Mindset BY DIVE STUDIOS

PRIVACY POLICY

Effective as of: February 2, 2022

Your privacy is very important to DIVE Studios. This Privacy Policy describes how Creators Collective, Inc., a Delaware corporation doing business as DIVE Studios (“DIVE Studios”, “we”, “us” or “our”) handles personal information we collect through our digital properties that link to this Privacy Policy, including our websites and the MINDSET by DIVE Studios mobile application and web application (collectively, the "Platform"). This Privacy Policy describes the information DIVE Studios collects from you through the Platform, how DIVE Studios uses that information, and its legal basis for doing so. It also covers whether and how that information may be shared and your rights and choices regarding the information you provide to DIVE Studios.

By accessing and using the Platform you are accepting the practices described in this Privacy Policy (including new versions of this Privacy Policy when and as they go into effect). If you create an Account with MINDSET by DIVE Studios, you accept the MINDSET by DIVE Studios Terms and Conditions of Use, which governs this Privacy Policy and contains all disclaimers of warranties and limitation of liabilities, and which constitutes a legally binding agreement between DIVE Studios and each individual, corporation, limited liability company, partnership, association, or other entity or party (a “Person”) that accesses or uses the Platform (collectively, “Users,” and each, a “User”, “you” or “your”). Capitalized words not defined in this Privacy Policy are defined in the Terms and Conditions of Use for the MINDSET by DIVE Studios application.

Personal Information DIVE Studios Collects and Receives

Personal Information we collect may include:

• Contact Information, such as your name and email address.
• Profile Information, such as your profile name and profile picture and a username and password you generate when creating an Account.
• Demographic Information, such as your city, state, country of residence, postal code, and birth date.
• Device Information, such as your computer or mobile device’s operating system type and version, manufacturer and model, browser type, screen resolution, RAM and disk size, CPU usage, Internet Protocol (IP) address, and unique device identifiers.
• Location Information. With your permission, DIVE Studios may collect Global Positioning System (GPS) data and mobile device location information. If you do not wish to share your precise location with us, you can switch off location services via the settings on your mobile device.
• Transactional Information, including details of any requests or transactions you make through the Platform, such as the purchase of Premium Episodes, which is facilitated by DIVE Studios’ payment processing partners, Stripe and Paypal, in which case the payment information you submit will be collected and used by the payment processor in accordance with its privacy policy.
• Usage Information, including the times and dates and the extent of your usage of the Platform; time zone, language, screen resolution, and other usage preferences you select when using the Platform; device keyboard settings usage history such as areas and pages within the Platform that you access or use and/or which buttons on the Platform you click on; the search terms you entered into a search engine that may have led you to the Platform; the Internet service provider (ISP) or mobile platform you use, and other device and Platform access information such as your browser type, operating system, and referring/exit pages.
• Communications. Communications you send to DIVE Studios, such as when you request support or a refund of a purchase of a Premium Episode, submit comments or questions to DIVE Studios, or report a problem to DIVE Studios.
• Marketing Information, such as your preferences for receiving our marketing communications and details about your engagement with them.
• User-generated content, such as profile pictures, photos, images, music, videos, comments, questions, messages, works of authorship, and other content or information that you generate, transmit, or otherwise make available on the Platform, as well as associated metadata. Metadata includes information about how, when, where and by whom a piece of content was collected and how that content has been formatted or edited. Metadata also includes information that users can add or can have added to their content, such as keywords, geographical or location information, and other similar data.

DIVE Studios also collects and maintains aggregated, anonymized, or pseudonymized information to protect the safety and security of the Platform, improve the Platform, or comply with its legal obligations.

You may decline to provide DIVE Studios with some or all of your information. However, this will limit, or in certain cases prevent, your ability to use the Platform.

Types of Cookies and other Tracking Technologies DIVE Studios Uses

DIVE Studios may use the following technologies to collect personal information:

• Cookies, which are small text files that websites store on user devices and that allow web servers to record users’ web browsing activities and remember their submissions, preferences, and login status as they navigate a site. Cookies used on our sites include both “session cookies” that are deleted when a session ends and “persistent cookies” that remain longer.
• Local storage technologies, like HTML5 and Flash, that provide cookie-equivalent functionality but can store larger amounts of data on your device outside of your browser in connection with specific applications.
• Web beacons, also known as pixel tags or clear GIFs, which are used to demonstrate that a webpage or email address was accessed or opened, or that certain content was viewed or clicked. For example, DIVE Studios will know how many Users access a specific Platform page, Episode, or Mindset and what Content they clicked on or streamed. DIVE Studios uses this aggregated information to understand and optimize how the Platform is used.

