Privacy Policy

COTTON INCORPORATED PRIVACY POLICY

This Privacy Policy was last updated on June 17, 2019.

PERSONAL DATA

Cotton Incorporated ("Cotton" or "we" or "us" or "our") endeavor to protect your online privacy while providing you with the most useful and enjoyable Web experience possible. As part of our Terms and Conditions, this Privacy Policy governs your visit to this website and any other website owned and operated by Cotton (collectively, the "Websites" and each, a "Website"). This Privacy Policy sets forth how we collect, store, use, disclose and transfer the personal data you provide through any of the Websites and the reasons why we collect your personal data. "Personal Data" is any information that can be used to uniquely identify you, either directly or indirectly. This includes information such as a name, an identification number, location data, and an online identifier. We strongly encourage you to read this Privacy Policy as well as our Terms and Conditions before you use our Websites. By accessing any of our Websites, you signify that you accept and agree to all of the terms of this Privacy Policy, and the practices described in it, as well as our Terms and Conditions. If you do not agree with any term of this Privacy Policy or the Terms and Conditions, please do not use our Websites or submit any Personal Data. Before you affirmatively submit any Personal Data to us on our Websites, we will request your explicit consent to our collection and use of your Personal Data, and as part of that consent, we will ask you to confirm that you have read our Privacy Policy and Terms and Conditions.

HOW WE COLLECT AND USE PERSONAL DATA

How and Why We Collect Personal Data
When you visit and use the Websites, we may ask for and collect certain Personal Data from you at certain points throughout the Websites in order to provide and improve upon our products, our inventory and our services and for advertising and marketing purposes. Depending on the information and/or services you request through the Websites, you may be asked to provide your name, email address, mailing address and other identifying information, all of which constitutes Personal Data. We do not ask you to provide any Personal Data to simply browse our Websites. If you wish, however, to participate in some of the features and services the Websites may offer, including features and services available to registered users, we may ask you to provide certain Personal Data and/or non-personally identifiable or demographic information. Users who affirmatively choose to receive communications from us via a wireless device may be asked to submit a cell phone number to receive text messages. Personal Data includes, but is not limited to, your name, home and/or business address, phone number, email address, date of birth, location data, or an online identifier. Your submission of demographic information, such as race, age, gender, occupation, income level, or marital status, is generally optional and rarely required. When non-personally identifiable information, such as demographic information, is tied to you personally (i.e., with other personally-identifiable information), it will be treated as Personal Data. In any instances in which we ask you to provide certain Personal Data, we will ask your permission to collect said Personal Data by asking you to affirmatively consent to our collection of your Personal Data. If you submit Personal Data to us, we will only use your Personal Data for our legitimate business purposes (i.e., the provision of our Websites and our products and services) and to comply with any legal obligations imposed upon us. We do not collect Personal Data unless you voluntarily provide it to us, and for any Personal Data you submit to us through our Websites, only after you affirmatively consent to our collection of your Personal Data. In some instances, if you choose not to provide the requested information, for example, in connection with your use of the Cottonseed Marketplace feature on wholecottonseed.com, or in order to register with one of our Websites or to participate in sweepstakes, contests and surveys, you may not be able to access all of the areas on the Websites or participate in all of their features.

If at any time you provide a third party's Personal Data to us, whether in the form of a name, shipping address, photo, email address or other information, you warrant that you have the permission of the person whose information you submit to share that information with us and you agree to indemnify, defend and hold harmless Cotton and third-party service providers from and against any claims, liabilities, costs and expenses arising in connection with your sending or providing that information to us.

"Cookies" and other Tracking Technologies
"Cookies" are small files placed on your computer's hard drive by a website when you access the website, so that the website remembers your preference when you visit subsequently. Cookies can be temporary, or session cookies, which are deleted as soon as you close your browser, or permanent, which remain on your computer and preserve your preferences for a website, remember your password for future visits and save items in a shopping cart, among other things. Like many other websites, our Websites use cookies. Most Web browsers automatically accept cookies but allow you to modify security settings so you can allow or block cookies on a case-by-case basis. If you do not accept our use of cookies on the Websites, you may modify your browser settings to block cookies. If you modify your browser settings so that your computer does not accept cookies from us, then we cannot guarantee that all functions of the Websites will operate as intended.

As with many websites, we also may use other technology (e.g., web bugs, email bugs, clear GIFs, web beacons and tracker GIFs) in our Websites and/or in our communications with you to enhance the functionality of our Websites and to make your activities at our Websites more convenient and efficient. These technologies may be used by us to store and collect information relating to your viewing and use of our Websites and our correspondence with you. We also may collect your IP (Internet Protocol) address and other publicly available information, such as Internet browser information, operating system information, dates and times of a particular users visit and/or click path taken through the site, lookup information, and information that may be publicly available in connection with an IP address, such as general location of the user, business names and contact information, to help diagnose problems with our server, administer our Websites and identify our users. This aggregate information provides statistics that we use to analyze, market and improve our Websites and business.

