Grove Collaborative Privacy Policy

Effective Date: July 12, 2023

Grove Collaborative operates an ecommerce service and related services through grove.com, grove.co, mobile applications, and related sites accessible to mobile devices, tablets, and other connected devices (collectively, the “Grove Collaborative Service” or “Service”). As used in this policy, “Grove Collaborative” refers to Grove Collaborative, Inc. and its subsidiaries. We may refer to Grove Collaborative as “we”, “us”, or “our”. We may refer to you as “consumer”, “you”, or “your”.

This Privacy Policy describes the personally identifiable information from or about an individual ("Personal Information") that we gather from you, how we use and disclose that information, and the ways in which you can control how we use and share it. By using our Service or when applying for or accepting a position with us, you acknowledge that you have read, understood and agreed to the terms of this Privacy Policy. If you are unable to review or access this Privacy Policy and require assistance, please contact us at: support@grove.co.

When you use the Service, this Privacy Policy is incorporated into and is subject to the Grove Collaborative Terms of Use. Please make sure that you have carefully read and understand the Grove Collaborative Terms of Use before you use our Service. Capitalized terms that are not defined in the privacy policy have the meaning given to them in the Grove Collaborative Terms of Use.

Residents of California, Colorado, Connecticut, Nevada, Utah, and Virginia may have additional rights. Please see our Supplemental Privacy Notices for each of these states.

TYPE OF INFORMATION WE COLLECT

How Information is Collected. Grove Collaborative collects your information in two ways:

Directly (for example, when you provide information when you use or visit the Service or submit a job application).
Indirectly (for example, through technology used within the Service or within our talent management tools).

Information That You Give Us Directly

We receive and store any information you voluntarily give to us when you use the Service, submit a job application or work for us. You may choose not to provide certain information, but then you might not be able to use the Service, take advantage of certain Service features, or complete job related activity with us. You provide most of this information when you interact with the Service or our talent management tools. Some examples of of this type of information are below.

When you create an account or login to your account, the information that we request such as your first and last name, email address, shipping address, billing address, phone number, and password.
When you order products on our Service, the information necessary to complete the transaction, such as your name, items purchased, special instructions, date and time of order, purchase price information, limited credit card information (last four digits and expiration date), billing information and shipping information.
When you interact with certain Service features, the information that you provide during that interaction, such as (i) product reviews, (ii) information required to participate in one of our sweepstakes, giveaways, contests, customer panels, or other programs, (iii) information that you submit or provide if you choose to participate in one of our surveys, quizzes, or other questionnaries - including the Grove Wellness quiz, and (iv)information required to verify your identity. Please do not post or add Personal Information in your reviews.
When you contact us, the information that you provide and the information that we need to respond, such as your name, email address, your message to us, and our response.
When you visit us at our offices or locations, information that you provide, such as your name and email address and information gathered from security surveillance.
When you interact with us as part of a business relationship, professional information that you provide such as your job title and information about your employer.

Information That You Give Us via the Grove Careers Page

You can search for open positions and apply for a job with Grove Collaborative through our Careers site.

When you submit a job application with us, you provide requested information, such as your name, email address, postal address, telephone number, military or veteran status, job history, and educational information.
If you send us an email regarding a position, the information we receive is the information you include in your cover letter, resume and email message.
By providing us with your information in connection with employment opportunities, you authorize us to transmit and store your information in our recruitment database, to circulate that information as necessary for the purpose of evaluating your qualifications for job openings with Grove Collaborative, and to contact you about possible employment opportunities. If you are hired by Grove Collaborative, the information you provide during the recruiting process will become part of our employee records.

Information Collected Automatically

When you use the Service, we collect information automatically to help us operate and improve the Service or process a job or business related interaction, such as the Internet protocol (IP) address used to connect your computer to the Internet; device data, login; email address; password; computer and connection information such as browser type, version, and time zone setting, browser plug-in types and versions, operating system, and platform; the full Uniform Resource Locator (URL); information regarding your interaction with our Service and advertisements; inferences such as recommendations of products based on your purchase or browsing history; clickstream to, through, and from any of our Internet web sites, including date and time; cookie number; products you viewed or searched for; and the phone number you used to call our 800 number. We may also use browser data such as cookies or similar technologies on certain parts of our website for business processes, fraud prevention and other purposes. For details about how we use these technologies, and your opt-out opportunities and other options, please see our Cookie Policy. We receive information from you and third-parties that helps us approximate your location. During some visits we may use software tools such as JavaScript to measure and collect session information, including page response times, download errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs), and methods used to browse away from the page. We may also collect technical information to help us identify your device for fraud prevention and diagnostic purposes.

