• Changing Mobile Device Privacy Settings. Your mobile device may collect and share device-level information to facilitate targeted advertising. This is independent of our Services but can affect your overall privacy experience. To better understand and manage these settings, you may refer to the privacy resources provided by your device’s operating system. For your convenience, we’ve included links to informational pages for Google’s Android and Apple’s iOS platforms.
• Limiting Interest-Based Advertising. You have the option to limit the interest-based advertising you receive. Various organizations and platforms offer opt-out features that allow you to have more control over your online advertising experience. For example, the Digital Advertising Alliance (DAA) provides a consumer choice tool that lets you opt out of interest-based advertising from participating companies. You can access this tool at the DAA Opt-Out Page. Similarly, the Network Advertising Initiative (NAI) offers an opt-out tool for participating members. You can access this tool at the NAI Opt-Out Page. Please note that participation in the DAA and NAI opt-out programs is entirely optional. These are third-party services and opting out through these platforms is not a requirement for using our Services. We are not responsible for the effectiveness of any such opt-out options. Opting out of interest-based advertising does not mean you will no longer see advertisements; it simply means that the advertisements you do see will not be tailored to your interests.
• “Do Not Track” Signals. Do Not Track (“DNT”) is a privacy preference that you can set in your web browsers, which allows you to opt out of tracking by websites and online services. Like many websites, we do not currently respond to ‘Do Not Track’ browser settings or signals. For more information about DNT, please see eff.org/issues/do-not-track.
• “Global Privacy Control.” Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to the websites you visit indicating your choice to opt-out from certain types of data processing, including the “sharing” of your personal data. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting.

4.3      Data Collected from Other Parties

We obtain information from businesses provide us with our business and Online Services, such as our data analytics providers, marketing or advertising service providers, fraud prevention service providers, vendors that provide services on our behalf, and publicly available sources. We also create information based on our analysis of the information we have collected from you. We use this information for our business operations purposes, including offering and improving our Services, providing customer support, measuring the effectiveness of our Services, accounting and transaction purposes, and to enforce our terms and policies. Please see “Disclosure of Your Personal Data” to learn more about how we process personal information via our business services providers.

4.4      Other Purposes for Processing Personal Data

While less frequent, there are other scenarios where we may use or disclose your personal data:

• Audits Involving External Entities: Sharing data with external organizations, including those we collaborate with or those that evaluate our business operations, to ensure compliance with industry standards, certifications, or legal obligations.
• Legal Obligations: Fulfilling legal obligations such as responding to subpoenas, court orders, or other binding government requests. In the rare event of litigation, we may use your data to establish, exercise, or defend legal claims.
• Reorganization: In the event of a business transaction such as a sale, merger, consolidation, acquisition, change in control, transfer of substantial assets, bankruptcy, or reorganization, your personal data may be shared or transferred. This also includes any subsequent integration activities post-transaction.
• Business Transfers: In the event of a divestiture, investment, or other asset transfer that is not part of a broader business transaction like a merger or acquisition, your personal data may be shared or transferred.
• With Your Consent: We use information about you where you have given us consent to do so for a specific purpose not listed above.

5        Disclosure of Your Personal Data

We may disclose the above information to the following types of parties:

• Other MBK Group Entities (Affiliates). We may share personal data between the MBK family of brands that are related by common ownership or control. We share personal data for our routine business purposes and to develop new and improve existing Services.
• Authorized Persons and Agents. We may disclose personal data to marketing, advertising, analytics and other client services providers with whom we interact on your behalf.

• Business Services Providers. These are persons or entities with whom we have a relationship to provide business operations services and support to MBK. These companies, known as “service providers,” are contractually obligated to use your data only for the service they’re providing and cannot use it for anything else. These providers may include the following:

