SUPPLEMENTAL NOTICE FOR CALIFORNIA RESIDENTS

Effective Date: March 15, 2024

This Supplemental Privacy Notice for California Residents (this “Supplemental Notice”) supplements Apricus’s Privacy Policy found here - privacy policy and applies to you if you reside in California. This Supplemental Notice is adopted to comply with the California Consumer Privacy Act of 2018 (the “CCPA”) and the California Privacy Rights Act (“CPRA”). It also addresses requirements of certain other California laws. Capitalized terms used without definition shall have the meanings ascribed to them in the Privacy Policy and other undefined terms shall have the meanings ascribed to them in the CCPA/CPRA.

Information We Collect.

The Site or App collects information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked to a consumer or personal device. For purposes of this Supplemental Notice, such information constitutes personal information.

Personal Information Collected. Below are categories of personal information recognized by the CPRA along with examples (provided by the CPRA) of

Identifiers.

Real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers

CA Customer Records Statute categories.

Name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information

Protected Class Characteristics.

Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information)

Commercial Information.

Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies

Biometric Information.

Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.

Internet/network activity.

Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement

Geolocation data.

Physical location or movements

Sensory data.

Audio, electronic, visual, thermal, olfactory, or similar information

Professional/employment-related information.

Current or past job history or performance evaluations

Non-public education information.

Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records

Inferences drawn from other personal information.

Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes

Sensitive Personal Information.

Racial/ethnic origin, political opinions, religious or philosophical beliefs, genetic data, biometric data, sex life / sexual orientation, union membership, past or spent criminal convictions, mail, email and text message content, precise geolocation data, social security, driver’s license, state identification card, passport number, account login, financial account, debit card, or credit card number.

Exclusions.

Personal information does not include publicly available information from government records, permanently deidentified consumer information, and information excluded from the CCPA/CPRA’s scope (such has HIPAA–protected information and information protected by the Gramm-Leach Bliley Act). Personal information collected as part of a communication or transaction between Apricus and a representative of a government agency or other business, where the transaction is made for providing or receiving a good or service to or from such government agency or other business or conducting due diligence in connection with the foregoing is also excluded from the scope of this Supplemental Notice except with respect to Section 21(c) (non-discrimination).

Sources.

We obtain Personal Information from you, including from you directly when you provide Apricus with the information, from you indirectly when you interact with the Site or App, and from you when you make electronic communications to Apricus.

Use of Personal Information.

Apricus uses the personal information it collects in the ways described in Section 5 of the Privacy Policy. Apricus may use the personal information for commercial purposes as well as business purposes.

Disclosure of Personal Information.

Disclosure.

Apricus uses the personal information it collects in the ways described of the Privacy Policy. Apricus has shared or disclosed Personal Information within the past twelve months as described below. The following chart identifies the categories of personal information recognized by the CCPA/CPRA and collected by Apricus, provides examples of the types of personal information within each category collected by Apricus, indicates whether Apricus has collected such categories of personal information during the past twelve months, the source of such personal information, how Apricus uses such personal information, to whom Apricus has disclosed such personal information, and the estimated retention period of that information within the past twelve months:

Category of Personal Information	Source	Business Purpose	To Whom Disclosed (categories)
Identifiers	-you -technologically gathered from you -service providers -business partners	-facilitate transactions -marketing/ communications -fulfill requests -provide support -provide goods/services -fulfill contractual obligations	-service providers -business partners
CA Customer Records Statute categories	-you -service providers -business partners	-facilitate transactions -marketing/ communications -fulfill requests -provide support -provide goods/services -fulfill contractual obligations -respond to inquiries	-service providers -business partners -analytics and advertising partners
Protected Class Characteristics	n/a	n/a	n/a
Commercial Information	-you -service providers -business partners	-facilitate transactions -provide goods and services to customers - improve goods and services -fulfill contractual obligations -respond to inquiries	-service providers -business partners
Biometric Information	n/a	n/a	n/a
Internet/network activity	-you/your device -analytics and advertising partners	-improve Site -personalize Site -improve Site experience -marketing and remarketing	-service providers -analytics and advertising partners -business partners
Geolocation data	-you/your device -analytics and advertising partners	-improve Site -personalize Site -improve Site experience -improve customer experience -marketing and remarketing	-analytics and advertising partners -business partners
Sensory data	n/a	n/a	n/a
Non-public education information	n/a	n/a	n/a
Inferences drawn from other personal information	-analytics and advertising partners -business partners -service providers	-provide goods and services -marketing and remarketing -improve customer experience -improve product and service offerings -respond to inquiries	-analytics and advertising partners -business partners
Sensitive personal information	n/a	n/a	n/a

Retention.

Typically, Apricus retains your Personal Information for the period necessary to fulfill the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law. Please note that in many situations we must retain all, or a portion, of your personal information to comply with our legal obligations; resolve disputes; enforce our agreements; protect against fraudulent, deceptive, or illegal activity; or for another one of our business purposes.

Sale.

Apricus does not sell personal information, including of minors under 18 years of age.

Deidentified Information.

Apricus may also disclose aggregated, anonymized, or de-identified information, which cannot reasonably be used to identify you.

California Rights.

California law provides you with specific rights as a California resident. This section identifies those rights and how to exercise them.