Information from Other Sources

We may receive or collect information about you from third parties and combine and store it on our servers with other information we may have already received or collected from you. We may store this information or combine it with information we collect in other ways. Some examples include:

Service partners that provide or make available advertising, features and functionality, and content on or through the Service.
Partners that collect and maintain information on their consumers. These partners may provide Grove Collaborative with certain information about those consumers for the purposes of serving advertisements and/or marketing offers to their consumers.
Marketing companies and data providers that create, maintain, and distribute professional marketing lists or segments, or maintain and distribute other marketing, or similar information.
Governmental or quasi-governmental agencies or organizations that provide or make available, to the public, census and demographic data.
Third-party social media websites, applications, or services that you use, when we allow those websites, applications, or services to interact through the Service to provide personalized services to you. In some cases, those websites, applications, or services may automatically provide us with information about you to facilitate personalization unless you use the controls available on those websites, applications, or services to opt-out of such sharing.

HOW WE USE THE INFORMATION THAT WE COLLECT

We use your Personal Information in ways that help us operate and improve the Service and complete requested business activities. Some examples include:

To fulfill your requests or to meet the reason you provided the information. For example, if you share your name and contact information to ask a question about our products or Service, we will use that Personal Information to respond to your inquiry. If you provide your Personal Information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process returns. If you choose to provide responses to the Grove Wellness quiz to help you identify which products might meet you needs, we will use this information such as your email, nutritional needs, health concerns, dietary preferences, and other health-related information to display, email and offer product information.
To personalize and provide the Service, such as to identify you as a consumer, to establish and maintain your account, to remember your information so that you do not have to re-enter it, to provide the transactions that you request, to assess the current and future needs of your household, to process and fulfill your orders, provide refunds.
To contact you for administrative purposes, legal purposes, and certain Service-related purposes, such as to send you emails, text messages, or other communications about your orders, consumer support requests, and products and services that we believe may interest you.
For marketing and advertising purposes, such as displaying content based upon your interests or providing promotional and advertising materials (either directly or through our service providers) about our products and Services, including relevant product information based on your responses to our Wellness Quiz. You may opt-out of our marketing communications by submitting a request by clicking here.
To contract or partner with third parties to provide specialized services on our behalf, such as development, hosting, analytics, maintenance, payment processing, products, shipping, message delivery, payment processors, consumer support, ad servers or other providers of advertising services, platform technology providers, bulk email processors, parties who assist us with sweepstakes management and prize fulfillment, and other services relating to the operation of the Service.
To test, research, and analyze our Services.
To help maintain the safety, security, and integrity of our Service, databases and other technology assets, and business.
To evaluate any job applications you may submit to us.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
To execute any other purpose disclosed to you at the time we collect or receive the information, or otherwise with your consent.

WHEN WE DISCLOSE THE INFORMATION THAT WE COLLECT

We will share categories of your Personal Information for business purposes with certain third parties that help us perform our business operations or that you designate to receive such information, including other websites, social media platforms, other individuals, and other businesses. For example, we may disclose your Personal Information to:

Service providers who provide specialized services on our behalf such as development, hosting, analytics, maintenance, payment processing, products, shipping, message delivery, text messaging, consumer support, ad servers or other providers of advertising services, platform technology providers, bulk email processors, talent management tools, benefits providers, parties who assist us with sweepstakes management and prize fulfillment, and other services relating to the operation of our business.
Third party payment processors who process your payment when you make a purchase on the Service. We rely on these third parties (such as Paypal and Stripe) to collect and process directly payment and financial information you provide to pay for your purchases. The terms and policies regarding the security practices of and use of your information by the payment processors is governed by the terms and conditions of these third parties, and we encourage you to read their terms carefully before submitting your information.
Other parties that we think are necessary to: (i) take precautions against liability; (ii) protect Grove Collaborative and others from fraudulent, abusive, or unlawful uses or activity; (iii) investigate and defend ourselves against any third party claims or allegations; (iv) protect the security or integrity of the Service; and/or (v) protect the rights, property, or personal safety of Grove Collaborative, our users, or others. We may also disclose your information if required to do so by law or if we believe that such action is necessary to comply with state and federal laws; in response to a court order, judicial or other government subpoena or warrant; or to otherwise cooperate with law enforcement activity.

