Privacy Policy

Last Updated: June 15, 2023

We at Phantom Fireworks and our affiliates, including companies within the Phantom Fireworks group (sometimes referred to as “Company,” “us,” “we,” or “our”) take very seriously the concept of receiving your personal information. We do not share this information for any other purpose other than servicing you with respect to your dealings with Phantom Fireworks. Our goal, and the purpose of this privacy policy (“Policy”), is to inform you as to how we collect and use your personal information during your interactions with us, both online and offline. This Policy, more specifically, is intended to provide consumers with information about how we collect, use, disclose, retain, and safeguard certain of the personal information we gather about them, such as through the:

• Use of our websites, including mobile websites, applications (collectively, the “Site”)

• Visits to our stores, temporary locations or offices

• Attendance at one of our events or an event that we sponsor

• Phone and email communications

• Social media interactions, such as through LinkedIn, Facebook, Twitter, Instagram, YouTube, or TikTok

• Viewing our online advertisements or emails

It also describes options consumers may have concerning their personal information.

Please read this Policy carefully before using the Site or submitting personal information to us. By accessing or visiting the Site, you indicate your understanding that the collection, use, disclosure, and retention of your personal information is subject to the terms of this Policy. If you do not consent to the collection, use, disclosure, and retention of your personal information as described in this Policy, please do not provide us with such information. This Policy does not apply to third-party websites accessible through our Site or other applications.

Personal Information We Collect

As described below, we may collect or have collected in the preceding 12 months the following categories of personal information (“PI” or “personal information”). We may add to the categories of PI we collect and the purpose(s) we collect and use it. In those cases, we will inform and update this section of the Policy. Please note that because this list is comprehensive it may refer to types of information that we share about people other than yourself.

• Identifiers – such asreal name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, or other similar identifiers.

• Other elements – such asname, signature, characteristics or description, address, telephone number, education, bank account number, credit card number.

• Characteristics of protected classifications under state or federal law.

• Commercial information – such asproducts and services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.

• Education information – such asinformation that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (20 U.S.C. section 1232g, Sec. 1232g; 34 C.F.R. Part 99).

• Internet or other electronic network activity – such asbrowsing history, search history, a consumer’s interaction with an internet website, application, or advertisement.

• Biometric information – such as an individual’s physiological, biological, or behavioral characteristics used or is intended to be used singly or in combination with each other or with other identifying data, to establish individual identity.

• Geolocation data – such aslocation information while using one of our apps.

• Audio, electronic, visual, thermal, olfactory, or similar information – such asidentifiable information obtained about you from voicemail messages, while speaking with our service representatives, including on the telephone, and captured by video cameras.

• Professional or employment-related information – such as information on job applications, information needed during onboarding for payroll and benefits, and information needed for evaluating performance.

Personal information does not include certain categories of information, such as publicly available information from government records, and deidentified or aggregated consumer information.

Google Analytics and Other Third Parties

Phantom Fireworks cooperates with Google Analytics, a Web analytics service provided by Google, Inc. (“Google”). Phantom Fireworks and third-parties, including Google, use first-party cookies and third-party cookies together to a) inform, optimize, and serve ads based on someone's past visits to our website, and b) report how our ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related visits to our site. Phantom Fireworks uses Google Analytics Demographics and Interest Reporting to collect demographic information on visitors to our website. See Google’s privacy policy for Google Analytics.

Google Analytics is established in the United States and has entered into the Safe Harbor agreement, which entails that they must ensure an adequate standard for privacy protection in light of applicable EU rules and regulations.

Google has developed the Google Analytics Opt-out Browser Add-onto enable provide website visitors the ability to prevent their data from being used by Google Analytics. You can also use Google's Ads Settings.

We are currently using Demographic and Interest Reporting along with our Google Analytics tracking. This information is for our internal use only and will not be shared with third party vendors. It is designed to give us more information about who our customers are and what we can do to better provide them with the type of products they are interested in.

