Privacy

Welcome to the Buffalo Rock Company, Inc. (“Buffalo Rock”) website. Below you will find our Privacy Notice regarding any
personal information that you may supply to us through this web site.

Last updated: 6.20.23 

It is our aim through this BUFFALO ROCK COMPANY PRIVACY NOTICE (“Notice”) to explain what information we collect
about you and why we collect that information. We also want to make sure you understand how we use and share your
information and the choices available to you. Our goal is to earn and keep your trust as you visit websites and
applications about our products and brands.

This Notice describes how we treat personal information on websites (“sites”), mobile or social media applications
(“apps”), and any other services where we include an authorized link or reference to this Notice (together, the
“Services”). This Notice does not describe our practices on sites or apps where it is not referenced. The ‘Sites’ are
offered by Buffalo Rock Company Inc., Sun Fresh Beverages Inc., etc., any applicable Buffalo Rock parent, subsidiary,
and affiliated companies, Site developers, and other promotional partners (collectively “the Company”, or “we”, “us”,
“our”). Some of our other sites and/or programs may have their own, possibly different, policies that are posted
on their own sites. We encourage you to review those policies when using those sites.

Your use of our apps and sites indicates you agree to our collection, use, and sharing of your information as set forth
in this Notice.

What information do we collect?

We collect identifiers and contact information. For example, we may collect your name, and street address
including zip code. We may also collect your phone number or email address. We also collect online identifiers. For
example, if you engage with us through a social media site, we may collect your social media user identifier.

We collect information you submit or otherwise provide or authorize us to collect. We collect the information you
post in a public space on our site. This includes comments and videos or photos. We also collect any other information
you may provide to us or authorize us to collect.

We collect internet and electronic network activity information, such as device and usage information. We may
collect information about the browser you are using, and we may look at what site you came from, or what site you visit
when you leave us. We may also collect information about your operating system, Internet Service Provider (ISP)
information and IP addresses and other device identifiers, such as mobile device identifiers. In addition, we may
collect information about your use of our Services, including through use of tracking technologies such as cookies,
pixel tags, and similar technologies.

We collect geolocation information. Using technologies such as GPS or Wi-Fi, we may collect information about
your location. For example, if you use our mobile apps, we may access your device’s location information to provide you
location-enabled features.

We collect job application information, such as professional or employment-related information and education
information. We collect information if you apply for a job with us. This information may include your education
and work history, your skills, and qualifications for the position. We may ask about how you learned about the position.
If applicable, we may ask about your driving record and your ability to perform the position. We may also collect the
last four digits of your social security number and your nationality.

How do we collect information?

We collect information directly from you. We collect information from you when you:

• Apply for a job
• Contact us
• Otherwise submit it to us

We collect information from you passively. We use tracking tools like browser cookies and mobile device IDs. We
do this on our websites, in emails that we send to you, and in media advertising. We collect information about usage and
browser information over time.

We may combine information from different sources

We may combine information. For example, we may combine information we have collected offline with information we
collect online. We combine information we have collected across third-party sites, including social media sites. We
combine information across devices such as computers and mobile devices. We may also combine information from third
parties with information we already have.

How we may use the information we collect

We may use information to improve our products and services. One of our goals is that you have a positive
experience with our sites, apps, and products. Therefore, we may use your information to improve your experience with
our sites, apps, and products.

We may use information for security purposes. We may use your information to help protect you, our sites and
apps, our company, our customers, and our consumers.

We may use information to get feedback from you about how we’re doing and for other transactional purposes. We
may contact you about this Notice or the Terms of Use posted to the sites or apps you are using. We may also communicate
with you about a job application.

We may use information as the law allows us or as we may notify you.

How we may share information we have collected

We may share information with select business partners. For example, we may share information with joint
promotion partners. If you register for a joint promotion, your information may be collected by both us and the third
party. This might include retailers. Your information will be used by us as described in this Notice or by promotion
partners as described in their policies.