If we engage in a joint promotion with a business partner, we may share your contact information with our business partner to be used in relation to the promotion. We may share aggregated or non-personal information (such as the number of daily visitors to a particular web page or the size of an order placed on a certain date) with third parties such as advertising partners. We can also share your Personal Information as part of a sale, merger or change in control, or in preparation for any of these events. Any other entity which buys Grove Collaborative or part of our business will have the right to continue to use your information, but only in the manner set out in this Privacy Policy unless you agree otherwise.

Use of Anonymized Information

We anonymize and aggregate certain Personal Information we collect (so that it does not directly identify you). We may use anonymized information for purposes that include testing, research, data analysis, and Service improvements. We may also share such anonymized information with others.

Information You Provide About Others

If you provide Personal Information about another person (“Others") in connection with using the Service (such as programs through which refer a friend or family member) or interacting with Grove Collaborative in a business relationship (such as on job applications or to complete employment benefit information), we rely upon you to obtain any consents from Others that may be required by law to allow us to use the Personal Information of such Others. We will use the Personal Information of such Others as set forth in this Privacy Policy.

Data Retention

We retain information from or about you for so long as necessary to fulfill the purposes outlined in this Privacy Policy. When the information is no longer necessary for these purposes, we may delete it or keep it in a form that does not identify you, unless we are required by law to keep this information for a longer period. When determining the retention period, we take into account various criteria, such as the type of products and services requested by or provided to you, the nature and length of our relationship with you, possible re-enrolment with our products or services, the impact on the services we provide to you if we delete some information from or about you, mandatory retention periods provided by law and the statute of limitations. You may have a right to request deletion of your Personal Information if you are a resident of certain states, and we will use commercially reasonable efforts to honor your request where required by law. However, we may be required to keep certain Personal Information and not delete it or to retain Personal Information for a certain time. In these cases, we will comply with your deletion request only after we have fulfilled applicable requirements. Deleted Personal Information is removed from Grove Collaborative’s active database, but may remain in our archives. We may also retain your Personal Information for fraud prevention or similar purposes.

Links to Third Party Services

The Service may also contain features or links to websites and services provided by third parties that we do not operate and are outside of our control. Any Personal Information you provide on these third party sites or services is provided directly to that third party and is subject to that third party's policies, if any, governing privacy and security, even if accessed through the Service. Please exercise caution and review their applicable privacy and security policies before providing them with Personal Information. We are also not responsible for any products or services you may purchase from these third-party sites. We do not and will not provide any representations or recommendations in relation to any of the information and suggestions comprised within the services. We do not guarantee or endorse the products or services offered by the third party. You are deemed to be responsible for and shall use your own skill and judgment as to, the quality, value and suitability of such information and suggestions and in deciding whether to enter into any contract with any third party for the supply of services or sale of goods.

Our Commitment To Children's Privacy

We do not knowingly allow children under 16 years of age to use the Service or knowingly collect or maintain Personal Information from persons under 13 years of age. If you are under 16 years of age, then please do not use or access the Service at any time or in any manner. If a child under 13 submits Personal Information to Grove Collaborative and we learn that the Personal Information is the information of a child under 16, we will attempt to delete the information as soon as possible. If you believe that we might have any Personal Information from a child under 16, please contact us at legal@grove.co.

