Privacy Policy

Last Updated: December 13, 2024

Thinx wants to give you the best Thinx experience possible. This Privacy Policy (this "Policy") describes the privacy practices of Thinx Inc. ("Thinx", "we", or "us") with respect to personal information which we collect:

• when you sign up for, use, access or otherwise interact with thinx.com or thinxforall.com (the "Sites") or other websites, mobile applications, online services, products, or widgets owned or operated by Thinx or that reference this Policy (collectively, including the Sites, the "Services"),
• in connection with our marketing activities,
• in other settings where we reference this Privacy Policy or interact with you,

and how we use, share and store that information. If you do not agree with any part of this Privacy Policy or our Terms of Use, please do not access or continue to use any of the Services or otherwise provide your Personal Data.

You can reach us at hello@thinx.com or the postal address in the "How to Contact Us " section below if you have further questions.

BY USING THE SERVICES YOU CONSENT TO THE COLLECTION, USE AND TRANSFER OF YOUR PERSONAL DATA FOR PROCESSING IN THE UNITED STATES AS DESCRIBED IN THIS PRIVACY POLICY.

This Policy covers the following areas:

I. Information We Collect

II. How We Use Your Information

III. How We Share Your Information

IV. Data Security

V. Data Retention

VI. Cookies and Other Data Collection Tools

VII. Your Privacy Rights

VIII. Children

IX. Region-Specific Disclosures

X. Third Parties We Don't Own or Control

XI. How to Contact Us

XII. Amendments

I. Information We Collect

Thinx collects personal information from users in connection with the Services.

We collect your Personal Data in a number of ways and for various purposes. "Personal Data" (also known as personal information) means information that relates to you and identifies you personally, directly or indirectly, either alone or in combination with other information available to us. Examples of Personal Data are a name, an online identifier, a contact address, social media reviews and ratings, and precise geolocation data.

We collect your Personal Data as follows:

We ask for and may collect personal information about you such as your: name, home address, address, phone number, email address, telephone number, user name and password, date of birth, gender, age, personal interests, inferences, physical characteristics or description, behaviors, preferences, internet activity including browser and internet protocol address or other unique identifiers, internet activity including browsing and search history, location (e.g., city or country) including Location Data (as described below), commercial information such as credit card information and other similar details directly from you when you sign up for our Services, register an account with us, or when you access or utilize one or more of our Services.

When interacting with our Services, data is automatically collected by the technology platforms providing the experiences, including without limitation information about the Sites that you visit and how you use them and any GPS-based, Wi-Fi-based, or cell-based location information ("Location Data"), and any other identifier that permits direct identifying, locating, or contacting of the device or user. Precise Location Data may be collected in ways such as through Bluetooth beacons, wireless carrier data, and WiFi location data, and your web browser, mobile device, or IP address from which you browse the internet may share Precise Location Data and other data with Thinx as those devices interact with Thinx's Sites or mobile apps. This data includes device IDs, network access, storage information, battery information, cookie data, IP addresses, referrer headers, data identifying your web browser and version, the date and time of your visit and how long you remained on our Sites, and web beacons and tags. Location Data may include the presence of the device, its signal strength and mobile network information, its manufacturer (Apple, Samsung, etc.) and model, and information about the device's interaction with the Services or business services. Thinx may combine this information with other information collected in connection with your use of the Services. More information about these practices is included in the Cookies and Other Data Collection Tools section below.

If you engage with us through a social media account we may collect account or profile information associated with that account. To the extent you connect an account managed by third parties such as social media sites (e.g., Facebook) with a Thinx account, you authorize Thinx to have access to information related to that account (as permitted by the terms of service of your account with that social media site) and agree that Thinx may collect, store and use such information in accordance with this Policy. If you do not want to provide us with this data, please modify the privacy settings on your applicable social media account.

If you are accessing third-party products and services that we have made available to you via the Services, we may collect your name, email address, city, and payment information, and other information, including any personal information that the third party service makes available to us, in connection with your registration for or access to those products and services. You should check your privacy settings on these third party services to understand and change any information sent to us through these services.

When you purchase or browse Thinx products online, we collect contact, purchase and browsing data (such as the path you take through the Sites or Services, how long you spent on a page, access times, and other details about your session on the applicable Service). As you browse our products online or submit product inquiries, we may collect Personal Data such as your contact information and information related to your account and your specific requests. We also may collect information regarding a completed purchase (payment amounts and methods, billing and shipping information, returns and other transaction information). We may associate purchase and browsing information to an account you have registered with us and combine it with information relating to all interactions with us.

When you shop at Thinx pop-up stores, we may collect contact and purchase information. When you are shopping at a Thinx pop-up store we collect any contact and purchase information that is necessary to process your transaction. For example, we may collect payment information and email address (to provide e-receipts). In addition, we may collect your email and phone number(s) in order to send you information about products and Surveys or Promotions (to the extent you have provided the consents required for such communications under applicable law and not opted out of such communications).

If you participate in or utilize or sign up for, as applicable, contests, sweepstakes, loyalty programs, surveys, referral programs, wear trial programs, discounts, research activities or initiatives or promotional sales ("Surveys or Promotions") being offered by Thinx, we may collect contact, demographic and eligibility information or other Personal Data. Promotions may also be run by a Thinx service provider or co-branded with one of our business partners. In such instances, Personal Data may be collected directly by and/or shared with Thinx, the service provider and/or business partner, including for marketing purposes. Personal Data associated with a Survey or Promotion may be shared with partners that sponsored or were involved with the Survey or Promotion. To the extent a Survey or Promotion collects information from you about your periods or period product usage, such information will be used to help us better understand your needs and provide you with additional information that you can incorporate into your evaluation of Thinx products and services and for purposes reasonably related to the Survey or Promotion and as otherwise described herein or the privacy notice governing such Survey or Promotion and only to the extent permitted by applicable law.

