PRIVACY POLICY

Last Updated: July 25, 2022

Introduction

Whenever you access our products or services or interact with us in other ways, Island Club Brands LLC d.b.a. Grain & Barrel Spirits and its affiliated companies (“Grain & Barrel”) collect and use (process) information about you (referred to as your “personal information”). This notice describes how we collect personal information and how we use, share, and protect it. It also explains your rights regarding your personal information and how you can contact us.

Since this notice contains important information, we encourage you to read it. Please use the links to access detailed information. If anything is not clear, please contact us via email at info@grainandbarrel.com. In this privacy notice we describe:

What information Grain & Barrel collects:

• How Grain & Barrel uses your personally identifiable information and other information you provide
• When and how we share your personal identifiable information
• Additional information we may collect concerning you
• What rights you may have and how you may exercise those rights concerning any information we collect about you.

Who collects your personal information

Grain & Barrel is a company, headquartered in Mount Pleasant, SC that sells spirits. Whenever we refer to “we” or “us” inthis notice we mean the relevant Grain & Barrel entity.

Information that we collect

To make our services available to you, or to meet a legal obligation, we need to collect and use certain personal information. If you do not provide the information that we request, we may not be able to provide you with the requested products or services. Some of this information we collect directly from you either in person or via a website or social media. We also collect personal information about you from other sources, such as advertisements for Grain & Barrel products that you may click on.

When we receive personal information about you from different sources, we may combine or link that information. Linking different sources of information enables us to provide a better customer support service when you contact us and to provide you with customized offers for our products and services, personalized services, content, and marketing.

We collect personal information when you:

1. Access our products and services online,
2. Sign up for information and create an online account with our online website,
3. Participate in a prize promotion, contest or event
4. Make a purchase through our online store or return something to us
5. Make a purchase of any Grain & Barrel product through one of our third-party online distributors
6. Submit a review or participate in a survey
7. Communicate with us via email or social media
8. Contact us for assistance
9. Interact with us on social media

We collect personal information from you, which might include:

1. Name, date of birth or country of residence
2. Contact information such as email address, telephone number, shipping address
3. Payment information such as debit or credit card details
4. Your reviews about our products and services, information about yourpreferences and consumption habits
5. Marketing communication and cookie preferences
6. Photographs and videos submitted by you or taken at one of our events
7. Profile pictures and social media profile information
8. Phone, laptop, or similar device data
9. Information about another individual.

If you disclose any personal information relating to other people to us or to our service providers in connection with our products and services, you represent that you have the authority to do so and to permit us to use the information in according with this Privacy Policy.

We also collect personal information from other sources:

• Information received as part of routine card verification (fraud) checks.
• Social network information. When you use asocial network login to access our services, you will share certain personal information from your social media account with us, for example, your name, email address, photo, list of social media contacts, and any other information that may be or you make accessible to us when you connect your social media account to your services account. The specific information transferred depends on your security settings and the privacy policy of your social media network.
• Advertisements with which you interact.
• Joint marketing partners when they share information with us.

How we use your personal information

We use your personal information for legitimate business purposes as described further below.

Providing access to our services:

We may use your personal information to verify you are of a legal age to access our site or obtain our products or services, provide you with the functionality of our services, facilitate purchases of our products and services, and share information about events that may interest you and mobile applications. We may also use personal information to send you administrative information, such as changes in our terms, conditions and policies. We will engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.

Administering prize promotions, offers and events:

We may conduct prize promotions, contests, and other promotional offers. If you participate, we will use your information to administrate such promotions and offers. If you are lucky enough to win, we might ask you for further information so that we can provide your prize and we will ask you to provide proof of your age so that we can verify that you are of legal purchase age and, if required, to satisfy eligibility requirements. Some of these promotions have additional rules containing information about how we will use and disclose your personal information. We use this information to manage our contractual relationship with you.

Customer service:

If you contact us, or we contact you, we will use your personal information such as your purchase information and contact history for the purpose of providing you with assistance, handling enquiries and complaints. We will engage in these activities to manage our contractual relationship with you, for our legitimate business reasons and/or to comply with a legal obligation.

