California Privacy Policy

CVB, Inc., a Utah Benefit Corporation, dba Malouf®

This Notice for California residents supplements the information contained in the Privacy Policy to qualifying residents under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (together, “CCPA”). The Notice explains our privacy practices as they apply to “Consumers” as defined by the CCPA and does not extend to individuals who are not defined under the CCPA.

Under the CCPA, “Personal Information” means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, not including publicly available information or de-identified or aggregate consumer information.

Consumer Privacy Rights

Under the CCPA, California consumers have the following rights:

• The right to know about the personal information we collect about you and how it is used and shared;
• The right to delete your collected personal information (with some exceptions);
• The right to opt-out of the sale of your personal information; and
• The right to non-discrimination for exercising your CCPA rights.

If you make a request for access to your personal information, the Company will disclose your records covering the 12-month period preceding the date of your request. Any request submitted is subject to an identification and verification process, which will depend on the nature of the request and the sensitivity of the personal information requested. For the safety and security of consumer information, we will not fulfill your CCPA request unless you provide adequate information to convince us that you are the consumer about whom we collected the personal information. Authorized agents who met the agency requirements of the CCPA may also submit requests on your behalf. See Verification requirements below.

To exercise your rights under the CCPA, we provide both an email address and a toll-free phone number (below) to submit your request. Please respond promptly to any follow up inquires, so we may process your request within the designated period.

• Email Address: online@linenspa.com

Additional Request Information: The Company will provide you with your personal information for the 12-month period preceding your request. A request receipt will be sent to you within 10 business days, and we will make efforts to respond to verified request within 45 calendar days of our receipt of your request. If we are unable to verify your request or if we require more time (up to 45 additional days) to grant the request, we will inform you in writing or by phone.

California consumers may only make requests to know or access their personal information twice within a 12-month period. The format is available in a transportable copy.

Consumer Verification

Prior to our fulfillment of a right to know or a right to delete request as described, below, Linenspa™ will require consumers to verify their identity. We will require verification of the consumer whether the consumer submits such a right to know or right to delete request directly or through an authorized agent.

The minimum requirements for consumer verification follow:

• First, Middle (if available), and Last Name
• Physical California address
• Valid email address
• Valid phone number

For a right to know or right to delete request submitted through the Company’s toll-free phone number, a company representative will call you to administer an identity authentication process.

If we are unable to successfully verify your identity, we will be unable to fulfill your requests to know or for deletion. If this is the case, you will be notified and directed to read the Linenspa™ Privacy Notice concerning our data collection, sale, and disclosure practices.

As mentioned, the CCPA allows California consumers to use “authorized agents” to submit requests on the consumers’ behalf to our company. If you choose to use an authorized agent, or if you are an authorized agent who would like to submit requests on behalf of a consumer, the following procedures will be required prior to acceptance of any authorized agent requests.

For the safety and security of consumer information, requests for the right to know and right to delete submitted by an authorized agent will require a direct method of communication with the consumer, preferably a valid email address, to fulfill the request.

All authorized agents will be required to successfully establish the minimum requirements for qualification as stated in the consumer verification minimum requirements list above. They will be required to establish the requirements prior to being authorized to submit requests on behalf of a consumer.

Agent Authorization Verification

In order to qualify as an authorized agent, businesses or individuals will be required to submit the following documentation:

Businesses. If you are operating as a business, the following documentation is required:

• Certificate of good standing with your state of incorporation;
• Written authorization document that includes each consumer’s name, address, telephone number and valid email address, signed and dated by each consumer authorizing you, as the authorized agent, to act on behalf of each consumer in making the request. Proof of written consumer consent for opt-out requests are generally not required, unless the Company must confirm authorization; and
• Valid consumer email address for our direct correspondence with each consumer, including an identity verification process to be conducted by our Company directly with that consumer.

Individuals. If you are an individual and acting as an authorized agent on behalf of a consumer, the following documentation is required:

• A “power of attorney” signed and dated by the consumer and notarized by a notary public naming you as the consumer’s authorized representative, which includes the consumer’s full name and physical California address;
• If you do not have a power of attorney signed by the consumer, then we require a written authorization document that includes the consumer’s name, address, telephone number and valid email address, signed by the consumer authorizing you, as the authorized agent, to act on behalf of the consumer in making the request; and
• Valid email address for direct correspondence with the consumer, including an identity verification process to be conducted by our Company directly with that consumer.

