Privacy Notice

Beach Riot Privacy Notice

Last Updated: October, 04, 2026

Introduction

This Privacy Notice describes the privacy practices of Designs by Nikki LLC d/b/a Beach Riot (“Beach Riot,” “we,” “our,” or “us”) in connection with (1) our websites, mobile applications, and other digital properties we own and operate, including www.beachriot.com (the “Websites”); (2) our communications with you in any manner, including by email, direct messaging, telephone, and/or in person (“Communications”); (3) our loyalty rewards program (the “Loyalty Program”) and referral program (the “Referral Program”); and (4) our interactions with certain third-party partners, such as advertising networks, co-branded product partners, and AI-channel partners. Items (3) and (4), together with any other services we provide, are collectively referred to as the “Services.” Please read this Privacy Notice carefully to understand our policies and practices regarding your information. If you do not agree with our policies and practices, your choice is not to use the Websites or Services. By accessing or using the Websites or Services, you acknowledge and agree to this Privacy Notice.

Updates to This Privacy Notice

We may update this Privacy Notice based upon evolving laws, regulations, and industry standards, or as we may make changes to our Websites and Services. We will post changes to our Privacy Notice on this page and encourage you to review our Privacy Notice when you use our Websites or Services to stay informed. We will take appropriate measures to inform you, consistent with the significance of the changes we make. If you disagree with the changes to this Privacy Notice, you should discontinue your use of the Websites and Services.

Children

The Websites and Services are not directed to, and we do not knowingly collect Personal Information from, anyone under the age of sixteen (16). If a parent or guardian becomes aware that their child has provided us with Personal Information, they should contact us at info@beachriot.com. We will delete such information from our files as soon as reasonably practicable.

Personal Information We Collect

Depending on how you interact with our Websites, the nature of our Communications, and how we interact with certain third-party partners in connection with your use of the Services, we may collect information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your household (“Personal Information”).

Information You Provide Us

We may collect Personal Information that you provide to us when you sign up for an account, enroll in our Loyalty Program, make a purchase, participate in our Referral Program, complete a survey, submit a review, or otherwise interact with our Services, such as your first name, last name, profile photograph, date of birth, postal address, billing address, shipping address, email address, phone number, account name, credit or debit card and other payment information, and any other information you choose to provide to us.

You may provide your credit card number and billing information when you make a purchase through the Websites. When you place an order, we will share your payment information with our payment processor. See “Payment Processing” below for more information.

Marketing Messages

You may opt in to receive SMS/text notifications from us to receive order updates and marketing information. SMS notifications will only be sent to you to fulfill the purposes for which you shared your phone number with us, including order updates and marketing communications. We share your phone number only with third-party service providers who help us send SMS notifications. You may opt in to our SMS delivery services by entering your phone number when prompted at checkout, by creating an account, or by texting a keyword to a phone number specified in a marketing communication or on our Websites. You may opt out at any time by replying STOP to any promotional message. We will not share your text-message opt-in or consent status with any third party for purposes unrelated to providing the messaging service. We may share this data with vendors who help us deliver text messages, including platform providers and phone carriers.

Loyalty Program

We offer a free customer rewards program that allows members to earn points through qualifying purchases and engagement activities (such as product reviews, photo reviews, social media follows, and referrals) and redeem those points for discounts and rewards. The Loyalty Program includes tiered membership levels that unlock additional benefits based on annual customer spend. You may also participate in our Referral Program.

To facilitate points earning, redemptions, tier status, rewards, and referrals, we collect and use information that may include your name, email address, phone number, shipping address, Loyalty Program tier status and annual spend, points earned and redeemed, referral activity, and other engagement-related information. You may opt out of the Loyalty Program at any time by contacting us at info@beachriot.com.

Product Reviews and User-Generated Content

We use third-party review platforms to collect and display product reviews on the Websites. If you submit a review, we may collect the name or pseudonym you choose to display, your email address, the content of your review, and any photographs, videos, or other user-generated content you choose to include. We may repurpose reviews, testimonials, and other user-generated content in our marketing materials in accordance with the applicable review platform’s terms and any rights granted at the time of submission.

Customer Service Communications

When you contact our customer service team, we collect the contents of your communications with us (including email, chat, and any voice or video media you voluntarily provide), your contact information, and any other Personal Information you choose to share. We retain these communications so we can respond to your inquiry, process returns and warranty claims, and improve our customer service operations.

