privacy policy

more info

Haven Website Privacy Policy

RLB Collective, Inc. and its subsidiaries and affiliates d/b/a Haven ("Haven," "us," "we," "our," or "Company") has

adopted this Privacy Policy to describe how we collect, use, disclose, and protect information when you visit our website

at www.myhavenstores.com, use our mobile or other applications, join the Haven Society rewards program, visit our

retail dispensaries, or use any other service where this Privacy Policy is posted (collectively, our "Services").

This Privacy Policy is provided for your information and is governed by our Terms and Conditions of Use, also available

on our Website. If there is any conflict between this Privacy Policy and the Terms and Conditions of Use as to the

handling of personal information, this Privacy Policy controls. Nothing in this Privacy Policy, or in any other

agreement between you and Haven, waives or limits any right you have under California law, including the

California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA"). Any contract

provision that purports to do so is void and unenforceable under Cal. Civ. Code § 1798.192.

NOTICE AT COLLECTION

Before or at the point we collect personal information, we provide the summary below, consistent with Cal. Civ. Code §

1798.100. The full categories, sources, purposes, disclosure recipients, and retention periods are set out in Section III

below.

• Categories collected: Identifiers, commercial information, internet/network activity, geolocation data, and

sensitive personal information (government ID data and precise geolocation), as detailed in Section III.

• Purpose of collection: order fulfillment, legal age verification, rewards administration, Website functionality and

security, analytics, and — where you have not opted out — marketing and advertising.

• Sold or shared: Certain identifiers and internet/network activity data are sold or shared for cross-context

behavioral advertising unless you opt out. Sensitive personal information used for age verification is never sold or

shared.

• Retention: See the retention period listed for each category in Section III. We do not retain personal information

longer than reasonably necessary for the disclosed purpose or as required by state cannabis recordkeeping law.

I. NOTICE REGARDING WEBSITE MONITORING TECHNOLOGIES

(CIPA)

PLEASE READ THIS SECTION CAREFULLY.

Pursuant to the California Invasion of Privacy Act (Cal. Penal Code §§ 631, 632, 638.51), this section explains the

technologies used on our Website and how we obtain your consent before any non-essential monitoring begins.

1. What is monitored

Certain interactions with our Website and digital Services — including pages viewed, general navigation, and, where

separately enabled, session-replay analytics, chat transcripts, and search terms entered into forms — may be recorded,

logged, or analyzed by us and by third-party service providers we engage for hosting, cybersecurity, analytics, and

customer support.

2. Consent occurs before monitoring begins, not after

Strictly necessary cookies and technologies required for the Website to function (e.g., shopping cart, age-gate, security)

load automatically. All other monitoring technologies — including session-replay, analytics beyond basic aggregate

counts, and advertising pixels — are disabled by default and do not load, run, or transmit data until you make an

affirmative choice through our cookie/consent banner. The banner presents "Accept" and "Decline" options of equal

visual prominence, and is displayed before any non-essential script is permitted to execute. Continuing to browse the

Website without interacting with the banner does not constitute consent to non-essential monitoring; those tools simply

remain off.You may withdraw consent at any time through the cookie preference link in the Website footer, which will disable non-

essential monitoring going forward and instruct us to direct applicable vendors to stop processing your data for those

purposes.

3. Third-party service providers

Any third-party tool operating on our site under this section acts as a Service Provider under a written contract that

restricts it to processing data solely on Haven's behalf, for the purposes disclosed here, and prohibits it from retaining,

using, or disclosing the data for its own independent purposes.

II. INFORMATION WE COLLECT ABOUT YOU

In order to access certain services and restricted areas within our Website, or to respond to specific inquiries, Haven

collects three primary types of information: (A) Information You Provide to Us, (B) Information We Automatically

Collect, and (C) Information We Receive from Third Parties (collectively, "Information").

1. Information You Provide to Us

• Contact Information: first and last name, email address, mailing address, and phone number.

• Purchase Information: products or merchandise you purchase, financial transaction details, and retail order

history.

