PRIVACY POLICY

Last updated: May 2024

Hotels at Home Worldwide, Inc. (“Hotels at Home”, “we”, “us” or “our”) operates the peabodyathome.com Website (the “Website”). This page provides our Privacy Policy because we know that you, like us, care about how your information is collected, used, shared, retained and secured. This Privacy Policy applies to information collected when you visit our Website or access or use services (“Services”) that we make available from time to time through our Website (collectively, the Website and Services hereinafter our “Platform”).

By using our Services, you agree to the terms of this Privacy Policy and our Terms of Use and consent to the collection, use and disclosure practices, and other activities as described in this Privacy Policy. If you do not agree and consent, discontinue use of the Platform.

PERSONAL INFORMATION WE COLLECT

We may collect or process the following types of personal information about you when you use our Services, including without limitation, when you register an account, update your profile, participate in a promotion, make a purchase or contact customer support. The specific information we collect about you will vary depending on how you interact with us.

• Contact and Identification Information. We may collect information such as your name, phone number, address, state, province, zip/postal code, country and city.
• Payment Information. When you make a purchase on our Website, we may collect payment information such as credit card information for payment processing through our payment processor.
• Online and Network Activity Information. When you interact with us online, we may collect the Internet Protocol (“IP”) address automatically assigned to your computer or device. We also use cookies and related technologies to collect information related to how you interact with our Website, and online content. Depending on your settings, we may collect the date and time of your visit, the pages you access and the amount of time you spend on each page, the type of Internet browser you use, your device’s model, manufacturer and operating system, your search terms on our Website, the URL of any Websites that you visited before and after visiting our Websites (including the advertisement that referred you to our Website), and whether you click or interact with our digital content and advertising on our Websites and other sites. We may also use technologies to record user sessions on our Websites. When you access the Website, we collect your device, your device’s unique identifier, your mobile network information, and the type of browser you use. We may also embed technologies (which may include, for example, web beacons, tags, and pixels) in the emails and other communications we or our vendors send to you to help us understand how you interact with those messages, such as whether and when you opened a message or clicked on any content within the message.
• Location Information. We may collect information about your precise geolocation (GPS) when you access the Website to the extent permitted by applicable law. We may also collect information about your general location using your IP address and your postal code.

HOW WE COLLECT PERSONAL INFORMATION

We collect the above-referenced categories of Personal Information from the following categories of sources:

• Directly from you. Much of the Personal Information we process is information that you directly provide to us. For example, you may provide us with Contact and Identification Information, when you create an account, make a purchase, participate in promotional or contact us.
• When you interact with our Website or emails. When you visit our Websites, or when you open or click on emails we send you, we (and third parties we work with) may automatically collect information from your browser or device, such as device identifiers and online and other network activity information using technologies such as cookies, pixel tags, and similar technologies. Cookies are small text files that Websites place on your Internet-connected device to uniquely identify your browser or to store information or settings in your browser. Pixel tags are small images which are embedded into our Websites or emails. We use pixel tags to collect information about your browser or device, how you interact with our Websites, or whether you open or click on the emails we send you. Pixel tags also enable us (and third parties we work with) to place cookies on your browser.
• From other businesses or individuals. We may work with business and marketing partners that give us Personal Information about you that they have collected either directly or indirectly from you.

USE OF PERSONAL INFORMATION

We may use the collected personal information for various purposes which includes the examples below without limitation:

• To provide and maintain our Services.
• To fulfill any other purpose for which you provide it.
• To notify you about changes to our Services.
• To allow you to participate in interactive features of our Services when you choose to do so.
• To provide customer support.
• For marketing purposes for example, to contact you with newsletters, marketing or promotional materials and news, special offers and general information about other goods, services and events which we offer in accordance with your contact preferences. You may opt out of receiving any, or all, of these marketing communications from us by following the unsubscribe link or instructions provided in any marketing communication we send.
• For analytics purposes. For example, we may collect data through Google Analytics which use cookies and technologies to collect and analyze data about use of the Online Services. These services also collect data regarding the use of other Websites, apps, and online resources. You can learn about Google’s practices by going to www.google.com/policies/privacy/partners/ and opt out by downloading the Google Analytics opt out browser add-on, available at https://tools.google.com/dlpage/gaoptout. Google Analytics may collect certain information through the use of Google Signals, which includes features such as cross-device tracking and advertising personalization for users who have opted-in to such features. The data collected through Google Signals is aggregated and depersonalized before being used for analytical purposes. This means that individual user identities are removed, and the information is presented in a way that protects user privacy. The aggregated data may be shared with other Google services, and Google may use this information to contextualize and personalize the ads of its own advertising network.
• To monitor the usage of our Services.
• To detect, prevent and address fraud, security and/or technical issues.
• To meet legal and regulatory requirements or compliance obligations.
• In any other way we may describe when you provide the information.
• For any other purpose with your consent.

