Privacy Notice

This Privacy Notice ("Notice") applies to personal data SMR Holdings LLC (together with its wholly owned subsidiaries, including Smart Metals Recycling, LLC d/b/a Sprout, "Sprout," "we," "us," or "our") collects. This Notice also covers rights and choices related to your personal data.

Data We Collect

We collect data about you in different ways. For example, we collect data:

• Directly from you. This includes when you make an account, sign up to get our emails, purchase our services, or contact us.
• Automatically. This includes through cookies, server logs, and other tools on our website or apps.
• From other sources. These can include our affiliates, vendors, publicly available sources, and other companies.

The following are a few examples of our collection and use of data:

Context	Examples of Personal Data	Primary Purpose and Legal Basis
Account Registration	We collect your name and contact information when you make an account. We also collect data on the actions that you perform while logged in.	We have a legitimate interest in providing account-related functionalities to users. Accounts can offer saved preferences, service options, and purchase history.
Client Information	We collect the name and contact information of our clients and their employees with whom we may interact.	We have a legitimate interest in contacting our clients and communicating with them about business activities such as projects, services, and billing.
Demographics	We collect personal data, such as your region.	We have a legitimate interest in understanding our users and potential customers better.
Distance	Our apps may collect your location from the GPS, Wi-Fi, and/or cellular technology in your device.	We have a legitimate interest in understanding our users and providing tailored services. In some contexts, our use is also based upon your consent to share location data.
Email Interactions	If you receive email from us, we use tools to capture when you open our message, click on links or banners in it, or make purchases after receiving an email.	We have a legitimate interest in understanding how you engage with our messages.
Feedback/Support	If you provide feedback or contact us for support, we collect your name and email, as well as other content that you send.	We have a legitimate interest in receiving and acting upon feedback and providing support.
Job Applicants	If you apply for a job or provide us with your personal information for purposes of employment, we collect information needed to process your application. This may include your social security number and any information on your resume. Providing this information is required for employment.	In some contexts, we are required by law to collect data about applicants. We also have a legitimate interest in using data to evaluate your application or consider you for other positions. If you become an employee, we will provide you with a separate privacy notice that explains how we collect, use, and share additional data about our employees.
Mailing List (Email or Mail)	When you sign up for our mailing lists, we collect your contact information.	We have a legitimate interest in sharing information about our products and services. Where required by law, we will ask for your consent before communicating with you.
Order Placement	We collect your name, billing, mailing, and email addresses, phone number, and billing information when you place an order for our services.	We use your information to perform our contract to provide our products and services.
Surveys	We collect data you share through surveys. If a third-party offers a survey, the third party's privacy notice also applies to the collection, use, and disclosure of your data.	We have a legitimate interest in understanding your opinions.
Sweepstakes or Contests	When you enter a sweepstakes or contest, we collect data about you such as your contact information.	We have a legitimate interest in operating the sweepstakes. We may also be required by law to collect such data.
Use of Our Website	We use technology (e.g., a cookie or a pixel) to learn how you engage with our websites. This may include which links you click or what you type into our online forms. We may also track your IP address, the website that referred you to us, and data about your device.	We have a legitimate interest in making our website operate. We also use it to understand how you interact with our websites, gather analytics, improve our websites, and learn your preferences. We may also use this data to help detect and prevent fraud. Where required by law, we base the use of technologies upon consent.
Website Targeted Advertising Technology	We may let third parties place tracking technology on our websites (e.g., a cookie or a pixel). The third party might also collect data over time and across other websites. Among other things, they may use this data to serve ads tailored to your interests, which may include ads about our products or services.	Where required by law, we base the use of third-party tracking technologies upon consent. Users should see our Cookie Preference Center for more information. You can also find more information about your options with regard to this technology in the Your Choices section below.
Use of Our Apps	We collect your username and password, as well as your interactions, when you use our Apps.	We use your information to perform our contract to provide App-related services. We have a legitimate interest in understanding how you use our app.

Sensitive Information Disclosure. We collect the following categories of sensitive personal data (as defined under relevant laws): social security, driver's license, state identification card, or passport number; account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; precise geolocation; racial or ethnic origin, citizenship or immigration status, religious or philosophical beliefs, or union membership; information concerning physical or mental health, condition, diagnosis, or treatment; biometric data; sex life or sexual orientation; status as transgender or nonbinary; or status as a victim of crime. We collect this data to process transactions, comply with laws, manage our business, or provide services. Note that we do not use such data for any purposes that are not identified within Cal. Civ. Code § 1798.121. We do not "sell" or "share" sensitive personal data for cross-context behavioral advertising, although we may transfer it to third parties when you instruct us to do so. When that occurs, third parties will use it for the purposes indicated in their privacy notices.

How We Use Data

We also use data to:

• Identify you when you visit our sites.
• Complete transactions.
• Improve or create services and products.
• Conduct analytics.
• Connect with you (e.g., addressing your requests, inquiries, issues, or feedback).
• Market our products or services.
• Market the products or services of our business partners.
• Find and prevent malicious, deceptive, fraudulent, or illegal activity.
• Find and prevent security incidents.
• Enforce our policies and agreements.
• Debug, find, and fix errors that impair our website and services.
• Comply with legal or regulatory obligations.
• Establish or exercise our rights.
• Defend against legal claims.
• Manage our relationships.
• For other reasons with your consent.

