PASSPORT CLUB LLC

PRIVACY POLICY

Last Updated: June 5, 2026

This Privacy Policy describes how Passport Club LLC ("Passport Club," "we," "us," or "our") collects, uses, shares, and protects your personal information when you use our websites (passportclub.co, goembarc.com, embarcsupply.com, and related Embarc properties), participate in promotions or sweepstakes, or otherwise interact with our services (collectively, the "Services").

If you are a California resident, please pay particular attention to Section 8 (Your California Privacy Rights), which describes your rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA/CPRA").

1. Information We Collect

A. Information You Provide Directly

We collect information you provide when you:

•       Create a Passport Club account (name, email address, phone number, date of birth for age verification)

•       Make a purchase at an Embarc retail location or online

•       Enter a sweepstakes or promotion (name, email address, phone number, mailing address, and any other information required by the applicable Official Rules)

•       Contact us for customer support

•       Sign up to receive marketing communications

B. Information Collected Automatically

When you visit our websites, we and our service providers automatically collect:

•       Device and browser information (IP address, browser type and version, operating system, device identifiers)

•       Usage data (pages visited, time and date of visits, links clicked, referring URLs, time spent on pages)

•       Location data (general location inferred from IP address)

•       Cookie and tracking technology data (see Section 4 below)

C. Information from Third Parties

We may receive information about you from third-party sources, including social media platforms if you connect your account, analytics providers, and advertising partners. We handle such information in accordance with this Privacy Policy.

2. How We Use Your Information

We use the personal information we collect for the following purposes:

•       Account creation and management: to create and maintain your Passport Club loyalty account and track your points and rewards.

•       Sweepstakes and promotions: to administer sweepstakes entries, select and notify winners, verify eligibility, and fulfill prizes. Information collected in connection with a sweepstakes promotion is used solely for promotion administration and prize fulfillment unless you separately consent to other uses.

•       Purchases and transactions: to process purchases, redemptions, and loyalty point transactions at Embarc retail locations.

•       Communications: to send you transactional messages (receipts, account notices, prize notifications), service updates, and, where you have opted in, promotional communications about Passport Club and Embarc products and offers.

•       Compliance and legal obligations: to comply with applicable laws and regulations, including age verification requirements under California cannabis law, and to respond to legal process.

•       Security and fraud prevention: to detect, investigate, and prevent fraudulent entries, unauthorized account access, and other harmful activity.

•       Service improvement: to analyze usage trends, troubleshoot technical issues, and improve our websites and services.

3. How We Share Your Information

We do not sell your personal information. We may share your information in the following circumstances:

A. Service Providers

We share information with vendors and service providers who perform functions on our behalf, such as website hosting, data analytics, email delivery, and sweepstakes administration. These parties are contractually required to use your information only as directed by us and in accordance with this Privacy Policy.

B. Affiliated Entities

We may share information among Passport Club LLC and its affiliated entities, including Embarc retail locations, subject to this Privacy Policy.

C. Business Transfers

If Passport Club is involved in a merger, acquisition, financing, or sale of all or a portion of our business, your information may be transferred as part of that transaction. We will provide notice before your personal information becomes subject to a materially different privacy policy.

D. Legal Requirements

We may disclose your information when required by law, court order, or government authority, or when we believe in good faith that disclosure is necessary to protect our rights, protect your safety or the safety of others, or investigate fraud.

E. With Your Consent

We may share your information for other purposes with your prior consent.

We do not share your personal information with third parties for their own independent marketing or advertising purposes without your consent.

4. Cookies and Tracking Technologies

We use cookies, web beacons, and similar tracking technologies to operate and improve our Services. The types of cookies we use include:

•       Strictly necessary cookies: Required for basic website functionality and security. These cannot be disabled.

•       Functional cookies: Remember your preferences and login details to personalize your experience.

•       Analytics cookies: Help us understand how visitors use our site so we can improve it. We use tools such as Google Analytics for this purpose.

