California Consumer Privacy Act (CCPA) & California Privacy Rights Act (CPRA) Notice

Scope and Application

This California Consumer Privacy Act and California Privacy Rights Act Notice ("CCPA/CPRA Notice") applies exclusively to individuals who reside in the State of California ("California Residents" or "consumers"). This Notice supplements our general Privacy Policy and is intended to satisfy the notice requirements under California Civil Code Sections 1798.100 through 1798.199.4, as amended by the California Privacy Rights Act of 2020 (Proposition 24).

This Notice describes our practices regarding the collection, use, disclosure, and sale or sharing of personal information of California Residents, and informs you of your rights under California law. In the event of a conflict between this Notice and our general Privacy Policy, this Notice controls with respect to California Residents.

Covered Business: K-Life Enterprise, Inc. ("Company," "we," "our," or "us"), operating the KANHA SUTRA brand, with operations in California. Website: https://kanhasutra.com/

We provide the rights described in this Notice to all California Residents. We do so as a matter of policy, and our doing so is not an admission or determination that we meet any particular applicability threshold under California Civil Code Section 1798.140(d).

Categories of Personal Information Collected

In the preceding 12 months, we have collected, and may continue to collect, the following categories of personal information, as defined under the CPRA and applicable regulations:

Sources of Personal Information

We collect personal information from the following categories of sources:

• Directly from you, when you create an account, place an order, enroll in a subscription, submit a review, contact us, or subscribe to communications
• Automatically, through cookies and similar tracking technologies when you use our website at https://kanhasutra.com/
• Analytics service providers, including web analytics tools
• Subscription management and order fulfillment providers
• Marketing and communications platform providers, where you have consented to marketing
• Law enforcement or government agencies, where required by applicable law

Business and Commercial Purposes for Collection

We collect and use the personal information described above for the following business and commercial purposes:

• To process, fulfill, and deliver orders
• To confirm that you meet the minimum age requirement for our Site
• To create and administer user accounts and subscriptions
• To provide customer support and respond to inquiries
• To send transactional communications, including order confirmations, shipping updates, and subscription renewal reminders required by law
• To send marketing and promotional communications, subject to your consent
• To publish and moderate reviews and other content you choose to submit
• To conduct analytics and improve our website and services
• To detect and prevent fraud, security incidents, and unauthorized access
• To comply with applicable federal and state law, including dietary supplement labeling and serious adverse event reporting obligations
• To enforce our Terms of Service and protect our legal rights
• To maintain records for tax, audit, and regulatory compliance purposes

Disclosure of Personal Information to Third Parties

In the preceding 12 months, we have disclosed personal information to the following categories of third parties for the business purposes described above:

• Payment processors: to securely process transactions
• Shipping and delivery carriers: to fulfill your orders
• Subscription management providers: to administer recurring orders, reminders, and cancellations
• Analytics providers: to measure website performance and improve user experience
• Marketing platform providers: to deliver communications you have consented to receive
• Review hosting providers: to publish content you choose to submit
• Legal and compliance service providers: attorneys, accountants, and compliance consultants
• The U.S. Food and Drug Administration: in connection with mandatory serious adverse event reporting
• Law enforcement and regulatory agencies: when required by applicable law, subpoena, or court order
• Business successors: in connection with a merger, acquisition, or asset sale, subject to the same privacy protections

Sale and Sharing of Personal Information

We do not sell personal information as defined under the CCPA and CPRA. We do not share personal information for cross-context behavioral advertising purposes.

We do not permit third-party advertising technology to collect personal information on our product detail pages, shopping cart, or checkout.

If our practices change and we begin selling or sharing personal information, we will update this Notice and our Privacy Policy, provide a prominent "Do Not Sell or Share My Personal Information" link on our homepage, and provide California Residents with the ability to opt out before any such activity begins.

We honor opt-out preference signals, including the Global Privacy Control (GPC), as valid requests to opt out of the sale or sharing of personal information.

Sensitive Personal Information

As described above, we may collect the following categories of Sensitive Personal Information as defined under the CPRA:

• Account log-in credentials, including usernames and passwords (stored in encrypted form)
• Information that may be characterized as concerning a consumer's health or sex life, to the extent the products a consumer views or purchases permit such an inference to be drawn

We do not use Sensitive Personal Information for purposes beyond those expressly permitted under California Civil Code Section 1798.121(a). We do not collect or process Sensitive Personal Information for the purpose of inferring characteristics about a consumer, and we do not use it for targeted advertising, audience segmentation, or profiling. You have the right to direct us to limit our use and disclosure of Sensitive Personal Information to only what is necessary to provide the services you request. See the "Your Rights" section below for how to exercise this right.

Your Rights Under CCPA and CPRA

As a California Resident, you have the following rights with respect to your personal information:

1. Right to Know (Categories and Specific Pieces)

You have the right to request disclosure of: (a) the categories of personal information we have collected about you; (b) the categories of sources from which personal information was collected; (c) our business or commercial purposes for collecting, selling, or sharing personal information; (d) the categories of third parties to whom we have disclosed personal information; and (e) the specific pieces of personal information we have collected about you. Our disclosure obligation covers the 12-month period preceding your request.