We collect Personal Data when you communicate with us and in connection with your interactions with promotional campaigns, advertising on the Services or Thinx online communities. We collect Personal Data when you communicate with us (such as your phone, email or chat communications in connection with technical or product customer support, online services, product information or to any other communication you initiate) and sign up for promotional campaigns or to receive other marketing or informational materials via email, text message, push notifications or other media. Where consistent with applicable law we record and store telephone calls and chat transcripts for a period of time when you interact with our customer or technical support personnel, or if you provide us feedback about our Services. Additionally, we may collect your Personal Data when you click on advertisements, submit content, make reviews, interact with our social media pages, or contribute to message boards, comment fields, blogs, and other media forums sponsored by or affiliated with Thinx.

We allow our trusted ad partners to collect information about you when you use our Services. These companies may collect information from you (e.g. subject of advertisements clicked or scrolled over) during your visits to the Services in order to provide advertisements about goods and services likely to be of interest to you. Our ad partners may use the data they collect from you for a variety of other purposes, including (a) in conjunction with advertising that appears on other websites, (b) to determine the popularity of certain content and analyze and track website traffic, statistics, advertisement data and other interaction with ads and the websites on which they are served, and (c) to measure the effectiveness of web-based and email ads. The ad partners that we engage are bound by confidentiality obligations and other restrictions with respect to their use and collection of your information.

We collect personal information from other sources and partners (e.g., when we purchase personal information about you from a third party to better personalize your experience or market to your interests). We (or our partners) may collect and process sensitive personal information. This may include information such as your race, ethnicity, or data related to your use of our Services such as menstruation (e.g., period calculator). We may also make inferences about your preferences, behaviors, characteristics, health, or attributes related to your use of our Site or products. When we collect data that may be considered “sensitive”, we (or our partners) will request your consent to process such sensitive personal information and we may provide other controls (like an opt-out of certain processing), when required by law. Please note that certain portions of the Sites may require this data for us to fully provide our Services, so your choice to not provide such information may limit the scope of available offerings. We respect our customers’ rights and heightened privacy interests pertaining to sensitive personal information. As such, we commit to verifying that law enforcement entities follow the laws and procedures in their jurisdictions before we respond to a request for such information. Even when compliant with the laws of the requesting agency’s jurisdiction, we may make reasonable challenges to such requests.

II. How We Use Your Information

We use the information we collect to:

Provide our products and services and customer support.

We use Personal Data to process and deliver product orders and to notify you of the status of your order and to address your requests, inquiries, and complaints. For example, data may be used to troubleshoot problems with your experience with the Services. If you contact our customer service (or vice versa), we will use Personal Data such as your order information and contact history to process your request and provide you with the best service possible.

Customize experiences on our Services and gain insights into our customers and communities and operate, maintain, improve, and promote the Sites and the Services.

We use Personal Data to present products and content tailored to you, your interests and location. Our use of Personal Data may also help you engage with other users of our Services. We also use Personal Data for quality assurance, to monitor and improve customer support and the Services, including monitoring browsing activity and session replays, and to better understand our customers and other individuals who access our Services, which helps us develop more interesting and relevant products and services.

Promote Thinx's business through direct mail and online advertising and marketing activities to you and others.

We use Personal Data in connection with advertising and online and offline marketing campaigns, to provide you with information on the products and Services that we think are most relevant to or appropriate for you and to track the success of our marketing activities. We display ads on the online platforms that we own and operate. We also use third party ad partners to display ads for Thinx on third party websites and apps ("Retargeting"). Retargeting technologies analyze the information collected about your interactions with Thinx Sites as described in relation to marketing above and information about you obtained from reputable third party sources parties, including your cookies, and display advertisements matched to your interests, as inferred from your online activities. Ads may also be based on the content of the pages on which they appear and Location Data may be used to serve ads that are more relevant to you based on your particular location. For most devices, you can control the interest-based ads you see as a result of Retargeting by changing the privacy settings of the device itself or changing the privacy settings of your browser but note that our Sites generally are not configured to respond to web browser do-not-track signals.

Connect you with third-party products and services.

We use the data we collect to provide third parties with the information required to enable those third parties to fulfill products or services that a Thinx user has ordered.

Communicate with you.

We may use Personal Data such as account information to contact you (through, for example, email or SMS messages (to the extent you have provided the consents required for such communications under applicable law and not opted out of such communications)) about the Thinx products or Services you have purchased or used and to notify you of other products, promotions and Services we think may be of interest to you. We may use your information to respond to requests for support, online services, product information or to any other interaction you initiate. We also may use your Personal Data to notify you of promotions and other special offers. Irrespective of your privacy settings, we may send you notifications pertaining to the performance of our Services, such as revision of our Terms or this Privacy Policy or other formal communications relating to products or Services you have purchased or use.

Administer and Analyze Surveys or Promotions.

In connection with Surveys or Promotions we may use Personal Data to verify identity, communicate with you about the Survey or Promotion or about other offers, conduct market research, and ask you questions relating to the Survey or Promotion. If you participate in questions and surveys regarding the Survey or Promotion we may share your responses with business partners for their own market research and communication purposes to the extent permitted by applicable laws. In connection with certain Surveys or Promotions such as research initiatives or wear trial programs Thinx may use Personal Data to evaluate the performance, comfort, usability and applicability of Thinx products. In some cases the Survey or Promotion may treat your Personal Data in a way that differs from this Privacy Policy in which case the Survey or Promotion shall provide notice to you of the privacy practice governing that collection of information in connection with that Survey or Promotion. To opt-out of this kind of collection and sharing, you can decline to answer these kinds of questions or decline to participate in the applicable Survey or Promotion altogether.

Operate and analyze our business.

We use Personal Data to analyze trends and statistics and monitor usage and performance of the Services, for purposes of data aggregation and centralization, to engage in business transactions, including the purchase, sale, lease, merger, amalgamation or any other type of acquisition, disposal, securitization or financing involving Thinx, and for sales, supply chain and financial analysis purposes.