How We Use Personal Data
We may use Personal Data to communicate directly with users, such as to respond to inquiries, confirm registration information or your desire to opt-in to marketing communications from us, to inform users when they have won a sweepstakes or contest, to send you communications and offers by mail or email, or to fulfill a request for an online newsletter or other online subscription service, to keep you informed about the status of any transactions, to deliver gifts, prizes or rewards, to protect the security and integrity of our Websites, to correct technical problems and malfunctions on our Websites, to process your information, to take precautions against liability, to notify you of a recall or to provide other information concerning products or services, or to offer additional information about other products, programs, services, promotions or offers that may be of interest. We may also use Personal Data to identify your product and service preferences, to improve our promotional offers, customer service and overall user experience on our Websites, and to research, develop, manage and improve our Websites.

We may provide Personal Data to third parties who provide services on our behalf. These parties may use the Personal Data solely in conjunction with the specific services they provide for us (e.g., data processing, fulfillment of an order, managing and enhancing customer data, sending you information about products, services, programs and events that we offer that may be of interest to you based on your preferences, responding to your question or comment, providing a promotional prize, deployment of a consumer survey, investigation of a complaint, etc.). Our service providers are obligated to protect your Personal Data. We may also provide third parties with aggregate statistics about traffic patterns and related Website information. This data reflects Website usage patterns gathered during millions of customer visits to our Websites each month, but it does not contain behavioral, profile, or identifying information about any individual user. We reserve the right to disclose any Personal Data as needed if such information is requested by law enforcement agencies or if we are required to do so by law, regulation, subpoena, court order or by a government entity. We also may disclose Personal Data to third parties in response to legal requests, such as court orders, subpoenas, and specific requests from law enforcement agencies, if we have reason to believe that disclosing such information is necessary to conduct investigations of possible breaches of law, to cooperate in any legal investigation, or to identify, contact, or bring legal action against someone who may be violating the Terms and Conditions.

We never rent, sell, or otherwise share Personal Data with third parties for any purpose unassociated with the business of Cotton unless you have given us your express permission to do so. In the event all or a portion of the business or assets of Cotton are sold or transferred, including in connection with a sale, merger, consolidation, change in control, transfer of assets, reorganization or liquidation of our business, user information is usually one of the business assets that is transferred. Prior to any transfer of your Personal Data in these circumstances, we will notify you via email of the transfer, and you will have the opportunity to opt out of having your Personal Data transferred. If your Personal Data is transferred, you will be subject to the Privacy Policy and Terms and Conditions of the new organization.

Cottonseed Marketplace
One of our Websites, wholecottonseed.com, offers the option for a user to submit a request through one of our product price quote or service inquiry services on the Cottonseed Marketplace, and we forward the user's contact information to one or more seed merchants and suppliers, none of which are affiliated with Cotton. We will explicitly request the user's consent to forward the user's Personal Data, including contact information, to such seed merchants and suppliers. We do not collect or store the Personal Data users submit through wholecottonseed.com; thus, once the Personal Data are sent to the seed suppliers, their use, storage and handling of a user's Personal Data are not governed by this Privacy Policy but are governed by the recipient supplier's own privacy policy. We cannot control, and are not responsible for, the manner in which such merchants use, store or handle your Personal Data. Do not submit a request to us via the Cottonseed Marketplace at wholecottonseed.com if you do not agree to these terms.

WHERE WE PROCESS AND STORE YOUR PERSONAL DATA

Please note that all Personal Data we collect is stored on our servers in the United States. If you are located outside of the United States, any Personal Data we collect, including location data and online identifiers, will be processed and stored in the United States. The data protection and privacy laws and regulations in the United States may be different from those of the country, territory or region where you reside or are a citizen and may offer less protection than the laws and regulations in your country, territory or region. By using our online services, you consent to the transfer and processing of your Personal Data in the United States, and we use this consent as the legal basis for that transfer. As noted above, when we initially ask you to provide us with your Personal Data on our Websites to receive services and/or communications from us, we will request your explicit consent to the transfer and processing of your Personal Data. For more information on transfers of your Personal Data to the United States, please see the "Transfer of Personal Data to the United States" section below.

