California Consumer Privacy Act

Purposes and General Principles

This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS supplements the information contained in the Privacy Statement of Spa and Bath Holdings, Inc. and its subsidiaries and apples solely to visitors, users, and others who reside in the State of California ("California consumers"). We adopt this notice to comply with the California Consumer Privacy Act of 2018 ("CCPA"). Any terms defined in the CCPA have the same meaning when used i this notice. 

We may choose to use, collect, or disclose the personal information for one or more of the following business purposes: 

• To provide consumers with information, products or services that they may request from us.  
• To provide consumers with email alerts, event registration and other notices concerning our products or services, or events or news, that may be of interest to them.
• To improve our website and present its contents to an audience which may include California consumers. 
• To carry out obligations and enforce rights arising from any contracts entered into between consumers and us, including for billing and collections.  
• For testing, research, analysis and product development. 
• As necessary or appropriate to protect the rights, property or safety of us, our clients or others. 
• To respond to law enforcement requests adn as required by applicable law, court order, or governmental regulations.
• As described to consumers when collecting personal information or as events otherwise set forth in the CCPA.
• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution or other sale or transfer of some or all of our assets, whether as a going concerning or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred. 

 Collection of Personal Information

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device ("personal information" or "personal data"). In particular, the following categories of personal information are collected from consumers within the last twelve (12) months found in the What Kind of Information does Balboa Collect section of this Privacy Policy. 

Personal information does not include: (1) publicly available information from government records; (3) de-identified or aggregated consumer information; (3) information excluded from the CCPA's scope, like health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA), and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Billey Act (GLBA) or the California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994. 

We obtain the categories of personal information listed above from the following categories of sources: 

Directly from our clients or their agents; 
Directly and indirectly from activity on our website; or
From third-parties that interact with us in connection with the services we perform.

We may disclose personal data to a third party for a business purpose [which may include the disclosure or sale of California consumers' personal information]; subject to the right to opt-out of those sales (see Opt-Out rights). Should we disclose personal information for a business purpose, we may enter a contract that describes the purpose and requires the recipient, or both keep that personal information confidential and not use it for any purpose except performing the contract. 

We will not collect or sell additional categories of personal information materially different, unrelated, or incompatible with purposes other than stated herein without providing California consumers notice. 

Disclosure of Sale of Personal Information

In the preceding twelve (12) months, Balboa has not disclosed or sold any personal information and will not do so. Balboa also does not sell personal information of minors under 16 years of age without affirmative authorization. 

Notice of Financial Incentive

The purpose of this notice of financial incentive is to explain to consumers of the financial incentive or price or service difference a business may offer in exchange for the retention or sale of a consumer's personal information. Merchants or service providers may offer discounts, offers, rebates, or other pricing to individual clients which may incorporate personal data. Offers may be individualized to each consumer or a group of consumers based on one or more factors. Financial incentives or price or service differences are permitted under the CCPA, provided that they do not invoke or influence behavior contrary to the goals of the CCPA. 

Rights Afforded Under the CCPA

The CCPA provides California consumers with specific rights regarding their personal information. Controllers of certain personal information have a duty to provide users located in California with access to specific information and disclosures concerning how personal data and data rights may be applicable. This section describes CCPA rights and explains how to exercise them: 

• Right to Know – A right to be informed of the categories of personal information that a business collects o otherwise receives, uses, sells or discloses about an individual consumer. Also included the right to be informed of the purposes of these activities and the categories of parties to which their personal information is disclosed. 
• Right to Opt-Out – A right to prohibit the sale of personal data to third parties. 
• Right to Be Forgotten – A right to request the deletion of persona consumer information.
• Right to Withdraw – A right to request that a business remove the consumer from a financial incentive program involving their personal data. Conversely, a consumer may opt-in to a financial incentive or price or service difference. 
• Right to Non-Discrimination – A right from withholding or penalizing for the exercise or intent to exercise any CCPA rights:
  – Denial of goods or services
  – Charge different price or rates for goods or services, including granting discounts or other benefits, or imposing penalties.
  – Provide a different level or quality of goods or services than customers who choose to provide consumer data
  – Suggest, influence, or otherwise impact consumer choices regarding receipt of a different price or rate for goods or services or a different level or quality of goods or services exclusively upon the provision of data or exercise of rights enumerated under the CCPA. 

• The categories of personal information collected. 
• The categories of sources for the personal information collected. 
• The business of commercial purpose(s) for collecting or selling personal information. 
• The categories of third parties with whom personal information is shared, if any. 
• The specific pieces of personal information collected.  
• If personal information was sold or disclosed for a business purpose, two separate lists disclosing: 
    – Sales, identifying the personal information categories that each category of recipient purchased; and
    – Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.