To protect our legitimate business interests and legal rights

Where required by law or where we believe it is necessary, we use the data we collect from you to protect our legal rights and the interests of others. This includes using such data to secure and protect your information and our interests, comply with any applicable legal or regulatory requirements, legal basis including legitimate interests or consent, or other legal obligation, to assist in an investigation, to protect and defend our rights and property, or the rights or safety of third parties, to protect the integrity of our Services, employees and users, to analyze user patterns to optimize web presentation, to identify and prevent error, negligence, and crime, for audit functions, to enforce our agreements (such as terms of use, terms of sale and this Privacy Policy), and to resolve disputes.

We may augment Personal Data we collect from you with information provided by reputable third party sources

We may combine Personal Data with information we receive from joint marketing partners, public databases, publicly available pages on social media platforms and other third parties, to give us better consumer insight into your needs, help us tailor our communications with you, deliver marketing messages to you and improve our business. For example, we may obtain updated email address information from email-change-of-address vendors or purchase third-party marketing data and address information and add it to our database to send you offline marketing materials, better direct our advertising and provide pertinent offers we think you are more likely to be interested in. You can opt-out of us combining your personal information with the information lawfully collected from third parties by contacting us using the contact details set out below.

III. How We Share Your Information

Thinx will share your Personal Data with third parties in the following ways:

To Affiliates

We will disclose Personal Data as well as, for the avoidance of doubt, anonymized and aggregate information, to businesses controlling, controlled by, or under common control with, Thinx Inc. for the use purposes and under the conditions outlined above.

To Partners and Suppliers

Thinx may (a) coordinate the provision of services and products to you through third party service providers, such as logistics and fulfillment or electronic infrastructure providers and (b) partner with third parties in order to promote, support, enable or expand Thinx's business and products and services or enable those third parties to deliver content or advertise the products and services of Thinx. We may share Personal Data with those service providers and partners and they may have access to or process your Personal Data. For example, Thinx may use third-party providers to assist us with delivering, marketing and advertising our products and Services, processing payments you make to us, delivering customer service and support, and for e-commerce order fulfillment. In addition, with your knowledge and consent, our Services may gather and transfer information from other applications, functions and tools within your mobile device.

With Social Networks

Our Sites and apps will, in certain circumstances, provide you with social plug-ins from various social networks. If you choose to interact with a social network such as Facebook or Twitter (for example by registering an account), your activity on Sites or via our apps will also be made available to that social network.

For Joint Marketing and Interest-Based Advertising

We disclose various types of information for purposes of interest-based advertising, including third party interest-based advertising. From time to time Thinx might establish joint marketing relationships with other persons or entities whom we believe trustworthy and have privacy practices that are consistent with ours. In such cases and where permitted by applicable law we might exchange, share and/or cross-reference information, including information about you that will enable such persons or entities to contact you (for example through web, mobile app or other advertising) regarding products and services that may be of interest to you. If you would like to opt out of our exchange of your information with other marketers, please let us know by writing to our Support Team . To learn more about third parties that are members of self-regulatory programs such as the Network Advertising Initiative, please visit the NAI's website (www.networkadvertising.org) which will allow you to opt out of interest-based advertising by one, or all, NAI members.

In Discussion Forums

Content you post through the Services such as reviews, commentary on discussion boards or blogs, and certain social networking preferences (e.g. pages you "Like" or "Recommend") may be accessible by other users and companies and may appear on other websites or web searches, and therefore this information could be read, collected, and used by others. Thinx cannot ensure the privacy of any Personal Data included in such user generated content. Please note that Thinx does not necessarily verify, endorse, or agree with any content posted in discussion forums.

In Connection with Business Transfers (country specific disclosures may apply)

Personal Data may be disclosed or transferred as part of, or during negotiations of any purchase, sale, lease, merger, amalgamation, or any other type of acquisition, disposal, securitization or financing involving Thinx. In the event Thinx goes through a corporate transaction resulting in a structural change, such as a merger, sale of assets, acquisition by another company, bankruptcy, insolvency, or dissolution, to the extent permitted by applicable law Personal Data may be transferred to a third party as part of such event and thereby become subject to the privacy practices of that third party, which may materially different than those of Thinx.

With Your Consent or at Your Direction

Thinx will share your Personal Data with other third parties (different from those described in this section) when we have your consent to do and when you intentionally direct us to do so or when you use our Services to intentionally interact with third parties.

For Legal Compliance and Special Circumstances

We may be required, subject to applicable law, to disclose your Personal Data if: (i) it is reasonably necessary to comply with legal process (such as a court order, subpoena, search warrant, etc.) or other legal requirements of any governmental authority, (ii) such a disclosure would potentially mitigate our liability in an actual or potential lawsuit, (iii) it is necessary to protect our legal rights or property (such as enforcing or applying applicable terms and conditions and other agreements, including the Services' terms of service), or (iv) it is necessary to protect the legal rights or property or physical security of others, or for the prevention or detection of crime and such disclosure is lawful.

We may transfer your personal information with our brands and trusted-third parties outside of the country or territory from where you reside. When these third countries do not offer the same level of data protection as your country, we (or our service providers or their contractors/sub-processors) take steps to make sure that there are adequate safeguards are in place to protect your personal information. For example, these adequate safeguards may include your consent or involve binding the third party transferring your personal information to a contract that requires the same level of standards as the country from which the data was collected. In addition, we comply with certain national or country “localization” laws that, among other things, require personal information about their residents to be collected, processed and/or stored inside the country before being transferred internationally.

We May Share your Deidentified Information

We may share deidentified information (e.g., aggregated or grouped information) that doesn’t identify you personally with third parties for research or other purposes identified in this Policy. When we share this information, we require these third parties to agree not to attempt or to allow others to use it to identify individuals.