Processing your order:

We use information about you to process your orders (including to determine that you meet the legal purchase age in your state or country), to take payment for items you have purchased from us, to dispatch items you have purchased or to process a return or request for a refund. We may also use your data to protect against or identify possible fraudulent transactions. We will engage in these activities to manage our contractual relationship with you and/or to comply with a legal obligation.

Sending you information about our (and third parties') products and services:

Where you have asked to receive marketing communications from us, we may send you information about our products, newsletters, promotions, offers or other information that we think might be of interest to you. We use personal information to send you marketing communications. You also may receive marketing communications from Grain & Barrel if you have consented to receive alcohol marketing messages from an approved third-party partner of Grain & Barrel. We will collect, store, share and transfer information from these communications either because we have a legitimate interest or with your consent. If you decide to opt-out from marketing messages, you may opt-out by emailing us at info@grainandbarrel.com.

We will seek to comply with your request(s) as soon as reasonably practicable. Please note that if you opt-out of receiving marketing communications from us, we may still send you important administrative messages, from which you cannot opt-out, including information about any purchase of products you might make.

Our business purposes:

We use the personal information we hold about you to accomplish our business purposes, including:

• To undertake quality control on our site;
• To prevent fraud with sales of our products;
• To conduct data analysis, for example, to improve the efficiency of our services;
• To conduct audits, to verify that our internal processes function as intended and are compliant with legal, regulatory or contractual requirements;
• To monitor for fraud and security purposes, for example, to detect and prevent cyberattacks or attempts to commit identity theft;
• To develop new products and services;
• To consider ways for enhancing, improving, or modifying our current products and services;
• To identify usage trends, for example, understanding which parts of our services are of most interest to users;
• To determine the effectiveness of our promotional campaigns, so that we can adapt our campaigns to the needs and interests of our users; and
• For operating and expanding our business activities, for example, understanding which parts of our services are of most interest to our users so we can focus our energies on meeting our users’ interests.

We engage in these activities to manage our contractual relationship with you, to comply with a legal obligation, and/or because we have a legitimate interest.

Personalizing our services:

We may analyze personal information collected for business reporting and providing personalized services, including: (i)to analyze or predict our users’ preferences in order to prepare aggregated trend reports on how our digital content is used, so we can improve our services; (ii) to better understand you, so that we can personalize our interactions with you and provide you with information and/or offers tailored to your interests; and (iii) to better understand your preferences so that we can deliver content via our services that we believe will be relevant and interesting to you. When you use one of our online stores, we will collect information from you during the checkout process. If you do not complete your purchase but ask us to save your basket, we will send you a follow-up email with a reminder of its contents. We may also use your information to provide personalized content and recommendations when we send you information about your purchases. We will provide personalized services either with your consent or because we have a legitimate interest.

Reviews:

Where you have provided a review of one of our products, we will publish this review on the relevant store, subject to our review standards in our Terms of Use. We will treat this information as publicly available content so please do not include any information that should be kept confidential.

Security:

We may use information collected from monitoring our websites, online services, and emails to protect you, our employees, and our partners. This information may be passed to the police or to other appropriate authorities. We will engage in these activities to comply with a legal obligation or because we have a legitimate interest.

How we share personal information

We share your personal information with your consent or as necessary to complete any transaction or provide any service you have requested. We do not share personal information with unaffiliated third parties currently. The following are categories of recipients with whom we might share your data:

• Approved, third-party partners, such as our delivery fulfillment and online distributor partners.
• Social media platforms, blogging sites and related online publishers to which you post information in reference to Grain & Barrel or our products and services.
• Investors, or in the case of a merger or acquisition or similar business transaction; and
• Law enforcement or other governmental agencies pursuant to a valid legal request.

Third party service providers:

We use third party service providers to process personal information on our behalf. These may include the provision of customer support, web hosting providers, customer data management and list enhancement companies, agencies that manage our prize promotions, companies that fill product orders or coordinate mailings, delivery companies, payment processors, data analysis firms and email service providers. We seek to use service providers who can provide appropriate data privacy and security standards.