• • IT Operations Providers. These include cloud computing service providers, internet service providers, data backup and security providers, functionality and infrastructure providers, and similar service providers.
  • Business Operations Providers. These include service provider with whom we partner to provide day-to-day business operations, including payment processors, security vendors, business software service providers, hospitality service providers, banks, facilities management providers and similar entities.
  • Professional Service Providers. These include lawyers, accountants, consultants, security professionals, and other similar parties when disclosure is reasonably necessary to comply with our legal and contractual obligations, prevent or respond to fraud or abuse, defend ourselves against attacks, or protect the rights, property, and safety of us, our customers, and the public.
• Marketing and Advertising Providers. These include advertising, direct marketing, and lead generation providers, affiliate marketing program providers, retargeting platforms, data brokers, ad networks, marketing consultants, and similar services providers.
• Law Enforcement/Government Agencies. Persons to whom we are required by law to provide information, such as pursuant to a subpoena or a court order.
• Corporate Transaction Disclosures. Persons involved in the consideration, negotiation, completion of a business transaction, including the sale, merger, consolidation, acquisition, change in control, transfer of substantial assets, bankruptcy, or reorganization, and any subsequent integration.
• Authorized Disclosures: To any party when authorized by the individual to whom it pertains to share it. Disclosures for Business Purposes

6        Data Retention

We retain your personal data only as long as needed to fulfill the purposes we collected it for, including satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider (i) the amount, nature, and sensitivity of the personal data; (ii) the potential risk of harm from unauthorized use or disclosure of your personal data; (iii) the purposes for which we process your personal data and whether we can achieve those purposes through other means; and (iv) the applicable legal requirements related to our processing activities. Additionally, we may anonymize your personal data (so that it can no longer be associated with you) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.  If you have any questions about the specific retention periods for different types of your personal data, please feel free to contact us using the Contact Information provided below.

7        Your Privacy Choices

You can control the collection and use of personal data for some of our processing activities. Below are the avenues through which you can manage the types of communications you receive from us:

• Email: To opt out of promotional emails, you may follow the ‘unsubscribe’ instructions located at the bottom of each email. Alternatively, you may contact us directly using the information provided in the Contact Information section. Please be advised that opting out of promotional communications will not preclude you from receiving transactional emails, such as those related to purchases or account activity.
• Text Messages: To discontinue receiving automated text notifications, simply reply ‘STOP’ to any of our messages, or use any alternative opt-out keyword we may have provided.
• Mail Promotions: Should you wish to be removed from our mailing list for physical promotions and solicitations, please send a written request to our customer service department using the address provided in the Contact Information section of this Privacy Policy. Ensure your full name and mailing address are included in your correspondence.

8        Your Privacy Rights

8.1        Description of Your Privacy Rights

Depending on your location and applicable laws and regulations, you may also have data privacy rights regarding MBK’s processing of your personal data. Based on the legal requirements applicable to your jurisdiction, and subject to any legal restrictions or exceptions, you may have the choices and rights described below.

• Right to Access. You may request access to the personal data we hold about you. This includes the right to be informed about the categories and specific pieces of personal data we have collected, the sources from which we collected it, the purposes for collecting it, and the categories of third parties with whom we have shared it.
• Right to Correct. You may request that we correct any inaccurate personal data relating to you without undue delay. In this context, taking into account the purposes of the processing, you may also have the right to request the completion of incomplete personal data – also by means of a supplementary declaration.
• Right to Delete. You may request the deletion of your personal data, subject to certain exceptions. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if the processing is necessary for the performance of a contract.
• Right to Portability. You may request that we provide you with a copy of your personal data in a structured, commonly used, and machine-readable format. You also have the right to request that we transfer this information to another data controller, where technically feasible.
• Right to Opt Out of Targeted Advertising. You may direct us not to sell or share your personal data with third parties. Request that we not disclose, disseminate, or transfer your personal data to a third party for targeted advertising or marketing purposes (also known as “cross-context behavioral advertising”). You may opt out of this activity by clicking “Your Privacy Choices” in the website footer and opting out of Targeted Advertising Cookies.
• Right to Restriction of Processing. You may request that we restrict processing of your personal data. In certain circumstances, it may not be possible for us to accept your request, for example, when the processing is necessary to comply with a legal obligation, or if we can demonstrate compelling legitimate grounds otherwise.
• Right to Opt-Out of Certain Data Processing. You may withdraw your consent that you have previously provided for MBK’s collection, use or disclosure of your personal data, subject to reasonable notice and any contractual or legal exceptions. Note that this will not affect the lawfulness of our processing of your personal data based on consent before its withdrawal.
• Right to Opt-Out of Automated Individual Decision-Making. You may have the right to not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Note that this right shall not apply if such a decision is necessary as part of a contract we have with or want to conclude with you, we have your consent, or we are permitted by law to engage in such automated decision making. In these cases, we will implement measures to safeguard your rights and freedoms and legitimate interests, and you may contest the decision by contacting us as set forth below.
• Right Against Non-Discrimination. You have the right not to be discriminated against for exercising any of your data protection rights. This means that we will not deny you goods or services, charge you different prices or rates, or provide you with a different level or quality of goods or services based solely on your exercise of these rights.

