California Privacy Notice

This California Privacy Notice supplements the Privacy Policy of Enzo Custom Florida Inc. and its commonly controlled affiliates (collectively, the “Enzo Group,” “Enzo Custom,” “we,” “us,” or “our”). Enzo Custom Florida is the primary business for shared customer systems; a local Enzo Group seller may also be responsible for its transaction records. This Notice applies to California residents whose information is subject to the California Consumer Privacy Act, as amended (“CCPA”), and describes practices during the preceding 12 months and those we reasonably expect to continue.

If this Notice conflicts with the United States Privacy Policy on a matter governed by California law, this Notice controls for California residents.

California summary

• We do not sell personal information for money and do not operate as a data broker.

• Advertising and analytics disclosures can be "selling" or "sharing" under the CCPA even when no money changes hands. You may opt out through Your Privacy Choices, by a qualifying Global Privacy Control signal, by emailing [email protected], or by calling 888-622-3696.

• We do not knowingly sell or share personal information of anyone under 16. As a matter of policy, we do not knowingly sell, share, or use for targeted advertising the personal information of anyone under 18.

• We do not use or disclose sensitive personal information for purposes that require a "Limit the Use of My Sensitive Personal Information" right. If that changes, we will provide the required notice and control before the new use begins.

• You may request to know, access, correct, or delete covered information and may use an authorized agent. You will not receive unlawful discriminatory treatment for exercising a CCPA right.

1 Categories of California personal information

The table uses the statutory CCPA categories and covers the preceding 12 months. We did not sell any category for money. Sale or sharing through advertising technology reflects the CCPA’s broader definitions. Business-purpose disclosure includes operational recipients described below.

CCPA category	Representative examples	Collected in past 12 months	Sold or shared through adtech last 12 months	Business-purpose disclosure last 12 months
A. Identifiers	Name, email, mobile number, postal or billing address, IP address, online identifiers, client, appointment, order, account, or referral identifier	Yes	Yes—limited online, advertising, or transformed matched-audience identifiers	Yes—service, payment, communications, security, analytics, production, and fulfillment providers
B. Customer Records information	Contact details, payment token, last four digits, billing information, electronic signature, and other transaction records	Yes	Yes—limited contact or online identifiers only where a matched-audience or attribution use is enabled	Yes—payment, fraud, service, records, communications, accounting, and professional providers
C. Characteristics of protected classifications	Limited information a person voluntarily provides in a service or functional-accommodation context; we do not request protected-class information for ordinary tailoring	Limited	No	Limited—only to providers needed to deliver the requested service or accommodation or meet law
D. Commercial information	Appointments, quotes, purchases, garment and fabric selections, order status, alterations, returns, credits, gift-card and referral activity, product interactions, and service history	Yes	Yes—limited product interaction, campaign, or conversion events; not measurements, fit notes, or detailed order records	Yes—service, production, payment, delivery, analytics, accounting, and professional providers
E. Biometric information	Historical face-related data generated by security-camera search functionality. Ordinary tailoring measurements and service photos are not processed for biometric identification.	Limited historical face-related data	No	Security and camera-technology providers for camera operation
F. Internet or other electronic network activity	Browsing, search, click, device, cookie, ad, consent, email-engagement, session-interaction, security, call-attribution, and referring-source information	Yes	Yes, subject to applicable choices	Yes—hosting, security, communications, analytics, and technology providers
G. Geolocation data	City, state, or region inferred from IP address and selected showroom; no intended precise GPS collection through ordinary Services	Yes—approximate only	Yes—approximate location may accompany advertising or analytics data	Yes—security, localization, analytics, and technology providers
H. Audio, electronic, visual, thermal, olfactory, or similar information	Fitting or garment photos, submitted media, video-support content, calls recorded or transcribed only after clear notice and affirmative consent, and video-only showroom security footage where notice is posted	Yes, as described	No service photos, call content, or security footage; public marketing only under separate authority	Yes—service, storage, security, quality, legal, or professional providers as needed
I. Professional or employment-related information	Company, occupation, business contact details, dress requirements, or wardrobe context voluntarily provided	Limited	No	Yes—service or communications providers as needed
J. Education information	Enzo Custom does not intentionally collect nonpublic education records through ordinary Services	No	No	No
K. Inferences	Likely garment interests, preferred showroom or clothier, event timing, marketing interests, and service or product recommendations	Yes	Yes—limited marketing or product-interest inferences, subject to choice	Yes—CRM, analytics, communications, and service providers
Sensitive personal information	Limited account log-in or payment credentials handled by authentication or payment providers and limited functional-accommodation information a person volunteers that may reveal health or disability information. We do not intentionally collect precise geolocation, government identifiers, genetic data, neural data, or biometric identifiers through ordinary Services	Limited	No	Yes—only to payment, authentication, security, accessibility, legal, or service providers as reasonably necessary