Our Commitment To Data Security

We use certain physical, managerial, and technical controls that are designed to improve the integrity and security of your Personal Information. We cannot, however, ensure or warrant the security of any information you transmit to us over the internet or store on the Service and you do so at your own risk. We also cannot guarantee that such information will not be accessed, disclosed, altered, or destroyed by breach of any of our physical, technical, or managerial controls.
If we learn of a security systems breach, then we may attempt to notify you electronically so that you can take appropriate protective steps. We may post a notice through the Service if a security breach occurs. Depending on where you live, you may have a legal right to receive notice of a security breach in writing. To receive a free written notice of any security breaches, you should notify us at support@grove.co.

International visitors

The Service is hosted in the United States and is intended solely for consumers located within the United States. If you choose to use the Service from the European Union or other regions of the world with laws governing data collection and use that may differ from U.S. law, then please note that you are transferring your personally identifiable information outside of those regions to the United States for storage and processing, and by providing your personally identifiable information on the Service you consent to that transfer, storage, and processing. Please note that the United States does not have the same data protection laws as the European Union and other regions.

Changes and updates to this Privacy Policy

Please revisit this page periodically to stay aware of any changes to this Privacy Policy. If we modify this Privacy Policy, we will make the modified version available through the Service and update the last updated data above. In the event that the modifications materially alter your rights or obligations hereunder, we will make reasonable efforts to notify you of the change. Our amended Privacy Policy will automatically take effect 30 days after it is made available through the Service, and if you do not agree with any changes to the Privacy Policy, you may terminate your account and stop using the Service. Your continued use of the Service after the revised Privacy Policy has become effective indicates that you have read, understood and agreed to the then-current version of the Privacy Policy.

Our contact information

Please contact us with any questions or comments about this Privacy Policy, your Personal Information, our use and disclosure practices, or your consent choices by e-mail at dataprivacy@grove.co. You may also contact us at the following address:

Grove Collaborative, Inc.

1301 Sansome Street

San Francisco, CA 94111

SUPPLEMENTAL STATE SPECIFIC PRIVACY NOTICE

This Supplemental State Specific Privacy Notice (“Supplemental State Notice”) applies only to Personal Information collected about consumers residing in California, Colorado, Connecticut, Nevada, Utah, and Virginia and supplements the information contained in the Privacy Policy. It provides information required under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, the “CCPA”), the Colorado Privacy Act of 2021 (the “CPA”), the Connecticut Data Privacy Act of 2022 (“CDPA”) the Nevada Privacy Act (the “NPA”), the Utah Consumer Privacy Act of 2022 (the “UCPA”) and the Virginia Consumer Data Protection Act of 2021 (the “VCDPA”) (all of which are collectively referred to as the “State Privacy Laws”) and their related regulations.

This Supplemental State Notice describes our practices regarding the collection, use, and disclosure of Personal Information and instructions for submitting data subject requests for consumers residing in states covered by the State Privacy Laws. If you are unable to review or access this Supplemental State Notice and require assistance, please contact us at: support@grove.co.

Definitions Used in this Policy

“consumer” means a natural person who resides in California, Colorado, Connecticut, Nevada, Utah and Virginia and to whom we offer the Services. For purposes of this Supplemental Policy, this term includes natural persons who reside in California and engage with us as part of business-to-business transactions, submit a job application to Grove Collaborative or work for Grove Collaborative.

“Personal Information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information includes “personal data” as that term is defined in the CPA, VCDPA, UCPA, NPA and CDPA. Personal Information also includes “Sensitive Personal Information,” as defined below.

“Sensitive Personal Information” means personal information that reveals a consumer’s: 1) social security, driver’s license, state identification card, or passport number; 2) account log-in, financial account number, debit card number, or credit card number in combination with any required security or access code, password, or credentials allowing access to the individual’s account; 3) precise geolocation; 4) racial or ethnic origin; 5) religious beliefs; 5) union membership; 6) contents of email or text messages, unless we are the intended recipient; 7) genetic data; 8) biometric information used to uniquely identify the consumer, and 9) health information, sex life, or sexual orientation. Sensitive Personal Information also includes “sensitive data” as that term is defined in the CCPA, CPA, CDPA, UCPA, and VCDPA.

“third party” means a person or organization which is not a consumer, service provider, or an entity owned or controlled by us and as defined by the CCPA, CPA, CDPA, UCPA, and VCDPA.

