PRIVACY POLICY

mark12thirty, LLC

A Limited Liability Company Registered in the State of Idaho

Last Updated: March 12, 2026

Version 1.0

TABLE OF CONTENTS

1. Introduction & Acceptance

2. Principles

3. Data We Collect

4. How We Use Your Data

5. Data Access & Sharing

6. Data Storage, Transfer, and Retention

7. Data Security

8. Your Data Protection Rights (All U.S. Residents)

9. California-Specific Privacy Rights (CCPA/CPRA)

10. State-Specific Privacy Rights (Additional States)

11. Additional Rights for Residents of the European Union / European Economic Area

12. Children's Privacy

13. Do Not Track Signals

14. Marketing Communications (CAN-SPAM Compliance)

15. Third-Party Links and Services

16. Data Breach Notification

17. Changes to This Privacy Policy

18. Dispute Resolution

19. Contact Information

1. INTRODUCTION & ACCEPTANCE

This Privacy Policy ("Policy") explains how mark12thirty, LLC ("Company," "we," "us," or "our") collects, uses, shares, and protects information that relates to you ("you" or "your") when you use our website at mark12thirty.com (the "Site"), engage with us on social media, or otherwise interact with us. This Policy also explains the rights you have concerning the personal data that we process and how you can exercise those rights.

By accessing or using our Site, you acknowledge that you have read, understood, and agree to be bound by the practices described in this Privacy Policy. If you do not agree with this Privacy Policy, please do not access or use our Site. Your continued use of the Site following the posting of any changes to this Policy constitutes your acceptance of those changes.

This Privacy Policy is incorporated into and subject to our Terms and Conditions, which are available on our Site. In the event of a conflict between this Privacy Policy and the Terms and Conditions, the Terms and Conditions shall control with respect to dispute resolution, limitation of liability, and governing law provisions.

2. PRINCIPLES

mark12thirty, LLC manifests its commitment to privacy and data protection by embracing the following principles:

• Lawfulness, Fairness, and Transparency: We use Personal Data lawfully, fairly, and in a transparent manner.
• Purpose Limitation: We collect Personal Data only for specified, legitimate purposes and do not process it in a manner incompatible with those purposes.
• Data Minimization: We collect no more Personal Data than is necessary for the purposes for which it is processed.
• Accuracy: We take reasonable steps to ensure that Personal Data is accurate and, where necessary, kept up to date.
• Storage Limitation: We retain Personal Data no longer than is necessary for the purposes for which it was collected.
• Security: We protect Personal Data with appropriate technical and organizational security measures.

3. DATA WE COLLECT

This Policy applies to information collected through the Site. We collect two categories of information:

3.1 Personal Data

"Personal Data" is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you. We may collect the following categories of Personal Data:

• Identifiers: Name, email address, mailing address, phone number, and Internet Protocol (IP) address.
• Commercial Information: Records of products purchased, obtained, or considered; purchasing or consuming histories or tendencies.
• Internet or Network Activity: Browsing history on our Site, search history on our Site, and information regarding your interaction with our Site.
• Geolocation Data: General geographic location inferred from your IP address (we do not collect precise geolocation data).
• Payment Information: Credit card or debit card number, billing address, and related payment details. Note: Payment processing is handled by our third-party payment processor(s); we do not store complete payment card numbers on our servers.

We collect Personal Data when you:

• Create an account or profile on our Site;
• Complete a purchase or transaction;
• Subscribe to our newsletter or marketing communications;
• Contact us with inquiries or customer service requests;
• Interact with us on social media platforms; or
• Browse or navigate our Site (automatically collected data).

3.2 Non-Personal Data

"Non-Personal Data" is information that does not directly identify you. This may include aggregated data, anonymized data, browser type, operating system, referring URLs, and general usage statistics. We may collect Non-Personal Data automatically through cookies, web beacons, and similar technologies.

4. HOW WE USE YOUR DATA

We use the Personal Data we collect for the following business purposes:

• To process and fulfill your orders, including shipping and payment processing;
• To communicate with you about your orders, account, or inquiries;
• To send you news, special offers, and general information about products and services we offer, where you have opted in to receive such communications;
• To improve, personalize, and optimize our Site and your shopping experience;
• To detect, prevent, and address fraud, security issues, and technical problems;
• To comply with applicable legal obligations;
• To enforce our Terms and Conditions and other agreements; and
• To protect the rights, property, or safety of mark12thirty, LLC, our customers, or others.