Information We Automatically Collect

When you visit the Websites, we may automatically collect certain information about your device and your interaction with the Websites, including information about your web browser, operating system, IP address, device identifiers, online identifiers (such as cookie IDs and mobile advertising IDs), time zone, and approximate geolocation (such as city, state, or postal-code-level location) derived from your IP address. Additionally, as you browse the Websites, we may collect information about the individual web pages or services that you view, what websites or search terms referred you to the Websites, your interactions with pages, content, and advertisements, and information about how you interact with the Websites. Some of this information is collected through cookies, pixels, tags, software development kits, and similar technologies deployed on the Websites, including through our tag management platform and by third parties who provide advertising, analytics, attribution, and social commerce services (as further described in the “Cookies & Similar Technologies” section below).

Information from Third-Party Partners

We also collect information from our third-party partners, data analytics providers, marketing and advertising providers, commerce platform providers, third-party suppliers, participating AI-channel partners that enable in-channel checkout, fraud prevention service providers, and other vendors that provide services to us. This information may include identifiers, commercial information, and inferences.

Inferences

We may derive inferences about you from the information described above, including predicted preferences, marketing audience segments, customer lifetime value estimates, and propensity scores used for advertising, retargeting, and personalization.

Cookies & Similar Technologies

We use cookies (small, often encrypted, text files that are stored on your computer or mobile device) and similar technologies (“Cookies”) to provide you with certain functions on our Websites and help collect data. This section explains how we use Cookies to collect information about the way you use our Websites and how you can control them.

How We Use Cookies

We use Cookies to track how you use our Websites by providing usage statistics and to analyze how you interact with our email communications. Cookies are also used to deliver content and updates to you and to enable account authentication based upon your browsing history and previous visits to the Websites. Information supplied to us using Cookies helps us to provide a better online experience to our visitors and users and send marketing communications to them, as the case may be. We may combine the information we collect from Cookies with Personal Information that we have collected from you to learn more about how you use our Websites to improve them.

We use Google Analytics and other third-party analytics providers (“Analytics Providers”) to collect information about how you use our Websites. Analytics Providers use Cookies in order to collect demographic and interest-level information and usage information from users that visit the Websites, including information about the pages where users enter and exit the Websites and what pages users view on the Websites, time spent, browser, operating system, and IP address. Analytics Providers use the information they collect from the Websites and other websites to share with us and other website operators information about users, including age range, gender, geographic regions, general interests, and details about devices used to visit the Websites and other websites and purchase items.

For more information regarding Google’s use of cookies, collection and use of information, see their Privacy Notice at https://policies.google.com/privacy?hl=en. The Google Analytics Opt-Out Browser Add-On is available at https://tools.google.com/dlpage/gaoptout.

Behavioral Marketing and Advertising

On our Websites we use the marketing and remarketing services of Google LLC and the visitor action pixels of Meta Platforms, Inc. (which operates Facebook and Instagram). These services allow us to display advertisements in a more targeted manner in order to present advertisements of interest to users. Through remarketing, ads and products are displayed to users relating to interests established by activity on other websites within the applicable networks. For these purposes, code is placed on our Websites and Cookies are stored on the user’s device. Google and Meta may link the resulting information to your Google or Meta account and use it for their own promotional purposes in accordance with their privacy policies.

You can opt out of interest-based advertising by Google using the settings and opt-out options provided by Google at http://www.google.com/ads/preferences. You can object to the collection of your data by the Facebook pixel, or to the use of your data for the purpose of displaying Facebook ads, at https://www.facebook.com/settings?tab=ads.

The companies we work with to provide you with targeted ads are required by us to give you the choice to opt out of receiving targeted ads. Most of these companies are participants of the Digital Advertising Alliance (“DAA”) and/or the Network Advertising Initiative (“NAI”). To learn more about the targeted ads provided by these companies, and how to opt out, please visit: (i) for website targeted ads from DAA participants, https://www.aboutads.info/choices; (ii) for app targeted ads from DAA participants, https://www.aboutads.info/appchoices; and (iii) for targeted ads from NAI participants, https://www.networkadvertising.org/choices/. Opting out only means that the selected participants should no longer deliver certain targeted ads to you, but does not mean you will no longer receive any targeted content and/or ads.