“service provider” means a “vendor,” “contractor,” or “processor” which collects, stores, or otherwise handles data for us, as those terms are defined in the CCPA, CPA, CDPA, NPA, UCPA, and VCDPA.

Other terms used in this Supplemental State Notice are as defined under the CPA, CPA, CDPA, NPA, UCPA, and/or VCDPA. If a definition varies under the different laws, the definition that applies in your state will apply. For example, if you are a California consumer, terms used in this Supplemental State Notice will have the definition used in the CCPA.

The Personal Information We Collect and Disclose

Below is a summary of the Personal Information we may collect (including the information collected from consumers over the past 12 months), the reason we collect the Personal Information, the types of sources from which each category of Personal Information is collected, and the type of third parties with whom we may share consumer Personal Information. As the summary shows, we may share or sell Personal Information to third parties or disclose certain Personal Information to service providers for business purposes.The section references relate to the sections above in the Privacy Policy.

Type of Information	Sources of Information	How We Use Information	How We Share Information
Identifiers (such as a name, address, unique personal identifier, email, phone number)	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description Data Retention	When We Disclose The Information That We Collect Links to Third Party Services
User records such as account and password Information	Type Of Information We Collect	How We Use The Information That We Collect Data Retention	When We Disclose The Information That We Collect Links to Third Party Services
Commercial information such as records of products or services purchased, obtained, or considered	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description Data Retention	When We Disclose The Information That We Collect Links to Third Party Services Third Party Cookies
Internet/electronic activity	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description Data Retention	When We Disclose The Information That We Collect Links to Third Party Services Third Party Cookies
Geolocation (outside of 1750 feet)	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description Data Retention	When We Disclose The Information That We Collect Links to Third Party Services Third Party Cookies
Demographic Information	Type Of Information We Collect	How We Use The Information That We Collect Data Retention	When We Disclose The Information That We Collect Links to Third Party Services
Sensory data, such as audio, electronic, visual (including support calls and video clips) or other similar information	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description Data Retention	When We Disclose The Information That We Collect Links to Third Party Services Third Party Cookies
Inferences about preferences, characteristics	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description	When We Disclose The Information That We Collect Links to Third Party Services Third Party Cookies
Sensitive Information which consists of account login data and possible health data (such as pregnancy diagnosis) for users of the Service; and for job applicants/employees may include social security number, driver’s license number, racial/ethnic origins, religious or philosophical beliefs, contents of emails or texts to others, genetic/biometric data, sexual orientation data	Type Of Information We Collect Category of Use of Cookies	How We Use The Information That We Collect Description Data Retention	When We Disclose The Information That We Collect Links to Third Party Services Third Party Cookies

Your Rights Related to Your Personal Information

As required by the State Privacy Laws, we provide detailed information below regarding the data subject rights available to California, Colorado, Utah, Nevada, Connecticut and Virginia consumers. Generally, the rights which you have can be categorized as follows:

Know whether we process your Personal Information.
Access and delete certain Personal Information.
Data portability.
Opt-out of Personal Information processing for targeted advertising and sales
Correct inaccuracies in your Personal Information, taking into account the information’s nature processing purpose.
Opt-out of profiling in furtherance of decisions that produce legal or similarly significant effects.

Processing of Sensitive Information: We must obtain your express consent prior to collecting and processing certain categories of Sensitive Personal Information such as health data, data about protected characteristics and genetic or biometric data.

Non-Discrimination: Grove Collaborative will not discriminate against customers who exercise their rights under the State Privacy Laws.

Personal Information of Minors

The Service is not intended for children or minors under the age of 16. Accordingly, we do not knowingly store information from minors under the age of 16 except as required pursuant to applicable law. If you believe that a child has submitted Personal Information to us, please contact us at dataprivacy@grove.co, and we will delete the information.

Financial Incentives for Consumers

Grove Collaborative does not have programs that provide financial incentive to consumers who allow us to retain and share their Personal Information.

PRIVACY NOTICE FOR CALIFORNIA RESIDENTS

If you are a California resident, the CCPA and CPRA grant you certain rights related to your Personal Information as summarized below.