5. DATA ACCESS & SHARING

We do not sell your Personal Data. We may share your Personal Data with the following categories of third parties for the business purposes described in this Policy:

• Service Providers: Third-party companies that perform services on our behalf, such as payment processing, shipping and fulfillment, email delivery, website hosting, and analytics. These service providers are contractually obligated to use your Personal Data only for the purposes of providing services to us and are required to maintain the confidentiality and security of your information.
• Business Transfers: In connection with any merger, acquisition, sale of assets, financing, or transfer of all or a portion of our business, your Personal Data may be transferred as part of that transaction.
• Legal Obligations: We may disclose your Personal Data if required to do so by law or in response to valid requests by public authorities (e.g., a court order, subpoena, or government agency request).
• Protection of Rights: We may disclose your Personal Data where we believe it is necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, situations involving potential threats to the safety of any person, or as evidence in litigation in which we are involved.

6. DATA STORAGE, TRANSFER, AND RETENTION

Your Personal Data is stored and processed in the United States of America. By using our Site and providing your information, you acknowledge and consent to the storage and processing of your Personal Data in the United States.

If you access our Site from outside the United States, you do so at your own initiative and are solely responsible for compliance with the laws of your jurisdiction. We make no representation that our practices comply with the laws of any jurisdiction outside the United States. Your use of the Site and submission of any Personal Data constitutes your acknowledgment and consent to the transfer of such data to the United States, where data protection laws may differ from those in your country of residence.

We will retain your Personal Data for as long as you remain a mark12thirty, LLC customer and for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with our legal obligations under applicable U.S. federal and state law, resolve disputes, and enforce our agreements.

When your Personal Data is no longer necessary for the purposes for which it was collected, or upon your valid deletion request (subject to applicable exceptions), we will delete or anonymize your Personal Data in accordance with our data retention schedule and applicable law.

7. DATA SECURITY

The security of your Personal Data is important to us. We implement appropriate technical and organizational measures designed to protect your Personal Data against unauthorized access, alteration, disclosure, or destruction. These measures include, but are not limited to, encryption of data in transit, secure server infrastructure, and access controls.

However, no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security. You acknowledge that you provide your Personal Data at your own risk.

8. YOUR DATA PROTECTION RIGHTS (ALL U.S. RESIDENTS)

Regardless of your state of residence, mark12thirty, LLC provides the following rights to all customers and Site visitors within the United States:

8.1 Right to Access

You have the right to request information about the Personal Data we hold about you at any time. You can contact mark12thirty, LLC and we will provide you with your Personal Data via email.

8.2 Right to Portability

Whenever mark12thirty, LLC processes your Personal Data, you have the right to request a copy of your data in a structured, commonly used, machine-readable format. This right applies only to the Personal Data you have directly submitted to us.

8.3 Right to Rectification

You have the right to request correction of inaccurate Personal Data we maintain about you, including the right to have incomplete Personal Data completed.

8.4 Right to Erasure

You have the right to request deletion of your Personal Data processed by mark12thirty, LLC at any time, except in the following situations:

• You have an open order that has not yet been shipped or delivered;
• You have an unsettled debt with mark12thirty, LLC;
• You have made a purchase within the last thirty-six (36) months, and we are required to retain transaction records for bookkeeping, tax, or accounting purposes;
• You are suspected of having misused our services or engaged in fraudulent activity, and we need to retain data to investigate;
• Your data is required to comply with a legal obligation; or
• Your data is necessary for the establishment, exercise, or defense of legal claims.

If you request erasure and none of the above exceptions apply, we will delete your Personal Data and, to the extent possible, direct any service providers with whom we have shared your data to do the same.

8.5 Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. We will not deny you goods or services, charge you different prices or rates, provide you a different level or quality of goods or services, or suggest that you may receive a different price or level of quality of goods or services as a result of exercising your privacy rights.

8.6 How to Exercise Your Rights

To exercise any of the rights described in this Privacy Policy, or if you have questions or concerns about our privacy practices, please contact our designated privacy contact via the online contact form at https://mark12thirty.com.

We will respond to your request in accordance with the applicable timeframes described in Section 12 of this Policy. When you submit a privacy rights request, we may need to verify your identity before fulfilling your request. We will attempt to verify your identity by matching information you provide with information we already maintain. If we cannot verify your identity using the information we have on file, we may request additional information from you, which will be used solely for verification purposes and will be deleted after verification is complete.