We retain your personal information for as long as necessary to provide you products and services, while you have an open account with us, process your employment application, or to improve our products and services, and in accordance with the Company’s data retention schedule, unless we have deidentified or deleted your personal information in response to a request to delete. We may retain your personal information for longer if it is necessary to comply with our legal obligations or reporting obligations, resolve disputes, collect fees,or as permitted or required by applicable law. We may also retain your Personal Information in a deidentified or aggregated form so that it can no longer be associated with you. To determine the appropriate retention period for your personal information, we consider various factors such as the amount, nature, and sensitivity of your information; the potential risk of unauthorized access, use or disclosure; the purposes for which we process your personal information; and applicable legal requirements.

Purposes We Collect and Use Personal Information

We collect and use your PI for the following business or commercial purposes. We may change or add to the purposes we collect PI. In that case, we will inform you and obtain your consent when required by law.

• To provide you with information, products, or services you request from us.

• To fulfill or meet the reason for which the information is provided.

• To fulfill benefits associated with use of our services, such as our Premier Membership, military/veteran discounts or offers and promotions.

• To contact you and/or provide you with email alerts and other notices concerning our products, services, events, or news that may be of interest to you. For example, we may send you announcements, surveys, and newsletters using any communications preferences you have expressed. We may provide these communications via email, postal mail, online advertising, social media, telephone, text message (including SMS and MMS), push notifications, in-app messaging, and other means. Of course, if at any time you no longer wish to receive such communications, you have the option of unsubscribing from our mailing list for that communication.

• To process payments.

• To engage in marketing activities.

• To communicate with you in social media concerning our products and services.

• To ensure your information is accurate and to personalize our communications to you. For example, we may aggregate your personal information with data from various sources for purposes of keeping information up to date. If you connect your social media services or other accounts to our services, we may use this information to make your experiences with us more personal or share and use it as described elsewhere in this Policy.

• To carry out our obligations and enforce our rights including those arising from any contracts entered into with you including for billing, payment, and collections.

• To review, improve, and monitor our website, applications, online services, and overall consumer experience, including to provide customization to meet the specific needs.

• To provide customer service and engage in quality control activities concerning our products and services.

• For testing, research, analysis and product and service development. We may use data, including public feedback and surveys, to conduct research and for the development of the Site and the services, products, and information we provide.

• To respond to law enforcement requests and as required by applicable law, court order, governmental regulations, or other lawful processes.

• As described to you when collecting your personal information.

• To manage our recruiting efforts and employment and workforce relationships. These activities include, for example, sourcing and processing employment applications, onboarding employees and contingent workers, and carrying out a range of employments activities relating to the employment relationship, such as compensation, benefits, promotion, discipline, termination, and certain post termination activities.

• As necessary or appropriate to protect the rights, property, security, and safety of us, our employees, our consumers, our information systems, and the public.

• To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by us is among the assets transferred.

For California Employees, Applicants and Independent Contractors, visit https://fireworks.com/careers for the relevant CCPA Notice at Collection.

Sources of Personal Information We Collect

• You. We may collect personal information that you provide during your interactions with us, such as through our Site, by email, or when you communicate with our associates online, by phone, or at one of our locations. We may also collect information when you attend an event, or participate in a sweepstakes, contest, promotion, or program we sponsor. We collect information when you are an applicant for employment with us and employed by us. We also collect information through certain online tracking tools, such as browser cookies, flash cookies, and web beacons. Please be reminded that you always have a choice as to whether or not you want to disclose information, and your failure to disclose information will in no way impact in your ability to navigate our entire site. You will provide personal information only at such time as you personally decide to do it.

• Related Entities and Affiliates. We may collect information about you from our related parties and affiliates, including joint ventures.

• Social media and related services.

• Service providers and contractors. When you obtain products and services from us, we may collect your PI from service providers and contractors who collected information about you that is needed to provide those products and services.

• News outlets, social media, surveys, and certain third parties. In the course of performing our services or marketing activities, we or third parties on our behalf may conduct research and other activities resulting in the collection of PI about you.