We use these technologies for the following purposes:

• Security: DIVE Studios secures the Platform with cookies that facilitate security features and allow DIVE Studios to detect activity that might violate the Terms and Conditions of Use, such as unauthorized Account access or Platform activity.
• Localization: Some cookies help DIVE Studios provide localized experiences, such as displaying the Platform in the local language.
• Site Features and Services: Certain cookies provide greater functionality to the Platform and help DIVE Studios deliver our products and services.
• Performance: DIVE Studios uses performance cookies to help route traffic between servers and understand how the Platform is performing so DIVE Studios can provide Users with the best experience possible.
• Analytics and Research: Cookies and other technologies also help DIVE Studios to understand, improve, and research features and content on the Platform, such as by using Google Analytics, which you can opt out of at https://tools.google.com/dlpage/gaoptout.
• Marketing and Online Behavioral Advertising. These technologies may help us deliver advertisements, including targeted advertisements, and track the performance of those advertisements.

Limiting or Blocking Cookies and Our Do Not Track Policy

Your browser may give you the ability to control cookies, which may depend on the type of cookie, and browsers can be set to reject browser cookies. However, blocking or deleting cookies may prevent you from using most of the Platform.

Some browsers have “do not track” features that allow you to tell a website not to track you. These features are not all uniform. If you block cookies, certain features on the Platform may not work. If you block or reject cookies, not all of the tracking described in this Privacy Policy will necessarily stop. Note that certain options you select are specific to certain browsers and devices.

How DIVE Studios Uses the Information It Collects

DIVE Studios uses the personal information it collects for the following purposes:

Platform Delivery

We may use your personal information to: enable DIVE Studios to provide you and other Users with the Platform; improve and promote the Platform and services, including Episodes; and communicate with you about the Platform, such as addressing inquiries, and responding to customer service requests, questions, and comments.

Research and development

We may use your personal information for research and development purposes, including to track and analyze use of the Platform and DIVE Studios’ services, such as to identify trends and conduct data analysis to improve our performance and provide Users with the best experience possible.

Marketing and advertising

We, our service providers, and our third-party advertising partners may collect and use your personal information for marketing and advertising purposes. For example, we may send you newsletters, offers, promotions, and other product specials or communications to customize your experience on the Platform and to determine the effectiveness of marketing and promotion efforts. We and our third-party advertising partners may use cookies and similar technologies to collect information, including information about your use of the Platform, and use it to serve online ads that may interest you. This is called interest-based advertising. We may also share information about our users with these companies to facilitate interest-based advertising.

Compliance and protection

We may use your personal information to:

• protect the Platform;
• maintain security and to enforce the Terms and Conditions of Use and comply with applicable law, such as to respond to subpoenas or requests from government authorities; and
• take steps that DIVE Studios believes are necessary to protect its rights, property, and the rights of other Persons, or as otherwise described to you at the time of collection.

How DIVE Studios Shares the Personal Information It Collects

We may share your personal information with the following parties and as otherwise described in this Privacy Policy or at the time of collection.

Affiliates

Our corporate parent, subsidiaries, and affiliates.

Service Providers

Third parties that provide services on our behalf or help us operate the Platform or our business (such as hosting, information technology, customer support, email delivery, marketing, customer research, and website analytics). See below for more details about how we share personal information with service providers.

Business and marketing partners

Third parties with whom we co-sponsor events or promotions, with whom we jointly offer products or services, or whose products or services may be of interest to you.

Linked third-party services

If you log into the Platform with, or otherwise link your Platform account to, a social media or other third-party services, we may share your personal information with that third-party service. The third party’s use of the shared information will be governed by its privacy policy and the settings associated with your account at the third-party service.

Professional advisors

Professional advisors, such as lawyers, auditors, bankers, and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others

Law enforcement, government authorities, and private parties, as we believe in good faith to be necessary or appropriate for the compliance and protection purposes described above. See the “Information DIVE Studios Shares to Protect DIVE Studios and Comply with the Law” section below for more information regarding how we share personal information with these parties.

Business transferees

In the event that DIVE Studios is acquired by or merged with a third-party Person, or sells all or substantially all of its assets, DIVE Studios reserves the right, in any of these circumstances, to transfer or assign to such acquirer the information and content it has collected from Users as part of such merger, acquisition, sale, or other change of control. In the unlikely event of bankruptcy, insolvency, reorganization, receivership, or assignment for the benefit of creditors, or the application of laws or equitable principles affecting creditors’ rights generally, DIVE Studios may not be able to control how your personal information is treated, transferred, or used.