Types of Cookies

We use both session Cookies (which expire once you close your web browser) and persistent Cookies (which stay on your device until you delete them). The Cookies we use on our Websites can be grouped into the following categories:

• Strictly Necessary: These Cookies are necessary for the Websites to work properly. They include any essential authentication and authorization Cookies for our Websites.

• Functionality: These Cookies enable technical performance and allow us to remember the choices you make while browsing our Websites, including any preferences you set. They also include sign-in and authentication Cookies and IDs that enable you to return without additional sign-in.

• Performance/Analytical: These Cookies allow us to collect certain information about how you navigate the Websites and services running on your device. They help us understand which areas you use and what we can do to improve them.

• Targeting: These Cookies are used to deliver relevant information related to our Websites to an identified machine or other device (not a named or otherwise identifiable person) which has previously been used to visit our Websites. Some of these types of Cookies on our Websites are operated by third parties with our permission and are used to identify advertising sources that are effectively driving customers to our Websites.

How to Control and Delete Cookies

Cookies can be controlled, blocked or restricted through your web browser settings. Information on how to do this can be found within the Help section of your browser. All Cookies are browser specific. Therefore, if you use multiple browsers or devices to access websites, you will need to manage your Cookie preferences across these environments. Find out how to manage Cookies on popular browsers:

• Google Chrome, available at https://support.google.com/accounts/answer/61416

• Microsoft Edge, available at https://privacy.microsoft.com/en-us/windows-10-microsoft-edge-and-privacy

• Mozilla Firefox, available at https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences

• Apple Safari, available at https://support.apple.com/guide/safari/manage-cookies-sfri11471/mac

• Opera, available at https://www.opera.com/help/tutorials/security/privacy/

If you are using a mobile device to access the Websites, you will need to refer to your instruction manual or other help/settings resource to find out how you can control Cookies on your device. For more information about Cookies, and how to disable Cookies, visit http://www.allaboutcookies.org.

Please note that if you restrict, disable or block any or all Cookies from your web browser or mobile or other device, the Websites may not operate properly, and you may not have access to our services available through the Websites. We will not be responsible for your inability to use our Websites or any degraded function you may experience that may be caused by your settings and choices regarding Cookies.

How We Use Personal Information

We use your Personal Information for the following purposes and as otherwise described in this Privacy Notice or at the time of collection:

• To provide, operate, and improve the Websites and Services;

• To create and manage your account and to fulfill any requests you place through the Websites and Services;

• To process, authorize, and fulfill orders (including shipping, returns, refunds, and warranty claims), and to send you transactional communications such as order confirmations, shipping updates, and receipts;

• To operate our Loyalty Program, including to calculate and track your points balance and tier status, process point redemptions, facilitate your participation in our Referral Program, and provide tier-based benefits;

• To communicate with you about the Websites and Services, including by sending you announcements and administrative messages, tier achievement notifications, points balance reminders, reward redemption reminders, birthday rewards, Referral Program notifications, and review requests;

• To respond to your requests, inquiries, issues, and feedback, and to provide customer service;

• To provide you with marketing and promotional communications by email, text message, or postal mail, and to administer our sweepstakes and other contests;

• To help us advertise the Websites and display advertisements to you, measure the performance of our marketing and advertising, attribute conversions across our marketing channels, and build, refine, and target audiences for advertising and retargeting through third-party advertising, social media, and connected-TV platforms;

• To personalize your experience with the Websites, recommend products, save you time, and better understand your needs and preferences;

• To display product reviews, testimonials, and other user-generated content on the Websites and to repurpose reviews and testimonials in our marketing materials with appropriate rights;

• To enable, process, fulfill, and support purchases you initiate through AI channels (as further described under “Payment Processing” below);

• To determine applicable taxes, shipping rates and options, regional advertising relevance, and the privacy laws that apply to your interactions with the Websites, based on approximate geolocation derived from your IP address and shipping address;

• To conduct testing, research, analysis, and product development, including to develop and improve our Websites, products, and Services;

• To generate and use inferences to personalize your experience with the Websites, recommend products, and tailor marketing and advertising to you;

• To anonymize or aggregate your information for marketing, analytics, and actuarial purposes;

• To detect, investigate, prevent, and respond to fraud, abuse, chargebacks, unauthorized activity, and other security or integrity risks affecting the Websites, our customers, or us;

• To authenticate you when you access your account and to maintain the security of your account;

• To enforce our terms and procedures and prevent harm to other users of our Services;

• To comply with our tax, accounting, and other legal and regulatory obligations, including maintaining transaction and financial records for the periods required by law;

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;

• To establish and exercise our rights and defend against legal claims; and

• With your consent.