• Via our IT systems. This includes our door entry systems and reception logs, CCTV and access control systems, computer networks and connections, CCTV and access control systems, communications systems, email and instant messaging systems.

Disclosures of Personal Information

We do not sell or share your personal information to third parties. We also do not collect, use or disclose your sensitive personal information for purposes that, with limited exceptions, are not necessary to provide our products and services as are reasonably expected by an average consumer requesting those goods and services.

We may, however, disclose your personal information to services providers and contractors who help us provide the products and services, such as, shipping, payment processing, marketing and advertising, email, text and other communications, applications, sales, business and inventory support, photography, and website, software, platform, cloud, data storage and other technical services.

We may also disclose your personal information if necessary to: (1) comply with federal, state, or local laws; (2) comply with a civil, criminal, or regulatory inquiry, investigation, subpoena, or summons by federal, state, or local authorities; (3) cooperate with law enforcement agencies concerning conduct or activity that we reasonably and in good faith believe may violate federal, state, or local laws; or (4) exercise or defend legal claims.

Lastly, we may transfer to a third party personal information as part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control or acquires of all or part of the assets of our business.

Of the categories of PI noted above, during the past 12 months, we disclosed the following:

Cookies, Tracking, and Certain Communications

Cookies. As is true of most websites, we gather some PI automatically and store it in log files. Small files called "cookies" may be attached to your Web browser. These files identify your browser and save information such as passwords so that websites can recognize you. This information also may include the Internet Protocol (IP) address, browser type, language, internet service provider (ISP), referring and exit page, operating system, and date/time stamp. In addition to the purposes above, we use this PI to understand and analyze trends, to administer the Site, to learn about user behavior on the Site, and to gather demographic information about our user base as a whole. To monitor use of the Site and improve its quality, we may compile statistical information concerning the use of the Site through analytics services, such as those provided by Google Analytics. Examples of this information may include: the number of visitors to the Site or to sections or pages within the Site, patterns of traffic flowing through the Site, length of time spent on the Site, or in sections or pages of the Site, the other sites that refer visitors to the Site, the pages of the Site that visitors frequently use as entry and exit points, utilization of the browser and operating systems and versions used by visitors to the Site. We also may use this PI in our marketing and advertising services.

Social Media Sharing. This Site may offer social media sharing features or other integrated tools, which let you share actions you take on this website with other media, and vice versa. These features may collect information about your IP address and which page you are visiting on our Site, and they may set a cookie or employ other tracking technologies. The use of such features enables the sharing of information with your friends or the public, depending on the settings you establish with the third party that provides the social sharing feature. Social media sharing features and widgets are either hosted by a third party or hosted directly on our Site. Your interactions with those features are governed by the privacy policies of the companies that provide them. For more information about the purpose and scope of data collection and processing in connection with social media sharing features, please visit the privacy policies of the third parties that provide these features.

Do Not Track. “Do Not Track” is a privacy preference that you can set in your Internet search browser that sends a signal to a website that you do not want the website operator to track certain browsing information about you. However, because our Site is not configured to detect Do Not Track signals from a user’s computer, we are unable to respond to Do Not Track requests. However, you can download a free opt-out browser add on that will prevent Google Analytics from collecting certain browsing information. The plug in can be obtained by visiting https://tools.google.com/dlpage/gaoptout/ .

Third Party Website Links. Our Site does contain links to other websites which we make available to you because we believe that the information available on those websites is helpful or complimentary to the information available on our Site. Phantom Fireworks has no responsibility whatsoever when you click on any of these links and enter anyone else's website. We encourage you to do so carefully, and we encourage you to read all disclaimers, privacy statements and articles of agreement that may appear on any of these linked websites. Your use of these other linked websites is subject to the respective terms of use and privacy policies located on the linked websites.

Email. We may collect your email address via cookies and pixels on the Site through the use of trusted third-party partners. These partners may combine your email information with other information they have access to such as mailing address so that we may send relevant marketing offers to you via direct mail.