Other users and the public

Content you provide on the Platform may be visible to other Users of the Platform and the public. For example, when you engage with interactive features (e.g., posting comments to episodes), Creators and all other Users will be able to view such engagements, which will be attributed to you through your username. When you use the Voice Messaging Feature, the Creator with whom you are chatting will be able to view/listen to your messages and nothing in this Privacy Policy or the Terms and Conditions of Use places any obligations on Creators or guarantees any protections to you with respect to the information shared via the Voice Messaging Feature, which is at your own risk. DIVE Studios will also maintain records of, and will be able to access, such Voice Messaging Feature messages. Users should not engage with Interactive Functionalities or communicate through the Voice Messaging Feature any information, including, without limitation, personal information, that they do not want to be publicly accessible or viewable.

Information DIVE Studios Shares with Trusted Third-Party Service Providers

DIVE Studios may share certain information pertaining to you with certain trusted third-party service providers to help provide, improve, promote, or protect the Platform, such as when DIVE Studios partners with payment processors, such as Stripe, Inc., or use services to help manage ads on other websites.

When DIVE Studios shares data with third-party Persons to help deliver the Platform and DIVE Studios’ services, DIVE Studios requires those service providers to use your information only for the purposes DIVE Studios has authorized and to take reasonable steps to ensure that the third parties protect your personal information with at least to the same standards DIVE Studios does. DIVE Studios may also share information that is aggregated and anonymized in a way that it does not directly identify you.

Information DIVE Studios Shares to Protect DIVE Studios and Comply with the Law

DIVE Studios reserves the right to disclose information DIVE Studios collects from or about you when doing so is reasonably necessary to comply with the law or valid law enforcement requests, to prevent fraud or abuse, or to protect DIVE Studios’ legal rights, property, or the safety of DIVE Studios, Users (including Creators), or other Persons. You hereby authorize DIVE Studios to share or disclose your personal information, including, without limitation, any content, records, or electronic communications of any kind (including those transmitted through the Voice Messaging Feature), when DIVE Studios determines, in its sole discretion, that the disclosure of such information is necessary to identify, contact, or bring legal action against you if and to the extent:

• You are or may be violating the Terms and Conditions of Use or this Privacy Policy;
• You are or may be interfering with the rights or property of DIVE Studios or a third-party (including any Creator);
• You are or may be violating any applicable law, rule, or regulation;
• Necessary or required by any applicable law, rule, or regulation; and/or
• Requested by governmental authorities in the event of any investigation, act of terrorism, or instance of local, regional, or national emergency.

California privacy rights notice

This section provides additional details about the personal information DIVE Studios may collect about California residents and the rights afforded to them under California Civil Code Section 1798.83 and the California Consumer Privacy Act of 2018 (“CCPA”). For purposes of this section, the term “Personal Information” has the meaning given in the CCPA and does not include information exempted from the scope of the CCPA. California-resident Users who wish to request further information about our compliance with the CCPA or who have questions more generally about our Privacy Policy or the CCPA and our privacy commitments to our Users should not hesitate to contact DIVE Studios at support@getmindset.com.

Your California privacy rights

California residents have the rights listed below under the CCPA. However, these rights are not absolute, and in certain cases we may decline your request as permitted by law.

• **Information. **You can request the following information about how we have collected and used your Personal Information during the past 12 months:
  • The categories of Personal Information that we have collected.
  • The categories of sources from which we collected Personal Information.
  • The business or commercial purpose for collecting and/or selling Personal Information.
  • The categories of third parties with which we share Personal Information.
  • The categories of Personal Information that we sold or disclosed for a business purpose.
  • The categories of third parties to whom the Personal Information was sold or disclosed for a business purpose.
• Access. You can request a copy of the Personal Information that we have collected about you during the past 12 months.
• Deletion. You can ask us to delete the Personal Information that we have collected from you.
• Nondiscrimination. You are entitled to exercise the rights described above free from discrimination as prohibited by the CCPA.

Exercising your right to information, access and deletion

You may submit requests to exercise your right to information, access, or deletion via email to support@getmindset.com; you can also submit a request to delete through the Mindset application (this can be done by going to the settings menu, account settings, delete account).