The sections above describe our main purposes in collecting your data, but often we have multiple purposes. For instance, if you purchase our services, we may collect your information to perform our contract with you. We also have a legitimate interest in maintaining that data so that we can easily address questions about an order. As a result, our collection and processing of your data is based in different contexts on your consent, our need to perform a contract, our legal obligations, and/or our legitimate interest in conducting our business.

To the extent we store and use deidentified personal data, we will not try to reidentify the information, except to test our deidentification methods. If we share deidentified data, we will obligate the recipient not to try to reidentify the data.

How We Share Data

In addition to the specific situations discussed elsewhere in this Notice, we may share personal data in the following situations:

• Affiliates and Acquisitions. We may share data with our affiliates (e.g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If a company acquires or enters negotiations to acquire our company, business, or assets, we may share data with that company.
• Other Disclosures without Your Consent. We may share data to cooperate with law enforcement, to participate in a legal process, or for legal compliance. We may share your data to establish or exercise our rights, to defend against legal claims, to investigate, prevent, or act on possible illegal activities, threats to safety of person or property, or a violation of our policies. Your data may be shared to ship products to you.
• Service Providers. We may share your data with service providers. Service providers may help us to run our website, conduct surveys, provide technical support, process payments, fulfill orders, and more.
• Professional Services. We may share personal data with our professional service providers, such as auditors or lawyers.
• Other Disclosures with Your Consent. We may share your data with third parties when you consent or direct us to.

Some areas require us to disclose whether the following categories of personal data are collected, shared with third parties for a "business purpose," or "sold," or transferred for "valuable consideration." The table below indicates the categories of personal data we collect and transfer in a variety of contexts. We do not "sell" your personal data for money. Because our services are not intended for children, we have no actual knowledge that we share for targeted advertising any personal data of individuals who are under 16 years of age.

Category of Personal Data	Category of Recipients
	Disclosures for a Business Purpose	Sharing for Targeted Advertising
Identifiers – this may include things like name, alias, postal address, unique personal identifier, online identifier, email address, or account name.	Affiliates or subsidiaries Data analytics providers Internet service providers Joint marketing partners Operating systems and platforms Other service providers Payment processors and financial institutions Professional services organizations, which may include auditors and law firms Social networks	Advertising networks
Financial Information – this may include bank account number, credit card number, debit card number, and other financial information.	Affiliates or subsidiaries Other service providers Government entities, as may be needed to comply with law or prevent illegal activity Payment processors and financial institutions Professional services organizations, which may include auditors and law firms	N/A
Health Related Information – this may include medical information, mental or physical condition or treatment, or health insurance information. This information is only collected from job applicants.	Affiliates or subsidiaries Other service providers Government entities, as may be needed to comply with law or prevent illegal activity Professional services organizations, which may include auditors and law firms	N/A
Characteristics of protected classifications – this may include age, sex, race, ethnicity, physical, or mental handicap, etc. This information is only collected from job applicants.	Affiliates or subsidiaries Government entities, as may be needed to comply with law or prevent illegal activity Other service providers Professional services organizations, which may include auditors and law firms	N/A
Commercial information – this may include information about products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Affiliates or subsidiaries Joint marketing partners Other service providers Payment processors and financial institutions Government entities, as may be needed to comply with law or prevent illegal activity Professional services organizations, which may include auditors and law firms	Advertising networks
Internet or other electronic network activity information – this may include browsing history, search history, and information regarding an individual's interaction with an internet website, app, or ad.	Affiliates or subsidiaries Data analytics providers Internet service providers Joint marketing partners Operating systems and platforms Other service providers Government entities, as may be needed to comply with law or prevent illegal activity Professional services organizations, which may include auditors and law firms Social networks	Advertising networks
Geolocation data – this could include precise or non-precise geolocation information.	Business partners Data analytics providers Internet service providers Joint marketing partners Operating systems and platforms Social networks	N/A
Audio, electronic, visual, thermal, olfactory, or similar information	Government entities, as may be needed to comply with law or prevent illegal activity	N/A
Professional or employment-related information – this includes, for example, information submitted by job applicants.	Affiliates or subsidiaries Other service providers Government entities, as may be needed to comply with law or prevent illegal activity Professional services organizations, which may include auditors and law firms	N/A
Non-public education information (as defined in the Family Educational Rights and Privacy Act). This information is only collected from job applicants.	Affiliates or subsidiaries Other service providers Government entities, as may be needed to comply with law or prevent illegal activity Professional services organizations, which may include auditors and law firms	N/A
Inferences drawn from any of the information listed above	Affiliates or subsidiaries Government entities, as may be needed to comply with law or prevent illegal activity Joint marketing partners Other service providers	Advertising networks
Additional categories of personal data described in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) – this may include signature, physical characteristics, or description, insurance policy number.	Affiliates or subsidiaries Government entities, as may be needed to comply with law or prevent illegal activity Payment processors and financial institutions Other service providers	N/A

