This PRIVACY NOTICE FOR CALIFORNIA RESIDENTS (“Privacy Notice")supplements the information contained in the Privacy Policy of Talisman Brands, Inc. d/b/a Established. and its subsidiaries (collectively, “Established.”, “we,” “us,” or “our”) and applies solely to visitors, users, and others who reside in the State of California (“consumers” or “you”). We adopt this Privacy Notice to comply with the California Consumer Privacy Act of 2018 as amended, including by the California Privacy Rights Act of 2020 (“CPRA”). Any terms defined in the CPRA have the same meaning when used in this Privacy Notice.

The CPRA requires businesses to disclose whether they sell Personal Information. Established. is a business and does not sell Personal Information. We may share Personal Information with third parties if those third parties are authorized service providers or business partners who have agreed to our contractual limitations as to their retention, use, and disclosure of such Personal Information.

If you are unable to access this Privacy Notice due to a disability or any physical or mental impairment, please contact us and we will arrange to supply you with the information you need in an alternative format that you can access.

How We Collect, Use and Share your Personal Information

We have collected the following statutory categories of personal information (“Personal Information”) in the past 12 months:

- Identifiers such as name, postal address, telephone or mobile contact number, unique personal identifier, online identifier, Internet Protocol address, email address, account name, and other similar identifiers;

- Employment, employment history, financial information;

- Browsing history, search history, information on a consumer’s interaction with a website, application, or advertisement;

- Professional or employment-related information such as current or past job history or performance evaluations.

We obtain the categories of Personal Information listed above directly from you or your device when you connect to our websites and/or if you contact us through our contact forms available on our websites or from third party sources such as data suppliers and service providers.

We may use or disclose the Personal Information we collect for one or more of the following business purposes:

• To fulfill or meet the reason for which the information is provided;

• To provide you with information that you request from us;

• To provide you with email alerts, event registrations and other notices concerning our products or services, or events or news, that may be of interest to you;

• To process responses to job offers you have responded to;

• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us;

• To improve our website and present its contents to you;

• As necessary or appropriate to protect the rights, property or safety of us, our clients or others;

• To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations;

• As described to you when collecting your Personal Information or as otherwise set forth in the CPRA.

We will not collect additional categories of Personal Information or use the Personal Information we collected for materially different, unrelated, or incompatible purposes without providing you notice.

How we Share Personal Information

We limit the number of people who access, receive and/or process your Personal Information and the type of Personal Information that is shared to the extent necessary to fulfill the identified purposes.

As part of the complaints management service, we may share your Personal Information with our business partners or licensees, solely to respond to your request.

We use third party service providers in connection with our websites and services. For example, we use service providers for data hosting, data management and marketing. In all cases where we share your Personal Information in this way, we explicitly require the third-party service providers to acknowledge and adhere to our privacy and data protection policies and standards.

Retention

We retain your Personal Information for as long as necessary to provide the service you have requested, or for other essential purposes such as complying with our legal obligations, maintaining business and financial records, resolving disputes, maintaining security, detecting and preventing fraud and abuse, and enforcing our agreements. The criteria used to determine retention periods includes the legal limitation of liability period, agreed contractual provisions, applicable regulatory requirements, and industry standards.

Your Rights and Choices

You have certain rights regarding the Personal Information we collect or maintain about you. Please note these rights are not absolute, and there may be cases when we decline your request as permitted by law.

The right of access means that you have the right to request that we disclose what Personal Information we have collected, used and disclosed about you in the past 12 months.

Please note that we are not required to:

- retain any Personal Information about you that was collected for a single one-time transaction if, in the ordinary course of business, that Personal Information about you is not retained; or

- reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered Personal Information.

The right of deletion means that you have the right to request that we delete the Personal Information collected or maintained by us, subject to certain exceptions.

The right to correct means that you have the right to request that we correct inaccurate information that we have about you.

The right to non-discrimination means that you will not receive any discriminatory treatment when you exercise one of your privacy rights.

Exercising Access, Data Portability, Correct and Deletion Rights

To exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by either:

• email us at: privacy@established.inc
• write to us at: Established., 22 rue Chauchat – 75009 Paris, France Only you or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your Personal Information. You may also make a verifiable consumer request on behalf of your minor child.

You may only make a verifiable consumer request for access or data portability twice within a 12-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it

We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Our use of tracking technologies through some of our websites may be considered a “sale” or “sharing” of your Personal Information for cross-context behavioral advertising under the CPRA. You may request us to stop sharing your Personal Information (“opt-out”) of such tracking technologies by utilizing the “Cookies Settings” link on our websites that use tracking technologies for cross-contextual behavioral advertising or targeted advertising or by sending an opt-out preference signal supported by your device or browser. Your use of an opt-out preference signal will apply only to your device or browser and not to other consumer information that is not linked to your device or browser. Response Timing and Format

We endeavor to respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing.

We will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Non-Discrimination

We will not discriminate against you for exercising any of your CPRA rights. Unless permitted by the CPRA, we will not:

• Deny you goods or services;

• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

• Provide you a different level or quality of goods or services;

• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Changes to Our Privacy Notice

We reserve the right to amend this privacy notice at our discretion and at any time. When we make changes to this privacy notice, we will notify you by email or through a notice on our website homepage.

Contact Information

If you have any questions or comments about this notice, our Privacy Statement, the ways in which we collect and use your Personal Information, your choices and rights regarding such use, or wish to exercise your rights under California law, please do not hesitate to contact us at:

Website: http://www.established.inc/

Website: privacy@established.inc

Postal Address:
Attn: Legal team - Data Privacy
22, rue Chauchat - 75009 Paris, France.