Payment Processing

Shopify Store

Our online store is hosted by Shopify Inc., which provides us with the e-commerce platform that allows us to sell our products and Services to you. Your data is stored through Shopify’s data storage, databases, and general Shopify application. For information about Shopify’s security practices, you may review Shopify’s Terms of Service at http://www.shopify.com/legal/terms and Shopify’s Privacy Statement at http://www.shopify.com/legal/privacy.

Payment

If you choose a direct payment gateway to complete your purchase, then Shopify processes and stores your credit card data in encrypted form. It is encrypted through the Payment Card Industry Data Security Standard (PCI-DSS). Your purchase transaction data is stored only as long as is necessary to complete your purchase transaction and to comply with applicable legal and recordkeeping obligations. All direct payment gateways adhere to the standards set by PCI-DSS as managed by the PCI Security Standards Council, which is a joint effort of brands like Visa, Mastercard, American Express, and Discover. PCI-DSS requirements help ensure the secure handling of credit card information by our store and its service providers.

Shopify Agentic AI Storefronts

We may also enable Shopify’s “Agentic Storefronts” functionality, which allows you to purchase eligible products directly within certain approved third-party AI channels without leaving the AI-channel interface. This currently includes Google AI Mode/Gemini and Microsoft Copilot. If you choose to purchase through an AI channel:

• The purchase remains a transaction between you and us. The transaction is completed through our Shopify store, with Shopify processing your payment information.

• You will also be subject to the AI channel’s own terms and Privacy Notice, in addition to our terms.

In order to provide the services through these AI channels, Shopify may disclose Personal Information associated with your order to participating AI channels to enable them to initiate, process, or complete the transaction, provide order status updates, support fraud/abuse prevention, and meet legal compliance requirements.

Separate from checkout, products may be discoverable in AI channels through multiple mechanisms described by Shopify (including Shopify Catalog syndication, web crawling/indexing, and product feeds that a merchant may separately share with those companies for other purposes such as advertising). If you disable in-channel checkout, an AI channel may still display products and redirect you to our online store to complete checkout.

Shopify Collective

We use Shopify Collective, a Shopify service that helps Shopify merchants source and sell products with each other. When you place an order on our Websites for a product sourced through Shopify Collective (i.e., products of other merchants), order and customer information needed to process and fulfill that order (for example, contact, shipping, and order details) may be shared between us, Shopify, and the applicable supplier so the order can be fulfilled, shipped, and supported. If we act as a supplier to another merchant through Shopify Collective, we may receive comparable order-related information from the retailer merchant and Shopify to process, ship, and service those orders. Shopify and participating merchants may each process Personal Information under their own privacy notices and legal obligations.

How We Share Personal Information

We share your Personal Information for the purposes described above. We may share your Personal Information with our affiliates and third parties to facilitate services they provide to us. These can include providers of services such as e-commerce and mobile app platforms, order management and fulfillment, payment processing, brand partners, internet service providers, Loyalty Program service providers, advertising networks, data analytics providers, marketing and communications, customer service, subscriptions, returns and exchanges, and Loyalty Program and Referral Program management. Such third parties are bound by contractual obligations to keep Personal Information confidential and to use it only for the purposes for which we disclose it to them.

We may share your Personal Information to comply with applicable laws and regulations, to respond to a subpoena, search warrant, or other lawful request for information we receive, to enforce our agreements, to protect our interests, property, or the safety of others, or in connection with claims, disputes, or litigation.

We may disclose your Personal Information as part of a corporate business transaction such as a merger or acquisition, joint venture, corporate reorganization, financing, divestiture, or sale of company assets, or in the event of insolvency, bankruptcy, or receivership. In these cases, Personal Information could be transferred to third parties as a business asset.

We may partner with third parties to offer co-branded products, to act as a supplier for our products through the partner’s sales channel, or to offer the partners’ products through our Websites. If you purchase co-branded products or engage with co-branded advertisements, or you make purchases in connection with a partner channel, we will share information with such partners and any related payment processors (as applicable) to fulfill orders and, in the case of co-branded products, for joint marketing purposes.