LEGAL BASIS FOR PROCESSING

Under applicable data protection laws, Cotton is the controller of the Personal Data you provide to us. As a controller, we will process the Personal Data we collect from you in accordance with this Privacy Policy. For more information on how we process the Personal Data of persons located in the European Economic Area ("EEA") at the time of data collection, please refer to the "Your General Data Protection Regulation Rights" section below. In most cases, we will request your explicit consent before collecting and processing your Personal Data; however, there are some exceptions to this when we may collect and process your Personal Data without your express consent, including:

1. To perform any contractual obligations to you in our Terms and Conditions and any contractual obligations arising under services we are providing to you;
2. To comply with laws, regulations, court orders, or other legal obligations, to defend legal claims, or to assist in an investigation;
3. To protect your vital interests or the vital interest of other persons, when necessary; and
4. For the purposes of our legitimate interests, including providing you with important notices about changes to our Terms and Conditions and this Privacy Policy, responding to your requests, inquiries, complaints, and any other communication you initiate, keeping our services safe and secure, and improving our services to enhance your experience with our services.

We will not perform any automated processing, including profiling, to provide our services to you without first obtaining your explicit consent to do so.

Your General Data Protection Regulation Rights

Under the European Union's General Data Protection Regulation ("GDPR"), persons whose Personal Data is collected while they are located in the EEA have certain rights that they may exercise in relation to the collection and processing of their Personal Data. If you are in this category of persons, you have the following rights:

1. Right of access to your Personal Data (Art. 15 GDPR): You have the right to obtain from us confirmation as to whether or not Personal Data concerning you is being processed, and where that is the case, access to the Personal Data and certain information related to the processing, such as the purposes of the processing, the categories of Personal Data involved, and the recipients of the Personal Data.
2. Right to rectification (Art. 16 GDPR): You have the right to obtain from us without undue delay the rectification of any inaccurate Personal Data.
3. Right to erasure ('right to be forgotten') (Art. 17 GDPR): You have the right to request that we erase your Personal Data, and we must erase your Personal Data following your request, when: (a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw the consent you gave to the processing of your Personal Data, including special categories of Personal Data, for one or more specific purposes (pursuant to Art. 6(1)(a) or Art. 9(2)(a)) and there is no other legal basis for the processing; (c) you object to processing necessary for the performance of a task carried out in the public interest or for purposes of carrying out our legitimate interests and there are no overriding legitimate reasons for the processing (pursuant to Art. 21(1)), or you object to the processing carried out for direct marketing purposes (pursuant to Art. 21(2)); or (d) your Personal Data have been unlawfully processed.
4. Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing where: (a) the accuracy of your Personal Data is contested by you, for a period enabling us to verify the accuracy of your Personal Data; (b) the processing is unlawful and you oppose the erasure of your Personal Data and request the restriction of their use instead; (c) we no longer need your Personal Data for the purposes of the processing but your Personal Data are required by you for the establishment, exercise, or defense of legal claims; or (d) you have objected to processing pursuant to Art. 21(1) pending the verification of whether our legitimate interests override your interests, rights, and freedoms.
5. Right to data portability (Art. 20 GDPR): You have the right to receive your Personal Data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where technically feasible, without interference from us.
6. Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of Personal Data concerning you which is based on processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of our legitimate interests or those of a third party (Art. 6(1)(e) and Art. 6(1)(f), respectively), including profiling based on those types of processing, as well as processing of Personal Data for direct marketing purposes and any profiling related to such direct marketing. Upon notice of your objection to processing of Personal Data which is based on Art. 6(1)(e) and Art. 6(1)(f), we will no longer process your Personal Data for such purposes, unless we are able to show compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims. Upon notice of your objection to processing of Personal Data for direct marketing purposes, we will no longer process your Personal Data for such purpose.
7. Automated individual decision-making, including profiling (Art. 22 GDPR): You have the right to not be subject to a decision based solely on automated processing, including profiling, which significantly affects you, unless the decision is necessary for entering into, or performance of, a contract between you and us, or is based on your explicit consent.
8. Right to withdraw consent (Art. 13 and Art. 14 GDPR): If our processing of your Personal Data is based on your consent, you have the right to withdraw this consent at any time.
9. Right to lodge a complaint with the Data Protection Authority (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the EEA member country of your habitual residence, place of work, or place of the alleged infringement if you believe the processing of your Personal Data infringes the GDPR. A list of Data Protection Authorities and their contact information can be found here: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

If you reside, or are otherwise located, in the EEA at the time we collect your Personal Data, we will only use your Personal Data as described in this Privacy Policy under the "HOW WE COLLECT AND USE PERSONAL DATA" section, and we will only transfer your Personal Data to the United States upon obtaining your explicit consent to do so as detailed in the "WHERE WE PROCESS AND STORE YOUR PERSONAL DATA" and "Transfers of Personal Data to the United States" sections herein.

For more information on the GDPR, you may follow this link: https://gdpr-info.eu/.