Parent/Guardian of Minor Child. Our Company does not knowingly collect or sell information about minors. If you are a parent or guardian of a minor child under 16 and would like to make a request for a right to know or right to delete on behalf of the minor child, the following documentation will be required:

The minor’s verification documents, which includes the following:

• Certified school record or transcript or home school notice of intent form that includes minor’s permanent address
• Proof of parental/guardianship identity document that matches the minor’s permanent residence

Right to Know

You may request that our company disclose what personal information we have collected, used, shared, or sold about you, and why we collected, used, shared, or sold that information. Specifically, you may request

• The categories of personal information collected
• Specific pieces of personal information collected
• The categories of sources from which the business collected personal information
• The purposes for which the business uses the personal information
• The categories of third parties with whom the business shares the personal information
• The categories of information that the business sells or discloses to third parties

We will provide you this information for the 12-month period preceding your request.

Right to Request Deletion

You may request that our company delete personal information that we and our service providers collected from you. For reasons outlined in Civil Code sections 1798.105(d) and 1798.145, a deletion request may not be granted. Common reasons that we must retain your personal information include:

• Your request cannot be verified
• To complete your transaction, provide a reasonably anticipated product or service, or for certain warranty and product recall purposes
• For certain business security practices
• For certain internal uses that are compatible with reasonable consumer expectations or the context in which the information was provided
• To comply with legal obligations, exercise legal claims or rights, or defend legal claims
• If the personal information is certain medical information, consumer credit reporting information, or other types of information exempt from the CCPA

Right to Opt-Out of Sale of Personal Information

The CCPA defines the term “sell” broadly. Under the definition, we may sell your personal information. Over the past 12 months, we may have sold the following categories of personal information:

• Identifiers/Contact Information – name, billing address, mailing address, email address, username, identification number, phone number(s), device cookies
• Commercial Information/Account Details – purchasing history, purchase tendencies
• Internet Usage Information – login information, device operating system, browser type, browser version, browser plug-ins, time zone setting, interactions with our website, computer systems, and devices
• Inferences from Personal Information – customer profiles, customer preferences

You may request that our Company stops selling your personal information (“opt-out”). With some exceptions, we will not sell your personal information after receiving your opt-out request unless you later provide authorization allowing us to do so again.

Right to Non-Discrimination

The Company will not deny goods or services, charge you a different price, or provide a different level or quality of goods or services to consumers who exercise their rights under the CCPA.

Under CCPA, we may offer you reasonable promotions, discounts and other incentives in exchange for collecting, keeping, or selling your personal information.

Minors

The Company does not design our websites to appeal to children, nor are the websites directed at children under the age of 13. Therefore, we do not knowingly collect or sell the personally information from persons under the age of 13. If you are a parent of a child under 13, and you believe that your child has provided us with information about themselves, please contact us.

Pursuant to the CCPA, we clearly understand that we can only sell the personal information of a child that they know to be under the age of 16 if they get affirmative authorization (“opt-in”) for the sale of the child’s personal information. For children under the age of 13, that opt-in must come from the child’s parent or guardian. For children who are at least 13 years old but under the age of 16, the opt-in can come from the child.

Financial Incentives

Financial incentive programs require consumers to opt-in to participate. Infrequently, we may offer financial incentives in the form of VIP Membership, discounted products, contests, promotions, advanced notices of new products or of product sales. The incentives are available to consumers who opt-in to our Company marketing materials, allowing us access to personal information such as first name, last name, postal address, email address, and internet/electronic activity.

The purpose of the incentives is to encourage consumers to fully experience our websites, products, and related services. The information collected as part of the incentives, in turn, help us improve the customer experience, as well as understand consumer buying and spending habits.

When offered, you may opt-in to participate in incentives by clicking “Accept” or by checking the opt-in box. Consent may be revoked at any time by emailing or calling our toll-free phone number:

• Email Address: online@linenspa.com

This California Privacy Policy was last updated February 2023. Please check periodically for updates.