MAHA USA, LLC U.S. PRIVACY POLICY

This U.S. Privacy Policy (this “Privacy Policy”) was last updated on, and is effective as of, February 15, 2022.

UNLESS YOU ARE A RESIDENT OF THE EUROPEAN UNION OR OTHER DATA SUBJECT UNDER THE GDPR (AS DEFINED BELOW), WHEN YOU ACCESS THE PLATFORM OR USE OUR SERVICES YOU AGREE TO THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, OR TO ANY CHANGES WE MAY SUBSEQUENTLY MAKE, YOU SHOULD STOP ACCESSING THIS WEBSITE OR APPLICATION, AS APPLICABLE (COLLECTIVELY, THE “PLATFORM”) OR USING THE SERVICES (AS DEFINED BELOW).

1. Overview

a. Purpose. MAHA USA, LLC, (“MAHA,” “Company,” “we,” “us,” or “our”), operates the Platform, and provides the services and other offerings available through the Platform (collectively, the “Services”). For purposes of this Privacy Policy, “you” or “your” means our customers and other persons who are authorized to use and access the Platform or Services. Your privacy is important to us, which is why we have developed this Privacy Policy to explain our practices regarding the use and disclosure of personally identifiable information and other information that we obtain online from users of the Platform and Services.

b. Changes to Privacy Policy. We reserve the right to modify this Privacy Policy at any time, and any modifications made will be effective immediately upon posting, so you should check this page for any changes. We will post at the top of this Privacy Policy the date that modifications were last made, which will alert you to any changes since your last visit to the Platform. Your continued use of the Platform is your agreement to the revised Privacy Policy.

2. The personal information we collect. We collect and process the following personal information.

a. Information that you give us. This includes information you give us so we can provide you with access to the Platform or the Services. When using the Platform or the Services, you provide us with personal information about you and your business so we can provide you with the Services. The information collected may include, but is not limited to, your name, address, e-mail address, and phone number.

b. Information that we collect automatically. We automatically collect the following information from your use of the Platform:

i. technical information, including the Internet protocol (IP) address used to connect your computer to the Internet, your login information (if applicable), browser type and version, browser plug-in types and versions, operating system and platform; and

ii. information about your visit, including the full Uniform Resource Locators (URL) clickstream to, through, and from the Platform (including date and time); products and/or services that you viewed or searched for; page response times, length of visits to certain pages, and methods used to browse away from the page and any phone number used to call our customer service number.

c. Information that we receive from third parties. We work closely with certain third parties to help us provide our Services to you, receive information from them, and to otherwise conduct our business (including, for example, business partners, resellers, sub-contractors in technical services, advertising networks, analytics providers, and search information providers).

3. Why we collect personal information and what we do with it. When you provide your personal information to us we will make reasonable efforts to ensure that the purpose for which you are providing it is clear and honored. Depending on who you are and your relationship with us, we will process your personal information as follows:

a. to carry out our obligations to you from your use of our Platform, the Services, or under another agreement with you;

b. to administer your account with us;

c. to provide you with information about the Platform, the Services, and any other products and/or services we provide;

d. to administer the Platform and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

e. to allow you to participate in interactive features of the Platform or the Services, when you choose to do so;

f. internally, to inform decisions about our business operations and strategy; and

g. to contact you from time to time to market any other products and/or services we provide and we think may be of interest to you.

4. Who we share your personal information with. In the course of normal business, we may disclose your personal information to the following entities:

a. to business partners, suppliers and sub-contractors for the performance of any contract we or you enter into with them or to provide our products and/or fulfill our Services to you;

b. in the event that we sell or transfer any part of our business or assets (whether by merger, asset sale or otherwise), in which case we reserve the right to disclose and transfer your personal information to the prospective buyer of such business or assets;

c. in the event we are under a duty to disclose or share your personal information in order to comply with any legal or regulatory obligation or request; and

d. to third parties to enforce agreements between us and such party or to investigate suspected breaches of those agreements or to protect the rights, property or safety of our customers, or others. This includes exchanging information with other companies and organizations for the purposes of fraud protection.

5. Security Measures for the Platform. We implement a variety of technical, administrative and organizational security measures for the Platform, the Services, and our provision of our products, that we believe are commercially reasonable to help us maintain the safety of your personal information. You are responsible for keeping confidential your access credentials for the Platform, including password(s) and you should not share your password(s) with anyone.

Notwithstanding the above, you should be aware that the transmission of information via the Internet is not completely secure. Although we will use commercially reasonable measures to protect your personal information, we cannot guarantee the security of your information transmitted using the Services or the Platform, and as a result, any transmission of personal information is at your own risk.