Residents of California may also have additional rights pertaining to their personal data, as described in “California Privacy Rights.”

8.2      Exercising Your Privacy Rights

To exercise any of the rights outlined above, please visit our web form.

To ensure the security and confidentiality of your personal data, we have established verification measures that must be completed prior to fulfilling any request to exercise your data rights. These measures may involve confirming your identity through a series of questions or requiring documentation that substantiates your identity or authority to make the request. Should we be unable to verify your identity or authority adequately, we reserve the right to decline the request and will provide an explanation for our decision. Upon receiving a verified request to exercise your data rights, we will acknowledge receipt of the request. We will aim to respond substantively to your request within time permitted under the applicable law. If we require more time to process your request, we will inform you of the reason and extend the period by the notified number of days.

Please note that not all requests will be granted. Certain legal exceptions may apply, such as if we are unable to verify your identity, or if there are legal or contractual reasons that prevent us from fulfilling a deletion request. Regardless of the outcome, you will receive a written response that either details the actions we took or explains why no action was possible. If you are dissatisfied with our initial response, you may seek further review. To initiate an appeal, please contact us within 30 days of receiving our initial response using the method provided in the response. You should include a copy of your original request, our response, and a detailed explanation of why you are seeking reconsideration. You may also attach any additional supporting information and documents that you believe are relevant. We will review your appeal and provide a final determination within 60 days.

9        Security

We implement recognized physical, technical, and organizational safeguards tailored to protect the confidentiality, integrity, and availability of the specific categories of personal data we collect and process. These safeguards are designed to prevent unauthorized or unlawful access, destruction, loss, alteration, or disclosure of your personal data. However, despite our best efforts, no controls can provide absolute protection against all security threats, and we cannot guarantee that unauthorized access or loss will never occur. We have procedures in place to deal with any suspected data security breach. We will notify you and/or any applicable regulator of a suspected data security breach where we are legally required to do so in accordance with any legally prescribed timeframes.

10   Data Transfers

MBK’s primary operations are based in the United States, and as such, the majority of data processing occurs within the United States. To facilitate our international operations for the purposes of providing our Services, we transfer of your personal data across different locations, including countries other than the one where the information was originally collected. We implement appropriate measures to ensure that your personal data remains protected and secure during these transfers, including by adopting approved certifications, codes of conduct, or contractual clauses specific to the data transfer.

11      Children’s Privacy

Our Services are not directed to children under 16 (or other age as required by local law), and we do not knowingly collect personal data from children. If you are a parent or guardian and believe that your child has provided us with personal data, please use our Contact Information. If we become aware that we have collected the personal data of a child, we will take steps to promptly delete such information.

12   Updates to This Privacy Policy

We reserve the right to modify this Privacy Policy at any time to reflect changes in our practices, services, or legal obligations. Any modifications will be effective upon the date specified in the updated Privacy Policy. If we make material changes to this Privacy Policy that significantly affect your rights or the way we use your personal data, we will notify you through the most appropriate channels. Generally, this will be done by updating the date at the top of this page. However, other notification methods may include sending an email to the address you have provided, posting a notice on our Services, or other methods as required by law.  Your continued use of our Services following the posting of changes constitutes your acceptance of such changes.

We will indicate the date of the last revision at the top of this Privacy Policy. We encourage you to periodically review this Policy to stay informed about how we are protecting your personal data.

13   California Privacy Rights

This section is tailored to meet the specific requirements imposed by California law. While this section outlines state-specific rights for California residents, the preceding sections of this Privacy Policy also apply to them.

13.1  Additional Notice to California Residents

California law requires us to disclose the following additional information with respect to our privacy practices. If you are a California resident, this section applies to you in addition to the rest of the privacy policy.

For a comprehensive understanding of the types of personal information we collect, the sources from which we collect it, and the purposes for which we use it, please refer to the “Information Collected and How We Use It” section of this Privacy Policy.