We have not used or disclosed sensitive personal information for purposes outside the permitted operational purposes that trigger a CCPA right to limit. We do not use sensitive personal information to infer characteristics. We do not sell sensitive personal information.

2 Categories of sources

We obtain California personal information from:

• California residents directly through appointments, showroom visits, fittings, orders, forms, messages, surveys, consent screens, reviews, events, and referrals;

• our clothiers, customer-service personnel, showrooms, production and order systems, and security systems;

• browsers and devices through cookies, pixels, tags, local storage, server logs, analytics, session-interaction, email-engagement, call-attribution, and similar technologies, subject to applicable choices;

• service providers and contractors supporting scheduling, payment, fraud prevention, communications, CRM, production, tailoring, delivery, storage, support, security, analytics, and advertising;

• social networks, advertising platforms, and public sources when a resident interacts with our content, authorizes a connection, or makes information public;

• people acting at the resident's direction, such as a wedding organizer, shipping recipient, or authorized agent; and

• referral links or introducing clients for attribution. The referred person submits their own contact information before we contact them through the referral journey.

3 Business and commercial purposes

We collect, use, and disclose the categories above to:

1. schedule and manage appointments, fittings, group events, deadlines, and showroom service;

2. design, produce, alter, personalize, deliver, reorder, and support garments;

3. process payments, refunds, credits, gift cards, accounting records, and taxes;

4. authenticate clients and transactions, maintain fit and preference records, and preserve service continuity;

5. communicate about orders, appointments, alterations, pickup, delivery, privacy, security, and support;

6. send marketing under the applicable consent or opt-out framework;

7. administer reviews, surveys, referrals, and promotions;

8. operate, debug, secure, measure, and improve our sites, showrooms, products, communications, and business;

9. analyze traffic and campaigns, attribute appointments or sales, and provide targeted advertising where permitted and subject to opt-out;

10. prevent, detect, and investigate fraud, misuse, security events, and violations of our terms;

11. comply with law and lawful requests, protect people, property, and rights, and establish or defend claims; and

12. create and use aggregated or deidentified information that we maintain in deidentified form.

4 Categories of recipients

Depending on the information and purpose, we disclose personal information to:

• website, cloud, IT, cybersecurity, scheduling, CRM, customer-service, payment, fraud-prevention, email, SMS, storage, and records-management providers;

• commonly controlled Enzo Group entities, including showroom companies, Enzo Sartori, and Sanpari, and service providers supporting production, tailoring, materials, shipping, and logistics;

• analytics, attribution, advertising, and social-media platforms, subject to Your Privacy Choices;

• professional advisers, insurers, auditors, and financial institutions;

• regulators, courts, law enforcement, counterparties, and other legal or safety recipients;

• parties to a financing, merger, acquisition, reorganization, insolvency, sale, or transfer of all or part of the business, subject to appropriate safeguards; and

• recipients a resident directs us to use.

The categories of third parties to which we sold or shared personal information under the CCPA's broad definitions during the preceding 12 months were advertising networks, social-media platforms, and analytics or attribution providers. Current providers are identified in our Cookie and Tracking Technologies Policy and preference center.