Access and Data Portability.
Subject to certain exceptions, you have the right to request certain information about Apricus’s collection, use, and/or disclosure of your personal information over the past 12 months. After receipt of a verifiable consumer request from you, Apricus will disclose to you the categories of personal information collected, categories of sources for the categories of personal information collected, business or commercial purpose for collecting such personal information, categories of third parties with whom Apricus shared such personal information, and specific pieces of personal information collected about you.
Deletion or Correction.
Subject to certain exceptions, you may request that Apricus delete or correct personal information about you that it has collected and retained.
Non-Discrimination.
You have the right not to receive discriminatory treatment for the exercise of your privacy rights under the CPRA.
Opt-Out.
California law requires that we provide transparency about personal information we “sell,” which means scenarios where we disclose personal information to third parties in exchange for valuable consideration. We do not sell or share data for monetary consideration without your consent. We do not sell personal data of individuals we know to be under 16 years of age.

4. California Request Process.

Instructions.
If you reside in California, only you or someone legally authorized to act on your behalf may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child. You may make a verifiable consumer request for access or data portability no more than twice within a 12-month period. Such a request must provide sufficient information to allow Apricus to reasonably verify that you are (or are an authorized representative of) the person about whom Apricus collected the personal information, and describe your request with sufficient detail to allow Apricus to properly understand, evaluate, and respond to it. Please note that Apricus cannot respond to your request or provide you with information if Apricus cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with Apricus. Apricus will only use personal information provided in a verifiable consumer request to verify your identity or authority to make the request. If you reside in California, you may exercise your personal information rights by submitting verifiable consumer requests in one or more of the following manners:

If you are a California resident, you may make verifiable requests to exercise your personal information rights via emailing curatorialspecialistteam@apricusartcollection.com.
If you prefer to submit your verifiable request to exercise your personal information rights by phone, you may contact Apricus by phone toll free at 6153304346 or by submitting a request using any of the contact information set forth in Section 27 below.

Verifying Requests.
Apricus will confirm receipt of your request within the time period prescribed by the CPRA and/or its regulations, let you know how Apricus will process the request, and let you know Apricus’s verification process and anticipated timeframe for response. Apricus may try to verify your request by asking you to provide certain information and matching it to the information Apricus maintains about you. Apricus will request at least two data points about you. Depending on the nature of your request, Apricus may require more data points to match and/or may require you to sign a declaration confirming under penalty of perjury that you are the consumer whose personal information is the subject of the request.

Authorized Agent.
If you are a California resident, you may designate an authorized agent to make requests on your behalf to exercise your personal information rights. The authorized agent must be registered with California’s Secretary of State. The authorized agent making any request on your behalf to know or delete certain personal information about you must submit a copy of the written permission you granted them to act as authorized agent or a copy of the document showing you granted them a power of attorney for this purpose. If the authorized agent does not have a power of attorney in compliance with California’s probate law, you must also directly verify your identity with Apricus. If adequate proof is not presented, Apricus may deny the request.

Response Timing and Format.
Apricus will try to respond to a verified consumer request within forty five (45) days of receipt, but if Apricus requires more time to respond, it will let you know how long and why in writing. Apricus will respond to you by mail or electronically at your option. Any disclosures Apricus provides in response to your request will pertain only to the 12-month period immediately preceding receipt of the verifiable consumer request. If Apricus is unable to respond to the request, Apricus will explain why, if applicable. If Apricus is unable to verify your identity in connection with a request for specific pieces of information about you, Apricus will let you know (but will not disclose the specific pieces of information) and will evaluate the request as though it were a request for categories of personal information disclosed to third parties during the past 12 months. If Apricus denies a request due to conflict with federal or state law or an exception to the CCPA/CPRA, Apricus will explain the basis for the denial. If Apricus cannot verify your identity in connection with a request to disclose categories of information disclosed to third parties, Apricus will let you know, and will provide you information about its general business practices regarding collection, maintenance, and sale of personal information. If Apricus cannot verify the identity of an individual requesting deletion of personal data, Apricus will deny your request and will treat the request as a request to opt-out of sale. Apricus has no obligation to provide you with specific personal information if such disclosure creates a substantial, articulable, and unreasonable risk to security. For any data portability requests, Apricus will provide your personal information in the following format: by pdf. Unless your request is excessive, repetitive, or manifestly unfounded, Apricus will not charge a fee to process or respond to your request. If Apricus determines that a fee is warranted, Apricus will explain why it reached that decision and provide you with a cost estimate before responding.

5. Changes to Privacy Policy.

Changes to the Supplemental Notice will be posted on this page. If Apricus makes material changes to the way it treats users personal information, it may choose to notify you by email or through a notice in addition to posting. The date the Supplemental Notice was last revised appears at the top of the Supplemental Notice. You are responsible for ensuring that Apricus has a current email address for you and for periodically visiting the Site or App and the Supplemental Notice to check for any changes.

6. Data Sharing for Direct Marketing Purposes.

California Civil Code Section 1798.83 permits users of the Site or App who are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please contact Apricus at the contact information set forth in Section 8 below.

7. Contact.

If you have any questions or comments about this Supplemental Notice and Apricus’s privacy practices, or if you wish to exercise your rights as a California resident, please contact Apricus at:

Apricus Art Collection, LLC

Attn: Data Privacy Officer

Email: curatorialspecialistteam@apricusartcollection.com

Phone: 6153304346