IV. Data Security

Thinx takes precautions to secure your personal information and protect it from loss, theft, unauthorized access, destruction, use, modification and disclosure. Such measures include technological, physical and organizational safeguards that are appropriate given the sensitivity of the personal information, including maintaining controlled access to electronic and paper documents and files, and using appropriate technology safeguards such as passwords firewalls and encryption as well as non-disclosure or confidentiality agreements as we deem appropriate to protect your data. However, please note that Thinx's security measures may change or be unavailable from time to time and no data transmission over the Internet or any wireless network is 100% secure.

V. Data Retention

Thinx will retain Personal Data for as long as needed to provide the service to you (for example, as long as you have an online account with us) or as needed to fulfill our own obligations, such as preventing fraud, meeting regulatory requirements, resolving disputes, improving our services or maintaining security, and in each case, as consistent with applicable law. We may retain non-personal information that has been sufficiently aggregated or anonymized for a longer period.

VI. Cookies and Other Data Collection Tools

Thinx and its partners use various technologies to collect information when you use our Services, including session replay, sending cookies to your device and using web beacons. By using the Services you consent to the use of such technologies, including cookies, advertising IDs, geolocation, screen capture technology and pixel tags, to collect information about you. These technologies help us personalize your use of our Sites and mobile applications, customize the Services, and mitigate risks and the potential for fraud. These technologies are also used by Thinx and its advertising partners to deliver ads to you based on your interests and online activities. To the extent we use session replay technology, we may collect on a real-time basis information on how you use and navigate the Services. This may include mouse movements and how you scroll through the Services. Some of our websites and Services may contain electronic images called "web beacons". Web beacons are objects embedded in a web page or email which are used to check if a user has accessed content. In addition to allowing us to count how many persons read our messages, web beacons allow us to develop statistical information about the activities and features that most interest our users in order to provide more personalized content.

How We Use Cookies

When you access or use the Services, our web server may send a cookie to your device. "Cookies" are small data files placed on a device's hard drive or memory when you interact with a website or view a message. Among other things, cookies support the integrity of our account creation process, retain your preferences and account settings, and help evaluate and compile aggregated statistics about user activity.

We may use cookies to:

• Remember that you have visited us or used the Services before and personalize our content for you and remember your preferences (for example, your choice of language or region).
• Ensure we have enough capacity to accommodate all of our users and that users are finding what they are looking for easily and do not encounter technical errors.
• Collect anonymous statistical information about how you use the Services (including the length of your web or application session) and the location from which you access the Services, so that we can improve the Services and learn which elements and functions of the Services are most popular with our users.
• Helps us and our ad partners to deliver ads or messages that are relevant to you and your interests. We may also share this information with third parties for this purpose. For example, these cookies allow us to identify and send you messages about items you have left in your cart and make other purchasing recommendations.

How We Use Third-Party Cookies

We may allow third parties to collect information via the Services through cookies, third party plug-ins and widgets. Third party cookies enable third party features or functionality to be provided on or through the Sites (e.g., we may use Google Analytics and Google Adwords to collect and process certain analytics data). Additional data may be collected though Google Analytics (and similar categories of solutions) to help evaluate the visitation and use of our Site. To learn more about Google Analytics, please visit www.google.com/policies/privacy/partners/ and find information about opting-out here: https://tools.google.com/dlpage/gaoptout . In addition, you may connect with us or one of our Sites through social networking websites. Prior to submitting information on a social network website or to third parties, you should familiarize yourself with their privacy policies and practices. We are not responsible for the privacy practices of these third parties. For mobile devices, you can manage how your device and browser share certain device data by adjusting the privacy and security settings on your mobile device. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.

Interest-based or Online-Behavioral Advertising

Online-behavioral advertising is automated, customized advertising that is tailored to your preferences and interests based on your online browsing activities over time and across multiple third-party websites and applications. Your preferences and interests are determined from personal information collected about you, whether by us or other parties. You may receive this advertising when using online services, like advertisements in mobile applications or on websites; To stop receiving interest-based advertising from companies who participate in the Digital Advertising Alliance, you can opt-out here . For Europe, you may opt-out here . Even if you opt-out, you may still see advertisements, but they will be based on the context of the sites you visit and not based on your viewing activities. For more information on online-behavioral advertising, go here .

VII. Your Privacy Rights

Individual Rights. Where we process your personal information, you may be entitled to certain rights made available through applicable data protection laws. Some of these rights are explained below. You can reach Thinx with any questions or to exercise your rights via the How to Contact Us section of this Policy. Please also consult the Region-Specific Disclosures section of this Policy, as depending on the applicable data privacy laws in your jurisdiction, you may have the below rights regarding your personal information.