Right to Know: You may ask us for a copy of your Personal Information collected over the past 12 months and for information about how we collect, use, disclose, and sell it.
Right to Deletion: You may ask us to delete any Personal Information. If you delete your Personal Information, you will permanently lose access to your account and the information in your account. We may save Personal Information when permitted by applicable law or for business purposes including, without limitation, when the information is needed to comply with our legal obligations (including law enforcement requests), meet regulatory requirements, meet requirements of our business operations, resolve disputes, maintain security, prevent fraud and abuse, enforce our Terms of Service, fulfill your request to “unsubscribe” from further messages from us, or confirm that we have deleted your data. We retain de-personalized information after your account has been closed. Any information that you posted in product reviews, including your first name and last initial will remain visible on the Service. We cannot disclose or delete specific pieces of Personal Information if the disclosure would create a substantial, articulable, and unreasonable risk to the security of the personal information, your account with us or the security of our systems.
Right to Correction: You may modify certain details of your Personal Information by logging into our Service and using your username and password and visiting “Settings” on the “Account” page. If there are additional details of your Personal Information that need to be corrected, you may submit a request by completing this Privacy Request Form or contacting support@grove.co.
Right to Request Information: You have the right to request certain information regarding the Personal Information we have collected about you. You may make such a request up to twice in a 12- month span. Please note that there are circumstances in which we may not be able to comply with your request, including when we cannot verify your request or when there is a conflict with our own obligations to comply with other legal or regulatory requirements. We will notify you following submission of your request, if this is the case.
Notice of Sale and Right to Opt-Out of the Sale or Sharing of Your Personal Information: Grove Collaborative does not sell, in the traditional sense of the word, or rent Personal Information to third parties. We do, however, share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. We have shared the categories of Personal Information over the past 12 months as listed in the Privacy Policy. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from California residents from these activities. We do not knowingly sell or share Personal Information of consumers under 16 years of age.You have the Right to Opt-Out of sharing of your Personal Information and of the processing of Personal Information for the purpose of targeted advertising. To exercise this right, please submit a request by clicking here. The link will take you to a webform that you can complete and submit to make a request to opt out. Please note that any request to opt-out may take a few days to become effective, but will be handled within the timeframe permitted by law. Once your opt out request is processed, it will apply on a going forward basis with respect to our disclosure of information. Although we do not sell your Personal Information after you submit an “Opt Out Request”, we will continue to share some Personal Information with service providers. These service providers help us perform a host of services, including, but not limited to, analytic-related functions such as measuring our website performance, ensuring services are working correctly and securely, providing aggregate statistics and analytics, communicating directly with users and/or reducing fraud.
Right to Limit Use of Sensitive Personal Information: California consumers have the right to limit the use of each type of Sensitive Personal Information for each purpose with each type of third-party partner. Consumers can revoke this permission at any time. Please note that Grove Collaborative collects very limited Sensitive Personal Information from users of the Service and we do not use or disclose Sensitive Personal Information in ways that would be subject to a California resident’s right to limit the use or disclosure of his or her Sensitive Personal Information under the CCPA. Grove Collaborative only uses or discloses Sensitive Personal Information to provide to you our products and/or Services and related information. If you are a user of the Service, Grove collects and stores (i) your account login information for the business purpose required (to permit and process your account access); and (ii) health related information you choose to provide in response to the Grove Wellness quiz to display, email and offer product information. If you are a job applicant or employee, much of the Personal Information that Grove Collaborative collects and stores about you (including your social security number, driver’s license number, racial/ethnic origins, immigration status, religious or philosophical beliefs, contents of emails or texts to others, genetic/biometric data, sexual orientation data, medical information, and information related to any accommodation requests regarding potential disabilities or other health conditions) include, or contain information from which it may be possible to infer, Sensitive Personal Information or characteristics of protected classifications under the CCPA. At this time, we do not use or disclose Sensitive Personal Information in ways that would be subject to a California resident’s right to limit the use or disclosure of his or her Sensitive Personal Information under the CCPA.
Right to Non-Discrimination: Grove Collaborative will not discriminate against consumers who exercise their rights. Specifically, if you exercise your rights, we will not deny you access to the Service, charge you different prices or rates for products or Service or provide you a different level or quality of products or Service. However, as permitted by the CCPA, we may offer you certain financial incentives that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to the value of your Personal Information, for instance, if you sign up for a newsletter with us, we may provide you with discounts for future Services. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time. Please note that a legitimate denial of a request to access, delete, or opt-out is not discriminatory, nor is charging a fee for excessive or repetitive requests.
Right to Appeal: You have the right to appeal our decisions about your data subject requests.