2. Information We Automatically Collect & Technologies Used

When you visit our Website (subject to Section I above), we automatically collect:

• IP address (associated with your internet service provider, company, or university);

• Approximate geographic location and time zone;

• Date and time of your visit;

• Device type, browser, operating system, platform, or domain server;

• Cookies installed on your device (per Section I);

• Referring and exit web pages; and

• Pages or products viewed, referring search terms, and on-site interactions.

Technologies We Use:

• Cookies & Retargeting Pixels: subject to your consent choice in Section I, our Website may use retargeting

pixels from third-party advertising networks. Third-party providers, advertisers, and partners set or view their own

cookies subject to their own privacy policies.

• Log Files: record IP address, browser type, internet service provider, referring/exit pages, and date/time stamps

for security and troubleshooting.

• Analytics Tools: subject to your consent choice in Section I, third-party analytics services may help us

understand and improve Website performance.

• Mobile Application Technologies: if you use our mobile application, your device may provide device

information and, with your permission, precise location.

III. CCPA/CPRA DISCLOSURES & DATA RETENTION

In the preceding 12 months, Haven has collected, disclosed for a business purpose, and in some cases "sold or shared"

(for cross-context behavioral advertising) the following categories of personal information ("PI") and sensitive personal

information ("SPI") under California law:

Identifiers: First and last name, phone number, email address, physical address, and driver's license or state

identification number. Collected directly from you and via point-of-sale ID scanners at our dispensaries. Used for order

fulfillment, legal age verification (21+), rewards administration, and account management. Disclosed for businesspurposes to point-of-sale software vendors, identity verification services, and email/SMS delivery platforms. Sold or

shared to third-party marketing and advertising networks unless you have opted out. Retained for 7 years pursuant to

state commercial cannabis regulatory recordkeeping rules.

Commercial Information: Purchase history, products viewed, loyalty program points, and financial transaction details.

Collected directly from point-of-sale systems and Website checkout. Used for order fulfillment, Haven Society rewards

administration, and business analytics. Disclosed for business purposes to payment processors and state-mandated

inventory-tracking software platforms. Not sold or shared to third-party ad networks. Retained for 7 years pursuant to

state commercial cannabis regulatory rules.

Internet and Network Activity: IP address, browser type, operating system, interaction logs, referring/exit pages, and

search terms. Collected automatically via cookies, log files, and (only after consent under Section I) session-tracking

scripts. Used for Website administration, technical troubleshooting, security monitoring, analytics, and — where not

opted out — targeted advertising. Disclosed for business purposes to cloud hosting providers, analytics partners, and

cybersecurity contractors. Sold or shared to third-party advertising pixels unless opted out. Log files retained for 120

days.

Geolocation Data: IP-derived general location, device location (with your permission), and time zone. Collected via

your browser or mobile application. Used for store-locator tools and verifying local municipal cannabis-ordinance

compliance. Disclosed for business purposes to geolocation mapping software providers. Not sold or shared to third-

party ad networks. Retained for the duration of the active session.

Sensitive Personal Information: Driver's license or state ID data and precise geolocation data. Collected directly via

physical or digital identification scanning. Used strictly for mandatory legal age verification under state commercial

cannabis regulations. Disclosed for business purposes to licensed identity-verification vendors and state regulatory

authorities where required by law. Never sold or shared for marketing or advertising purposes. Scanned identification

images are deleted within 24 hours of verification; compliance audit logs (confirming that verification occurred, without

retaining the ID image) are retained for 7 years.

Personal Information of Minors: Haven does not knowingly sell or share the personal information of any consumer it

has actual knowledge is under 16 years of age. Because our Services are restricted to individuals 21 or older (or 18+ with

a valid medical recommendation), we do not expect to collect information from minors; if we discover that a consumer is

under 16, we will not sell or share that consumer's information without the opt-in authorization required by Cal. Civ.

Code § 1798.120(c) (consumer opt-in for ages 13–15; parent or guardian opt-in for under 13).

