Sources of Collection

We obtain the categories of Personal Information listed above from the following sources:

• Directly from you. For example, from forms you complete or purchases you make.

• Indirectly from you. For example, from collecting data, such as device and browser information, and usage data, based on your actions on our Website.

• From third party or public or commercially available sources or from companies that partner with us. This may include information we receive from our advertising and market research partners, who may provide us with information about your interest in and engagement with our online advertisements.

Business and Commercial Purposes for Collecting Personal Information

We collect and use Personal Information for the business and commercial purposes described in the “Disclosure or Sale of Personal Data” section of the Privacy Policy, including: providing our products and services; account creation and management; order fulfillment and customer service; marketing communications; fraud prevention and security; analytics and service improvement; and compliance with legal obligations.

4. YOUR PRIVACY RIGHTS

Under Applicable State Privacy Laws, you have the following rights regarding your Personal Information:

Right to Know / Access

You have the right to request that we disclose what Personal Information we have collected, used, disclosed, sold, or shared about you. For California residents, if we retain Personal Information for longer than 12 months, you may request access to Personal Information collected back to January 1, 2022, by specifying a date range. Once we receive your request and confirm your identity, we will disclose to you:

• The categories of Personal Information we collected about you.

• The categories of sources for the Personal Information we collected about you.

• Our business or commercial purpose for collecting or selling that Personal Information.

• The categories of third parties with whom we share that Personal Information.

• If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing: (a) sales, identifying the Personal Information categories that each category of recipient purchased; and (b) disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.

• The specific pieces of Personal Information we collected about you (also called a data portability request).

Right to Delete

You have the right to request that we delete your Personal Information that we have collected from you, subject to certain exceptions. Once we receive and confirm your verifiable deletion request, we will delete (and direct our service providers to delete) your Personal Information from our records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you;

• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities;

• Debug products to identify and repair errors that impair existing intended functionality;

• Exercise free speech rights, ensure the right of another to exercise their free speech rights, or exercise another right provided for by law;

• Comply with the California Electronic Communications Privacy Act or similar state laws;

• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when deletion of the information may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent;

• Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;

• Comply with a legal obligation; or

• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Right to Correct

You have the right to request that we correct inaccuracies in your Personal Information. Once we receive and confirm your verifiable correction request, we will correct your Personal Information in our records (and direct our service providers to correct such information in their records), unless an exception applies. In determining the accuracy of the Personal Information that is the subject of a request to correct, we shall consider the totality of the circumstances relating to the contested Personal Information and may deny a request to correct if we determine that the contested Personal Information is more likely than not accurate, based on the totality of the circumstances.

Right to Opt-Out of Sale/Sharing

You have the right to opt out of the sale of your Personal Information or the sharing of your Personal Information for cross-context behavioral advertising (also called targeted advertising). We will honor opt-out preference signals, including Global Privacy Control (GPC), and will display confirmation when such requests have been processed.

Right to Limit Use of Sensitive Personal Information

California residents have the right to limit our use and disclosure of Sensitive Personal Information to purposes permitted under CCPA/CPRA.

Right to Data Portability

You have the right to obtain a copy of your Personal Information in a portable and, to the extent technically feasible, readily usable format.

Right to Opt Out of Automated Decision-Making / Profiling

Residents of certain states have the right to opt out of the processing of Personal Information for purposes of profiling in furtherance of decisions that produce legal or similarly significant effects. California residents have additional rights regarding Automated Decision-Making Technology (ADMT), which are described in Section 7 below.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights under Applicable State Privacy Laws. Unless permitted by law, we will not: deny you goods or services; charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties; provide you a different level or quality of goods or services; or suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

5. HOW TO EXERCISE YOUR RIGHTS

To exercise any of the above rights, you or your authorized agent may contact us using the contact details provided in Section 11 below. We will only respond to verifiable requests related to your Personal Information coming from you, or someone legally authorized to act on your behalf. You may also make a verifiable request on behalf of your minor child.

Your request must: (1) provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative of that person; and (2) communicate your request with sufficient detail to allow us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm that the relevant Personal Information relates to you. Making such a verifiable request does not require you to create an account with us. However, we do consider requests made through your password-protected account sufficiently verified when the request relates to Personal Information associated with that specific account.

Response Timing and Formats

We endeavor to respond to a verifiable request within forty-five (45) days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. If you have an account with us, we may deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide may cover the period back to January 1, 2022 for California residents, or the preceding 12 months for residents of other states, depending on applicable law. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is commonly used and should allow you to transmit the information from one entity to another entity without undue hindrance.

Appeals Process

If we deny your request, you have the right to appeal that decision. We will respond to your appeal within 45-60 days (depending on applicable state law). If your appeal is denied, you may contact the attorney general in your state to submit a complaint.

6. DISCLOSURE OF PERSONAL INFORMATION

As described in the Privacy Policy, we may disclose your Personal Information to third parties for business purposes. We only make these disclosures for business purposes under written agreements with such third parties that require the recipient to (i) keep the Personal Information confidential, and (ii) not use it for any purposes other than those necessary for the performance of the agreement.

Categories of Third Parties

In the preceding twelve (12) months, we have disclosed Personal Information for business purposes to the following categories of third parties:

• Processors or other service providers

• Data aggregators

• Affiliates

• Partners

• Cookie data recipients (See Cookie Policy)

In the preceding 12 months, we have disclosed the following categories of Personal Information to service providers and contractors: identifiers, personal information categories, protected classification characteristics, commercial information, internet or network activity information, geolocation data, professional or employment-related information, and inferences.

Specific Third-Party Partners

We may also disclose your Personal Information to third parties when you explicitly ask or authorize us to do so, in order to provide you with certain services. For example:

• If you choose to participate in the hearing test within the Nothing X app, we make certain Personal Information available to our third-party partner, Mimi Hearing Technologies GmbH, to provide you with personalized sound function.

• Xcotton, a third-party service provider, may collect and process your order and shipping information in accordance with its privacy policy.

Sale and Sharing of Personal Information

In the preceding 12 months, we have disclosed the following categories of Personal Information to third parties in ways that may be considered a “sale” or “sharing” under applicable state privacy laws: identifiers, commercial information, and internet or network activity information. You have the right to opt out of such sale or sharing at any time.

Third-Party Disclosure Lists (Oregon and Rhode Island)

Oregon and Rhode Island residents have the right to request a list of specific third parties to whom we have disclosed Personal Information. Upon request, we will provide either: (1) a list of specific third parties to whom your Personal Information was disclosed, or (2) a list of all third parties to whom we disclosed Personal Information of any consumer.

7. AUTOMATED DECISION-MAKING TECHNOLOGY (CALIFORNIA)

Effective January 1, 2027, California residents have specific rights regarding our use of Automated Decision-Making Technology (ADMT) to make significant decisions concerning consumers.