We do not collect, use, or sell personal information for the purpose of training large language models. We do not authorize providers to use personal information we supply to train large language models.

The preceding-12-month disclosures above describe historical practices and do not authorize a disabled feature to continue. Under the current program, session replay and heatmaps, customer-data uploads, matched audiences, and enhanced conversions using customer data are disabled. Nonessential tracking otherwise requires affirmative opt-in, and applicable opt-outs and Global Privacy Control are honored. We do not use, or permit vendors to use, customer fitting photographs, identifiable measurements, private client communications, or health or functional-accommodation information to train, fine-tune, or evaluate any AI model. This restriction applies to internal and vendor models, including general-purpose and shared models. There is no consent-based exception in the current program. We do not process or analyze customer fitting photographs with AI or create biometric identifiers from them. Limited review by authorized people for the disclosed service or quality purpose is distinct from AI model training. Licensed professional-model imagery used in marketing is governed by its separate rights and permissions.

5 Retention

We do not retain personal information longer than reasonably necessary and proportionate for the disclosed purpose. The fitting-photo and inactive-profile limits below apply separately from minimum transaction and accounting archives. Ordinary criteria include:

• contact and client profiles: Active client relationship, then delete or irreversibly deidentify after 3 years without a purchase, appointment, or direct service contact. Passive email opens, advertising activity, and tracking do not restart the period. Minimum transaction fields may remain in a restricted 7-year transaction or legal archive; the full profile and reusable fitting photos do not.

• inquiry-only records: generally 3 years after last activity;

• orders, payments, alterations, refunds, accounting, and transaction records: generally 7 years after final activity;

• measurements, fit, and style records: Active client relationship, then delete or irreversibly deidentify after 3 years without a purchase, appointment, or direct service contact. Passive email opens, advertising activity, and tracking do not restart the period. Minimum transaction fields may remain in a restricted 7-year transaction or legal archive; the full profile and reusable fitting photos do not.

• routine support communications: generally 3 years after last direct service contact; specific transaction or dispute records up to 7 years after resolution where justified, limited to relevant records;

• service photos: Fitting photos are optional and require separate affirmative permission for the stated service purpose. We delete them when no longer reasonably needed and ordinarily no later than 12 months after each photo was captured. A later appointment, order, message, or other interaction does not restart that period. We may preserve only relevant photos under a documented legal requirement or active-dispute hold, with restricted access and periodic review; we delete them when that basis ends. Valid deletion requests are handled within the applicable legal deadline, subject to applicable exceptions. Publicity images obtained under a separate valid release follow that release and its stated media term.

• session replay and heatmaps: disabled for new collection; any historical raw recordings generally no more than 30 days; security logs, other analytics, and historical aggregated interaction analytics generally up to 24 months; cookie duration in the preference center;

• marketing inferences: Delete or irreversibly deidentify after 3 years without a purchase, appointment, or direct service contact. Passive marketing opens and tracking do not restart the period. Minimal consent and suppression evidence follows its separate schedule.

• consent and messaging evidence: generally 5 years after the last relevant message or withdrawal; minimal suppression records generally 10 years and longer only while reasonably necessary to honor a continuing choice, a specific law, legal hold, claim, or enforcement matter; and

• privacy-request records: generally 2 years.

A longer retention period requires a documented legal requirement or specific active claim or dispute, access restricted to those handling that matter, and periodic review. We keep only the information relevant to that basis and delete or irreversibly deidentify it when the basis ends. We do not retain a full client profile or fitting-photo archive merely because minimum order or accounting records must be kept. Lawful deletion requests and applicable exceptions still apply. Backup deletion follows a documented cycle and applicable legal deadlines.

6 California privacy rights

Subject to exceptions and verification where permitted, a California resident may:

• Know and access: request the categories and specific pieces of personal information we collected; categories of sources; purposes; categories of information sold, shared, or disclosed; and categories of recipients.

• Delete: request deletion of personal information we collected, subject to exceptions such as completing a transaction, providing a requested product, maintaining security, complying with law, and establishing or defending claims.