• Notice of Financial Incentive. We may offer our customers loyalty and other incentive programs that provides certain benefits, such as rewards and exclusive offers. We may also provide other promotional campaigns, such as sweepstakes, contests, or limited-time promotions (collectively, the “Programs”). When you sign up for one of these Programs, we typically ask you to provide your name and contact information (such as email address and/or telephone number). Because our Programs involve the collection of personal data, they might be interpreted as a “financial incentive” program under the CCPA. The value of your personal data to us is related to the value of the free or discounted products or services, or other benefits that you obtain or that are provided as part of the applicable Program, less the expense related to offering those products, services, and benefits to Program participants. Participation in a Program is governed by the applicable terms and conditions (including the Official Rules for any sweepstakes or contest or the promotional terms for any short-term promotion), which will also describe the financial incentives association with the promotion and how to participate. You are not obligated to participate in any contest, sweepstakes, or short-term promotion and may terminate your participation at any time (as described in the survey terms and conditions). You may withdraw from participating in a Program at any time by contacting us using the designated method set forth in the applicable Program terms and conditions.
• Shine the Light Disclosure. California Civil Code Section § 1798.83, also known as the “Shine the Light” law, permits California residents to request and obtain from us once a year, free of charge, a list of the third parties to whom we have disclosed their personal information (if any) for direct marketing purposes in the preceding calendar year, as well as the type of personal information disclosed. To make such a request, please send an email with the subject “Shine the Light Request” to the email address in our Contact Information.

13.2  California-specific Privacy Rights

California law grants rights specific rights to California consumers regarding their personal information. Note that these may be duplicative of the rights described above in “Your Privacy Rights” They are as follows:

• Right to Know. You can request, up to two times each year, that we disclose the categories and/or specific pieces of personal information that we collect, use, disclose, and may sell.
• Right to Correction of Personal Information. You have the right to have inaccurate personal information corrected.
• Right to Deletion of Personal Information. You can ask us to delete the personal information that we have collected from you, subject to certain exceptions such as to complete a transaction for you, to exercise our rights, or to comply with a legal obligation.
• Sales of Personal Information. In the preceding twelve (12) months, MBK has not “sold” personal information as this term is defined in the CCPA. Therefore, we do not offer such a right.
• Right to Opt Out of Sharing of Personal Information. The CCPA defines “sharing” as disclosing or making a consumer’s personal information available to a third party for cross-context behavioral advertising. In the preceding twelve (12) months, MBK has shared certain categories of personal information (identified in the above table) with third-party advertisers to tailor ads to consumers’ interests. You have the right to opt out of your personal information being shared for targeted advertising, and you may exercise this right by clicking “Your Privacy Choices” in the website footer and opting out of Targeted Advertising Cookies.
• Right to Limit Use and Disclosure of Sensitive Personal Information. You have the right to direct us to limit our use of your sensitive personal information to that use which is necessary to perform the services or provide the goods reasonably expected by an average consumer. MBK does not use sensitive personal information beyond the CCPA’s permissible purposes.
• Right against Discrimination. You are entitled to exercise the rights described above free from retaliation as prohibited by the CCPA.

To exercise your California privacy rights, please visit this web form or use the contact methods described below. We may request specific information from you to help us confirm your identity and your rights. We will respond to your request within a reasonable period (if properly submitted) and in accordance with applicable law. If we need more time to verify your identity, process and respond to your request, we will notify you of that fact along with the reason for the delay. If we decline to act regarding your request, we will inform you of our decision and the reason for it, and, if applicable, with instructions on how you may appeal our decision.

You have the option to designate an authorized agent to submit requests on your behalf for exercising your data rights. An authorized agent can be either a person or a business entity that you have formally authorized to act on your behalf.

To use an authorized agent:

1. Signed Authorization: You must provide the authorized agent with a signed written authorization to act on your behalf. This document should clearly indicate that you grant them the authority to submit requests for you.
2. Agent Submission: The authorized agent can then submit a request via the methods outlined above. The agent should attach a copy of the written authorization you provided.
3. Identity Verification: We may contact you directly to confirm that you have authorized the agent to act on your behalf. This is a security measure designed to protect your personal information.

Please note that we reserve the right to deny requests from agents who do not provide proof of authorization or if we cannot verify the agent’s identity.

14   Contact Information

If you have any questions or concerns about this Privacy Policy or our data practices, you can reach out to us through the following means:

Toll-Free Telephone: (855) 914-1987 (U.S. only).

Email: privacy@MBK.com.

Submit Your Privacy Rights Request: Consumer Request Form