For this California Notice, unless we indicate otherwise, "personal information" means information that identifies, relates to, describes, references, is reasonably capable of being associated with or could reasonably be linked, directly or indirectly, with a person or household ("personal information"). Personal information does not include: publicly available information from government records; de-identified or aggregated consumer information; and, information excluded from the CCPA's scope.

In the past twelve (12) months, we have collected one or more pieces of personal information that falls into eleven of the categories of personal information defined in the CCPA and as indicated below.

Artsonia collects personal information for the following business purposes:

• to create and allow access to accounts
• to create a school gallery and ensure that visitors can locate the correct school
• to create a student digital portfolio and showcase their artwork to parents, friends, and family
• to create screennames for the public galleries
• to locate students in the public portfolio
• to organize student portfolios and artwork
• to process orders and ship product
• to communicate with customers, students, teachers, and parents
• to encourage students and teachers
• to allow parents and teachers to communicate about a student's artwork portfolio
• to identify the devices used and improve the product and experience
• to improve our products, websites, services marketing emails and notifications
• to provide the Artsonia service

Artsonia has not "sold" personal information in the past twelve (12) months. For the purposes of this disclosure, "sold" does NOT include the sale of merchandise that may contain personal information as sold within the Artsonia Gift Shop.

We have shared the following categories of personal information with other members of the Artsonia Family, our service providers and third parties with which you have agreed we can share your information, in the past twelve (12) months:

• Identifiers
• Personal Information listed in the California Customer Records Statute ("Customer Records")
• Commercial information
• Internet or other network activity
• Non-public educational information
• Inferences drawn from personal information

If you would like additional information about the kinds of information we collect and how we use it, please visit our Data Usage Chart.

The CCPA gives California Residents the right to ask us about our collection and use of the personal information we have collected, used, and disclosed over the past twelve (12) months. To do so, you can submit a verifiable consumer request for information (a "Request to Know"), including:

• Categories of personal information we collected about you over the past twelve (12) months;
• Categories of sources for the personal information we collected about you;
• Our business or commercial purpose for collecting the personal information;
• Categories of personal information, if any, that we have disclosed to third parties;
• For each category of personal information identified, the categories of third parties with whom we share that personal information; or,
• Certain, specific pieces of personal information we collected about you ("Data Portability Request").

California Residents have the right to request that we delete the personal information we have collected and retained ("Requests to Delete") about you. Upon Artsonia's receipt of a verifiable request to delete personal information (see Exercising Access, Data Portability, and Deletion Rights, below), we will delete your personal information from our records and direct service providers to also delete your personal information by permanently and completely erasing the personal information on our systems; de-identifying the personal information; or, aggregating the personal information.

Please note that we cannot delete information that is retained at the direction of a school, including Artwork uploaded by students or teachers on behalf of students, unless the school makes or approves the request. We may also deny your deletion request and, then, won't comply with your request (so we also wouldn't ask service providers to comply with the request) if retaining the information is necessary to perform certain functions or commitments as follows: completing the transaction for which the personal information was collected; providing a service requested; otherwise performing our contract with you or taking reasonably anticipated actions within the context of our ongoing business relationship with you; detecting security incidents and protecting against malicious, deceptive or otherwise illegal activity or to prosecute those responsible for those activities; complying with a legal obligation or otherwise using the personal information, internally, in a lawful manner; complying with the California Electronic Communications Privacy Act; fulfilling the terms of a written warranty or product recall conducted in accordance with federal law; or, for a purpose otherwise contemplated by Cal. Civ. Code Section 1798.105(c)-(d) and as amended. If your personal information is stored on archived or backup systems, we may delay compliance with your request with respect to that data until it is restored.

You may make a verifiable customer request for access or data portability twice within a 12-month period. To exercise the access, data portability and deletion rights described above, please submit a verifiable consumer request to us by either:

• Calling us at 800-869-9974
• Submitting a personal information request form

Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to the personal information about you. You may also make a verifiable consumer request on behalf of your minor child. For children under the age of thirteen (13), requests must be made by the child's parent or legal guardian. If the request is made through an agent, we reserve the right to require a signed authorization or verification of the agent's identity from you in order protect the privacy of the personal information requested.

Should you call us or visit the website we've shown above, you will access the form we have for making a verifiable request. But, generally, your verifiable request must:

• Provide sufficient information to allow us to reasonably verify you are the person about whom we collected personal information or that you are the authorized representative of that person;
• Describe your request with sufficient detail to allow us to understand, evaluate and respond to it.