• The Right to be Informed. You may have the right to be informed about how we plan to process your information. This is the main purpose of this Policy;
• The Right to Deletion or Erasure. You may have the right to have your personal information deleted;
• The Right to Access Your Data. You may have the right to access and receive a copy of your personal information and other supplementary information;
• The Right to Port Your Data. You may have the right to obtain and reuse your personal information for your own purposes across different services and companies;
• The Right to Rectify Your Data. You may have the right to rectify your data if it is inaccurate or needs to be supplemented;
• The Right to Object. You may have the right to object to certain types of processing, including direct marketing;
• The Right to Withdraw Your Consent;
• Email Marketing Communications. If you wish to withdraw the use of your personal information for email marketing for any or all of our brands, you may unsubscribe as directed in our marketing emails. You also may unsubscribe directly on some of our Sites (e.g., “unsubscribe” footers). You may also reach out to us via the “ How to Contact Us ” section of this Policy;
• Telephone or SMS Marketing Communications. If you wish to withdraw the use of your personal information for telemarketing or SMS marketing for any or all of our brands, text “Stop” as directed in the marketing text messages. You may also reach out to us via the “ How to Contact Us ” section of this Policy;
• Postal Marketing Communications. If you wish to withdraw the use of your personal information for postal marketing for any or all of our brands, you may reach out to us via the “ How to Contact Us ” section of this Policy;
• The Right Not to be Discriminated Against. You may have a right not to be discriminated against (e.g., be denied goods or service, charged different prices or rates for goods or services, provided a different level of quality of goods or services) for exercising your legal rights. However, we may offer a different price, rate, level, quality or selection of goods or services to you if you opt-out (or stop sharing your data) and such difference is reasonably related to the value provided to us by your data. For more information, see the “Region-Specific Disclosures” sections of this Policy.
• The Right Not to Be Subject to Automated Decision Making or Profiling. You may have the right not to be subject to automated decision making (a decision that is created solely by automated means and without any human intervention) including the automated processing of personal information for the purposes of profiling or of the evaluation of certain things about you that have legal or similar significant effects, as defined by applicable law. You also may have the right to request human involvement, obtain an explanation of the decision, or challenge such decision;
• Right to Lodge a Complaint with a Competent Supervisory Authority. You may have the right to lodge a complaint with a regulatory authority pertaining to our processing of your personal information. For more information, see the “Region-Specific Disclosures” sections of this Policy.

Verifying Requests. To help protect your privacy and maintain security, we will, according to applicable law, take steps to verify your identity before processing certain rights requests, such as granting you access to your personal information or complying with your request. The procedures for identity verification varies depending on the circumstances and the rights request but may include asking you to verify your name, email address, phone number, or other data points maintained by us. If you fail to verify the data points we may be unable to verify you sufficiently to honor your request. If you designate an authorized agent to make a request on your behalf, we may require you to (a) provide the authorized agent written permission to do so and to share such authorization with us when processing a rights request, or (b) verify your own identity directly with us.

VIII. Children

The Services are intended for general audiences and is not directed to children. As a general matter, we usually do not knowingly collect or process personal information from children under the age of 16, unless a lower age is provided or allowed by local law. Where we do knowingly collect or process personal information from children under the age of 16 (or under an age stipulated by local law), we follow all applicable data protection laws. For example, in the U.S., we obtain verified parental consent as required by law when collecting personal information from children younger than 13 years of age.

IX. Region-Specific Disclosures

Personal Data we collect may be stored and processed in the United States or any other country in which Thinx or its affiliates, subsidiaries, agents, or third party service providers maintain facilities and/or infrastructure, and by using the Services and submitting information to us, you consent to the transfer, processing and storage of such information outside of your country. Note that the United States is a jurisdiction in which the data protection regime may not provide the same level of security as those in the nation where you reside. Unless applicable law requires different security and protections to be applied in any given relevant jurisdiction, we apply the same principles in using, handling and transmitting data as described in this Privacy Policy in all of our operations.

Residents of Canada

If you reside in Canada, your consent to use or share your Personal Data for the marketing purposes identified above is optional and is not required as a condition of obtaining the Services. If you do not want your personal information to be used or shared for these additional purposes, please write to us through our Support Team or the mailing address set out below. We do not collect social insurance numbers from Canadian consumers.

Residents of the European Economic Area, Switzerland, and the United Kingdom (“UK”)

If you are a resident of the EEA (specifically, any country in the European Union, Liechtenstein, Norway, or Iceland), a resident of the United Kingdom ("UK") or a resident of Switzerland, this section applies to you, and it explains what retention periods for your personal information, international data transfers, automated decision making, and rights you may exercise in relation to your personal information.

Retention Period. We retain your personal information for as long as necessary to fulfill the purposes for which the personal information was collected as outlined in this Policy. The following retention periods will apply to the processing of your personal information:

• Contractual purposes: retained during the provision of the Site plus a period of 10 years after the termination or withdrawal of such contract, except when the retention of the data is necessary to respond or to file legal actions, upon request of the competent authorities or in compliance with the applicable laws; and
• Marketing purposes: retained for a period of 24 months after your relationship with us ends or until you withdraw your consent.

International Data Transfers. If personal information is transferred between countries, we take commercially reasonable efforts to protect such personal information, such as by entering into Standard Contractual Clauses as approved by the European Commission. In some instances, we may also be required to disclose Personal Data to comply with lawful requests from governmental authorities, including to meet national security, governmental interest or law enforcement requirements.

Automated Decision Making. We do not engage in any automated decision with a legally significant effect with respect to the personal information subject to this Policy without your consent.

Rights Regarding Personal Information. Certain data protection law gives rights to individuals in respect of personal information that organizations hold about them. In particular, you can exercise the following rights:

• to obtain from us confirmation of the existence of personal information and to be informed of its source, verify its accuracy and request its integration, updating, or amendment;
• request the erasure, anonymization or restriction of the processing of data processed in breach of the applicable laws;
• object in whole or in part, on legitimate grounds, to the processing of the data;
• to withdraw your consent to the processing of the data (if and to the extent such a consent is necessary); and
• In addition to the above, you will also have the right to request us to limit the processing of your personal information where:
• you contest the accuracy of the personal information until we have taken sufficient steps to correct or verify its accuracy;
• the processing is unlawful but you do not want us to erase the data;
• we no longer need your data for the purposes of the processing, but you require it for the establishment, exercise or defense of legal claims; or
• you objected to processing justified on legitimate interests, pending verification as to whether we have compelling legitimate grounds to continue processing;
• you receive an electronic copy of the data, if you would like to port data to yourself or a different provider, when we are relying upon your consent or the fact that the processing is necessary for the provision of the services and the data is processed by automatic means; and/or
• you lodge a complaint with the relevant data protection supervisory authority.

If you would like to exercise your rights, please visit our " Privacy Request Form " or contact us through our Support Team or at the physical address listed below mentioning your electronic contact details and identity sufficiently to allow Thinx to verify your identity. Please note that requests to exercise data protection rights will be assessed by us on a case-by-case basis. There may be circumstances where we are not legally required to comply with your request because of exemptions provided for in data protection legislation. We do not charge you a fee for exercising any of your rights described above.