6. Cookies. The Platform uses cookies to distinguish you from other users of the Platform. This helps us provide you with a good experience when you browse the Platform and enables you to use the Services. The use of cookies also allows us to improve the Platform and the Services.

A cookie is a small file that a site or its service provider transfers to the hard drive of your computer or other device through your Web browser and enables the site or the service provider’s systems to recognize your browser and capture information for use during your visit to our Platform and for future visits to our Platform.

The following are types of cookies that we use:

a. Strictly necessary cookies. These are cookies that are required for the operation of the Platform. They include, for example, cookies that enable you to log into secure areas of the Platform, use a shopping cart or session tracking.

b. Analytical/performance cookies. They allow us to recognize and count the number of visitors and to see how visitors move around the Platform when they are using it. This helps us to improve the way the Platform works, for example, by ensuring that users are finding what they are looking for easily.

c. Functionality cookies. These are used to recognize you when you return to the Platform. This enables us to personalize our content for you, greet you by name and remember your preferences.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you will not be able to access all or parts of the Platform and use the Services.

7. Children’s Privacy and Age Limitations for the Platform. The Platform is intended for use by persons aged 18 or older. We do not knowingly collect personally identifiable information from persons under the age of 18. If we discover or are made aware that we have received personally identifiable information from an individual who indicates that he or she is, or whom we otherwise have reason to believe is, under the age of 18, we will delete such information from our systems. If you are a parent or guardian of a child under the age of 18 and believe he or she has disclosed personally identifiable information to us, please contact us as provided below in Section 11.h. In any such event, a parent or guardian of a child under the age of 18 may review and request deletion of such child’s personally identifiable information as well as prohibit the use thereof.

8. Links to Other Websites. The Platform contains links to other websites, applications, products and services provided or maintained by our affiliates and/or by third parties that may not follow the same privacy policies as applicable to the Platform. These other websites, applications, products and services may use cookies, collect data and use the data in ways that are different from the way in which we use the information collected through the Platform. When linking to another website, you should read that website’s privacy policy. Our Privacy Policy only governs information collected on or through the Platform.

9. Assignment. We reserve the right to assign our rights and duties under this Privacy Policy, including, without limitation, our rights in information collected through the Platform, to any third party at any time without notice to you in connection with any sale, merger, acquisition, divestiture, or liquidation of all or part of our business or assets related to the Platform, all or substantially all of our business or assets, or as part of any reorganization or restructuring of our business.

10. General Information to Contact Us. Questions, comments and requests regarding our Privacy Policy are welcomed and should be addressed to us at MAHA USA LLC, P. O. Box 194, Pinckard, AL 36371, USA, or at info@maha-usa.com.

11. Additional Privacy Notices for California Residents. The following additional privacy notices for California residents (the “California Notice”) supplement the information contained in the other portions of the Company’s Privacy Policy and apply solely to individuals who reside in the State of California (“California consumer” or “you”). The Company adopts this California Notice to comply with the California Consumer Privacy Act and its related regulations (the “CCPA”) and other applicable California laws.

a. Overview of Consumer Rights Under the CCPA. Under the CCPA, California consumers have certain rights regarding their personal information (as defined below in subsection 11.b), including:

i. The right to know the categories of personal information that the Company has collected and the categories of sources from which we obtained such information.

ii. The right to know the Company’s business purposes for sharing personal information.

iii. The right to know the categories of third parties with whom the Company shared personal information.

iv. The right to know if we sold or disclosed your personal information for a business purpose, two separate lists disclosing:

1. sales, identifying the personal information categories that each category of recipient purchased; and

2. disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.

v. The right to access the specific pieces of personal information that the Company has collected and the right to delete your personal information.

vi. The right to not be discriminated against if a California consumer exercise their rights under the CCPA.

The provisions below of this California Notice provide further details about these rights and how you may exercise them.

b. Information We Collect. We collect information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular California consumer, household or device (collectively, “personal information”).

We have collected the following categories of personal information from California consumers within the last twelve (12) months:

c. Sources of Personal Information. In addition to sources of personal information addressed elsewhere in this Privacy Policy, we obtain the categories of personal information listed above from the following categories of sources:

i. Directly From You. For example, from forms you complete in order to receive the Services you purchase, or from communications with you such as when you contact the Company (whether in person, by mail, by phone, online, via electronic communication or by other means) including our customer support service.

ii. Indirectly From You. For example, from observing your actions on our Platform or from the Services that you have purchased from the Company, if you have enabled such functionality, such as telemetry services.

iii. From Others.

1. FROM THIRD PARTY SERVICE PROVIDERS. For example, if you choose to make an electronic payment directly to the Company, or through a linked website or app, or through an affiliate of ours, the Company may receive personal information about you from third parties such as payment services providers, for the purposes of that payment.

