End User Licensing Agreements or other contracts with you;
• the processing is necessary for the purposes of our legitimate interests, such as in improving, personalizing, and developing the TruAge Program and maintaining the TruAge Program safely and securely as described above;
• consent is provided by you for a specific purpose; or
• the processing is necessary to comply with a legal obligation, a court order, or to exercise or defend legal claims.

10. Can children use the TruAge Program?

The TruAge Program are not directed to children under the age of majority (i.e., 18 or above). We do not knowingly collect information from children or others who are not legally able to use the TruAge Program or unless consent has been given by a parent or guardian. If we obtain actual knowledge that we have collected information from a child under the age of majority without consent, we will promptly destroy that information unless we are legally obligated to retain it. If you believe we have mistakenly or unintentionally collected information from a child under the age of majority, please contact us as noted below.

11. Updates to this Privacy Policy.

We may update or change this Privacy Policy. The Effective Date of this document (or the date shown in the footer) states when it was last revised. Any change to this Privacy Policy will become effective when we post the revised Privacy Policy on the TruAge website and the Program Site. Your continued use of the TruAge Program shall serve as an indication of your agreement.

If any change in this Privacy Policy materially and negatively affects the privacy or security of your Personal Information, we will use reasonable efforts to notify you in advance and give you a reasonable time to object to any changes or withdraw your consent. We encourage you to review this Privacy Policy periodically to stay informed about how we collect, use, and share your Personal Information.

12. Contacting Us

Use the contact information below if you (a) would like to exercise any individual rights you may have about your Personal Information, (b) have questions, concerns, or complaints about this Privacy Policy or our privacy practices, or (c) would like additional information about our privacy practices.

Email: contactus@mytruage.org

Phone: 703.684.3600

Mail: TruAge Solutions, LLC
1600 Duke Street
7th Floor
Alexandria, VA 22314

13. Acknowledgement of Legal Basis/Affirmative Consent

I have read the above information presented by TruAge about their Privacy Policy. I hereby recognize and acknowledge that TruAge, through our contract to enroll in and use the TruAge Program and as part of the Customer End User License Agreement, has provided me with notice and information about its Privacy Policy. In addition, in some situations, I may be able to give affirmative consent to TruAge to collect and use my personal information. I am aware that I have the right to seek to withdraw my consent at any time, with effect for the future, by email or in writing to TruAge at the appropriate mailing address. See the Contact heading for detailed information.

I have read and acknowledged this Privacy Policy before enrolling in the TruAge Program by downloading and using the Application. Accordingly, I give my affirmative consent to and accept this Privacy Policy.