SMS Communications. You may elect to receive text messages from us. When you sign up to receive text messages, we will send you information about promotional offers and more. These messages may use information automatically collected based on your actions while on our Sites and may prompt messaging such as cart abandon messages. To the extent you voluntarily opt to have SMS notifications sent directly to your mobile phone, we receive and store the information you provide, including your telephone number or when you read a text message. You may opt out of receiving text messages at any time by texting “STOP” to our text messages.

Our Sites and Children

We do not knowingly collect or solicit PI from children under 16 years of age. We are concerned about the safety of children when they use the Internet and will never knowingly request PI from anyone under the age of 16. If the parent or guardian of a child under 16 believes that the child has provided us with any PI, the parent or guardian of that child should contact us and ask to have this PI deleted from our files. If we otherwise obtain knowledge that we have PI about a child under 16 in our files, we will delete that information from our existing files so that it is not in retrievable form.

It is the policy of Phantom Fireworks not to do business or send catalogs or other promotional material to any individual under the age of 16 years. All transactions on Phantom Fireworks website that require divulging of any personal information also require verification of age 16 or older age status. Phantom Fireworks will not knowingly accept any information from anyone under the age of 16, nor will Phantom Fireworks knowingly ship products, catalogs or other promotional material to anyone under the age of 16 years. We also do not have actual knowledge that we have sold personal information of minors under age 16.

Security

While we use reasonable measures to protect our Site and your information, the Internet is not 100% secure. The measures we use are reasonable for the type of information we collect. We cannot guarantee use of our Site is 100% secure. We encourage you to use caution when using the Internet.

Applicable law

This Policy is governed by the laws of the State of Ohio without regard to its conflict of laws principles. Jurisdiction for any claims arising under or out of this Policy shall lie exclusively with the state and federal courts within Ohio. If any provision of this Policy is found to be invalid by a court having competent jurisdiction, the invalidity of such provision shall not affect the validity of the remaining provisions of this Policy, which shall remain in full force and effect.

Notice to Site Users Located Outside the U.S.

The Company operates in accordance with the laws of the U.S. When you access our Site from outside the U.S., we may transfer the PI that we collect from you to a location outside of your jurisdiction, including the U.S. The data protection laws in these jurisdictions may not provide you with the same protections as those of your jurisdiction. By using this Site, you acknowledge that these laws may provide a different standard of protection and you consent to the transfer of your personal data to other jurisdictions, including the U.S.

Contact Us

If you have additional questions, you may call us at 1-800-777-1699 or reach us by email at privacy@fireworks.com.

Limitation of Liability. Phantom Fireworks makes no representations or warranties of any kind, whatsoever, regarding this Site and/or any and all materials provided hereon. All users agree and accept all information on this website on an “as is” basis with no warranties expressed or implied by Phantom Fireworks as to the accuracy, completeness or reliability of any such content. Furthermore, Phantom Fireworks will not be liable in any manner for any damage that anyone may sustain from using this website or any viruses that may infect any user's hardware or software by virtue of your browsing or using this site or downloading any information that may be on this site.

Changes to this Policy

Effective Date: June 15, 2023

From time to time, we may change or modify our policy, so we invite you to check this Policy periodically and from time to time, so that you can be fully informed and completely up to date on exactly how Phantom Fireworks is going to use the personal information that we collect from you and under what circumstances we will disclose it to other people. Your use of our site constitutes your acknowledgement of all the terms and conditions of our privacy policy.

Notice to California Residents

Shine the Light. If you are a California resident, California Civil Code Section 1798.83 permits you to request information regarding the disclosure of your personal information by certain members of the Company to third parties for the third parties’ direct marketing purposes. Requests may be made one time per calendar year. If applicable, this information would include the categories of customer information and the names and addresses of those businesses with which we disclosed customer information for the immediately prior calendar year (e.g., requests made in 2023 will receive information regarding 2022 sharing activities). You may submit your request using the contact information in this Policy.

