The California Consumer Privacy Act of 2018 (the "CCPA") is a California law that gives California residents ("consumers"), the right to learn about and control certain aspects of how a business handles the personal information that a business collects about them. For purposes of this addendum, Jelly Belly Candy Company is referred to as "we" or "our". Pursuant to the CCPA, effective January 1, 2020, consumers have certain rights, including:

• The right to know the categories of personal information we’ve collected and the categories of sources from which we got the information;
• The right to know the business purposes for sharing personal information;
• The right to know the categories of third parties with whom we’ve shared personal information; and
• The right to access the specific pieces of personal information we’ve collected; and
• The right to delete your information.
• California residents also have the right to not be discriminated against if they choose to exercise their privacy rights.

CATEGORIES OF PERSONAL INFORMATION UNDER THE CCPA

Identifiers
We may collect your:

• Name
• Billing address
• Shipping address
• Email address
• Personal/online identifier
• Password
• IP address

Personal information described in California Civil Code section 1798.80
We may collect your:

• Phone number

Protected classifications under California or federal law
We may collect your:

• Age

Commercial information
We do not collect this information.

Biometric information
We do not collect this information.

Internet or other electronic network activity information
(browsing history, search history, and information regarding a consumer’s interaction with an internet website, application, or advertisement)
We may collect:

• Browser type
• Cookies
• Device type
• Domain names
• Access time/logs

Geolocation data
We may collect this information.
We collect this information to ensure that website traffic is redirected appropriately.

Audio, electronic, visual, thermal, olfactory, or similar information
We do not collect this information.

Professional or employment-related information
We do not collect this information.

Education information (information that is not publicly available)
We do not collect this information.

Inferences drawn from any of the above to create a profile about a consumer
We may collect this information.
We may collect this information to tailor on-site and off-site content to consumer interests.

* We disclose personal information for business purposes only.

YOUR RIGHTS UNDER THE CCPA:

Right to Opt-Out of Sale of Your Personal Information

Consumers have the right to request that a business that sells the consumer’s personal information, or that discloses it for a business purpose, inform the consumer of what has been collected about them and who it has been sold or disclosed to. Consumers also have the right, at any time, to direct a business that sells personal information about them not to sell their personal information.

• Jelly Belly Candy Company does not sell or share your personal information for monetary or other valuable consideration.

Right to Access / Data Portability

Consumers have the right to request that a business that collects personal information about them disclose the following: (1) The categories of personal information it has collected about that consumer; (2) The categories of sources from which the personal information is collected; (3) The business or commercial purpose for collecting or selling personal information; (4) The categories of third parties with whom the business shares personal information; (5) The specific pieces of personal information it has collected about that consumer.

• To exercise your right to access, you can submit a Verifiable Consumer Request.

Right to Deletion

Consumers have the right to request that a business delete any personal information about them. However, there are exceptions to this rule. For example, a business does not have to delete information if it is necessary to: a) complete a transaction; b) prevent illegal activity; c) exercise free speech; d) comply with a legal obligation; e) identify or repair errors that impair functionality; or f) otherwise use a consumer’s personal information, internally, that is compatible with the context in which the consumer provided that information.

• To exercise your right to deletion, you can submit a Verifiable Consumer Request.

Right to Non-Discrimination

A business cannot discriminate against a consumer because the consumer exercised any of the consumer’s rights listed above.

CONSUMER REQUEST PROCESS

1. You may submit a Verifiable Consumer Request by calling us toll free at (800) 522-3267 or by sending an email to privacy@jellybelly.com.
2. We will contact you within 10 days to confirm that we have received your request.
3. We will then take steps to determine whether your request is a valid Verifiable Consumer Request. If you have an account, we may ask you to login to confirm this information. We will not ask you to create an account if you do not already have one. We will only ask for information that is reasonable in light of the nature of your request. In most cases, we will require at least two (2) pieces of identifying information to proceed with your request.
4. When you submit a request for access:
   1. Within 45 days, we will provide you with a copy of the information listed in "Right to Access / Data Portability," above, by mail or electronically. To the extent possible, this information shall be provided in a portable and useable format.
   2. In the event we need additional time, we will inform you within the initial 45-day period of our need for an additional 45 days (for a maximum of 90 days between request and provision of information).
   3. We are not required to provide personal information to a consumer more than twice in a 12 month period.
5. When you submit a request for deletion
   1. We have created a two-step process for responding to requests for deletion. After you submit the initial request, we will ask that you separately confirm that you would like your information deleted.
   2. If your request does not fall within one of the exceptions to deletion listed in "Right to Deletion" above, we will confirm deletion within 45 days. If we are not required to delete your account, we also let you know within 45 days.

QUESTIONS

If you have any questions about this California Privacy Rights, or any Jelly Belly privacy practices, please contact us at privacy@jellybelly.com. You can also call us at (800) 522-3267, or write to us at: 1 Jelly Belly Lane, Fairfield, CA 94533.