We may share your Personal Information with your consent, which may be obtained in writing; online, through “click-through” agreements; when you accept the terms of use on our Websites; orally, either in person or on the phone; or by other means.

We may use non-personally identifiable and aggregate information for any lawful purpose, including analyzing trends, administering the Websites, tracking user movements, creating new products or services, or improving our business and the Websites. We may share aggregate information with third parties to develop and deliver targeted advertising, to analyze and report on the advertising you see, and for other business purposes. Aggregate information does not constitute Personal Information and is not intended to identify or re-identify any individual.

Summary of Data Disclosed to Third Parties

In the preceding twelve (12) months, we may have disclosed the categories of Personal Information listed below for a business purpose, and may have “sold” or “shared” Personal Information (as those terms are defined under the CCPA, including for purposes of cross-context behavioral advertising) to the categories of third parties indicated in the chart below:

We do not sell or share (for purposes of cross-context behavioral advertising) the Personal Information of minors under sixteen (16) years of age.

Social Sharing

We may embed social sharing icons throughout our Websites. These sharing options are designed to enable users to easily share content from our Websites with others using a variety of different social networks. We are not responsible for the security or privacy of any information collected by these third parties. You should review the privacy statements or policies applicable to the third-party services you connect to, use, or access.

Links to Third-Party Websites

The Websites may contain links to other websites, mobile applications, and other online services operated by third parties. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or in mobile applications or online services that are not associated with us. We do not control third-party websites, mobile applications, or online services, and we are not responsible for their actions. Other websites, mobile applications, and services follow different rules regarding the collection, use, and sharing of your Personal Information. We encourage you to read the privacy policies of the other websites, mobile applications, and online services you use.

Privacy Technology Practices

Do Not Track Signals

Some browsers have incorporated “Do Not Track” features to enable users to make privacy and security choices. By using these settings, your browser may send a signal to our Websites not to collect tracking information. Please note that we do not alter our Websites’ data collection and use practices when we see a “Do Not Track” signal from your browser. For more information on “Do Not Track,” visit http://www.allaboutdnt.com.

Global Privacy Control

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to the websites you visit to opt out from certain types of data processing, including data “sales” and “sharing” as defined under applicable privacy laws. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

Your Choices

Account Information

You may access, update, or remove certain information that you have provided to us through your account by visiting your account settings or sending an email to info@beachriot.com. We may require additional information from you to allow us to confirm your identity. Please note that we will retain and use information about you as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

Marketing Emails

You can opt out of receiving promotional emails from us at any time by following the unsubscribe instructions in any promotional email you receive from us, or by emailing us at info@beachriot.com with “UNSUBSCRIBE” in the subject field. Please note that you cannot opt out of non-promotional emails, such as those about your account, transactions, servicing, or our ongoing business relationship.

Text Messages and Calls

You can opt out of receiving text messages or calls from us at any time by (i) for text messages, replying “STOP” to any text message you receive from us or contacting us at info@beachriot.com; and (ii) for calls, requesting opt-out during any call you receive from us or contacting us at info@beachriot.com. Please note that your opt-out is limited to the device and phone number used and will not affect subsequent subscriptions.

Data Security

We employ a number of administrative, technical, and physical safeguards designed to protect the Personal Information we collect. The safety and security of your information also depends on you. Where we have given you (or where you have chosen) a password for access to certain parts of our Websites, you are responsible for keeping this password confidential. We ask you not to share your password with anyone. We urge you to be careful about giving out information in public-facing areas of the Websites, such as product reviews or community features.

If you make any purchases through the Websites, we may use a third-party payment processor to assist with securely processing your payment information. For details on how your credit card data is encrypted and stored, please see the “Payment Processing” section above.

Unfortunately, the transmission of information via the internet is not completely secure. Although we do our best to protect your Personal Information, we cannot guarantee the security of your Personal Information transmitted to our Websites. Any transmission of Personal Information is at your own risk.

Data Retention

We retain your Personal Information for as long as we have a business relationship with you or as necessary to fulfill the purposes for which it was collected, provide the Websites and Services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws. To determine the appropriate retention period for Personal Information, we consider applicable legal requirements, the amount, nature, and sensitivity of the Personal Information, certain risk factors, the purposes for which we process your Personal Information, and whether we can achieve those purposes through other means. We reserve the right to retain anonymized and aggregate information indefinitely. If we dispose of your information, we will do so in a way that is secure and appropriate to the nature of the information subject to disposal.