When you share personal information:

• On message boards, chat, profile pages, blogs and other services to which you are able to post information and content (including, without limitation, our social media pages). Please note that any information you post or disclose through these services is typically in the public domain and may be available to other users and the general public. Grain & Barrel cannot control how or if other visitors to those sites or members of those services share your
• Through your social sharing activity. When you connect to the services with your social media account, you will share information with your friends associated with your social media account, with other users, and with your social media account provider. By doing so, you authorize us to facilitate this sharing of information, and you understand that the use of shared information will be governed by the social media provider’s privacy policy.

Business transactions, legal reasons and law enforcement:

We have a legitimate interest in disclosing or transferring your personal information to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceedings). Such third parties may include, for example, an acquiring entity and its advisors. We may also disclose personal information to comply with legal obligations (such as paying taxes); to respond to requests from government or other public authorities; to protect the rights, privacy, safety or property of Grain & Barrel, you or others; and to permit us to pursue available remedies or limit the damages that we may sustain. These legal obligations and government requests can include laws and authorities outside your country of residence.

Other information we collect

We and our service providers also may collect other information that does not reveal your specific identity or does not directly relate to an identifiable individual (referred to as “other information”). This may include:

• Server log files and environmental variables
• Information collected through cookies, pixel tags and other technologies
• Demographic information and other information provided by you that does not reveal your specific identity
• Information that has been aggregated in a manner such that it no longer reveals your specific identity

If we are required to treat other information as personal information under applicable law, then we may use and disclose it for the purposes for which we use and disclose personal information detailed in this Policy.

Other information may be collected in a variety of ways, including:

Through your browser or device:
• Session and Server Log Files. We may collect your log files when recording web-server activity on our web servers including, for example, the IP address (a number automatically assigned to the computer that you are using by your Internet Service Provider), device identifier, time and date of request, page requested, user agent, referrer and cookie values sent or received. The server log files are collected and may be analyzed to provide information about user activity in the aggregate and identify potential errors or problems with website performance. Collecting IP addresses is standard practice on the Internet and is done automatically by many websites.
• Using cookies
• Using pixel tags and other similar technologies

We and our service providers may also use so-called "pixel tags," "web beacons," "clear GIFs" or similar means (collectively, "Pixel Tags") in connection with some Website pages and HTML-formatted e-mail messages to, among other things, compile aggregate statistics about Website usage and response rates. A Pixel Tag is an electronic image, often a single pixel (1x1) that is ordinarily not visible to Website visitors and may be associated with Cookies on the visitors’ hard drives. When used in HTML-formatted e-mail messages, Pixel Tags can tell the sender whether and when the e-mail has been opened.

Our websites may also provide us with information including details of the content you access and interact with. This is done through Grain & Barrel websites and through cross-website tracking. We use cookies and other technologies to collect information about your device browser and operating system, IP address, links you click and pages you open, which we then use to tailor marketing messages. We will provide personalized services either with your consent or because we have a legitimate interest.

Analytics:

We use GoogleAnalytics, which uses cookies and similar technologies to collect and analyze information about use of our services and report on activities and trends. Google Analytics may also collect information regarding the use of other websites, apps, and online resources. You can learn about Google’s practices by going to https://policies.google.com/technologies/partner-sites.

Approximate Physical Location:

We may collect the physical location of your device if you use a location-based service. Before this information is collected, you may be permitted to allow or deny such uses and/or sharing of your device’s location, but if you do, we and/or our marketing partners may not be able to provide you with the applicable personalized services and content.

Uses and disclosures of other information

We may use and disclose other information for any purpose, except where we are required to do otherwise under applicable law. In some instances, we may combine other information with personal information. In those instances, we will treat the combined information as personal information while it is combined.