If any of the rights described in the sections above apply to you, you may make a request by visiting the Password & Privacy section of your Account Settings, or contacting us at dataprivacy@grove.co, and we will consider your request in accordance with applicable laws. In order to complete your request, you must confirm your identity. If you request to opt-out of sales/sharing of your Personal Information under the CCPA, you will be directed to verify your identity before completing your request. If you choose to exercise another right under the CCPA, you will directed to verify your identity by logging into your account.

California “Shine the Light” disclosure

The California “Shine the Light” law gives residents of California the right under certain circumstances to opt out of the sharing of certain categories of personal information (as defined in the Shine the Light law) with third parties for their direct marketing purposes, or in the alternative, that we provide a cost-free means for consumers to opt out of any such sharing. We do not currently share your Personal Information with third parties for their own direct marketing purposes.

PRIVACY NOTICE FOR NEVADA RESIDENTS

Nevada residents may have the right to request opt-out of the sale of Personal Information that we may collect through our websites or online applications. Grove Collaborative does not use your Personal Information in a way that constitutes a “sale” under the NPA (sell your personal information in exchange for monetary compensation). If you are a Nevada resident and wish to submit a request, contact support@grove.co.

PRIVACY NOTICE FOR VIRGINIA RESIDENTS

If you are a Virginia resident, you have the right to request, subject to our verification:

To confirm whether or not a controller is processing your Personal Information and to access such Personal Information;
To correct inaccuracies in your Personal Information;
To delete your Personal Information;
To obtain a copy of your Personal Information that you previously provided to us in a portable, and if technically feasible, readily usable format, if processing is carried out by automated means;
To opt out of the processing of your Personal Information for purposes of (i) targeted advertising, (ii) the sale of Personal Information, or (iii) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

Right to Non-Discrimination: Grove Collaborative will not discriminate against consumers who exercise their rights. Specifically, if you exercise your rights, we will not deny you access to the site or Services, charge you different prices or rates for products or Services or provide you a different level or quality of products or Services. However, as permitted by VCDPA, we may offer you certain financial incentives that can result in different prices, rates, or quality levels. Any permitted financial incentive we offer will reasonably relate to the value of your Personal Information, for instance, if you sign up for a newsletter with us, we may provide you with discounts for future services. Participation in a financial incentive program requires your prior opt in consent, which you may revoke at any time.

Sensitive Information Opt-In: We must also obtain your express consent prior to collecting and processing certain categories of Sensitive Personal Information such as precise geolocation data, data about protected characteristics and genetic biometric data. We do not generally collect this type of information from consumers, except when you choose to provide specific health diagnosis (such as pregnancy) in your responses to the Grove Wellness quiz. submitting your information to the Grove Wellness quiz-you agree that we may use this information to display, email and offer Grove product information.

If you are a resident of Virginia and wish to exercise any of your rights under the VCDPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising, sale, or profiling by submitting a Privacy Request Form here, or by emailing support@grove.co.

If you use an authorized agent to submit your request, we may require proof of the written authorization you have given. We also may require you to confirm your identity and your residency in order to obtain the information, and you are only entitled to make this request up to twice annually. For emails, please include “Virginia Privacy Rights” as the subject line. You must include your full name, email address, and attest to the fact that you are a Virginia resident. We will process your request within 45 days or let you know if we need additional time or cannot process your request. If you make this request by telephone, we may also ask you to provide the request in writing so that we may verify your identity. If we are unable to honor your request for any reason, we will notify you of the reason within the request time period.

If we decline to take action on your request, you can appeal our decision by submitting an email to support@grove.co entitled “Virginia Privacy Rights Appeal” and we will review your request and respond within 60 days of the receipt of your appeal with a written explanation of the reasons for our decision. If your appeal is denied, you may contact the Virginia Attorney General to submit a complaint.