• Correct: request correction of inaccurate personal information we maintain.

• Opt out of sale or sharing: direct us not to sell or share personal information. See Section 7 and Appendix B.

• Limit sensitive-personal-information use: direct a business to limit certain uses or disclosures of sensitive personal information. We do not currently use or disclose sensitive personal information for purposes that trigger this right. If our practices change, we will provide the required notice and method before the change.

• Access or opt out of covered automated decisionmaking: exercise any right that applies if we introduce automated decisionmaking technology used to make a significant decision or for another covered use. We do not currently use solely automated processing to make decisions that produce legal or similarly significant effects about clients.

• Use an authorized agent: designate an agent to make a request where permitted.

• Receive equal treatment: exercise a CCPA right without unlawful discrimination or retaliation.

7 Sale and sharing opt out

We do not sell personal information for money. We may permit advertising, social-media, analytics, or attribution providers to receive identifiers, online activity, approximate location, limited commercial events, or inferences. This may constitute sale or sharing under the CCPA.

Opt out through:

• Your Privacy Choices, available in the website footer;

• a qualifying Global Privacy Control signal enabled in your browser or extension;

• [email protected]; or

• 888-622-3696.

An opt-out does not require an account or identity verification. We use only information reasonably needed to process the request. A browser signal applies to that browser or device and, when we can reasonably associate it with an account or profile, to related information as required. We process opt-outs as soon as feasible and no later than 15 business days. We do not ask a person who has opted out to opt back in for at least 12 months unless the person initiates the request.

An opt-out does not prevent disclosures to restricted service providers or contractors needed to provide requested services, maintain security, process payment, or comply with law. It also does not stop contextual advertising.

See Appendix B for the full Notice of Right to Opt Out of Sale or Sharing.

8 Requests to know access delete or correct

Submit a request through:

• enzocustom.com/privacy-request;

• [email protected]; or

• 888-622-3696.

Tell us the right you wish to exercise and provide enough information to locate the relevant records. We acknowledge a verifiable request within 10 business days and ordinarily respond within 45 calendar days. If reasonably necessary and legally permitted, we may extend the response period once and will explain the extension within the original period.

We verify identity in a manner proportionate to the request and sensitivity of the information, using information already associated with an account, appointment, order, or communication when possible. We do not ask for a Social Security number. If we cannot reasonably verify identity or authority, we may deny the request and explain why. We do not disclose Social Security numbers, government identification numbers, account passwords, security questions and answers, unique biometric data, or other information that law prohibits us from disclosing in response to a request.

An authorized agent may submit a request. We may require a signed authorization and ask the resident to verify identity or confirm the request directly, unless the agent holds legally sufficient power of attorney. An agent may use the same request channels.

We ordinarily do not charge a fee. We may charge a legally permitted reasonable fee or deny a request that is manifestly unfounded, excessive, or repetitive, after giving the required explanation. California residents may generally make a request to know without charge up to twice in a 12-month period. A request ordinarily covers the 12 months before we receive it. For personal information collected on or after January 1, 2022, a resident may request a longer period where the CCPA requires us to provide it, unless doing so is impossible or would involve disproportionate effort. A request does not require us to keep information longer than our ordinary retention schedule.

9 Sensitive personal information

We do not sell sensitive personal information. We do not use or disclose sensitive personal information to infer characteristics. Our limited sensitive-information processing is confined to purposes permitted without a right to limit, including providing requested goods or services, processing payment through a provider, authenticating access, preventing and investigating security incidents and fraud, complying with law, and providing a functional accommodation requested by the resident.

If we begin using or disclosing sensitive personal information for a purpose that triggers the right to limit, we will provide a conspicuous Limit the Use of My Sensitive Personal Information method before that use begins.

10 Children and teens

We do not have actual knowledge that we sell or share the personal information of consumers under 16. We do not knowingly sell, share, or use for targeted advertising the personal information of anyone under 18. Our Services are not directed to children under 13, and we do not knowingly collect their personal information online without legally required parental consent.