Here's the thing: we can't provide you with the information sought in a Request to Know, or comply with a Request to Delete, if we can't verify your identity or authority to make the request and/or can't confirm the personal information relates to you. We're trying to avoid any unauthorized access of your data. So, even if you already have an account with us, we reserve the right to require additional information from you to verify your request before we respond. If you are not an account holder, or if we believe that the request is fraudulent or that there is fraudulent activity with your account, we may require that you provide a declaration, under penalty of perjury, that you are authorized to make the request, in addition to requiring additional information, before we comply. Any information provided to us in a verifiable customer request will be used only to verify the requestor's identity or authority to make the request and, except as required by law, will be deleted after we have processed your request. We also reserve the right to refuse a Request to Know or a Request to Delete if we believe that the request may be fraudulent or may compromise the security of personal information. Where we refuse a Request, we'll let you know and explain the reasons for refusing.

We'll let you know that we received your request within ten (10) business days of receipt and give you information regarding how we will process you request. We'll try to respond to a verifiable consumer request within forty-five (45) calendar days of its receipt. And, if we require more time to provide a response, up to ninety (90) days from receipt, we will write to you and give you the reason for the extra time and amount of extra time. For example, if you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. If we are not able to verify your request in time to provide you a response within ninety (90) days, we reserve the right to deny your request.

Any disclosures we provide will only cover the twelve (12) month period preceding the verifiable consumer request's receipt. For data portability requests, we will select a format by which to provide your personal information that is readily useable and should allow you to send the information from one entity to another entity without problems. For requests to delete, we will let you know whether or not we were able to comply with your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. If we are only able to comply with part of your request, we will let you know the portions with which we cannot comply and explain why. Know that we don't charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded.

As mentioned above, we may collect or process sensitive data as needed or required to deliver services you have requested, to inform you of other products or services, and to contact you via surveys to conduct research about your opinions. You may request that we delete this information, subject to certain exceptions as provided by the CCPA.

We will not discriminate against you for exercising any of the rights conferred by California statute, including the CCPA. Unless permitted by law, we will not: deny you goods or services; charge you different prices or rates; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate or a different level or quality of goods or services. We may offer certain financial incentives permitted by the CCPA that can result in different prices, rates or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information's value and contain written terms that describe the program's material aspects.

Under California's "Shine the Light" law, California residents are entitled to ask businesses, annually, for a list of the personal information that has been shared with third parties to use for their direct marketing purposes, as well as the name and addresses of those third parties, subject to certain exceptions. Businesses with a published privacy not to disclose personal information to third parties to use in their direct marketing without consent are not subject to this requirement if they have notified the customer that they have the right to prevent disclosure of personal information and have provided the customer with a cost-free means to exercise this right.

Artsonia NEVER discloses children's personal information with third parties for their direct marketing purposes. We do not share the personal information of ANY user with third parties for their direct marketing purposes, unless you affirmatively agree to a specific disclosure. If we do share personal information with third parties for their direct marketing purposes and you authorize us to include your information, we will only share that information in connection with that specific promotion. To prevent disclosure of your personal information for use in direct marketing by a third party, do not opt in to such use when you provide personal information on our Service. If you later decide that you do not want that third party to use your personal information, you will need to contact the third party directly.

California customers can receive more information about our compliance with this law, to opt out of information sharing, or to make a request under California Civil Code Section 1798.83 by contacting us as described in the Contacting Artsonia section below.

Do Not Track (or "DNT") is a privacy preference that users can set in various browsers – including Chrome, Internet Explorer, Firefox, and Safari. "DNT" relies on a technology known as a DNT header, which sends a signal to Web sites visited by the user about the user's browser DNT preference setting. Artsonia does not track its users over time and across third-party websites to provide behaviorally-targeted advertising and therefore does not respond to Do Not Track (DNT) signals with respect to the Artsonia Website. For more information on "do not track", please visit www.allaboutdnt.org.

Third parties that have content embedded on the Artsonia Website, such as a Social Media Feature, may set cookies on a user's browser and/or obtain information about the fact that a web browser visited the Artsonia Website from a certain IP address.

If you are under the age of 18, or the parent of a child using Artsonia under the age of 18 residing in California, you are entitled to request removal of content or information you (the minor) have publicly posted on our Service. If you would like to request removal of your or your child's publicly posted content or information, please contact us as described in the Contacting Artsonia section below for assistance. Parents can delete specific Artwork directly by logging into their account. Please note that removal of your content or information does not ensure complete or comprehensive removal, as there may be deidentified or recoverable elements of your content or information on our servers in some form. Additionally, we will not remove content or information that we may be required to retain under applicable federal and state laws.

Artsonia may modify its Privacy Notice, including this specific California Privacy Notice, from time to time. The most current version of this Privacy Notice will govern our use of your information and will be located at https://www.artsonia.com/privacy and https://www.artsonia.com/privacy/ca. We will notify you of material changes to our policies by posting a notice at the Websites or by emailing you at an email address associated with your Websites Account, if applicable, and provide an "at a glance" overview of any changes.

Artsonia is located at 1350 Tri-State Pkwy Suite 106, Gurnee, IL 60031. Should you have any comments or questions about how we collect and use your personal information, communication can be directed to Artsonia's postal address, via email to privacy@artsonia.com or by telephone to 800-869-9974.