Your rights to your personal information

You may request to access, correct, or remove your personal information. You also may request to receive an electronic copy of your personal information to transmit it to another company (to the extent this right to data portability is provided by applicable law). In each case, we may require you to prove your identity and/or provide further information to identify your information. We will respond to your requests consistent with applicable law.To exercise these rights, please email us at info@grainandbarrel.com.

Accessing your personal information

You may ask to see what information we hold about you and to receive an explanation about how we process your data by using the “contact us” form.

Correcting your personal information

If we hold personal information about you that is incorrect, you have the right to tell us that itis incorrect and ask us to amend it.We will do this consistent with applicable law.

Removing your personal information

You may ask us to remove or delete your personal information from our database.

Portability Requests

You may ask us to port your personal information from our database.

Other important information

We take the security of your information very seriously. This section outlines our technology practices to keep your information protected. Please click the links to learn more.

How we protect your information

We use various security measures and tools, such as firewalls, to help protect against the loss, misuse, and alteration of the personal information under our control. Unfortunately, no data transmission over the Internet or data storage system can be guaranteed to be 100% secure.Please do not send us sensitive personal information.

How we retain your personal information

We retain personal information for as long as needed or permitted considering the purpose(s) for which it was obtained and consistent with applicable law. The criteria used to determine our retention periods for payment card information and age-verification information include:

• The length of time we have an ongoing relationship with you and provide the services to you (for example, for as long as you have an account with us or keep using the services).
• Whether there is a legal obligation to which we are subject(for example, certain laws require us to keep records of your transactions for a certain period of time before we can delete them);
• Whether retention is advisable considering our legal position(such as in regard to applicable statutes of limitations, litigation or regulatory investigations).

International transfers of your personal information

We may transfer your information to Grain & Barrel in the United States and to other service providers who may be located outside of the European Economic Area (EEA). Currently, we do not intend to collect any personal data of any individual who is a resident of the European Union, Switzerland or the European Economic Area. If you are a resident of one of these territories or countries and you believe we have collected your information, please contact us at info@grainandbarrel.com and we will delete your personal data after attempting to verify your identity. In these circumstances we take measures to ensure that your information is protected, this includes putting in place contracts with the recipients of your information to ensure that they provide adequate protection for your information.

In certain circumstances, courts, law enforcement agencies, regulatory agencies or security authorities in those other countries may be entitled to access your personal information.

Access to services by individuals who are underage

Our services are not directed to individuals who are under the legal age to purchase alcohol, and we do not knowingly collect personal information from such individuals.

Third-party services

This Privacy Policy does not address, and we are not responsible for, the privacy, information, or other practices of any third parties, including any third party operating any website or service to which our services link. The inclusion of a link on the services does not imply Grain & Barrel’s endorsement of the linked site or service.

Third-party advertising

We use third-party advertising companies to serve advertisements regarding goods and services that may be of interest toyou when you access and use Grain & Barrel services and other websites or online services and if you purchase any of our services. You may receive advertisements based on information relating to your access to and use of the services and other websites or online services on any of your devices, as well as on information received from third parties. These companies place or recognize a unique cookie on your browser (including using pixel tags). They also use these technologies, along with information they collect about your online use, to recognize you across the devices you use, such as a mobile phone and a laptop.

Sensitive personal information

We ask that you not send us, and you not disclose, any sensitive personal information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, sexual orientation, criminal background, or trade union membership) on or through the services or otherwise to us.

Updates to this Privacy Policy

We may change this Privacy Policy. The “LAST UPDATED” legend at the top of this Privacy Policy indicates when this Privacy Policy was last revised. Any changes will become effective when we post the revised Privacy Policy on the services. Your use of the services following these changes means that you accept the revised Privacy Policy.

Contacting us

If you have any questions about this Privacy Policy, please contact us at info@grainandbarrel.com, or, because email communications are not always secure, please do not include credit card or other sensitive information in your emails to us.

Additional information for individuals in the EEA

If you are in the EEA, you also may lodge a complaint with a data protection authority for your countryor region, or of an alleged infringement of applicable data protection law.

© 2022 Grain & Barrel Spirits. All Rights Reserved.