We will need to verify your identity to process your information, access and deletion requests and reserve the right to confirm your California residency. To verify your identity, we may require government identification, a declaration under penalty of perjury, or other information. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

Your authorized agent may make a request on your behalf upon our verification of the agent’s identity and our receipt of a copy of a valid power of attorney given to your authorized agent pursuant to California Probate Code Sections 4000-4465. If you have not provided your agent with such a power of attorney, you must provide your agent with written and signed permission to exercise your CCPA rights on your behalf, provide the information we request to verify your identity, and provide us with confirmation that you have given the authorized agent permission to submit the request.

Personal Information that we collect, use and disclose

The list below summarizes our practices currently and during the past 12 months with respect to the Personal Information specified in the CCPA (Cal. Civ. Code § 1798.140). We do not sell your personal information. During the 12 months preceding the effective date of this privacy policy, we used services to help deliver interest-based advertisements to you (web pixels), which may be classified as a “sale” of personal information as broadly defined under the CCPA. Please see the sections above for more information regarding the categories referenced in this list. Information you voluntarily provide to us, such as in free-form web forms, may contain other categories of personal information not described below.

Identifiers (excluding online identifiers):

• Categories: Contact Information, Profile Information, Communications
• Sources: You, Third-Party Sources
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

Online Identifiers:

• Categories: Device Information, Demographic Information, Usage Information
• Sources: You, Automatic Collection, Third-Party Sources
• Purposes: Platform Delivery, Research and Development, Marketing and Advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

California Customer Records:

• Categories: Contact Information, Device Information, Usage Information, Communications, Marketing Information
• Sources: You, Automatic Collection, Third-Party Sources
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

Commercial Information:

• Categories: Transactional Information, Usage Information
• Sources: You, Automatic Collection, Third-Party Sources
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

Financial Information:

• Categories: Payment Information
• Sources: You
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Professional advisors, Authorities and others, Business transferees

Internet or Network Information:

• Categories: Usage Information, Marketing Information
• Sources: Automatic Collection, Third-Party Sources
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

Inferences:

• Categories: May be derived from the information listed above
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Professional advisors, Authorities and others, Business transferees

Protected Classification Characteristics

• Categories: Demographic Information (age)
• Sources: You
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

Sensory Information

• Categories: Audio Recordings, User-generated content
• Sources: You
• Purposes: Platform Delivery, Research and Development, Marketing and advertising, Compliance and Protection
• Third parties with whom we share: Affiliates, Service Providers, Business and marketing partners, Linked third-party services, Professional advisors, Authorities and others, Business transferees

European Users

The information provided in this “European Users” section only applies to individuals in the United Kingdom, Switzerland, and the European Economic Area (hereafter collectively referred to as “Europe”).

EU/UK Representative

Our data protection representative in the European Union/United Kingdom is DataRep. If you want to raise a question regarding our data practices or otherwise exercise your rights in respect of your personal data in the European Union/United Kingdom, you may do so by (i) sending an email to DataRep at datarequest@datarep.com and quoting “Creative Collective, Inc.” in the subject line or (ii) contacting DataRep on its online webform at www.datarep.com/data-request and specifying “Creative Collective, Inc. as the controlling organization.

Legal bases for processing

European Union data protection law requires a “lawful basis” for collecting and retaining personal information from citizens or residents of the European Economic Area. DIVE Studios’ lawful bases include:

• Consent: In certain cases, you have affirmatively provided DIVE Studios with your consent to collect your personal data for a specific purpose, such as when you register for an Account.
• Contract: DIVE Studios may need your personal data to comply with contractual obligations to deliver the Platform, such as fulfilling transactions or subscriptions made through the Platform.
• Legal Obligations: Sometimes the law requires the collection and use of your data, such as applicable tax laws may require DIVE Studios to retain records of payments made through the Platform.
• Legitimate Interests: This is a technical term that means DIVE Studios has a good and fair reason to use your data and in ways which do not harm your interests and rights, such as to pursue DIVE Studios’ legitimate interests in a way that might reasonably be expected as part of running its business and that does not materially impact your rights, freedom, or interests. For example, DIVE Studios uses identity, device, and location information to prevent fraud and abuse and to keep the Platform secure, may also send you promotional communications about the Platform and services, including Episodes or Mindsets, subject to your right to opt out, analyze how Users interact with the Platform so DIVE Studios can understand better what elements do or do not work well, thereby facilitating improvements and developments in the quality of the online experience for all Users.