2. Right to Access

You have the right to request that we provide you with a copy of the specific personal information we have collected about you in the preceding 12 months. We will deliver the requested information in a portable and, to the extent technically feasible, readily usable format.

3. Right to Delete

You have the right to request that we delete personal information we have collected from you, subject to certain exceptions permitted by law. We may retain personal information where necessary to: complete a transaction; detect security incidents or protect against fraud; comply with a legal obligation, including serious adverse event recordkeeping required by federal law; or exercise our legal rights. We will inform you of any exception that applies to your request.

4. Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you. Upon receiving a verifiable consumer request, we will use commercially reasonable efforts to correct the inaccurate information, taking into account the nature of the personal information and the purposes of the processing.

5. Right to Opt-Out of Sale or Sharing

You have the right to direct us to not sell or share your personal information. We do not currently sell or share personal information. If this changes, we will provide a "Do Not Sell or Share My Personal Information" link and a web-based opt-out mechanism on our homepage and in this Notice.

6. Right to Limit Use of Sensitive Personal Information

You have the right to direct us to limit our use and disclosure of your Sensitive Personal Information to only what is necessary to provide the goods and services you request, as permitted under California Civil Code Section 1798.121. To exercise this right, contact us using the methods provided in the "How to Submit a Request" section below.

7. Right to Non-Discrimination

We will not discriminate against you for exercising any of your rights under the CCPA or CPRA. We will not deny goods or services, charge different prices or rates, provide a different level of quality of goods or services, or retaliate against you for exercising your privacy rights.

How to Submit a CCPA/CPRA Request

You may submit a verifiable consumer request to exercise any of your rights described above using the following methods:

• Email: privacy@kanhasutra.com (Subject line: CCPA/CPRA Privacy Request)
• Toll-Free Phone: (866) 988-7405
• Web Form: https://kanhasutra.com/privacy-request
• Mail: K-Life Enterprise, Inc., 5062 Lankershim Blvd #137, North Hollywood, CA 91601, Attention: Privacy Compliance

Identity Verification

We are required to verify your identity before processing your request to protect against unauthorized disclosure or deletion of personal information. We will use the personal information you provide in your request to verify your identity by matching it against information we maintain on file. Depending on the sensitivity of the request, we may require additional verification steps. We will not retain any information provided solely for verification beyond what is necessary to fulfill the request.

Response Timeline

We will acknowledge receipt of your request within 10 business days and will respond to your request within 45 calendar days of receipt. If we require additional time (up to an additional 45 days), we will inform you in writing of the reason and extension period. We will provide our response to requests at no charge, unless requests are excessive, repetitive, or manifestly unfounded.

Authorized Agents

You may designate an authorized agent to submit a CCPA/CPRA request on your behalf. To use an authorized agent, you must provide the following to us:

• A signed written authorization from you permitting the agent to act on your behalf, OR a copy of a valid power of attorney granted pursuant to California Probate Code Sections 4000 to 4465
• Verification of the authorized agent's identity

In addition, we may contact you directly to verify your own identity in connection with the agent's request, unless you have provided a power of attorney. Failure to provide adequate authorization may result in denial of the request.

Household Requests

Where personal information is collected in connection with a household, all members of the household who are California Residents may jointly request to know, access, or delete the household's personal information. We may require individual verification from each household member before responding to such requests.

Financial Incentive Programs

We do not currently offer any financial incentive, loyalty, or rewards program that involves the collection or use of personal information in exchange for a price difference or other benefit. Our subscription program offers a discount on recurring orders, but it does not condition that discount on the provision of personal information beyond what is necessary to fulfill those orders. If we establish a financial incentive program in the future, we will provide the required disclosures under California Civil Code Section 1798.125, including the material terms of the program and the estimated value of your personal information.

California "Shine the Light" Disclosure

California Civil Code Section 1798.83 permits California Residents to request information about whether a business has disclosed personal information to third parties for those third parties' direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes. If our practices change, we will update this disclosure and provide the disclosures required by applicable law.

Contact for California Privacy Inquiries

For questions, concerns, or requests related to this CCPA/CPRA Notice or your California privacy rights:

Email: privacy@kanhasutra.com

Phone: (866) 988-7405

Web Form: https://kanhasutra.com/privacy-request

Mail: K-Life Enterprise, Inc., 5062 Lankershim Blvd #137, North Hollywood, CA 91601, Attention: Privacy Compliance Officer

Website: https://kanhasutra.com/

We aim to respond to all privacy inquiries within 10 business days and to complete all verifiable consumer requests within 45 calendar days of receipt.

Changes to This Notice

We may update this CCPA/CPRA Notice at any time to reflect changes in our practices, legal requirements, or regulatory guidance from the California Privacy Protection Agency (CPPA). Updates will be posted on our website with a revised Last Updated date. We encourage you to review this Notice periodically. For material changes, we will provide additional notice where required by law.