8.7 Authorized Agents

In certain states, you may designate an authorized agent to submit a privacy rights request on your behalf. If an authorized agent submits a request on your behalf, we may require: (a) signed written authorization from you; and (b) verification of your identity directly. We may deny a request from an authorized agent who does not submit sufficient proof of authorization.

9. CALIFORNIA-SPECIFIC PRIVACY RIGHTS (CCPA/CPRA)

This section applies to residents of the State of California and supplements the rights described above, as required by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (collectively, "CCPA"), Cal. Civ. Code §§ 1798.100-1798.199.100.

9.1 Categories of Personal Information

In the preceding twelve (12) months, we have collected the categories of personal information described in Section 3 of this Policy.

9.2 Sale of Personal Information

We do not sell your personal information as defined by the CCPA. We have not sold personal information in the preceding twelve (12) months.

9.3 Right to Know

You have the right to request that we disclose:

• The categories of personal information we have collected about you;
• The categories of sources from which personal information is collected;
• The business or commercial purpose for collecting personal information;
• The categories of third parties with whom we have shared personal information; and
• The specific pieces of personal information we have collected about you.

9.4 Right to Delete

You have the right to request that we delete any personal information we have collected from you or maintain about you, subject to the exceptions described in Section 8.4 above and any additional exceptions permitted by the CCPA.

9.5 Right to Correct

You have the right to request that we correct inaccurate personal information that we maintain about you.

9.6 Right to Opt-Out of Sale or Sharing

As stated above, we do not sell or share your personal information for cross-context behavioral advertising. If we change this practice in the future, we will update this Policy and provide you with an opt-out mechanism as required by the CCPA.

9.7 Right to Limit Use of Sensitive Personal Information

We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. If we begin doing so in the future, we will provide you with a mechanism to limit such use.

9.8 California Shine the Light

Under California Civil Code § 1798.83 ("Shine the Light" law), California residents may request information regarding the disclosure of their personal information to third parties for direct marketing purposes. We do not disclose personal information to third parties for their direct marketing purposes. If you have questions, please contact us via the online contact form at https://mark12thirty.com. Please allow thirty (30) calendar days for a response.

9.9 Response Timeframe

We will respond to verified CCPA requests within forty-five (45) calendar days of receiving your request. We may extend this period by an additional forty-five (45) days where reasonably necessary, provided we notify you of the extension within the initial 45-day period. (Cal. Civ. Code § 1798.130(a)(2).)

10. STATE-SPECIFIC PRIVACY RIGHTS (ADDITIONAL STATES)

In addition to the rights described above for California residents, residents of certain other U.S. states have additional rights under their respective state privacy laws. This section describes those additional rights. If you are a resident of one of the states listed below, you may exercise the applicable rights by contacting us via the online contact form at https://mark12thirty.com.

Applicable States: Virginia (Va. Code §§ 59.1-575 to 59.1-585), Colorado (Colo. Rev. Stat. §§ 6-1-1301 to 6-1-1313), Connecticut (Conn. Gen. Stat. §§ 42-515 to 42-525), Utah (Utah Code §§ 13-61-101 to 13-61-404), Texas (Tex. Bus. & Com. Code §§ 541.001-541.205), Oregon (Or. Rev. Stat. §§ 646A.570-646A.604), Montana (Mont. Code Ann. §§ 30-14-2801 to 30-14-2817), Delaware (Del. Code tit. 6, §§ 12D-101 to 12D-115), Iowa (Iowa Code §§ 715D.1-715D.8), Nebraska (Neb. Rev. Stat. §§ 87-1101 to 87-1116), New Hampshire (N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:14), New Jersey (N.J. Stat. Ann. §§ 56:8-166 to 56:8-177), Tennessee (Tenn. Code Ann. §§ 47-18-3201 to 47-18-3213), Minnesota (Minn. Stat. §§ 325O.01-325O.11), Maryland (Md. Code Ann., Com. Law §§ 14-4601 to 14-4614), and any other U.S. state that enacts a comprehensive consumer privacy law after the date of this Policy.

