LAST MODIFIED: NOVEMBER 2022

Introduction

Norwex respects and is committed to protecting your privacy, and this Privacy Notice (“notice”) explains how we collect, use, and share personal data when you visit to our websites and when we provide you services (“services”). It also describes your rights with respect to the processing of your personal data, and how you can contact us to exercise those rights or with questions about our privacy practices.

Please note that this notice does not apply to information collected on third-party sites or by any third-party application that may link to or be accessible from the websites; if you click on a link to another website, please read their privacy notice.

1. When and how we collection information about you
2. The types of information we collect
3. How and why we use your information
4. How we will we share your information
5. Your choices about your information
6. How we secure your information
7. How we store your information
8. How long we keep your information
9. Your Rights under the UK & EU GDPR
10. Your Rights under the CCPA
11. Your Rights under PIPEDA
12. Your Rights under the Australian Privacy Act
13. Your Rights under the New Zealand Privacy Act
14. Changes to our privacy notice
15. How to contact us

1. When and how we collect information about you

From the first moment you interact with us, we are collecting data. Sometimes you provide us with data, sometimes data about you is collected automatically. Here’s when and how we do this.

We collect personal data when:

• You browse any page of our website
• You register for an account
• You complete a transaction with us without registering for an account
• You fill out a form requesting to speak with a Consultant
• You fill out our Join Us form to become a Consultant
• You fill out our Party Contact form
• You receive emails from us
• You interact with us for customer support
• You complete your profile or share your personal story

You provide personal data when:

• You register for an account
• You complete a transaction with us without registering for an account
• You fill out a form requesting to speak with a Consultant
• You fill out our Join Us form to become a Consultant
• You fill out our Party Contact form
• You receive emails from us
• You interact with us for customer support
• You complete your profile or share your personal story

2. The types of information we collect

Depending on how you interact with us as described above, we may collect:

• Your contact information, including your name, email, phone number, mailing address and your billing address, if the two are not the same.
• A password when you set up an account with us.
• National Identification information, such as passports, social security number (United States), or any other type of unique identifier used on a national level.
• Date of Birth.
• Payment information if you complete a transaction with us.
• Basic contact information if you chose to register to use our websites, subscribe to our services, post material, or request further services or information.
• Data that identifies you such as your IP address, login information, browser type and version, time zone setting, browser plug-in types.
• Internet activity, including your interactions with our Services, URL clickstreams (the path you take through our site), products/Services viewed, page response times, download errors, how long you stay on our pages, what you do on those pages, how often, and other actions.

For more information about cookies used on our website, please see our separate Cookie Notice.

Does Norwex collect sensitive data? We don’t collect sensitive data about you (like racial or ethnic origin, political opinions, religious/philosophical beliefs, trade union membership, genetic data, biometric data, health data, data about your sexual life or orientation, precise geolocation data, or offences or alleged offences) except when we have your specific consent, or when wehave to in order to comply with the law.

Does Norwex collect children’s data? No. Our websites are not intended for use by children under 13 years of age, and we do not knowingly collect personal data, contact, or solicit information of any kind from children under 13. If you believe that we might have any information from or about a child under 13, please contact us so we can delete that information immediately, at: privacy@norwex.com

3. How and why we use your information

Data protection law means that we can only use your data for certain reasons and where we have a legal basis to do so. We process your data for:

• Delivering Services: Performing our contractual obligations to provide services to you. Legal basis: Contract
• Customer support: Responding to questions and solving issues via phone or email. Legal basis for this data usage: Contract
• Marketing purposes (with your consent): Sending you emails and messages aboutnew features, products and services, contests, and content. Legal basis for this data usage: Consent
• Running & Improving our Site and Services: Managing your requests, login, and authentication, remembering your settings, hosting, and back-end infrastructure, testing features, managing landing pages, and identifying fraud. Legal basis: Contract, Legitimate Interests

What does each legal basis mean?

Consent: You have given clear consent for you to process your personal data for a specific purpose. You can choose to withdraw your consent using specific features provided to enable you to withdraw consent, like an email unsubscribe link.

Contract: Processing your data is necessary for performing services under a contract, or because we have asked you to take specific steps before entering into that contract.