AGGREGATE OR DE-IDENTIFIED DATA

To better understand users of our Services, we might use information, including information that has been aggregated or de-identified to operate, maintain, manage, and improve our Platform. This aggregated or de-identified information does not identify you personally. We may use and share this aggregated or de-identified data for any purpose except as prohibited by applicable law.

HOW WE DISCLOSE YOUR PERSONAL INFORMATION

We may disclose personal information, that we collect in accordance with the practices described in this Privacy Policy. The types of entities to whom we may have disclosed personal information with in the last 12 months, include the following:

• Business Partners and Other Third Parties. We may share information with our business partners and other third parties in connection with offering co-branded services, selling or distributing our products, or engaging in joint marketing activities.
• Service Providers. We may transfer personal information to service providers who perform services on our behalf based on our instructions. We do not authorize these service providers to use or disclose the information except as necessary to perform services on our behalf or comply with legal requirements. Examples of these service providers include entities that process credit card payments and fulfill orders.
• Parties to a corporate transaction. We also reserve the right to transfer personal information we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a merger, acquisition, joint venture, reorganization, divestiture, dissolution, or liquidation).
• Advertising Companies. We work with third party advertising companies (such as advertising networks) to serve advertisements on our behalf.
• Other third parties. In addition, we may disclose personal information about you (i) if we are required to do so by law or legal process, (ii) to law enforcement authorities or other government officials, (iii) when we believe disclosure is necessary or appropriate to prevent physical harm or financial loss, or in connection with an investigation of suspected or actual fraudulent or illegal activity, (iv) when disclosure of your personal information is otherwise required or permitted by law, or (v) with your consent.

HOW WE USE COOKIES

Cookies are small text files that Websites place on your Internet-connected device to uniquely identify your browser or to store information or settings in your browser which allows us to remember you when you come back to our Website and provide you with personalized experiences and advertisements. We use different types of cookies on our Website, which may include strictly necessary cookies, performance cookies, functional cookies and targeting cookies.

YOUR CHOICES

You have rights and choices in connection with the personal information we have about you.

• Data Subject Rights. Depending on local laws, you may have rights with respect to your personal information. For example, you may be able to request access to the personal information we maintain about you, update and correct inaccuracies in your personal information, and have the personal information deleted or transmitted to a third-party. You may request to access, correct, or delete your personal information or restrict the sale and sharing of your personal information by contacting us using the form available at peabodyathome.com/contact-us.aspx. We may take reasonable steps to verify your identity when you make a request. You may also have the right to lodge a complaint with a data protection authority.
• Marketing & Advertising Preferences. You can opt-out of receiving marketing communications (such as email) by following the unsubscribe instructions sent within those communications.

RETENTION OF DATA

We will retain your Personal Data only for as long as is necessary for the purposes set out in this Privacy Policy. We will retain and use your Personal Data to the extent necessary to comply with our legal obligations (for example, if we are required to retain your data to comply with applicable laws), resolve disputes, and enforce our legal agreements and policies.

TRANSFER OF DATA

Your personal information, may be transferred to and processed outside of your state, province, country or other governmental jurisdiction where the data protection laws may differ than those from your jurisdiction.

If you are located outside United States and choose to provide information to us, please note that we may transfer the personal information, to United States and other jurisdictions. Data protection laws in the US and other jurisdictions may be different from those of your country of residence. Your use of the Platform, decision to provide data to us, or to allow us to collect data through our Platform, constitutes your acknowledgement that we are processing your data in the United States and other jurisdictions, and your consent to the transfer to and from, processing, usage, sharing, and storage of information about you in the US and other jurisdictions as set out in this Privacy Policy even though the standards of data protection and privacy available in the United States and other jurisdictions may not be the same or as high as the standards in your home country. Your consent to this Privacy Policy followed by your submission of such information represents your agreement to that transfer.

SECURITY OF DATA

The security of your data is important to us, but remember that no method of transmission over the Internet, or method of electronic storage is 100% secure. Hotels at Home will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Privacy Policy However, while we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

LINKS TO OTHER SITES

Our Platform may contain links to other sites that are not operated by us. If you click on a third-party link, you will be directed to that third party's site. We strongly advise you to review the Privacy Policy of every site you visit.

