U.S. STATE PRIVACY ADDENDUM

Effective Date: September 21, 2026
Last Updated: September 21, 2026

This U.S. State Privacy Addendum ("Addendum") supplements the WIND ATHLTX Privacy Policy ("Privacy Policy") and applies to residents of U.S. states whose privacy laws provide applicable rights concerning the Company's collection, use, disclosure, sale, sharing, or processing of personal information.

This Addendum is intended to address applicable state comprehensive privacy laws, including, as applicable, laws enacted by California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other states that enact applicable comprehensive privacy legislation.

The applicability of a particular right depends upon the consumer's jurisdiction, the Company's activities, applicable statutory thresholds, exemptions, and other requirements.

1. Scope

This Addendum applies only to the extent a particular state privacy law applies to Company and the individual requesting rights under that law.

Nothing in this Addendum expands Company's legal obligations beyond those imposed by applicable law.

Where a state statute provides broader rights than those described in this Addendum, Company will comply with the applicable statutory requirements.

2. Categories of Personal Information

Company may collect categories of information including:

  • identifiers;

  • contact information;

  • account information;

  • commercial information;

  • transaction information;

  • Internet or electronic activity;

  • device information;

  • approximate geolocation;

  • customer communications;

  • User Content;

  • preferences and inferences;

  • payment information; and

  • other information disclosed in the Privacy Policy.

3. Purposes of Processing

Company may process personal information for:

  • providing products and services;

  • processing transactions;

  • fulfilling orders;

  • shipping;

  • returns and refunds;

  • customer service;

  • account administration;

  • fraud prevention;

  • security;

  • analytics;

  • personalization;

  • marketing;

  • advertising;

  • promotions;

  • product development;

  • business administration;

  • legal compliance;

  • enforcement of agreements;

  • protection of Company and third-party rights; and

  • other purposes permitted by applicable law.

4. Consumer Rights

Depending upon the applicable state law, consumers may have some or all the following rights:

Right to Access

You may have the right to confirm whether Company processes your personal information and obtain access to that information.

Right to Correct

You may have the right to correct inaccurate personal information.

Right to Delete

You may have the right to request deletion of personal information, subject to statutory exceptions.

Right to Data Portability

You may have the right to obtain certain personal information in a portable format.

Right to Opt Out of Sale

Where applicable, you may have the right to opt out of the sale of personal information.

Right to Opt Out of Targeted Advertising

You may have the right to opt out of processing personal information for targeted advertising.

Right to Opt Out of Profiling

Certain state laws provide a right to opt out of certain profiling that produces legal or similarly significant effects.

Company does not intend to make decisions producing legal or similarly significant effects through automated profiling unless separately disclosed and permitted by law.

Right to Appeal

Certain state laws provide consumers with a right to appeal a denied privacy request.

If your request is denied, Company's response will identify the applicable appeal procedure where required.

5. Sensitive Personal Information

Certain states regulate "sensitive personal information" or "sensitive data."

Company will process such information only as permitted by applicable law.

Where a law provides a right to limit, withdraw consent concerning, or otherwise control processing of sensitive information, Company will provide the applicable mechanism.

6. Universal Opt-Out Mechanisms

Where required by applicable law, Company will recognize legally valid universal opt-out mechanisms, including recognized browser-based or device-based signals.

For California residents, Company will process Global Privacy Control signals as required by the CCPA and applicable regulations. California recognizes GPC as a mechanism through which consumers may communicate an opt-out of sale or sharing.

7. Verification

To protect customer information and prevent unauthorized disclosure, Company may take reasonable steps to verify the identity of a person submitting a privacy request.

Verification procedures may vary depending upon:

  • the sensitivity of the requested information;

  • the type of request;

  • the account status of the requester;

  • applicable law; and

  • the reasonably foreseeable risk of unauthorized disclosure.

Company will not require unnecessary information solely for purposes of verification.

8. Authorized Agents

Where permitted by law, a consumer may designate an authorized agent to submit a request.

Company may require evidence of authorization and may independently verify the consumer's identity where legally permitted.