Contact [email protected] if you believe a minor's information was handled contrary to this section. A parent or guardian may use the request methods in Section 8.

11 Referral program and financial incentive

Our referral program may provide a $100 benefit to a new client on a first qualifying Enzo garment purchase of $400 or more and a $100 credit to the introducing client. The referred person must self-submit a link or code before Enzo contacts them; attribution lasts 90 days; and an eligible introducing-client credit is issued within 30 days after full payment and the six-hour cancellation period. The credit expires after 18 months where lawful. One referral credit may be used per transaction and may be combined with a paid gift card, but not another promotion, employee discount, or family-and-friends discount.

Because the program uses personal information to attribute referrals and provide benefits, Appendix C provides a Notice of Financial Incentive. Review that notice and the applicable referral-program terms before participating.

12 Shine the Light

California's Shine the Light law permits eligible residents to request information about certain disclosures of personal information to third parties for their own direct-marketing purposes. We do not disclose personal information to third parties for their own direct marketing as defined by that law without the applicable choice. Questions or requests may be sent to [email protected] with "California Shine the Light" in the subject line.

13 Security

We use administrative, technical, and physical safeguards designed for the nature of the information and our operations. No system is completely secure. If an incident triggers a California notice requirement, we provide notice in the legally required manner and time.

14 Accessibility and other formats

This Notice is designed to be printable and accessible. Contact us if you need it in an alternative format or in another language in which we provide material privacy notices. Our Accessibility Statement provides additional contact options.

15 Changes to this Notice

We may update this Notice as laws, vendors, technologies, or our practices change. We will post the revision with a new Last updated date and provide additional notice or obtain consent where required. Prior versions are available on request.

16 Contact us

Privacy Office Enzo Custom Florida Inc. d/b/a Enzo Custom 501 E Las Olas Blvd., Suite 300 Fort Lauderdale, FL 33301 [email protected] 888-622-3696 Privacy Request Form Your Privacy Choices

Appendix A California Notice at Collection

Effective: October 1, 2026

This Notice at Collection is provided by Enzo Custom Florida Inc. d/b/a Enzo Custom. It applies when we collect personal information online or offline from a California resident. A shorter collection-point notice may identify the categories relevant to a particular form, showroom interaction, call, appointment, order, or feature and link directly to this Appendix.

We do not sell personal information for money. As described below, we may sell or share limited online or advertising information under the CCPA's broad definitions. You can opt out at or before collection through Your Privacy Choices or a qualifying Global Privacy Control signal.