Notice to California Residents

This section applies to Beach Riot customers who are residents of California, and describes our practices under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, and its implementing regulations (collectively, the “CCPA”). This section does not apply to information that is exempt from the CCPA, including deidentified, aggregated, or publicly available information.

For information about the categories of Personal Information we collect from California residents, the sources from which we collect it, the business or commercial purposes for which we use it, and the categories of third parties with whom we share or sell it, please see “Personal Information We Collect,” “How We Use Personal Information,” and “How We Share Personal Information” (including the “Summary of Data Disclosed to Third Parties” chart) above.

Sensitive Personal Information

We do not use or disclose “sensitive personal information” (as defined by the CCPA) for any purpose other than as permitted by the CCPA. Specifically, we do not use sensitive personal information of California residents to derive characteristics about them. Our uses of sensitive personal information are limited to: (1) performing the services or providing the goods reasonably expected by an average consumer who requests them; (2) preventing, detecting, and investigating security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted personal information; (3) resisting malicious, deceptive, fraudulent, or illegal actions and prosecuting those responsible; (4) ensuring the physical safety of natural persons; (5) short-term, transient use, including non-personalized advertising shown as part of a consumer’s current interaction with us; (6) performing services on our behalf; (7) verifying or maintaining the quality or safety of a product, service, or device that is owned, manufactured, manufactured for, or controlled by us, and improving, upgrading, or enhancing such product or service; and (8) collecting or processing sensitive personal information where such collection or processing is not for the purpose of inferring characteristics about a consumer.

Your California Privacy Rights

Residents of California have the following rights under the CCPA:

• Right to Know. The right to request what Personal Information we have collected, used, disclosed, and shared during the past twelve (12) months, including (1) the categories of Personal Information we have collected about you; (2) the categories of sources from which we collected it; (3) the business or commercial purpose for collecting, selling, or sharing Personal Information; and (4) the categories of third parties to whom we disclose Personal Information.

• Right to Access. The right to request a copy of the specific pieces of Personal Information we maintain about you.

• Right to Delete. The right to request that we delete your Personal Information, subject to certain exceptions.

• Right to Correct. The right to request that we correct Personal Information that has become outdated or is otherwise inaccurate.

• Right to Opt Out of Sale, Sharing, and Targeted Advertising. The right to opt out of the “sale” or “sharing” of your Personal Information, and of the use of your Personal Information for targeted advertising or cross-context behavioral advertising, as those terms are defined under the CCPA.

• Right to Limit Use of Sensitive Personal Information; Right to Opt Out of Profiling. You have the right, to the extent granted by the CCPA, to limit our use and disclosure of sensitive personal information to purposes permitted under applicable law, and to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.

• Right to Data Portability. The right to request that we provide you or another entity with your Personal Information in a readily usable format, as technically feasible.

• Right to Non-Discrimination. The right not to be discriminated against for exercising any of your rights under the CCPA.

Automated Decision-Making Technologies

Automated decision-making technologies (“ADMT”) are technologies that process Personal Information and use computation to execute a decision and either replace or substantially replace human decision-making, resulting in decisions made without human involvement. Decisions are significant when they result in the provision or denial of employment or independent contracting opportunities or compensation, education enrollment or opportunities, housing, healthcare services, or financial or lending services. Under the CCPA and its implementing regulations, advertising is not considered a significant decision. We do not currently use ADMT to make significant decisions about applicants or consumers, so we do not provide ADMT access, opt-out, or appeal rights.

Exercising Your Rights

You or an authorized agent designated on your behalf may submit a verifiable consumer request to us by:

• Emailing us at info@beachriot.com; or

• Calling us at +1 888-891-1937 (toll free).

Please specify which right you are seeking to exercise and the scope of the request. Only you, or someone legally authorized to act on your behalf (an “Authorized Agent”), may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child. Making a verifiable consumer request does not require you to create an account with us.

When you submit a verifiable consumer request, we will take steps to verify your identity, which may include requesting additional information (such as your name, an email address you have used with us, or details about a recent purchase) or, in some circumstances, requiring you to sign a declaration under penalty of perjury. If we are unable to verify your identity, we may deny your request. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

If you designate an Authorized Agent to act on your behalf, you must (1) provide the Authorized Agent with written and signed permission to submit a request on your behalf, or a power of attorney pursuant to California Probate Code Sections 4000 to 4465, and (2) verify your own identity directly with us. We may deny a request from an Authorized Agent that does not submit proof of authorization.