We work with analytics and advertising partners. Our online Services may use analytics, advertising and other
third-party content or functionality through which our partners may collect internet and electronic network activity
information, such as device and usage information.

We will share information if we think we must in order to comply with the law or to protect our company. For
example, we will share information to respond to a court order or subpoena. We may share information if a government
agency or investigatory body requests it. This includes United States and non-United States law enforcement or
regulatory authorities. We may also share information if we are investigating potential fraud.

We may share information with any successor to all or part of our business. For example, if part of our business
is sold we may include your information as part of that transaction.

If there are additional reasons we may share information, we will describe those to you.

You have certain choices about how we use your information

You can control cookies and tracking tools. To learn how to manage how we and our vendors use cookies and other
tracking tools.

Do-Not-Track Signals and Similar Mechanisms. Some web browsers transmit “do-not-track” signals to
websites. Because the standards for these signals are still under development, we currently do not take action in
response to these signals.

You can control tools on your mobile devices. For example, you can turn off the GPS locator or push notifications
on your phone. To modify the push notifications you get from our app, you can alter your preferences in your profile.

You may have other choices under applicable state laws. Depending on where you live, you may have certain
additional rights, as described below. We only honor these rights where required by law.

• You may have a right to request to confirm whether or not we process your personal information as well as to
  access and receive a copy of the specific personal information we have collected about you in a portable format.
• You may have a right to request deletion of your personal information.
• You may have a right to request correction of any inaccurate personal information we hold about you.
• In some circumstances, you may have the right to opt out of automated decision-making, such as where it produces
  legal or other significant effects.
• You have a right not to receive discriminatory treatment for exercising any of your rights described under this
  section.

These additional rights are subject to exceptions under applicable laws. For example, we may not be able to honor
certain rights requests without taking steps to verify your identity.

If you would like to exercise these rights under applicable state privacy laws, you or your authorized agent have two
options for doing so:

• Call Us: You may call our Corporate Headquarters at (205) 942- 3435
• Submit Through Email: You may submit your request through our Contact page with the reason for contact
  selected as “Other” https://www.buffalorock.com/contact/

We may verify your request by asking you to provide information to confirm your identity. This information may vary
depending on your relationship with us. If you are a consumer in a jurisdiction that recognizes the ability to use an
authorized agent and wish to contact us through an authorized agent, we may request evidence that you have provided such
agent with power of attorney or that the agent otherwise has valid written authority to submit requests to exercise
rights on your behalf.

If you are in a jurisdiction that recognizes your ability to appeal a decision we have made in connection with your
attempt to assert a right under applicable laws, you may submit a request to appeal through our secure web portal, You
may submit your request to appeal through our Contact page with the reason for contacting selected as “Other”  https://www.buffalorock.com/contact/

Please provide the state that you are writing from, accompanied with information you may have regarding the matter you
are appealing. If your jurisdiction allows you to file a complaint with the state’s Attorney General’s Office regarding
any concerns with the result of your appeal request, you may do so by using their online properties.

Retention of personal information

We keep the categories of personal information described above for as long as is necessary for the purposes described in
this Notice or otherwise authorized by law. This generally means holding the information for as long as one of the
following apply:

• Your personal information is reasonably necessary to manage our operations, to manage your relationship with us,
  or to satisfy another purpose for which we collected the information;
• Your personal information is reasonably necessary to carry out a disclosed purpose that is reasonably compatible
  with the context in which the personal information was collected;
• The information is reasonably required to protect or defend our rights or property (which will generally relate
  to applicable laws that limit actions in a particular case); or
• We are otherwise required or permitted to keep your information by applicable laws or regulations.

Children’s privacy

It is not our intention to collect personal information from children under age 13. If you are a parent or legal
guardian and think that your child under 13 has given us information, you can contact us at https://contact.pepsico.com/pepsico/contact-us and we will
take appropriate steps. You can also write to us at the address listed below. Please mark your inquiries “COPPA
Information Request.”