Legitimate interests: Processing your data is necessary for our legitimate interests or the legitimate interests of a third party, provided those interests are not outweighed by your rights and interests. These legitimate interests are:

• Gaining insights from your behavior on our website and within our services sites.
• Delivering, developing, and improving our services.
• Enabling us to enhance, customize or modify our services and communications.
• Determining whether marketing campaigns are effective.
• Enhancing data security.

In each case, these legitimate interests are only valid if they are not outweighed by your rights and interests.

4. How we share your information

We may disclose personal data to our group companies (i.e., our holding company and its subsidiaries and affiliates) to fulfill our contractual obligations to you, and to direct contractors and authorized service providers that perform certain services on our behalf.

Our service providers may only use data we share with them in in accordance with our instructions. These services may include web hosting providers, web analytics providers, email service providers, and cloud-survey platform providers.

We may also use your information to contact you about goods and services that may be of interest to you where you have consented to be contacted for such purposes.

In the event (whether prospective or actual) of a merger, acquisition, or any form of sale of some or all of Norwex’s assets, in which case personal data held by Norwex’s about its customers will be among the assets transferred to the (prospective) buyer.

We may also disclose your personal data in the event of a merger, acquisition, or any form of sale of some or all of Norwex’s assets; to third parties to comply with any court order or other legal obligation; to enforce or apply our terms of use or terms of sale and other agreements; and to protect the rights, property, or safety of Norwex, our customers, or others.

5. Your choices about your information

As the owner of your own personal data, you have choices, specifically, the following: You have several choices available when it comes to information about you:

Limit the amount of Personal Data provided to Norwex: If you have a personal or business relationship with Norwex, you have the right to limit the types of personal data we store, process, and/or transmit.

Opt-Out of Marketing: You can exercise your right to prevent such processing by checking or unchecking the opt-in checkboxes on the forms we use to collect your data. You can also exercise the right at any time by contacting us at:

Privacy@norwex.com

Opt-Out of Electronic Communications: You have the right opt out of receiving promotional messages from Norwex using the “Unsubscribe” hyperlink at the bottom of every email. You may also email us at the email addresses above with “Unsubscribe” in the subject.

Please note that even if you opt out of promotional messages, Norwex may still send you additional messages relating to your account and other important information.

6. How we secure your information

We have implemented measures designed to secure your personal data from accidental loss and from unauthorized access, use, alteration, and disclosure. Unfortunately, the transmission of information via the Internet is not completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of your personal data transmitted to our websites; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorized access.

7. How we store your information

We may transfer data to Norwex databases in countries other than where it was provided, and when we do so, we transfer the information in compliance with the applicable data protection laws. In addition, personal data shall only be transmitted to organizations outside of the United Kingdom or European Union if appropriate mechanisms have been implemented, such as the EU Standard Contractual Clauses, Binding Corporate Rules, or individual contractual agreements that meet the relevant requirements of European law.

8. How long we keep your information

We will only retain your information for as long as necessary for the purposes set out in this notice; for as long as your account is active; or as needed to provide services to you.

Norwex will retain and use your information to the extent necessary to comply with our legal obligations, resolve disputes, enforce our agreements, and as otherwise described in this notice.

9. Your Rights under the UK & EU GDPR

You can exercise your rights by sending us an email at:

Privacy@norwex.com

Please note that we are required to verify your identity before we are able to process any of the requests described in this Section; and at our discretion, deny your request if we are unable to verify your identity.

Right of Access: You have the right to obtain confirmation whether your personal data is being processed, and, where that is the case, obtain a copy of your personal data.

Right to Rectification (Correction): You have the right to correct inaccurate personal data and the right to have incomplete personal data completed.

Right to Erasure (Right to be Forgotten): You have the right to request we erase your personal data.

Right to Restriction of Processing: You have the right to restrict the processing of your personal data.

Right to Data Portability: You have the right to request the transfer of your personal data directly to you or to another organization in a structured, commonly used, and machine-readable format.

Right to Object: You have the right to object to the processing of your personal data.

