3.1 User Ability to Access, Update, and Correct PII. At any time you may contact Brushempire.com via email at [email protected] to update your PII or request that your PII no longer be shared by Brushempire.com. In the case that your user name or password is lost, stolen, or used without permission, promptly contact

Brushempire.com at [email protected] to update the PII we have on file for you.

3.2 Your California Privacy Rights. California residents may have additional personal information rights. For more information or to see if these rights apply to you, please contact us. We will promptly review all such requests in

accordance with applicable laws. As described in this Privacy Policy, from time to time we may make your personal information available to third parties for their marketing purposes. California law permits individuals who are

California residents to request certain information about our disclosure of personal information to third parties for direct marketing purposes. If you are a California resident and would like to make such a request, please submit your request in writing to [email protected]. If you do not want us to share your personal information with third parties, you may opt-out of this information sharing by emailing us at [email protected]. In accordance with California Civil Code Sec. 1789.3, California resident users are entitled to know that they may file grievances and complaints with the California Department of Consumer Affairs, 1625 North Market Blvd., Suite N112, Sacramento, CA 95834; or by phone at 916-445-1254 or 800-952-5210; or by email to [email protected].

3.3 Persons covered by GDPR. Certain rights are granted to persons in the European Union. If you are a person for whom the processing of personal information is subject to REGULATION (EU) 2016/679 (GDPR) (“Covered Person”), the rights described in this section apply to you. Right of access, rectification, erasure and restriction of processing: you may obtain access to your personal information stored by us by contacting us. If we process or use your personal information, we shall endeavor to ensure, by implementing suitable measures, that your personal information is accurate and up to date for the purposes for which they were collected. If your personal information is inaccurate or incomplete, you may obtain the rectification of such personal information by contacting us. You may obtain the erasure or restriction of processing of your personal information in situations where no legitimate business purpose exists, or the further storage is unnecessary under statutory storage obligations. Right to data portability: you may receive the personal information about you that you have provided to us, in a structured, commonly used, and machine-readable format or transmit this information to another controller. To exercise this right, contact us. Right to object: you may object, on grounds relating to your particular situation, to the processing of your personal information. To exercise this right, you must contact us as provided herein. To the extent your personal information is processed for reasons other than direct marketing, you understand and agree that we have compelling legitimate reasons for information processing, such as providing access to our Services. You may use ad-blocking software to limit information capture and usage. You may also contact us with questions about this policy or to make a removal request. Making a request does not guarantee that the request will be honored. Right to withdraw your consent: If you have given your consent to the collection or processing of your personal information, you may withdraw your consent without affecting the lawfulness of processing based on consent before its withdrawal by contacting us in writing. We currently store your personal information in the United States, but your personal information may be transferred, stored, or processed in a location outside of the United States. If you make a request under the sections above, we have 30 days to respond to you. To exercise any of these rights, please contact us. The legal basis for processing your personal information is: The collection of your data is necessary for the performance of our contractual relationship.

3.4 Security. Brushempire.com maintains reasonable physical, administrative, and technical safeguards to protect PII from loss, misuse, or unauthorized access, disclosure, alteration, or destruction. However, no system is 100% secure. Brushempire.com enforces its Privacy Policy via self-assessment.