If you have an unresolved privacy or data use concern that we have not addressed satisfactorily, please contact us. You may also contact your local data protection authority within the European Economic Area or the UK for unresolved complaints. Contact details for data protection authorities in the EEA are available here ; contact details for the data protection authority in the UK are available here ; and contact details for the Swiss data protection authority are available here .

Residents of California

This California Consumer Privacy Statement (“Statement”) applies solely to California consumers and addresses personal information we collect online and offline. This Statement does not apply to our personnel. Sections 2-5 of this Statement do not apply to job applicants. This Statement uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, along with any implementing regulations (the “CCPA”).

1. Notice of Collection and Use of Personal Information

We may collect (and may have collected during the 12-month period prior to the effective date of this Statement) the following categories of personal (including sensitive) information about you:

• Identifiers: identifiers such as a real name, alias, postal address, unique personal identifier (such as a device identifier; cookies, beacons, pixel tags, mobile ad identifiers and similar technology; customer number, unique pseudonym, or user alias; telephone number and other forms of persistent or probabilistic identifiers), internet protocol address, email address, and account name.
• Additional Data Subject to Cal. Civ. Code § 1798.80: signature, physical characteristics or description, education, and financial or health information.
• Protected Classifications: characteristics of protected classifications under California or federal law, such as race, color, national origin, religion, age, sex, gender, medical condition, disability, citizenship status, and military and veteran status.
• Commercial Information: commercial information, products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies.
• Online Activity: Internet and other electronic network activity information, including, but not limited to, browsing history, search history, and information regarding your interaction with the Site.
• Geolocation Data
• Employment Information: professional or employment-related information.
• Education Information: education information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. Sec. 1232g; 34 C.F.R. Part 99).
• Inferences: inferences drawn from any of the information identified above to create a profile about you reflecting your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

We may use (and may have used during the 12-month period prior to the effective date of this Statement) your personal information for the purposes described in this Privacy Policy and for the following business or commercial purposes specified in the CCPA:

• Performing services, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, personalizing the services, providing advertising or marketing services, providing analytics services, or providing similar services.
• Auditing related to a current interaction with you and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance.
• Short-term, transient use, including, but not limited to, the contextual customization of ads shown as part of the same interaction.
• Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity.
• Debugging to identify and repair errors that impair existing intended functionality.
• Undertaking internal research for technological development and demonstration.
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.
• Managing career opportunities with us.

2. Sources of Personal Information

During the 12-month period prior to the effective date of this Statement, we may have obtained personal information about you from the following categories of sources:

• Directly from you, such as when you contact us with a question.
• From your devices, such as when you visit our Site or mobile applications.
• Your family or friends, such as when they provide us with your contact information so we can send information that may interest you.
• Our affiliates and subsidiaries.
• Vendors who provide services on our behalf.
• Our joint marketing partners.
• Online advertising services and advertising networks.
• Government entities.
• Social networks.
• Data brokers.
• Data analytics providers.

3. Selling or Sharing of Personal Information

We do not sell your personal information in exchange for monetary consideration without your consent.

We may allow certain third parties (such as online advertising services) to collect your personal information via automated technologies on our Site in exchange for non-monetary consideration. We share the categories of personal information listed below for the business and commercial purposes of online advertising and to provide third-party social network features and functionality on our Site. Those third parties may include Google, Coveo, TikTok, Twitter, Facebook, EqualWeb, and Neustar. Those third parties may use your personal information to optimize our properties, display cross-contextual advertising and manage their own platforms. Please see the Cookies and Similar Tracking Technology section above to learn more about those third parties’ collect of information. You have the right to opt out of this disclosure of your information, which may be considered a “sale” or “sharing” under California law, as set forth below in Section 5 (California Consumer Rights) of this Statement.

During the 12-month period prior to the effective date of this Statement, we may have sold or shared the following categories of personal information:

Category of Personal Information	Category of Third Party
Identifiers	Advertising networks, data analytics providers, social networks, data broker
Commercial Information	Advertising networks, data analytics providers, social networks, data broker
Online Activity	Advertising networks, data analytics providers, social networks, data broker
Inferences	Advertising networks, data analytics providers, social networks, data broker

 

We do not knowingly sell or share the personal information of minors under 16 years of age without affirmative authorization if we have actual knowledge of the individual’s age. Any individuals who register for an account who are under 16 years of age are automatically opted out of the sale or sharing of their personal information. If an individual wants to opt-in and agree to the sale or sharing of their personal information, they must do so by affirmatively unchecking the “Do Not Sell or Share My Personal Information” box in their online profile.

4. Disclosing Personal Information to Third Parties

During the 12-month period prior to the effective date of this Statement, we may have disclosed your personal information with certain categories of third parties and service providers, as described below.

We may have disclosed the following categories of personal information about you listed below for the commercial and business purposes set forth in Section 1 (Notice of Collection and Use of Personal Information) of this Statement to the following categories of third parties:

Category of Personal Information	Category of Third Party
Identifiers	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Additional Data Subject to Cal. Civ. Code § 1798.80 Law	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Protected Classifications	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Commercial Information	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Online Activity	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Geolocation data	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Employment Information	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Education Information	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers
Inferences	Advertising Networks, Data Analytics Providers, Social Networks, Data Brokers

 

In addition to the categories of third parties identified above, during the 12-month period prior to the effective date of this Statement, we may have disclosed personal information about you with the following additional categories of third parties:

• Government entities

5. California Consumer Privacy Rights 

Privacy Rights. You have certain choices regarding your personal information, as described below. If you exercise any of these choices and rights, we will not disadvantage you. You will not be denied or charged different prices or rates for goods or services or provided a different level or quality of goods or services.   