2. FROM AFFILIATES. We may collect personal information about you from our affiliates or others acting on their behalf.

3. FROM PUBLIC SOURCES. For example, we may collect information from public records.

d. Uses of Personal Information. In addition to uses of personal information addressed elsewhere in this Privacy Policy, we may use or disclose the personal information we collect for one or more of the following business purposes:

i. To fulfill the reason that you provided the information. For example, if you share your name and contact information to request a price quote, request to be contacted, or ask a question about the Services and/or our products, we will use that personal information to respond to your inquiry. If you provide your personal information to purchase any of the Services and/or our products, we may use that information to process your payment and facilitate delivery. We may also save your information to facilitate new service orders or to process refunds.

ii. To perform services such as customer service, order fulfillment, payment processing, financing and advertising, marketing or analytic services.

iii. To advance our commercial or economic interests, such as by helping you to buy, rent, lease, join, subscribe to, provide, or exchange products, information, or services, or enabling or effecting, directly or indirectly, a commercial transaction.

iv. To verify or maintain quality standards or improve or upgrade a service and/or product provided or controlled by or for us.

v. To create, maintain, customize and secure your account with us.

vi. To process your requests, purchases, transactions and payments and prevent transactional fraud.

vii. To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.

viii. To personalize your Platform experience and to deliver content, service, and product offerings relevant to your interests, including targeted offers and ads through our Platform, third-party sites and via mail, email or text message (with your consent, where required by law).

ix. To help maintain the safety, security and integrity of our Platform, the Services, our products, databases and other assets and business.

x. For testing, research and analysis purposes, including to develop and improve our Platform, the Services, and our products.

xi. To respond to law enforcement requests and as required by applicable law, court order or governmental regulations.

xii. As described to you when collecting your personal information or as otherwise set forth in the CCPA or applicable law.

xiii. To send you information relevant to your past purchases and interests, subject to compliance with applicable laws regarding direct marketing.

xiv. To otherwise use as reasonably necessary and proportionate to achieve our operational or notified purpose for collecting personal information and as compatible with the context in which we collected the information.

xv. To perform services on behalf of a CCPA-covered business or its service provider, such as customer service, order fulfillment, payment processing, financing and advertising, marketing, or analytic services.

xvi. To review and audit our business interactions with you.

xvii. To detect or prevent security incidents or other illegal activity.

xviii. To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which personal information held by us about our Platform users, including California consumers, is among the assets transferred.

We will not collect additional categories of personal information or use the personal information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

e. Disclosing Personal Information. We may disclose your personal information to a third party for a business purpose. When we disclose personal information for a business purpose, we enter a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except performing the contract. In the preceding twelve (12) months, the Company has disclosed the following categories of personal information for a business purpose and to the following categories of third parties:

f. Sales of Personal Information. The Company does not sell personal information to third parties.

g. Exercising Your CCPA Rights and Choices. The sections below describe how you may exercise your rights under the CCPA.

i. Access to Specific Information and Data Portability Rights. You have the right to request that we disclose certain information to you about our collection and use of your personal information over the past twelve (12) months. Once we receive and confirm your verifiable consumer request (see “Exercising Access, Data Portability and Deletion Rights” below), we will disclose to you:

1. The categories of personal information we collected about you.

2. The categories of sources for the personal information we collected about you.

3. Our business or commercial purpose for collecting that personal information.

4. The categories of third parties with whom we share that personal information.

5. The specific pieces of personal information we collected about you (also called a data portability request).

6. If we disclosed your personal information for a business purpose, a list disclosing the personal information categories that each category of recipient obtained.

As allowed by the CCPA, we do not provide these access and data portability rights (i) for business-to-business personal information or (ii) as to personal information collected from the Company’s California-based employees, job applicants or contractors when provided or collected in such employee, job applicant or contractor capacities.

ii. Deletion Request Rights. You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see “Exercising Access, Data Portability and Deletion Rights” below), we will delete (and direct our service providers to delete) your personal information from our (and service provider) records, unless an exception applies. We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

1. Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, or otherwise perform our contract with you.

2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.

3. Debug products or services to identify and repair errors that impair existing intended functionality.

4. Exercise free speech, ensure the right of another California consumer to exercise their free speech rights, or exercise another right provided for by law.

5. Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.).

6. Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent.

7. Enable solely internal uses that are reasonably aligned with California consumer expectations based on your relationship with us, such as future field campaigns or product safety issues.