Your Choices

Some jurisdictions give you a right to make the following choices:

• Access. You may request access to your personal data or confirmation that we have data about you. In certain limited cases, you may ask to receive access to your data in a portable, machine-readable form.
• Change. Most of our websites allow you to change your account profile. If our website does not permit you to update or correct certain information, you can ask us to correct inaccurate or incomplete data by contacting us at the address below. We may keep historical data in our backup files as permitted by law.
• Deletion. You may ask us to delete your personal data. If required by law, we will grant such a request, but note that in many cases, we must keep your personal data to comply with legal obligations, resolve disputes, enforce agreements, or for other business purposes.
• Opt-out of Website Targeted Advertising. You may opt-out of online targeted advertising (e.g., cookies) by clicking "Reject" in the cookie settings link on our homepage. Note that if you change browsers or devices, or if you clear your browser's cache, you may need to click the link again to apply your preference. You may opt-out of other forms of targeted advertising by submitting a request as described below. We recognize Global Privacy Control (GPC) signals broadcast from web browsers as a valid opt-out request where required by applicable law. Please note that the GPC will apply only to your current browser. We do not recognize the "Do Not Track Signal." If there is a conflict between the GPC signal and a manual choice that you have made on our website regarding targeted advertising, we will honor your manual choice.
• Objection to or Restriction of Certain Processing. In certain circumstances, you may object to the processing of your personal data, or ask that we restrict processing of your personal data. To do so, follow the instructions below.
• Promotional Emails. You may provide us with your email address to allow us to send newsletters, surveys, offers, or other promotional content, as well as targeted offers from third parties. You can stop receiving such emails by following the unsubscribe instructions at the bottom of those emails. If you choose not to receive such emails, we may still send you service-related communications.
• Revocation of Consent. Where we process your personal data based upon consent, you may revoke consent. Note, if you revoke consent for processing personal data, we may no longer be able to provide you some types of services.
• California Shine the Light. If you would like more information on the categories of personal data (if any) we share with third parties or affiliates for those parties to use for direct marketing, submit a written request using the information in the Contact Information section.

Not all the rights above are absolute, and they do not apply in all circumstances. We may limit or deny a request because the law permits or requires us to. We will not discriminate against individuals who exercise a privacy right.

Submitting Requests

You may exercise the above rights by contacting us via the contact information below. If you disagree with our denial of a request, you may appeal our decision by contacting us with the subject line "Appeal."

We will require you to prove your identity when making most types of requests. We may verify your identity by phone or email. Depending on your request, we will ask for information such as your name, the last service you purchased from us, or the date of your last purchase from us. We may also ask you to send us a signed declaration confirming your identity.

In some circumstances, you may designate an authorized agent to exercise rights on your behalf. If you are an authorized agent, you must show that you may act on another's behalf as well as verify your identity with us.

How We Protect And Retain Data

No method of internet transmission or electronic storage is fully secure. While we use reasonable efforts to protect personal data, we cannot guarantee its security. If we are required to inform you about a security incident, we will do so electronically, in writing, or by phone, as the law permits.

Some of our websites permit you to create an account. You are responsible for selecting a unique and complex password and keeping it confidential. You are responsible for any access to or use of your account by someone who has obtained your password, whether or not you approved of such access or use. Notify us of unauthorized use of your password or account immediately.

We keep your personal data for only as long as necessary to fulfil the purposes in this Notice unless a longer retention period is required or permitted by law. This includes the purposes of satisfying legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the data. We also weigh the potential risk of harm from unauthorized use or disclosure of the data, the purposes for which we obtained the data and whether we can meet those purposes through other means, as well as applicable legal requirements.

Transmission Of Data To Other Countries

We may process your data in a country with less stringent privacy laws than the laws in the country that you reside. Where possible, we treat personal data using the same privacy principles that guide the law of the country in which we first receive your data. By submitting your personal data to us, you agree to the transfer, storage, and processing of your data in a country other than your country of residence including, but not limited to, the United States. For more information on our attempts to apply the privacy principles applicable in one area to data when it goes to another, contact us using the contact information below.

Third-Party Applications/Websites

We may provide links to websites and other third-party content or services that we do not own or operate. We have no control over the privacy practices of websites or services we do not own. For details about such third parties' privacy practices, see their privacy notices.

Changes To This Privacy Notice

We may change our Notice and privacy practices. New notices will be published on our website. If changes are material, we will notify you by posting a banner on our website or by sending you an email to the email we have on file. Also, if changes are material, the Notice that was in place when you submitted personal data to us will generally govern that data unless you consent to the new Notice. Our Notice shows "effective" and "last updated" dates below. The effective date is the date the current version took effect. The last updated date is the date the current version was last substantively changed.

Contact Information

If you have questions, comments, or complaints on our privacy practices, or if you need to access this Notice in a different form due to a disability, please contact us. We will try to address your requests and provide you with additional privacy-related information.

info@sproutup.com
+1 704 873 8878

If you are not satisfied with our response and are in the European Union or United Kingdom, you may have a right to lodge a complaint with your local supervisory authority.