• Know: You have the right to know what personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of third parties to whom we disclose personal information, and the specific pieces of personal information we have collected about you.
• Deletion: You have the right to request that we delete certain personal information we have collected from you, subject to certain exceptions.
• Correct: You have the right to correct inaccurate personal information that we maintain about you.
• Opt-Out of Sale or Share: You have the right to opt out of the sale or sharing of your personal information, by either clicking to “Do Not Sell or Share My Personal Information” links on our websites and apps or visit our " Privacy Request Form – Opt-Out ". Once we receive and verify your request, we will not sell or share your personal information unless you later allow us to do so. We may ask for your permission to resume sale or sharing of your personal information later, but we will wait at least 12 months before doing so. You may also opt-out of our sharing and selling through certain browser enabled opt-out preference signals, such as the Global Privacy Control. You can learn more about that option here: https://globalprivacycontrol.org/ .
• Limit Use and Disclosure of Sensitive Personal Information: In some instances, we may use or disclose your sensitive personal information (e.g., information about your health or ethnicity) outside of the limited purposes set forth below. You have the right to direct us to limit our use and disclosure of such sensitive information. If you do, we may still use the information for certain limited purposes, such as the following: (i) performing our services or providing goods; (ii) detecting security incidents; (iii) resisting malicious, deceptive, fraudulent, or illegal actions; (iv) ensuring physical safety; (v) for short-term transient use, including certain non-personalized advertising; (vi) maintaining or servicing accounts, providing customer service, verifying customer information, or providing similar services; and (vii) to verify and maintain the quality or safety of a service or product or to improve, upgrade or enhance a service or product.

Shine the Light Request: You also may have the right to request that we provide you with (a) a list of certain categories of personal information we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year and (b) the identity of those third parties.

How to Submit a Request. To submit a request to know, delete, or correct, or limit the use of sensitive personal information, use the Privacy Request Form – Opt-Out or call us at 1-844-604-0978 . To submit a Shine the Light request, please send a written request to: Thinx Inc, 1836 Westchester Ave #3240, The Bronx, NY 10472. To opt out of the sale or sharing of your personal information or to limit the use of your sensitive personal information, click the applicable link(s) at the bottom of our Sites or send us an email at hello@thinx.com .

Authorized Agents. You may designate an authorized agent to submit requests on your behalf. To submit a request as an authorized agent on behalf of a consumer, please contact us as described in the How to Contact Us section of our Policy.

Verifying Requests. To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to your personal information or complying with your request. If you have an account with us, we may verify your identity by requiring you to sign into your account. If you do not have an account with us and you request access to or deletion of your personal information, we may require you to provide any of the following information: name, email, and phone number or other data points maintained by us sufficient to make sure that you are the consumer we may have collected personal information about or a person who has been duly authorized to make the request. In addition, if you do not have an account and you ask us to provide you with specific pieces of personal information, we will require you to sign a declaration under penalty of perjury that you are the consumer whose personal information is the subject of the request. If you designate an authorized agent to make an access, deletion or opt-out of sale request on your behalf (a) we may require you to provide the authorized agent written permission to do so, and (b) for access and deletion requests, we may require you to verify your own identity directly with us (as described above).

 

Financial Incentives. Creating an online account or participating in a financial incentive program such as surveys, promotions, loyalty programs or coupon-based initiatives administered by us or our partners may entitle you to receive special offers and benefits from us. We are providing you with this financial incentive information so that you may make an informed decision on whether to participate in our programs. Examples of the programs we offer include surveys, limited-time promotions or sweepstakes and one-time promotions. In exchange for participation in such programs you may be offered a financial incentive, such as a discount or a product giveaway. To administer such programs, we may need to sell, collect, disclose, or retain your personal information. We calculate the value of your data based on the return on investment or incremental margin generated by us from administering financial incentives and from the sale, collection, or retention of your personal information. Participation in our promotional programs is always optional and you may end your online account or cancel your participation in any applicable program (which will withdraw you from the financial incentives) at any time by entering a request at Privacy Request Form – Opt-Out , or emailing us at hello@thinx.com .

Additional Information. If you choose to exercise any of your rights under the CCPA, you have the right to not receive discriminatory treatment by us.

Data Retention. We keep records and personal information for specified periods of time, depending on business needs, privacy interests and the law. As a general matter, we only retain personal information for as long as it is needed or useful for accomplishing a business, legal or tax purpose. After such period, the data is deleted or fully anonymized: data not processed based on your consent, but collected to fulfill our contractual obligations to you is retained while we have a relationship with you plus a period of no more than 10 years after that relationship ends, except when the retention of the data is necessary to enforce or defend our rights or comply with law; and data collected for marketing purposes according to your consent is retained for a maximum period of 5 years after your relationship with us ends or until you withdraw your consent (although in many circumstances we retain that information for a shorter period, as required by law).

Residents of Nevada

As a Nevada resident, you have the right to ask certain companies not to sell your personal information in exchange for money under the Nevada’s privacy law, SB260. Consistent with this Policy, we do not engage in such sales for monetary consideration, without your consent.

Residents of Virginia

This portion of our Policy only applies to residents of the state of Virginia after January 1, 2023. This portion of our Policy advises Virginia residents of rights provided in the Virginia Consumer Data Protection Act (the “VCDPA”) and how Virginia residents may exercise those rights. You may exercise any of the rights in this Section by emailing us at hello@thinx.com, calling 1-844-604-0978 , or through our Privacy Request Form . If we refuse to take action regarding your exercise of any of the rights described in this section, you may appeal our refusal to do so by emailing hello@thinx.com .