8. Comply with a legal obligation.

9. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

As allowed by the CCPA, we do not provide these deletion rights (i) for business-to-business personal information or (ii) as to personal information collected from the Company’s California-based employees, job applicants or contractors when provided or collected in such employee, job applicant or contractor capacities.

h. Submitting a Verifiable Consumer Request for Access, Data Portability, and Deletion Rights. To exercise the access, data portability and deletion rights described above, you should submit a verifiable consumer request to us by one of the following methods:

i. Calling us at toll free at: 1-866-624-2872

ii. Emailing us at: info@maha-usa.com

iii. Visiting the following page on our Platform: https://www.maha-usa.com

iv. By postal mail at: us at MAHA USA LLC, P. O. Box 194, Pinckard, AL 36371, USA].

v. Accessing an online account that you maintain with us.

i. Making a Verifiable Consumer Request. Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of a minor child for whom you are a parent or legal guardian. You may only make a verifiable consumer request for access or data portability twice within a twelve (12) month period. The verifiable consumer request must provide sufficient information that allows us to reasonably verify that you are the person about whom we collected personal information or an authorized representative, which may include: your name, your address, additional information depending upon the type of request and the sensitivity of the information involved with such request. The request should also have sufficient detail to enable us to properly understand, evaluate and respond to such request. We cannot respond to your request or provide you with personal information if we cannot verify your identity or your authority to make the request and confirm that the personal information involved with the request relates to you. Making a verifiable consumer request does not require you to create an account with us. However, we will consider requests made through a password-protected online account that you maintain with us to be sufficiently verified when the request relates to personal information associated with that online account, provided such online account functionality is then made available by us on the Platform. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

j. Response Timing and Format to Verifiable Consumer Request. We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing. If you have an online account with us, we may deliver our written response to that online account, provided that such online account functionality is then made available by us on the Platform. If you do not have an online account with us, or such functionality is not available for your online account we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the twelve (12) month period immediately preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

k. Non-Discrimination. We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA or other applicable law, we will not as a result of you exercising any of your rights under the CCPA:

i. Deny you goods or services;

ii. Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

iii. Provide you a different level or quality of goods or services; or

iv. Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA that can result in different prices, rates, or quality levels. Any CCPA-permitted financial incentive we offer will reasonably relate to your personal information’s value and contain written terms that describe the program’s material aspects. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

l. Other California Privacy-Related Disclosures.

i. California Do-Not-Track Disclosure. At this time, the Platform is not set up to honor web browser do-not-track settings.

ii. Sharing Personal Information for Direct Marketing Purposes. Before sharing personal information of California consumers with third parties for direct marketing purposes we will obtain opt-in consent from the applicable California consumers or provide such California consumers with a cost-free method to opt out.

iii. Information on Marketing Disclosures. California Civil Code Section 1798.83 permits our users who are California residents to request and obtain from us once a year, free of charge, information about the personal information (if any) we disclosed to third parties for direct marketing purposes in the preceding calendar year. If applicable, this information would include a list of the categories of personal information that was shared and the names and addresses of all third parties with which we shared information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing to us at us at MAHA USA LLC, P. O. Box 194, Pinckard, AL 36371, USA.

iv. Content Removal Requests for Users Under 18 Years Old. If you are a user under 18 years of age and reside in California, you may request and obtain removal of, content or information that you have posted on the Platform. You may send us any such requests by one of the following methods: (A) by email (writing “Privacy Policy – Removal Request” in the subject line) at info@maha-usa.com; or (B) by writing to us at MAHA USA LLC, P. O. Box 194, Pinckard, AL 36371, USA. We will review the request and respond promptly. You should be aware that a request to remove content or information posted by you on the Platform does not ensure or require complete or comprehensive removal of such content or information from our databases.

m. Complaints. If you have any complaint about use of the Platform, you may contact us by email at info@maha-usa.com, or by postal mail at MAHA USA LLC, P. O. Box 194, Pinckard, AL 36371, USA. In accordance with California Civil Code Section 1789.3, California residents may also file complaints with the Complaint Assistance Unit, Division of Consumer Services, California Department of Consumer Affairs by postal mail at 1625 North Market Road, Suite N112, Sacramento, CA 95834 or by telephone at 800-952-5210.

n. Changes to Our California Notice. We reserve the right to amend this California Notice at our discretion and at any time. When we make changes to this California Notice, we will post the updated California Notice on the Platform and update the California Notice’s effective date. Your continued use of our Platform following the posting of changes constitutes your acceptance of such changes.

12. Additional Notices to European Union Citizens. Persons who are residents of the member countries of the European Union (“EU”) or other data subjects covered by the EU’s General Data Protection Regulation, (EU) 2016/679 (the “GDPR”), have certain additional privacy rights under applicable law. Please see our European Privacy Policy at the following link: https://www.maha-usa.com/en/data-protection.