IV. HOW WE USE YOUR PERSONAL INFORMATION

We use and process your Information for purposes that include, but are not limited to, the following:

• Providing Website Services, related products, promotions, newsletters, and requested information;

• Enrollment, participation, support, and improvement of our rewards programs, such as Haven Society;

• Responding to inquiries and providing communications by email or text message, including alerts, event

notifications, and contest details;

• Marketing and advertising, including promotional materials or special offers on our behalf or on behalf of our

marketing partners, affiliates, subsidiaries, and third parties, provided you have not opted out;

• Fulfilling contracts we have with you;

• Managing, improving, and fostering relationships with third-party service providers, vendors, suppliers, affiliates,

subsidiaries, and business partners;

• Maintaining, customizing, or administering Services, performing business analyses, resolving technical problems,

improving security, or developing new products;

• Complying with our Terms and Conditions of Use;

• Business intelligence and analytics;

• Complying with applicable laws, regulations (including state commercial cannabis rules), and lawful

governmental requests; and

• Any other purpose disclosed to you at or before the time of collection, or pursuant to your consent.

If Haven begins using automated decisionmaking technology (ADMT) to make a "significant decision" concerning you (for example, in a manner affecting the price or terms you are offered), we will provide a pre-use notice describing the ADMT, its logic, and your right to opt out and to access information about the decision, consistent with the CCPA regulations effective January 1, 2026.

V. SHARING YOUR INFORMATION

We may disclose anonymized, aggregated information that does not identify any individual without restriction.

Otherwise, we share your Information only in the following circumstances:

1. Third-Party Service Providers. We share Information with vendors performing functions on our behalf (hosting,

order fulfillment, database management, analysis, payment processing, customer service, marketing). These vendors are

contractually restricted to using Information solely to deliver these services to Haven and may not use it for their own

independent purposes.

2. Legal and Administrative Reasons. We may disclose Information where required to: (i) comply with a court order,

subpoena, search warrant, or other legal process; (ii) cooperate in internal or external audits or investigations; (iii) satisfy

regulatory requirements, including government agency inspection requests under state cannabis law; (iv) protect the

rights, safety, or property of Haven, our affiliates, officers, employees, or users; (v) enforce our Terms & Conditions; or

(vi) verify your identity in connection with a request you submit.

3. Business Transfers. If Haven merges, is acquired, sells assets, enters bankruptcy, or reorganizes, Information may be

transferred to the successor entity as a business asset, subject to the protections of this Privacy Policy. The successor's

use of previously collected Information remains subject to any choices you have made, including opt-outs of sale or

sharing.

4. Subsidiaries and Affiliates. We share Information across our subsidiaries and corporate affiliates for the purposes

described in Section IV. To opt out of this sharing where it constitutes a "sale" or "sharing" under the CCPA, use the

mechanisms in Section VIII.

VI. YOUR CALIFORNIA PRIVACY RIGHTS (CCPA/CPRA)

If you are a California resident, you have the following statutory rights, which you may exercise free of charge (subject

to certain limits on frequency and verification):

• Right to Know / Access: request disclosure of the categories and specific pieces of Information we have

collected, used, disclosed, sold, or shared about you, including the applicable look-back period.

• Right to Delete: request deletion of your Information, subject to statutory exceptions, including mandatory

cannabis recordkeeping requirements described in Section III.

• Right to Correct: request correction of inaccurate Information we maintain about you.

• Right to Opt-Out of Sale or Sharing: direct us not to sell or share your personal information for cross-context

behavioral advertising.

• Right to Limit Use of Sensitive Personal Information: direct us to limit our use of SPI to purposes necessary to

perform the Services or as required by law (we already limit SPI in this way; see Section III).

• Right to Non-Discrimination: we will not deny goods or services, charge different prices, or provide a different

level of service because you exercised a privacy right.

• Right to Opt-In for Minors: as described in Section III, we will not sell or share a known minor's personal

information without the required opt-in.

• Right to Designate an Authorized Agent: you may designate an authorized agent to submit requests on your

behalf, subject to verification.