10.1 Your Rights

Depending on your state of residence, you may have the right to:

• Access: Confirm whether we are processing your personal data and obtain a copy of such data in a portable format.
• Correction: Request correction of inaccurate personal data we maintain about you.
• Deletion: Request deletion of personal data we have collected from or about you, subject to certain legal exceptions.
• Data Portability: Obtain a copy of your personal data in a readily usable format that allows transfer to another entity, where technically feasible.
• Opt-Out of Sale of Personal Data: Direct us not to sell your personal data. As stated elsewhere in this Policy, we do not sell your personal data.
• Opt-Out of Targeted Advertising: Direct us not to process your personal data for the purpose of targeted advertising. To exercise this right, contact us via the online contact form at https://mark12thirty.com or use a recognized universal opt-out mechanism such as the Global Privacy Control (GPC). We will honor GPC signals as required by applicable state law.
• Opt-Out of Profiling: Direct us not to process your personal data for profiling in furtherance of decisions that produce legal or similarly significant effects concerning you.

10.2 Sensitive Data

Certain state laws require us to obtain your consent before processing "sensitive data," which may include precise geolocation data, racial or ethnic origin, religious beliefs, biometric data, health data, sexual orientation, or data concerning a known child. We do not knowingly collect sensitive data as defined by applicable state privacy laws. If we begin collecting sensitive data in the future, we will obtain your consent as required by applicable law before doing so.

10.3 Right to Appeal

If we decline to take action on your privacy rights request, you have the right to appeal our decision. To appeal, please contact us via the online contact form at https://mark12thirty.com with the subject line "Privacy Rights Appeal" within thirty (30) days of receiving our response. We will respond to your appeal within the timeframe required by your state's applicable law (generally 45 to 60 days). If your appeal is denied, we will provide you with information on how to contact your state's Attorney General to submit a complaint, as required by applicable law.

The following states require us to provide Attorney General contact information for appeals:

• Virginia: Office of the Attorney General, 202 North 9th Street, Richmond, VA 23219; www.oag.state.va.us
• Colorado: Office of the Attorney General, 1300 Broadway, 10th Floor, Denver, CO 80203; coag.gov
• Connecticut: Office of the Attorney General, 165 Capitol Avenue, Hartford, CT 06106; portal.ct.gov/AG
• Texas: Office of the Attorney General, P.O. Box 12548, Austin, TX 78711; texasattorneygeneral.gov
• Oregon: Oregon Department of Justice, 1162 Court Street NE, Salem, OR 97301; doj.state.or.us

10.4 Response Timeframe

We will acknowledge receipt of your privacy rights request within ten (10) business days. We will respond to verified consumer rights requests within forty-five (45) calendar days of receiving your request. We may extend this period by an additional forty-five (45) days where reasonably necessary, provided we notify you of the extension and the reason for it. We will respond to appeals within sixty (60) calendar days (or such shorter period as required by your state's applicable law).

11. ADDITIONAL RIGHTS FOR RESIDENTS OF THE EUROPEAN UNION / EUROPEAN ECONOMIC AREA

The following rights apply only to individuals who are residents of the European Union or European Economic Area ("EU/EEA") and are provided solely to the extent required by the General Data Protection Regulation (EU) 2016/679 ("GDPR"). These rights do not apply to residents of the United States or any other jurisdiction outside the EU/EEA, and nothing in this section shall be construed as voluntarily extending GDPR obligations to non-EU/EEA residents or as a submission to the jurisdiction of any EU/EEA regulatory authority.

mark12thirty, LLC is a United States company that does not currently direct its products or services to individuals in the EU/EEA. However, if you are an EU/EEA resident who has interacted with our Site, you may have the following rights under the GDPR:

• Right of Access (GDPR Art. 15): You may request confirmation of whether we process your personal data and, if so, request a copy of such data.
• Right to Rectification (GDPR Art. 16): You may request correction of inaccurate personal data.
• Right to Erasure (GDPR Art. 17): You may request deletion of your personal data, subject to applicable legal exceptions.
• Right to Restriction of Processing (GDPR Art. 18): You may request that we restrict the processing of your personal data under certain circumstances.
• Right to Data Portability (GDPR Art. 20): You may request a copy of your personal data in a structured, commonly used, machine-readable format.
• Right to Object (GDPR Art. 21): You may object to the processing of your personal data for direct marketing purposes or on grounds relating to your particular situation.

To exercise any of these rights, please contact us via the online contact form at https://mark12thirty.com. We will respond to verified requests within thirty (30) days. We reserve the right to verify your identity and EU/EEA residency before processing any request under this section.

Disclaimer: mark12thirty, LLC does not maintain an establishment in the EU/EEA, does not offer goods or services specifically targeted to EU/EEA residents, and does not systematically monitor the behavior of individuals in the EU/EEA. The inclusion of this section is provided as a courtesy and does not constitute an admission that the GDPR applies to mark12thirty, LLC or a consent to the jurisdiction of any EU/EEA data protection authority.