Category collected	Representative examples	Purposes	Sold or shared under CCPA	Ordinary retention criterion
Identifiers and customer-record information	Name, contact details, addresses, IP address, online, appointment, client, order, account, or referral identifier, payment token, billing details, and signature	Appointments, orders, payment, delivery, support, accounts, identity matching, consent, security, and fraud prevention	Limited online identifiers may be sold or shared for advertising or measurement; no sale for money	Active client profile plus 3 years without substantive customer activity, then delete or irreversibly deidentify. Passive marketing engagement does not restart the period. Minimum transaction records generally 7 years; inquiry-only records generally 3 years.
Commercial, appointment, order, and referral information	Appointments, consultations, products, fabrics, alterations, refunds, credits, gift cards, referral activity, product interactions, and conversion events	Provide and service garments, administer programs, accounting, analytics, attribution, and improve offerings	Limited product interaction, campaign, or conversion events may be sold or shared; detailed order, measurement, and referral-credit records are not	Generally 7 years after final transaction or program activity
Measurements, fit, style, and preferences	Body and garment measurements, nonmedical fit observations, alterations, size, style, color, fabric, showroom, clothier, and communication preferences	Design, produce, alter, reorder, personalize, and support garments and service	No	Active relationship plus 3 years without a purchase, appointment, or direct service contact, then delete or irreversibly deidentify. Passive marketing activity does not restart the period. Keep only minimum transaction fields in the restricted 7-year archive.
Internet, device, and interaction information	Cookie and advertising identifiers, IP address, browser/device, pages, clicks, searches, referrer, timestamps, email engagement, consent signals, session interactions, and security logs	Operate, secure, remember choices, analyze, attribute, troubleshoot, improve, and advertise subject to choice	Yes, depending on the technology and choice	No new replay or heatmap collection. Historical raw recordings generally no more than 30 days; security logs, other analytics, and historical aggregated interaction analytics generally up to 24 months; cookie duration in preference center.
Approximate geolocation	City, state, or region inferred from IP and selected showroom	Localize service, route inquiries, prevent fraud, analytics, and advertising where allowed	Approximate location may accompany advertising or analytics information	Follows associated device, appointment, or order record
Communications, sensory, social, and submitted content	Email, text, chat, direct messages, forms, calls recorded or transcribed only after clear notice and affirmative consent, photos, video support, security footage where noticed, feedback, reviews, and content you send	Respond, support, fit review, service documentation, quality, disclosed transcription or AI summaries, security, dispute resolution, and public marketing only under separate authority	No service communications, photos, recordings, security footage, or private feedback	Routine support communications generally 3 years after last direct service contact; justified specific transaction or dispute records up to 7 years after resolution. Fitting photos: no longer than needed and ordinarily within 12 months of each capture; later interactions do not restart. Separate publicity media follow the release. Documented legal or active-dispute holds are restricted and reviewed periodically.
Professional information	Company, occupation, business contact details, dress requirements, or wardrobe context voluntarily provided	Tailor service and group or business engagement	No	Under the applicable inquiry, client, or order criterion
Inferences	Garment interests, preferred showroom or clothier, event timing, marketing interests, and recommendations	Personalization, routing, service, analytics, and marketing where permitted	Limited marketing or product-interest inferences may be sold or shared	Delete or irreversibly deidentify after 3 years without a purchase, appointment, or direct service contact. Passive marketing opens and tracking do not restart the period. Minimal consent and suppression evidence follows its separate schedule.
Consent, privacy, and security information	Notice version, channel choice, timestamps, opt-outs, Global Privacy Control, privacy requests, verification, access logs, and fraud events	Prove and honor choices, process rights, secure systems, prevent fraud, and comply with law	No	Consent evidence generally 5 years after the last relevant message or withdrawal; minimal suppression records generally 10 years and longer only while reasonably necessary to honor a continuing choice, a specific law, legal hold, claim, or enforcement matter; requests generally 2 years; security according to risk
Sensitive personal information	Limited payment or account credentials handled by providers and limited functional-accommodation information voluntarily provided that may reveal health or disability information	Provide requested services, payment, authentication, security, legal compliance, and requested accommodation	No	Only as long as needed for the purpose and applicable legal, transaction, security, or claim period

We do not use or disclose sensitive personal information to infer characteristics or for other purposes that trigger a right to limit. We do not knowingly sell or share personal information of anyone under 16 and, as a matter of policy, do not knowingly sell, share, or use for targeted advertising the personal information of anyone under 18.

Some providers identified in our Cookie Policy and preference center may act as third parties that independently control collection through their tags or embedded features. For each such provider, our preference center links to the provider’s own notice at collection or includes the provider’s collection practices in a joint notice at collection.

For the full description of sources, recipients, retention, and rights, read this California Privacy Notice and our United States Privacy Policy. To request access, deletion, or correction, visit enzocustom.com/privacy-request, email [email protected], or call 888-622-3696.

Appendix B Notice of Right to Opt Out of Sale or Sharing

California law gives you the right to direct Enzo Custom not to sell or share your personal information.

What this means

Enzo Custom does not sell personal information for money. We may permit advertising, social-media, analytics, or attribution providers to receive online identifiers, IP address, device and internet activity, approximate location, limited product interactions or conversion events, or related inferences. Under the CCPA's broad definitions, that activity may be a sale or sharing even when no money is paid for the information.

We do not sell or share measurements, fit notes, functional accommodation information, service photographs, full payment-card data, call content, private feedback, or SMS opt-in data for cross-context behavioral advertising. We do not knowingly sell or share the personal information of anyone under 16.