We have no control over and assume no responsibility for the content, privacy policies or practices of any third-party sites or services.

CHILDREN'S PRIVACY

Our Platform is not intended for children under 18 years of age. No one under age 18 may provide any information to the Platform. We do not knowingly collect personal information from children under 18. If you are under 18, do not use or provide any information on this Platform or through any of its features, register on the Platform, make any purchases through the Platform, use any of the interactive or public comment features of this Platform, or provide any information about yourself to us, including your name, address, telephone number, email address, or any screen name or username you may use. If we learn we have collected or received personal information from a child under 18 without verification of parental consent, we will delete that information. If you believe we might have any information from or about a child under 18, please contact us using the form available at peabodyathome.com/contact-us.aspx.

CHANGES TO THIS PRIVACY POLICY

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.

U.S. STATE SPECIFIC RIGHTS

You may have additional privacy rights under the law of the U.S. state in which you live. This section describes those rights for residents of California Virginia, Colorado, Connecticut, and Nevada. Our Website is not designed to respond to “do not track” signals from browsers. We recognize the Global Privacy Control as some states require businesses to accept Global Privacy Control signals for “sale” and “share” opt outs. For more information about the Global Privacy Control, visit https://globalprivacycontrol.org/.

VIRGINIA, COLORADO, AND CONNECTICUT

This section applies to residents of Virginia, Colorado and Connecticut. You have the right to access, delete, and correct certain personal information we collect about you. When you request access to personal information, you have the right to receive that information in a portable and readily usable format. You also have the right to restrict the use of that personal information for targeted advertising and restrict the sale of that personal information. Before processing your request, we will take reasonable steps to verify your identity, which may include verifying that the email address from which you submit the request matches the email address we maintain on file for you. In some cases, we may ask that you provide additional information to verify your identity. You also have a right not to receive discriminatory treatment for the exercise of your privacy rights. You or your authorized agent may submit a request to exercise your access, deletion, and correction rights by submitting a Data Rights Request or calling us toll-free at 1-877-399-9998. If we deny your request, you have the right to appeal our decision. To opt out of targeted advertising and the sale or sharing of personal information, please contact us using the form available at peabodyathome.com/contact-us.aspx.

NEVADA RESIDENTS

Nevada law (NRS 603A.340) requires each business to establish a designated request address where Nevada consumers may submit requests directing the business not to sell certain kinds of personal information that the business has collected or will collect about the consumer. A sale under Nevada law is the exchange of personal information for monetary consideration by the business to a third party for the third party to license or sell the personal information to other third parties. If you are a Nevada consumer and wish to submit a request relating to our compliance with Nevada law, please contact us using the form available at peabodyathome.com/contact-us.aspx.

CALIFORNIA RESIDENTS

This section applies only to California residents. The California Consumer Privacy Act of 2018 (“CCPA”) provides additional rights to know, delete and opt out, and requires businesses collecting or disclosing personal information to provide notices and means to exercise rights.

Notice of Collection. As described in this Policy, and as set forth below, we collect the following categories of personal information, as enumerated in the CCPA:

1. Identifiers, including name, email address, phone number account name, IP address, and an ID or number assigned to your account.
2. Customer records and billing and shipping addresses.
3. Demographics, such as your age or gender. This category includes data that may qualify as protected classifications under other California or federal laws.
4. Commercial information, including purchases and engagement with the Services.
5. Internet activity, including your interactions with our Services.
6. Geolocation data, including location enabled services such as WiFi and GPS.
7. Inferences, including information about your interests, preferences and favorites.

Please review the Information Collection and Use section above for more information on, in the preceding 12 months, (1) how we have used and may use your personal information; (2) who we shared your personal information with; and (3) what sources we obtained your personal information from. We collect and use these categories of personal information for the business purposes described in the Purpose of Collection and Use section, including to provide and manage our Services. Some of our sharing may be a “sale” under the CCPA, of which you have a right to opt out, as explained below. Specifically, such “sale” may include advertising technology activities such as those disclosed in the Analytics and Advertising section. We disclose the following categories of personal information for commercial purposes: identifiers, demographic information, commercial information, internet activity, geolocation data and inferences. We use and partner with different types of entities to assist with our daily operations and manage our Service. Please review the Sharing Your Information section for more detail about the parties we have shared information with.