12. CHILDREN'S PRIVACY

Our Site and services are not directed to, and we do not knowingly collect personal information from, children under the age of sixteen (16). If you are under the age of 16, please do not use our Site or provide any personal information to us.

If we learn that we have collected personal information from a child under the age of 16 without verification of parental consent, we will take commercially reasonable steps to delete that information as promptly as possible. If you believe we may have collected information from or about a child under 16, please contact us immediately via the online contact form at https://mark12thirty.com.

For purposes of the Children's Online Privacy Protection Act (15 U.S.C. §§ 6501-6506), our Site is not designed to attract children under the age of 13, and we do not knowingly collect, use, or disclose personal information from children under 13.

13. DO NOT TRACK SIGNALS

Some web browsers transmit "Do Not Track" (DNT) signals to websites. Because there is no universally accepted standard for how to interpret and respond to DNT signals, our Site does not currently respond to DNT browser signals. However, we honor Global Privacy Control (GPC) signals as required by applicable state law, including the California Consumer Privacy Act and the Colorado Privacy Act. You may learn more about GPC at globalprivacycontrol.org.

14. MARKETING COMMUNICATIONS (CAN-SPAM COMPLIANCE)

If you have opted in to receive marketing communications from us, you may opt out at any time by:

• Clicking the "unsubscribe" link at the bottom of any marketing email;
• Contacting us via the online contact form at https://mark12thirty.com with the subject line "Unsubscribe"; or
• Replying to any marketing email with "STOP" or "UNSUBSCRIBE."

We will process your opt-out request within ten (10) business days in accordance with the CAN-SPAM Act (15 U.S.C. §§ 7701-7713). Please note that even after opting out of marketing communications, you may still receive transactional or service-related communications (such as order confirmations, shipping notifications, and account updates).

15. THIRD-PARTY LINKS AND SERVICES

Our Site may contain links to third-party websites, services, or applications that are not owned or controlled by mark12thirty, LLC, including but not limited to payment processors, social media platforms, shipping carriers, and analytics providers. This Privacy Policy applies only to information collected by mark12thirty, LLC through our Site.

We have no control over, and assume no responsibility for, the content, privacy policies, or practices of any third-party websites or services. We strongly advise you to review the privacy policy of every site you visit. Your interactions with third-party websites and services are governed solely by those third parties' own terms and privacy policies.

The inclusion of a link to a third-party website does not imply endorsement of the linked site or service by mark12thirty, LLC.

16. DATA BREACH NOTIFICATION

In the event of a security breach involving your personal information, mark12thirty, LLC will notify affected individuals in accordance with applicable federal and state law, including but not limited to the Idaho Identity Theft/Fraud statutes (Idaho Code §§ 28-51-104 through 28-51-107).

Notification will be provided without unreasonable delay, consistent with the legitimate needs of law enforcement and any measures necessary to determine the scope of the breach and restore the reasonable integrity of the data system. Notification may be provided by email, written notice, or other means as permitted by applicable law.

If a breach affects more than the notification thresholds established by applicable state law, we will also notify the relevant state attorney general or other regulatory authority as required.

17. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes to this Privacy Policy, we will notify you by:

• Posting the updated Privacy Policy on our Site with a revised "Last Updated" date;
• Sending an email notification to the email address associated with your account (if applicable); or
• Displaying a prominent notice on our Site.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Site after the posting of changes constitutes your acceptance of such changes. If you do not agree with the revised Privacy Policy, you should discontinue your use of the Site and contact us to request deletion of your personal information.

The "Last Updated" date at the top of this Privacy Policy indicates when it was last revised. Changes are effective when posted unless otherwise stated.

18. DISPUTE RESOLUTION

Any disputes arising out of or relating to this Privacy Policy are subject to the dispute resolution provisions set forth in our Terms and Conditions, including mandatory binding arbitration, class action waiver, and governing law provisions. Please refer to the Terms and Conditions available on our Site for complete details.

By using our Site and agreeing to this Privacy Policy, you also agree to the dispute resolution provisions in our Terms and Conditions.

19. CONTACT INFORMATION

If you have any questions about this Privacy Policy, wish to exercise your privacy rights, or have concerns about our data practices, please contact us:

mark12thirty, LLC

Online Contact Form: https://mark12thirty.com

For privacy rights requests, please include "Privacy Request" in the subject line of your message and provide sufficient information for us to verify your identity and process your request.