Eraser Law. If you are a California resident under the age of 18, and a registered user of any Site where this Policy is posted, California law permits you to request and obtain removal of content or information you have publicly posted. You may submit your request using the contact information in this Policy. Please be aware that such a request does not ensure complete or comprehensive removal of the content or information you have posted and that there may be circumstances in which the law does not require or allow removal even if requested.

California Consumer Privacy Act. The section concerning the California Consumer Privacy Act (“CCPA Section”) applies solely to individuals who are residents of the State of California (“consumers” or “you”) as required under the California Consumer Privacy Act, as amended (“CCPA”). This CCPA Section describes our policies and practices regarding the collection, use, and disclosure of personal information we collect about you, including personal information we obtain when you access or use the Site, or through other channels including but not limited to visiting one of our locations, phone and email conversations, attending our events, social media interactions on our websites and other third party websites such as social media sites, viewing our emails, or through our authorized services providers.

This CCPA Section supplements and amends the information contained in the Policy with respect to California residents. Any terms defined within the CCPA have the same meaning when utilized within this CCPA Section. All other terms shall have the meaning set forth in the Policy. The other provisions of the Policy continue to apply except as modified in this CCPA Section.

Please read this CCPA Section carefully before using the Site or submitting information to us. By accessing or visiting the Site, you indicate your understanding that the collection, use, and sharing of your information is subject to the terms of this CCPA Section.

IF YOU DO NOT CONSENT TO THE COLLECTION, USE, AND DISCLOSURE OF YOUR PERSONAL INFORMATION AS DESCRIBED IN THIS CCPA SECTION, PLEASE DO NOT PROVIDE US WITH SUCH INFORMATION.

Notice of Financial Incentive under California Law.We provide rewards benefits and special offers to customers who qualify and participate in our Premier Membership Program. We also may conduct surveys or send newsletters with special offers, host contests, and offer promotions to customers who sign up for emails, texts or interact with us on social media (Promotional Activities). Please review all applicable terms and conditions presented to you when you sign up to participate in these Promotional Activities. Because Promotional Activities and Premier Membership Program often involve the collection of personal information, they might be interpreted as a “financial incentive” program under California law. The value of your personal information to us is related to the value of the free or discounted products or services that you obtain in connection with Promotional Activities or the Premier Membership Program and it is based on the expense related to offering those free or discounted products or services. You may unsubscribe from marketing emails or withdraw from participating in a Premier Membership by contacting privacy@fireworks.com.

We do not collect or process Sensitive Personal Information (as defined by California law) for the purpose of inferring characteristics about individuals.

Right To Know About Personal Information Collected or Disclosed.We generally describe in this Privacy Policy our current and practices for the prior 12 months related to the categories of personal information we collect, how we collect and use the personal information, and how we disclose your personal information. In addition to what is described above, as a California resident, you also have the right to request more information regarding the following topics for the preceding 12 months, to the extent applicable:

• the categories of personal information,

• the categories of sources from which the personal information is collected,

• the business or commercial purpose for collecting, selling, or sharing personal information, if applicable,

• the categories of third parties to whom the business discloses personal information, and

• the specific pieces of personal information the business has collected about you.

Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will provide a response to such requests. Any disclosures we provide will only cover the 12-month period preceding the receipt of your verifiable consumer request. With respect to personal information collected on and after January 1, 2022, and to the extent expressly required by applicable regulation, you may request that such disclosures cover a period beyond the 12 months referenced above, provided doing so would not require a disproportionate effort by us.

Right To Request Deletion Of Your Personal Information. You have the right to request that we delete the personal information we collected or maintain about you. Once we receive your request, we will let you know what, if any, personal information we can delete from our records, and we will direct any service providers and contractors with whom we disclosed your personal information to also delete your personal information from their records.

There may be circumstances where we cannot delete your personal information or direct service providers or contractors to delete your personal information from their records. Some of these instances include, but are not limited to, if we need to:

• Complete the transaction for which the PI was collected, provide a good or service requested by you, or reasonably anticipated by you within the context of our ongoing business relationship with you, or otherwise perform a contract between the Company and you.