• Right to Appeal: if we decline to act on your request, you may appeal by replying to our decision email or

emailing privacy@myhavenstores.com with "Appeal" in the subject line; we will respond within 45 days.

How to Exercise Your Rights

You may submit a request through either of the following methods:• Email: privacy@myhavenstores.com

We will verify your identity using information reasonably necessary for the sensitivity of the request before fulfilling it,

and will respond within the time frames required by the CCPA.

Global Privacy Control (GPC): We honor opt-out preference signals, including GPC, sent by your browser or device.

When we detect a GPC signal, we treat it as a valid request to opt your browser out of the sale and sharing of personal

information for that browser or device, without requiring you to submit a separate request.

"Do Not Sell or Share My Personal Information": A dedicated link with this title (or the combined "Your Privacy

Choices" link and opt-out icon) is posted on our homepage and in the Website footer, allowing you to opt out of

sale/sharing without creating an account.

VII. NOTICE OF FINANCIAL INCENTIVE (HAVEN SOCIETY)

We offer participation in the Haven Society rewards program, which provides point accruals and discounts in exchange

for contact information and purchase history.

• Material Terms: to participate, you provide your name, email, phone number, and birthdate. Points accrue on

retail purchases and are redeemable for store discounts.

• Value of Data: the value we place on the categories of data collected is reasonably related to the value of the

discounts and benefits provided, estimated using the average discount redeemed per enrolled member measured

against Haven's average incremental revenue and reduced administrative cost attributable to program members

over the same period. This methodology is reassessed annually.

• Withdrawal: you may withdraw from the program at any time by emailing privacy@myhavenstores.com or

replying STOP to any marketing text message, without losing access to the Website or non-program Services.

VIII. YOUR CHOICES & OPT-OUT MECHANISMS

• Email: click "unsubscribe" in any promotional email, or email privacy@myhavenstores.com.

• Mobile Push Notifications: adjust notification settings on your device.

• Text Messages: reply STOP (or as instructed) to any text message, or contact us.

• Location Choices: turn off location services in your device settings.

• Cookie Preferences: use the cookie preference link in our Website footer described in Section I to disable non-

essential monitoring and advertising technologies at any time.

• Direct Marketing & Targeted Ad Opt-Outs: you may also opt out of targeted advertising using mobile device

privacy tools or industry opt-out portals (e.g., the Digital Advertising Alliance's WebChoices tool).

IX. CALIFORNIA "SHINE THE LIGHT" LAW

California Civil Code § 1798.83 permits California residents to request, once per calendar year, information about our

disclosure of personal information to third parties for their direct marketing purposes. Send requests to

privacy@myhavenstores.com.

X. INFORMATION SECURITY

We maintain administrative, technical, and physical safeguards designed to protect Information appropriate to its

sensitivity, consistent with our obligations under California law, including Cal. Civ. Code § 1798.81.5. No method of

transmission or storage is completely secure, and we cannot guarantee absolute security. If we experience a breach of the

security of your unencrypted personal information, we will notify affected California residents and any required

regulators in the manner and time frame required by Cal. Civ. Code § 1798.82. Please contact us promptly at

privacy@myhavenstores.com if you suspect unauthorized access to your account or Information.

XI. AGE RESTRICTIONS & MINORS' INFORMATIONThe Website and Services are intended solely for individuals 21 years of age or older (or 18+ with a valid medical

recommendation). We do not knowingly collect personal information from anyone under 13. If we learn that a minor

under 13 has provided us with Information, we will delete it promptly. As described in Section III, we do not sell or

share the personal information of any consumer we know to be under 16 without the required opt-in. If you believe we

have collected Information from a minor, contact us immediately at privacy@myhavenstores.com.

XII. CHANGES TO THIS PRIVACY POLICY & CONTACT US

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Effective Date"

above and, where required by law, will be accompanied by additional notice (for example, a Website banner or email to

registered users) before the change takes effect. We encourage you to review this Privacy Policy periodically.

Email us: privacy@myhavenstores.com

Last Updated: August 20th, 2026