Security measures

We use various technical and organizational mechanisms to secure our websites and apps. You should understand that no
data storage system or transmission of data over the Internet or any other public network can be guaranteed to be
perfectly secure.

Our services are intended for a United States audience

If you live outside of the United States and choose to use this site or app, you understand that it is at your own risk.
You also understand that your information will be sent to and stored in the United States. The United States may not
afford the same level of protection as laws in your own country.

We may link to other sites or apps or have third-party services and tools on our platform we don’t control

We may link to or allow you to access the Services from third-party websites or platforms. Our sites and apps may also
include third-party content that collects information. Third-party content may include tools like cookies and tracking
technologies. These third parties may use your information for their own purposes. This may include behavioral
advertising and analytic purposes. We do not control these third parties or their use of these technologies, so please
read their privacy policies carefully.

We may update this notice

From time to time, we may change this Notice. When we do, we will notify you of any material changes as required by law.
This may include posting an updated copy here and updating the “Last Updated” date. Please check this Notice
periodically for updates.

California specific notices

California “Shine the Light” Law

If you reside in California, you have the right to ask us one time per year for information about our disclosure, if
any, of personal information to third parties for their direct marketing purposes in the preceding calendar year. To
make a request, please contact us at https://contact.pepsico.com/pepsico/contact-us or write to
us at the address listed below. Indicate in your letter that you are a California resident making a “Shine the Light”
inquiry. We reserve our right not to respond to requests submitted other than by the means specified in this section, if
the request is not labeled or sent properly, or if the request does not have complete information.

California Consumer Privacy Act (“CCPA”)

We have explained our privacy practices in full in the other sections of this Notice. In this section, we provide a list
of categories of personal information, as set forth in the CCPA, that have been collected, disclosed for business
purposes, shared for cross-context behavioral advertising, or sold for commercial purposes during the preceding 12
months, as well as certain other supplemental information. Some of these categories of personal information that we
collect may include information that is considered sensitive under the CCPA. Please see the other sections of this
Notice for additional information about our practices and your rights.

View our statistics on CCPA requests here.

As discussed in the other sections of this Notice, we collect these categories of information from you, through our
interactions with you and others, and from third parties.

Your personal information may also be disclosed to third parties with whom you interact and third parties that you
direct us to disclose your information to through our Services. We may also disclose personal information with third
parties in various additional ways, as described elsewhere in this Notice.

In California, you may have certain additional rights under applicable law, in addition to your rights to access,
correct, and delete your personal information as described above. In California, you also may have:

• The right to request other information about our data processing practices, including the categories of personal
  information that have been collected about you; the categories of sources from which personal information are
  collected; our business or commercial purpose for collecting, using, disclosing, selling or sharing personal
  information; the categories of third parties with whom we disclose, sell or share personal information; and the
  categories of personal information we have disclosed, sold or shared about you for a business purpose.
• The right to direct us to limit the use and disclosure of your Sensitive Personal Information to certain uses
  and disclosures, such as those that are reasonably necessary to provide our goods and services or as needed to
  ensure security and integrity; to prevent fraud or illegal activity; or for physical safety.

If you would like to exercise these rights under applicable state privacy laws, you or your authorized agent have two
options for doing so:

• Call Us: You may call us at our toll-free number, 1-833-548-0119; or
• Submit Through Our Portal: You may submit your request through our secure web portal, http://mydata.pepsico.com.

To the extent we collect precise geolocation information for purposes of performing a Service you have requested, we may
be deemed to be collecting data that is “sensitive” under California law. Our use of this data for performing a Service
you have requested is consistent with the permitted business purposes in California Civil Code § 1798.100 et seq. and
implementing regulations.

If you do not wish for us to sell or share your personal information for targeted advertising purposes, you can opt out
by submitting your request through Your Privacy Choices.