• Help to ensure security and integrity to the extent the use of the consumer's PI is reasonably necessary and proportionate for those purposes.

• Debug to identify and repair errors that impair existing intended functionality.

• Exercise free speech, ensure the right of another consumer to exercise his or her right of free speech, or exercise another right provided for by law.

• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with Section 1546) of Title 12 of Part 2 of the Penal Code.

• Engage in public or peer-reviewed scientific, historical, or statistical research that confirms or adheres to all other applicable ethics and privacy laws, when the Company's deletion of the information is likely to render impossible or seriously impair the ability to complete such research, if you have provided informed consent.

• To enable solely internal uses that are reasonably aligned with your expectations based on your relationship with the Company and compatible with the context in which the consumer provided the information.

• Comply with a legal obligation.

Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will provide a response to such requests.

Right to Request Correction. You have the right to request that the Company correct any inaccurate personal information we maintain about you, taking into account the nature of that information and purpose for processing it. Upon receipt of a verifiable consumer request (see below), and as required by the CCPA, we will provide a response to such requests.

Right to Non-Discrimination for the Exercise of Your Privacy Rights. We will not discriminate against you for exercising any of your rights under the CCPA, as described above. This includes, but is not limited to: (A) denying good or services to you; (B) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (C) providing a different level or quality of goods or services; or (D) suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services. It also includes an employee’s, applicant’s, or independent contractor’s right not to be retaliated against for the exercise of

their CCPA rights.

Submitting CCPA Rights Requests

How to submit. To submit a California CCPA request as outlined in this CA Addendum, please contact the Company by calling us at 1-800-777-1699 Monday-Friday from 8:30am–5:00pm EST, emailing us at privacy@fireworks.com, or using our contact form. We reserve the right to only respond to verifiable consumer requests to know, delete, or correct. A verifiable consumer request is one made by any individual who is:

• the consumer who is the subject of the request,

• a consumer on behalf of the consumer’s minor child, or

• the authorized agent of the consumer.

What to submit. In your initial submission, you must either identify yourself as a consumer making a request pursuant to the CCPA or state that you are a California resident. If we request, you must provide us with sufficient information to verify your identity and/or authority to act on behalf of a consumer. In general, we may ask you to provide identifying information that we already maintain about you or we may use a third-party verification service. In either event, we will try to avoid asking you for sensitive PI to verify your identity. We may not be able to respond to your request or provide you with PI if we cannot verify your identity or authority to make the request and confirm the PI relates to you. However, making a verifiable consumer request does not require you to create an account with us.

Additionally, you will need to describe your request with sufficient detail to allow us to review, understand, assess, and respond. We will not use the PI we collect from an individual to determine a verifiable request for any other purpose, except as required or permitted by law.

Our response. We reserve the right to charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded. If we determine that a request warrants a fee, we will attempt to notify you as to why we made that decision and provide a cost estimate before completing your request. We will endeavor to respond to a verifiable consumer request within forty-five (45) calendar days of receipt, but we may require an extension of up to forty-five (45) additional calendar days to respond and we will notify you of the need for the extension.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. The response we provide will also explain the reasons we cannot comply with a request, if applicable. To the extent permitted by the CCPA, we will respond to no more than two requests during any 12-month period.

Authorized Agent. You may authorize a natural person or a business (the Agent) to act on your behalf with respect to the rights under this CA Addendum. When you submit a Request to Know, Correct, or Delete, the Agent must provide proof that you gave the Agent signed permission to submit the request, and you either must (i) verify your own identity with the business or (ii) directly confirm with us that you provide permission to the Agent. However, these steps are not required when you have provided the authorized agent with power of attorney pursuant to Probate Code sections 4000 to 4465. We reserve the right to deny requests from persons or businesses claiming to be authorized agents that do not submit sufficient proof of their authorization.

CCPA Annual Data Requests. The following chart contains statistics about consumer data requests received in 2022. This chart will be updated annually.

Questions. If you have questions about this CA Policy, please contact us as described above in the Policy.