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of receipt. If we require an extension, we will inform you of the reason and the extension period, as permitted by applicable law. There are certain circumstances where applicable law allows us to retain certain information, and we will inform you of any denial and the reason for such denial. If we deny your request, you may submit an appeal; instructions for how to submit your appeal will be included in our response.

Right to Opt Out of Sale, Sharing, and Targeted Advertising

Some of our online tracking technologies may be considered a “sale” or a “share” of your Personal Information under the CCPA. The categories of Personal Information we may “sell” or “share” in these circumstances include your IP address, persistent online identifiers, ad identifiers, similar information about your devices and browsers, and information about your engagement with our Websites, products, and Communications. We have no actual knowledge that we sell the Personal Information of California residents who are under sixteen (16) years of age.

To opt out of the sale or sharing of your Personal Information, please email us at info@beachriot.com with “Right to Opt-Out” in the subject line, or call us at +1 888-891-1937 (toll free). You may also opt out by enabling the Global Privacy Control (GPC) on your browser. Once you make an opt-out request, we will wait at least twelve (12) months before asking you to reauthorize Personal Information sales. You may change your mind and opt back in at any time by emailing us at info@beachriot.com.

Non-Discrimination

We will not discriminate against you for exercising any of your rights under the CCPA. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Notice of Financial Incentive

We offer our customers various incentives, including discounts for signing up to our marketing program and providing us their email address, as well as the opportunity to participate in our Loyalty Program and Referral Program (collectively, the “Programs”). Because our Programs involve the collection of Personal Information and offering of certain benefits, the Programs may be interpreted as a “financial incentive” program under the CCPA. Participation is entirely voluntary; you must opt in to participate and may opt out at any time. The value of your Personal Information to us is related to the value of the discounted products or services, or other benefits, that you obtain or that are provided as part of the applicable Program, less the expense related to offering those benefits. You may opt out of the Loyalty Program or other financial incentive at any time by contacting us at info@beachriot.com.

California’s “Shine the Light” Law

California Civil Code Section 1798.83 permits users of our Websites who are California residents to request certain information regarding our disclosure of Personal Information they provide through the Websites to third parties for the third parties’ direct marketing purposes. To make such a request, please send an email to info@beachriot.com with “Request for California Privacy Information” in the subject line and in the body of your message. We will provide the requested information to you via an email response.

Notice to European Residents

If you are a resident of Europe, including the European Economic Area or the United Kingdom, the following additional disclosures apply to you. We act as a “controller” (as defined under the General Data Protection Regulation (“GDPR”) and similar data protection laws in Europe, including the UK Data Protection Act 2018 and the UK GDPR) with respect to Personal Information collected from you through our Websites, Services, or Communications.

We process your Personal Information on one or more of the following lawful bases: (a) to perform our contract with you, including to provide the Websites and Services; (b) to pursue our legitimate interests, including understanding how our Websites are functioning, improving our Services, developing new products, and preventing fraud, provided such interests are not overridden by your rights and freedoms; (c) with your consent, where required; and (d) to comply with our legal obligations.

Subject to certain conditions, you have the right to access, rectify, or erase Personal Information we process about you; request data portability; restrict or object to our processing (including, where applicable, the right to object to processing for direct marketing purposes); and, where applicable, withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. To exercise your rights, please contact us at info@beachriot.com. You also have the right to lodge a complaint with the data protection supervisory authority in your jurisdiction, though we would appreciate the opportunity to address your concerns before you do so.

International Data Transfers

We are based in the United States, and the information we collect is governed by U.S. law. If you are accessing the Websites or Services from outside the United States, please be aware that information collected through the Websites and Services may be transferred to, processed, stored, and used in the United States and other jurisdictions. Data protection laws in the United States and other jurisdictions may be different from those of your country of residence. Please review this Privacy Notice carefully before engaging with our Websites and Services.

Contact Us

If you have any questions about the ways in which we collect and use your Personal Information, your choices and rights regarding such use, or wish to exercise your rights under applicable law, please contact us at:

Beach Riot

Email: info@beachriot.com

Phone: +1 888-891-1937 (toll free)