• Rights to Confirm and Access. You have the rights to confirm whether we are processing your personal information and you have the right to access such personal information;
• Right to Correct. You have the right to correct inaccuracies in your personal information, as appropriate given the nature of the personal information and our processing purpose;
• Right to Delete. You have the right to delete personal information provided by or obtained about you;
• Right to Obtain a Copy. You have the right to obtain a copy of your personal information that you provided to us in a portable format, and to the extent technically feasible, a readily usable format that allows you to transmit the data to another data controller, where the processing is carried out by automated means; and/or
• Right to Opt-Out. You have a right to opt-out of our: 1) processing for targeted advertising (whether the information was collected through online trackers or otherwise), 2) selling your personal information, or 3) profiling in a way that produces legal or otherwise significant effects concerning you. Please note that we do not sell personal information for monetary consideration without your consent, but you may opt-out of targeted advertising and certain other online tracking through the practices described in this Policy.

Washington Consumer Health Data Privacy Policy

This portion of our Policy only applies to Washington state residents.

As a Washington resident, the Washington State My Health My Data (MHMD) Act gives you certain choices regarding your health data, as described below. The law applies only to “consumer health data” about your past, present, or future health conditions.

Consumer Health Data We Collect. We collect data from a variety of sources. Because consumer health data is defined very broadly, many of the categories of data we collect could also be considered consumer health data. Examples of consumer health data we collect may include:

• Information about your health-related conditions, symptoms, status, diagnoses, testing, or treatments. For example, your use of our products (such as those for menstruation or incontinence) may give us insight into your health status. We may also collect health information when you interact with our website through product recommendation questionnaires and similar offerings. These surveys may give us additional insight into your health status.
• Behavioral data resulting from your use of our websites. Data collected may include the pages you visited and the actions you took while using the site (for example but not limited to button clicks, products purchased, samples ordered, searches performed, and other actions taken).
• Information that could identify your propensity to seek health care services or information, e.g., that related to the treatment of and care for incontinence or conditions associated with reproductive- and/or menstruation-related disorders.
• Inferences derived from the above data.

Sources of Consumer Health Data. We collect personal data (which may include consumer health data) from three main sources:

• You provide us this information directly when you purchase products, sign up for newsletters, fill out surveys (such as the “Find Your Perfect Pair” questionnaire), enter promotions, or register for an account on our website.
• We collect some of this information automatically when you browse our website or interact with us online.
• We may collect consumer health information from other sources and partners, such as when we purchase information about you from a third party to personalize your experience or market to your interests.

Why We Collect and Use Consumer Health Data. We collect and use consumer health data as reasonably necessary to provide you with the products and/or services you have requested and to market to your interests. Providing requested products and services to you may include delivering the products, making suggestions about what products are appropriate for you, and/or personalization of certain product features. We also use consumer health data to improve our products and for other essential business operations, such as analyzing our performance, meeting legal obligations, and conducting research and development.

We may also use consumer health data to market or advertise our own products and services. We may also use your purchase history or information received from third parties to advertise other products we sell that we think may be of interest to you.

For marketing and advertising, we give you choices and/or obtain your consent as required by law. Please see the “Your Privacy Rights” section above for more details on the controls and choices you may have. To exercise a right pursuant to MHMD, see the “How to Exercise Your Rights” section below.

Disclosures of Consumer Health Data. We may share each of the categories of consumer health data described above with your consent or as reasonably necessary to provide our products and services.

We may also share your information with service providers who operate on our behalf to help us provide you with products and services you have requested, to make product improvements, and to market and advertise our products and services to you.

Processors and other Third Parties with whom We Share Consumer Health Data. As necessary for the purposes described above, we may share consumer health data with the following categories of third parties. More detail on each category is available in the “How We Share Your Information” above:

• Service Providers.
• Third Parties and Partners. Your consumer health data may be shared with partners, advertisers, advertising networks, advertising servers, social media networks, analytics companies, and similar companies who process the information on our behalf as stated in the “Why We Collect and Use Consumer Health Data” section above.
• Parties to a Business Transaction, such as a corporate merger.
• Government Agencies and Law Enforcement.
• Other third parties. In certain circumstances, it may be necessary to provide data to other third parties, for example, to comply with the law or to protect our rights or those of our customers.

How to Exercise Your Rights. Washington’s MHMD Act provides certain rights with respect to consumer health data. These rights include your right to access your consumer health data and receive a list of all third parties and affiliates—including contact information—who receive your health data. You also have the right to request that we delete our consumer health data. You can withdraw consent relating to the collection and sharing of your data too, subject to certain exceptions.

You can request to exercise such rights using the “Privacy Request Form” information described in the "How to Contact Us" section below.

If your request to exercise a right under the MHMD Act is denied, you may appeal that decision by contacting our Global Privacy Officer at the addresses provided in the "How to Contact Us" section. If your appeal is unsuccessful, you can raise a concern or lodge a complaint with the Washington State Attorney General at www.atg.wa.gov/file-complaint.

X. Third Parties We Don't Own or Control

This Privacy Policy does not apply to the practices of companies that we do not own or control or to people that we do not employ or manage. For example, if you choose to pay through a third-party mechanism offered on our website, the information you choose to share with that third-party will be treated in accordance with that third-party's privacy policy. This Policy does not apply to, and we are not responsible for, for the content of such third party features or the privacy practices, including third-party cookies, web beacons, or other tracking technologies, of such third parties. We encourage you to read the privacy policies of each and every device, website, and service that you use.

XI. How to Contact Us

Thinx welcomes questions and comments about this Privacy Policy. You can contact us by emailing us at hello@thinx.com or writing to us at:

Thinx Inc.

Attention: Privacy Office

2100 Winchester Road, Neenah, WI 54956

Call toll-free at: 1-844-604-0978

XII. Amendments

We may change this Policy from time to time. The most current version of this Policy will be effective at the time it is posted. By continuing to access or use the Services after those changes become effective, you agree to be bound by the revised Policy. If you have a registered account, we may notify you of any changes to our Privacy Policy via email and/or we may ask you to affirmatively acknowledge and consent to the changes the next time you use our Services.