How to opt out

Use any of these methods:

1. Select Opt Out of Sale, Sharing, and Targeted Advertising at Your Privacy Choices.

2. Enable a qualifying Global Privacy Control signal in a supported browser or extension and visit our site.

3. Email [email protected] with "Do Not Sell or Share" in the subject line.

4. Call 888-622-3696 and ask to opt out of sale and sharing.

You do not need an account, and we do not verify your identity unless limited information is needed to associate an offline or account-level practice with your request. A Global Privacy Control signal applies to the browser or device that sends it and, when we can reasonably associate it with an account or profile, to related information as required.

We process the request as soon as feasible and no later than 15 business days. When technically feasible and legally required, the privacy interface indicates that the opt-out has been recognized. We notify relevant third parties of the request when required. We will not ask you to opt back in for at least 12 months unless you initiate the request.

Opting out does not stop disclosures to service providers or contractors needed to provide requested Services, maintain security, process payment, or comply with law. It does not stop contextual advertising. You may still separately manage analytics and functional technologies in the preference center.

Questions may be sent to [email protected] or 888-622-3696.

Appendix C Notice of Financial Incentive Referral Program

Effective: October 1, 2026

Enzo Custom offers a voluntary referral program. We do not condition participation on consent to sell or share personal information, and we do not sell referral-program information for money. We provide this Notice because the program collects and retains information to attribute referrals and provide a price or service benefit.

1 Summary of the benefit

• A referred friend may receive a $100 benefit on a first qualifying garment purchase of $400 or more.

• The introducing client may receive a $100 Enzo Custom credit after the referred friend's qualifying order is confirmed and paid.

• The current referral-program terms govern private personal sharing, the 90-day attribution period, the 30-day issuance period, 18-month expiration where lawful, a 15-credit ($1,500) annual limit per introducing client, one-credit rule, paid-gift-card combination, promotion and discount exclusions, fraud controls, cancellations, returns, and other restrictions.

2 Personal information involved

The program may use the participant's name, contact information, client or referral identifier, referral link or code, attribution and interaction records, qualifying purchase status, benefit or credit issuance and redemption, fraud-prevention information, and program communications. A referred friend submits their own information and choices. We do not contact a friend merely because an introducing client identifies them.

3 How to opt in

A participant opts in by voluntarily joining or using the referral program after receiving this Notice—for example, by requesting or sharing a personal referral link, submitting information through the referred-friend journey, or applying a referral benefit to a qualifying purchase. Participation is not required to buy garments at the ordinary price and service level.

4 How to withdraw

A participant may withdraw at any time by emailing [email protected], submitting a request at enzocustom.com/privacy-request, or calling 888-622-3696. State "Withdraw from Referral Program." Withdrawal stops future participation after processing. It does not require us to unwind a completed transaction or erase records we must retain for accounting, fraud prevention, dispute resolution, or law. Treatment of an already earned or redeemed benefit is governed by the program terms and applicable law.

5 Good faith value estimate and method

Enzo Custom estimates incremental data value at up to $100 per participating consumer receiving a benefit for a completed qualifying referral. The estimate concerns information used to attribute and administer referrals; it is not a sale price for personal information. Unconverted referrals may have lower or no incremental value.

Our method considers incremental gross margin and acquisition cost avoided, less both participants’ benefits and attributable administration, communication, fulfillment, and fraud costs. We compare qualifying referrals and their conversion and redemption experience with the $100 individual benefit. The benefit cap alone does not establish data value. We document and reassess the calculation annually and after material changes, and revise or suspend the incentive if its relationship to estimated value cannot be supported.

6 Privacy choices and nondiscrimination

Joining the program does not require consent to sell or share personal information. A participant may opt out of sale, sharing, and targeted advertising through Your Privacy Choices without withdrawing from the referral program. We do not unlawfully discriminate against a person for exercising a CCPA right.

For details about information practices and rights, read this California Privacy Notice and our United States Privacy Policy.