You have the right to lodge a complaint regarding our use of your data: If your request or concern is not satisfactorily resolved, you may approach your local data protection authority:

EU- https://ec.europa.eu/info/law/law-topic/data-protection_en

UK - https://ico.org.uk/

10. Your Rights under the CCPA

The California Consumer Privacy Act (“CCPA”) provides California residents with specific rights regarding their personal data. You can exercise your rights by sending us an email at:

Privacy@norwex.com

Please note that we are required to verify your identity before we can process any of the requests described in this Section; and at our discretion, deny your request if we are unable to verify your identity.

Right To Know & Access: You may request that we disclose:

• The categories of personal data collected
• Specific pieces of personal data collected
• The categories of sources from which we collected personal data
• The purposes for which we use the personal data
• The categories of third parties with whom we share the personal data
• The categories of information that we sell or disclose to third parties

Right to Data Portability: You have the right to request your personal data in a structured, commonly used, and machine-readable format.

Right to Correction: You have the right to correct inaccurate personal data and the right to have incomplete personal data completed.

Right to Delete: You have the right to request we delete any of your personal data, subject to certain exceptions if retaining the information is necessary for us or our service providers to:

1. Complete the transaction for which we collected the personal data, provide a requested good or service, take actions reasonably anticipated within the context of our ongoing business relationship, or otherwise perform our contract.
2. Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
3. Debug products to identify and repair errors that impair existing intended functionality.
4. Exercise free speech, ensure the right of another individual to exercise their free speech rights, or exercise another right provided for by law.
5. Comply with the California Electronic Communications Privacy Act Cal. Penal Code §1546 seq.).
6. Enable solely internal uses that are reasonably aligned with individuals’ expectations based on your relationship with us.
7. Comply with a legal obligation.
8. Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA rights.

11. Your Rights under PIPEDA

The Personal Information Protection and Electronic Documents Act (“PIPEDA”) provides Canadian residents with specific rights regarding their personal data. You can exercise your rights by sending us an email at:

Privacy@norwex.com

Please note that we are required to verify your identity before we can process any of the requests described in this Section; and at our discretion, deny your request if we are unable to verify your identity.

Right To Know & Access: You may request that we disclose:

• Whether the company collects personal data about you
• he categories of personal data collected
• How personal data is being processed
• The third parties with which we share personal data

Right to Correction: You have the right to correct inaccurate personal data and the right to have incomplete personal data completed.Right to Object: You have the right to object to certain forms of processing, including processing relating to direct marketing communications.

12. Your Rights under the Australian Privacy Act

The Australian Privacy Act provides residents of Australia with specific rights regarding their personal data. You can exercise your rights by sending us an email at: Privacy@norwex.com

Please note that we are required to verify your identity before we can process any of the requests described in this Section; and at our discretion, deny your request if we are unable to verify your identity.

Right To Know, Access & Data Portability: You may request that we disclose whether the company collects personal data about you and request access to that personal data in a portable format.

Right to Correction: You have the right to correct inaccurate, out-of-date, and irrelevant personal data.

13.Your Rights under the New Zealand Privacy Act

The New Zealand Privacy Act provides residents of New Zealand with specific rights regarding their personal data. You can exercise your rights by sending us an email at: Privacy@norwex.com

Please note that we are required to verify your identity before we can process any of the requests described in this Section; and at our discretion, deny your request if we are unable to verify your identity.

Right To Know & Access: You may request that we disclose whether the company collects personal data about you and request access to that personal data.

Right to Correction: You have the right to correct inaccurate or out-of-date personal data.

14. Changes to our privacy notice

This notice may change from time to time and your continued use of the website is deemed to be acceptance of such changes, so please check this notice periodically for updates.

The date this privacy notice was last revised is identified at the top of the page.

15. How to contact us

You may contact us with any questions you may have on our privacy notice. Please contact us:

Privacy@norwex.com

If you are resident in the USA:
Chief Information Officer
Norwex USA, Inc.
800 W. Bethel Road
Coppell, TX 75019
USAUScompliance@norwex.com

If you are resident in Canada:
Chief Information Officer
Norwex Canada Inc.
P.O. Box 714
Stn Main
Dauphin, Manitoba R7N 3B3
Canada
CDNcompliance@norwex.com

If you are a resident of the European Economic Area:
Chief Information Officer
Norwex Malta Ltd
Pama 1, Misrah Is-Sebbiegh, Zebbiegh, L-Mgarr
MGR 2071 Malta
EUcompliance@norwex.com