•       Advertising/targeting cookies: Used to deliver relevant advertising. We will only use these with your consent where required by law.

You can control cookies through your browser settings. Note that disabling certain cookies may affect the functionality of our Services. We honor browser-based "Do Not Track" signals to the extent required by applicable law.

5. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy, including to maintain your Passport Club account, comply with legal obligations, resolve disputes, and enforce our agreements. When personal information is no longer needed, we delete or anonymize it in accordance with our data retention practices.

Sweepstakes entry data is retained for the period required by applicable state law (typically one year following the promotion end date) and then deleted or anonymized.

6. Data Security

We implement reasonable and appropriate technical and organizational security measures to protect your personal information against unauthorized access, disclosure, alteration, or destruction. However, no method of transmission over the Internet or electronic storage is completely secure. We cannot guarantee absolute security and encourage you to use strong passwords and protect your account credentials.

In the event of a data breach that affects your rights and interests, we will notify you as required by applicable law.

7. Children's Privacy

Our Services are intended solely for individuals who are 21 years of age or older, consistent with applicable cannabis regulations and our age-gating requirements. We do not knowingly collect personal information from anyone under the age of 21. If we become aware that we have inadvertently collected information from a person under 21, we will promptly delete it. If you believe we may have information about a minor, please contact us at the address below.

8. Your California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (together, "CCPA/CPRA"), provides you with specific rights regarding your personal information. This section describes those rights and how to exercise them.

A. Categories of Personal Information We Collect

In the preceding 12 months, we have collected the following categories of personal information:

•       Identifiers: name, email address, phone number, IP address, account username

•       Personal records: mailing address, date of birth (for age verification)

•       Commercial information: purchase history, loyalty points balance, reward redemptions

•       Internet/electronic activity: browsing history on our websites, interaction with our emails

•       Geolocation data: general location inferred from IP address

•       Inferences: profile data derived from the above to understand preferences and eligibility

B. Your Rights

Subject to certain exceptions, California residents have the following rights:

•       Right to Know: You may request that we disclose the categories and specific pieces of personal information we have collected about you, the sources, the purposes for collection, and the categories of third parties with whom we share it.

•       Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions (e.g., information needed to complete a transaction, comply with a legal obligation, or detect security incidents).

•       Right to Correct: You may request that we correct inaccurate personal information we maintain about you.

•       Right to Opt-Out of Sale or Sharing: We do not sell your personal information. If this changes, we will update this policy and provide a "Do Not Sell or Share My Personal Information" mechanism.

•       Right to Limit Use of Sensitive Personal Information: To the extent we collect sensitive personal information as defined by CPRA, you have the right to limit our use to what is necessary to perform the services you request.

•       Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge different prices, or provide a different quality of service because you exercised your rights under this section.

C. How to Submit a Request

To exercise any of the rights described above, please contact us using one of the following methods:

•       Email: thepassportclubco@gmail.com (subject line: "California Privacy Rights Request")

•       Mail: Passport Club LLC, 440 N. Barranca Ave., #8433 Covina, CA 91723

We will respond to verifiable consumer requests within 45 days. We may need to verify your identity before processing your request. We will not require you to create an account to submit a request. You may designate an authorized agent to submit a request on your behalf by providing written authorization.

D. Shine the Light

California Civil Code Section 1798.83 permits California residents to request information about our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes without your prior consent.

9. Links to Third-Party Websites

Our Services may contain links to third-party websites, including social media platforms and partner retailers. We are not responsible for the privacy practices of those third parties. We encourage you to review the privacy policies of any third-party sites you visit.

10. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or applicable law. When we make material changes, we will update the "Last Updated" date at the top of this policy and, where required, notify you by email or by prominent notice on our website prior to the change becoming effective. We encourage you to review this policy periodically.

11. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Passport Club LLC

440 N. Barranca Ave., #8433

Covina,CA 91723

Email: thepassportclubco@gmail.com

For sweepstakes-specific privacy questions, please reference the applicable promotion name in your inquiry.