Your California Rights

If you are a California resident, you have the right to request:

• Access to the personal information we have collected, used, disclosed, and sold or shared about you twice in a 12 month period.
• Deletion of the personal information we have collected from you (subject to certain exceptions).
• Correction of the personal information we maintain about you, if that information is inaccurate.
• Limitation of our use and disclosure of sensitive personal information used for inferring characteristics about you.
• Opt-out of the sale of your personal information or sharing of your personal information for cross-context behavioral advertising purposes.

You can exercise your rights by submitting a request through our contact form available at peabodyathome.com/contact-us.aspx. Before processing your request, we will take reasonable steps to verify your identity, which may include verifying that the email address from which you submit the request matches the email address we maintain on file for you. In some cases, we may ask that you provide additional information to verify your identity. You may also designate an authorized agent to make a request on your behalf. The authorized agent may submit the request through the contact form available at peabodyathome.com/contact-us.aspx and will be required to provide proof that they have been authorized to act on your behalf. If the authorized agent does not provide such proof, you will be required to confirm your identity and the authenticity of the request.

We do not collect or process Sensitive Personal Information (as defined by California law) for the purpose of inferring characteristics about individuals.

We will not discriminate against you on account of your exercise of your California privacy rights. If you would like us to read this Privacy Policy to you, please contact us toll-free at 1-877-399-9998.

California Shine the Light

Pursuant to Section 1798.83 of the California Civil Code, residents of California have the right to obtain certain information about the types of personal information that companies with whom they have an established business relationship (and that are not otherwise exempt) have shared with third parties for their direct marketing purposes during the preceding calendar year. If you wish to submit a request pursuant to Section 1798.83 of the California Civil Code, please contact us via email at peabodyathome.com/contact-us.aspx and specify that you are making a “California Shine the Light Request.” We may require additional information from you to allow us to verify your identity and are only required to respond to requests once during any calendar year.

ADDITIONAL DISCLOSURES FOR DATA SUBJECTS IN EUROPE (GDPR)

If you are from the European Economic Area (EEA), Hotels at Home’s legal basis for collecting and using the personal information described in this Privacy Policy depends on the Personal Data we collect and the specific context in which we collect it.

Hotels at Home may process your Personal Data because:

• We need to perform a contract with you.
• You have given us permission to do so.
• The processing is in our legitimate interests and it's not overridden by your rights.
• For payment processing purposes.
• To comply with the law.

If you are a resident of the European Economic Area (EEA), you have certain data protection rights. Hotels at Home aims to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

If you wish to be informed what Personal Data we hold about you and if you want it to be removed from our systems, please contact us at peabodyathome.com/contact-us.aspx.

In certain circumstances, you have the following data protection rights:

• The right to access, update or to delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Data by contacting us at peabodyathome.com/contact-us.aspx.
• The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your Personal Data.
• The right of restriction. You have the right to request that we restrict the processing of your personal information.
• The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where Hotels at Home relied on your consent to process your personal information.

Please note that we may ask you to verify your identity before responding to such requests.

You have the right to complain to a Data Protection Authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority in the European Economic Area (EEA).

BRAZIL PRIVACY RIGHTS

If you reside in Brazil or otherwise subject to the Federal Law nº 13.709/18 (“LGPD”), you are entitled with several rights in respect of your Personal Information under LGPD. You may exercise the following rights when applicable:

• Right to Withdraw Consent. You have the right, when the basis for processing is consent, to withdraw the consent at any time, through an easy to use and free of charge procedure.
• Right to Revision of Automated Decision Making. Under this right, you may request the revision of decisions taken solely on the basis of automated processing of your personal data which affects your interests, including decisions intended to define personal, professional, consumer or credit profile or aspects of your personality, providing clear and adequate information regarding the criteria and procedures used for an automated decision, subject to our commercial and industrial secrecy.
• Right to Petition. You may petition with the Brazilian regulatory authority as well as consumer protection entities regarding the processing of your personal data.

Brazilian residents can exercise these rights in accordance with this Section as well by emailing us at peabodyathome.com/contact-us.aspx or calling us toll-free at 1-877-399-9998.

Lawfulness of Processing: We may process your Personal Information on for the following legal bases:

• We need to perform a contract with you.
• You have given us permission to do so.
• The processing is in our legitimate interests and it's not overridden by your rights.
• For payment processing purposes.
• To comply with the law.

Transfers of your data to countries outside Brazil: If your Personal Information is subject to the LGPD, we will take all necessary measures to ensure that transfers out of Brazil are adequately protected as required by applicable data protection law and in accordance with this Privacy Policy.

CONTACT US

If you have any questions about this Privacy Policy, please contact us:

• By email at customerservice@peabodyathome.com
• By phone number: 1-877-399-9998