As far as DIVE Studios processes your personal information on the basis of its legitimate interests, you can object to processing at any time. You can find a detailed description of DIVE Studios’ processing activities and the legal basis herein. If you object to such processing, DIVE Studios will ask you to state the grounds of your objection to examine the processing of your personal information and decide whether to adjust the processing accordingly.

Sensitive personal information

We ask that you not provide us with any sensitive personal information (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the services, or otherwise to us.

If you provide us with any sensitive personal information to us when you use the services, you must consent to our processing and use of such sensitive personal information in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive personal information, you must not submit such sensitive personal information through our services.

Your rights

European data protection laws give you certain rights regarding your personal information. If you are located in Europe, you may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.
• Correct. Update or correct inaccuracies in your personal information.
• Delete. Delete your personal information.
• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Restrict. Restrict the processing of your personal information.
• Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.

You may submit these requests by email to support@getmindset.com or our postal address provided above. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

Cross-border data transfer

If we transfer your personal information from Europe to another country such that we are required to apply appropriate safeguards to your personal information under European data protection laws, we will do so. Please contact us for further information about any such transfers or the specific safeguards applied.

Links to Other Platforms and Services

The Platform may include links to websites or services whose privacy practices may differ from DIVE Studios’ privacy practices as described in this Privacy Policy. When you click or otherwise use a link to an external website or service, the privacy policy and data processing disclosures for that website or service, and not this Privacy Policy, govern.

Data Retention

DIVE Studios will retain the information collected from or about you as long as necessary to provide you with the Platform or DIVE Studios’ services, or as otherwise set forth in this Privacy Policy, and to the extent set out in this Privacy Policy and as necessary to comply with DIVE Studios’ legal obligations, resolve disputes, enforce our agreements, and protect DIVE Studios’ legal rights. Additionally, DIVE Studios may retain indefinitely any aggregated, anonymized, or pseudonymized information collected, and may from time to time transfer or merge your information collected off-line to our online databases or store off-line information in an electronic format.

Cross-Border Data Transfers

DIVE Studios is based in the United States so your information will be collected and processed in the United States, which has its own laws governing data protection and access to it, including by the government. If you reside outside of the United States, be advised that the rules that protect your personal information under United States federal, state, and local law may differ from those of your home country.

Children’s Privacy

‍ The privacy of children is of the utmost importance, and DIVE Studios is committed to complying with the federal Children’s Online Privacy Protection Act (COPPA). DIVE Studios does not knowingly collect, use, or disclose personal information from children under the age of thirteen (13). If DIVE Studios ever discovers that it has inadvertently collected personal information from a child under the age of thirteen (13) on or through the Platform, DIVE Studios will delete it from its records as soon as possible. If you are a parent or legal guardian of a child under the age of thirteen (13) and believe that DIVE Studios has collected personal information from your child, email us immediately at support@getmindset.com, and DIVE Studios will take steps to delete such personal information from its records as soon as possible.

Email Notifications

‍ DIVE Studios wants to communicate with you only if you want to hear from us. DIVE Studios may send you email relating to your transactions on or through the Platform. You may also elect to receive certain marketing email communications, including with respect to certain Creators or Mindsets, from which you may opt out at any time. DIVE Studios will also send you service-related announcements when and as necessary. DIVE Studios will try to keep emails to a minimum.

DIVE Studios maintains a strict no-spam policy. DIVE Studios will not use false or misleading subjects or email addresses, identify the message as an advertisement in a reasonable way, include DIVE Studios’ physical address, monitor third-party email marketing services for compliance, honor opt-out/unsubscribe requests quickly, and allow Users to unsubscribe by using the link at the bottom of each email.

If you are having problems unsubscribing, contact DIVE Studios at support@getmindset.com by forwarding the email communication and including the word “Unsubscribe” in the subject line and DIVE Studios will use reasonable efforts to remove you within seven (7) business days. Please note that DIVE Studios will not process any unsubscribe requests submitted as direct replies to any newsletter.

Security

We employ a number of technical, organizational, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

Updates to this Privacy Policy

DIVE Studios may change the terms of this Privacy Policy at any time. Whenever DIVE Studios makes a material change, DIVE Studios will take appropriate action to notify you, such as by posting on the Platform or sending you an email. The effective date of the most recent version of this Privacy Policy will appear at the top of this page. New versions of this Privacy Policy will never apply retroactively.

Contact

Questions or comments about this Privacy Policy should be sent by email to support@getmindset.com or mail to 700 North San Vicente Boulevard, 7th Floor, Los Angeles, California 90069.