9. Appeals

If Company denies a privacy request and applicable law provides an appeal right, you may appeal the decision by contacting:

info@joneslegaladvisory.com

Subject: Privacy Appeal

The appeal should identify the request, explain why you believe the decision should be reconsidered, and include any information reasonably necessary to evaluate the appeal.

Company will process appeals within the period required by applicable law.

10. Non-Discrimination

Company will not unlawfully discriminate against a consumer because the consumer exercised a privacy right.

However, to the extent permitted by applicable law, Company may offer different prices, rates, products, services, features, or benefits where the difference is reasonably related to the value of the consumer's data or otherwise permitted by law.

Company may also operate bona fide loyalty or promotional programs consistent with applicable law and applicable program terms.

11. Data Retention

Company retains personal information according to its operational, legal, security, accounting, fraud-prevention, dispute-resolution, and other legitimate business needs, subject to applicable legal requirements.

Company does not retain personal information longer than reasonably necessary for the disclosed purposes or as otherwise permitted or required by law.

12. Disclosure to Service Providers and Contractors

Company may disclose personal information to service providers, contractors, processors, vendors, affiliates, and other third parties that perform services on Company's behalf.

These parties may provide:

  • hosting;

  • payment processing;

  • order fulfillment;

  • shipping;

  • customer service;

  • analytics;

  • advertising;

  • marketing;

  • fraud prevention;

  • cybersecurity;

  • information technology;

  • professional services; and

  • other business functions.

Company may require contractual restrictions concerning the use of personal information where required by applicable law.

13. Sale and Targeted Advertising

Certain advertising and analytics arrangements may constitute "sale," "sharing," "targeted advertising," or a similar regulated activity under applicable state law.

Where applicable, consumers may opt out through:

YOUR PRIVACY CHOICES LINK

Company may also honor legally recognized universal opt-out signals.

14. Children's and Minor's Information

The Site is restricted to individuals 14 years of age and older.

Company does not knowingly permit children under 14 to use the Site.

Where applicable law imposes additional protections concerning minors between 14 and 17, Company will apply those protections as required.

Company does not knowingly sell or share personal information of minors in circumstances prohibited by applicable law.

15. Delaware Residents

Because Company is organized under Delaware law, Delaware residents may have rights under the Delaware Personal Data Privacy Act where its statutory applicability requirements are satisfied.

Those rights may include access, correction, deletion, portability, and certain opt-out rights.

16. California Residents

California residents should refer to the Company's separate California Notice at Collection and California provisions in the Privacy Policy.

17. Colorado Residents

Colorado residents may have rights under the Colorado Privacy Act, including applicable rights of access, correction, deletion, portability, and opt-out of certain processing activities.

18. Connecticut, Virginia, Utah, and Other State Residents

Residents of states with comprehensive privacy statutes may have rights under the applicable state law, subject to statutory thresholds, exemptions, and exceptions.

Company will apply the rights and obligations applicable to the consumer's jurisdiction.

19. Statutory Exceptions

Privacy rights are not absolute.

Applicable law may permit Company to deny or limit requests where necessary to:

  • comply with law;

  • detect or prevent fraud;

  • protect security;

  • establish, exercise, or defend legal claims;

  • comply with legal obligations;

  • complete transactions;

  • maintain certain business records;

  • protect the rights and safety of Company or others;

  • provide requested products or services;

  • comply with contractual obligations; or

  • satisfy other statutory exceptions.

Company reserves all applicable statutory exemptions and exceptions.

20. No Expansion of Rights

Nothing in this Addendum creates contractual rights beyond those required by applicable law.

Nothing in the Privacy Policy or this Addendum is intended to waive a non-waivable statutory privacy right.

21. Changes to This Addendum

Company may update this Addendum periodically to reflect:

  • changes in law;

  • regulatory guidance;

  • changes in Company's practices;

  • new products or services;

  • changes to technology; or

  • other operational requirements.

The revised Addendum will be posted with a new "Last Updated" date.

22. Privacy Contact

Jones Legal Advisors PLLC
77 W Wacker Drive STE 4500

Chicago, Illinois 60601
info@joneslegaladvisors.com
(312) 600-3201

Privacy Inquiries: info@joneslegaladvisors.com