PRIVACY NOTICE FOR COLORADO RESIDENTS

If you are a Colorado resident, you are provided with the following notification:

Sales and Targeted Advertising: Grove Collaborative does not sell your personal information in exchange for monetary compensation. We do share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from Colorado residents from these activities.

Profiling: To the extent we engage in automated processing or profiling to prevent, detect, protect against or respond to fraudulent or unlawful activity, we are not required to offer the right to opt out. We otherwise do not engage in profiling that requires an opt-out as defined under the CPA.

If you are a resident of Colorado and wish to exercise any of your rights under the CPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising by submitting a Privacy Request Form here, or by emailing support@grove.co. Please indicate that you are making a request pursuant to your “Colorado Privacy Rights” and provide us with the requested information to verify your request. We will take steps to verify your request by matching the information provided by you with the information we have in our records.

PRIVACY NOTICE FOR CONNECTICUT RESIDENTS

If you are a Connecticut resident, you have the following rights:

Right to Access: You may have the right to confirm whether or not we are processing your Personal Information and to access such Personal Information.

Right to Correction: You may have the right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information.

Right to Deletion: You may have the right to delete the Personal Information provided to us by you.

Right to Data Portability: You may have the right to obtain a copy of the Personal Information that you previously provided to us in a portable and, to the extent technically feasible, readily usable format that allows you to transmit your Personal Information to another controller without hindrance, where the processing is carried out by automated means.

Right to Opt-Out of Sale, Targeted Advertising, and Profiling: For purposes of the CTDPA, a “sale” includes disclosing Personal Information to a third party in exchange for monetary compensation or other valuable consideration. Grove Collaborative does not “sell” Personal Information under this definition. We do share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from Connecticut residents from these activities. Connecticut residents have the right to opt out of the processing of your Personal Information by us for decisions that produce legal or similarly significant effects concerning you. We do not process Personal Information for such profiling.

Right to Appeal: If you are a resident of Connecticut and wish to exercise any of your rights under the CTDPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising by submitting a Privacy Request Form here, or by emailing support@grove.co. Please indicate that you are making a request pursuant to your “Connecticut Privacy Rights” and provide us with the requested information to verify your request. We will take steps to verify your request by matching the information provided by you with the information we have in our records.

UTAH PRIVACY NOTICE

If you are a Utah resident, you have the following rights as of December 31, 2023:

Right to Access: You may have the right to confirm whether or not we are processing your Personal Information and to access such Personal Information.

Right to Deletion: You may have the right to delete the Personal Information provided to us by you.

Right to Opt-Out of Sale, Targeted Advertising, and Profiling: For purposes of UCPA, a “sale” includes disclosing Personal Information to a third party in exchange for monetary compensation. We do not “sell” Personal Information under this definition. Utah residents have the right to opt out of the processing of your Personal Information by us for decisions that produce legal or similarly significant effects concerning you. We do not process Personal Information for such profiling. We do share your Personal Information for targeted advertising purposes as we describe in the Privacy Policy to make the Service available to you. For example, we may disclose information to advertising partners, advertising technology companies, and companies that perform advertising-related services in order to improve the relevance of our advertising and marketing. To the extent possible, Grove Collaborative excludes Personal Information from Utah residents from these activities.

If you are a resident of Utah and wish to exercise any of your rights under the UCPA, you or your authorized agent may make a request to confirm, access, correct, delete, obtain a copy, or opt-out of the processing of your Personal Information for targeting advertising by submitting a Privacy Request Form here, or by emailing support@grove.co. Please indicate that you are making a request pursuant to your “Utah Privacy Rights” and provide us with the requested information to verify your request. We will take steps to verify your request by matching the information provided by you with the information we have in our records.

NOTICE CONCERNING DO NOT TRACK

Do Not Track (“DNT”) is a privacy preference that users can set in certain web browsers. We are committed to providing you with meaningful choices about the information collected on our websites for third-party purposes, and that is why we provide the variety of opt-out mechanisms listed above, and in our Cookies Notice. Some web browsers offer users a “Do Not Track” privacy preference setting in the web browser. We do not currently recognize or respond to browser-initiated Do Not Track signals. Learn more about Do Not Track at allaboutdnt.com.