Your California Privacy Rights
Under California Civil Code sections 1798.83-1798.84, California residents are entitled to ask us for a notice describing what categories of personal customer information we share with third parties for those third parties' direct marketing purposes. That notice will identify the categories of information shared and will include a list of the third parties with which it was shared, along with their names and addresses. If you are a California resident and would like a copy of this notice, please submit a written request to the following address: Cotton Incorporated, Attn: Intellectual Property, Contracts & Legal Department, 6399 Weston Parkway, Cary, NC 27513. Please allow up to 30 days for a response.

HOW WE PROTECT YOUR PERSONAL DATA

Cotton implements appropriate technical and organizational security precautions to maintain the security and accuracy of Personal Data we collect, including limiting the number of people who have physical access to our database servers, as well as employing electronic security systems and password protections that guard against unauthorized access, loss, misuse or alteration. Only authorized Cotton personnel, including service providers, have access to the data. Notwithstanding the above, due to the open nature of the Internet, we cannot fully guarantee that any Personal Data stored on our servers, or transmitted to or from a user, will be free from unauthorized access. By using our Websites and where applicable, explicitly consenting to our collection and use of your Personal Data, you acknowledge that you understand and agree to assume these risks. Please note that email is not encrypted and is not considered to be a secure means of sharing Personal Data with us.

HOW WE HANDLE LINKS

This Privacy Policy does not apply to the practices of entities that we do not own or control or persons that we do not employ or manage. For the convenience of our users, our Websites often contain links to other websites that are not under our control ("Linked Websites"). Cotton is not responsible for the privacy practices or the content of such Linked Websites. You acknowledge that Cotton is not responsible for the accuracy, copyright compliance, legality, decency, data collection, privacy policies, or any other aspect of the content of Linked Websites it does not operate or control. Accessing the links to any other off-site pages or other Linked Websites is at your own risk and subject to the applicable privacy policies and terms and conditions of such Linked Websites. We recommend that you make your own independent judgment regarding your use of, and submission of information to, Linked Websites.

YOUR CHOICES REGARDING USE OF THE INFORMATION WE COLLECT

At any time after you have opted in and provided us with your Personal Data you may opt-out of having your Personal Data used for commercial purposes. If you would prefer to no longer be contacted about our special offers, products or services, or if your Personal Data changes (such as email address, phone number, or mailing address), you may correct, update or delete/deactivate your Personal Data at any time by notifying us via one of the "How to Contact Us" options provided below.

If you choose to write to us, please include your name, address and any contact information that you want removed from our promotional contacts list, including phone numbers, and email addresses, and state one of the following:

• "NO MAIL OFFERS" (if you do not want to receive offers by mail);
• "NO PHONE OFFERS" (if you do not want to receive offers by telephone, including cell); or
• "NO PHONE OR MAIL OFFERS" (if you do not want to be contacted by either method).

If you opted in to a mobile messaging (e.g., SMS and MMS) offer but later decide you no longer wish to receive the mobile messages, please follow the opt-out instructions included in the mobile message. If you receive any online newsletter or similar promotional email communication from us, and you wish to unsubscribe or change your preferences, you will always have the option of replying to the email communication and inserting "unsubscribe" in the subject line, following the "Update Email Profile" link located in the Website footer, or emailing us your changed preferences at any one of our Websites. If you use more than one email address, then send your opt-out email from, or ask to unsubscribe for, each of your email addresses. Because customer lists generally are prepared well in advance of a communication, you may continue to receive some offers after you send us a request not to use your information for specified marketing purposes, but we will work to remove your information from that list as soon as possible. We appreciate your patience and understanding in giving us time to implement your request.

DATA RETENTION

Cotton will retain your Personal Data only for as long as you maintain an account with us or as otherwise necessary to provide services to you. We will also retain your Personal Data as necessary to comply with our legal obligations, to resolve legal disputes, and to enforce our agreements. Once we no longer need to process your Personal Data for the purposes described in this Privacy Policy, we will delete your Personal Data from our servers and systems. We will also delete your Personal Data upon your request to do so, where permissible. To request the deletion of your Personal Data, you may contact us using one of the "How to Contact Us" options listed at the end of this Privacy Policy.

INTERNATIONAL USERS AND MINORS

OUR WEBSITES ARE ONLY INTENDED FOR VIEWING IN THE UNITED STATES IF YOU ARE EIGHTEEN (18) YEARS OR OLDER and not a minor in your state of residence. If you are not an intended user, kindly do not use or view our Websites.

Cotton does not knowingly collect Personal Data from children under 13. If we learn that we have collected the Personal Data of a child under 13, we will take steps to delete the information as soon as possible.

We control and operate the Websites from our offices in the United States of America. Cotton makes no representation that materials on the Websites are appropriate or available for use in other countries, and access to them from countries, territories or regions where the Website content is illegal is prohibited. Those who choose to access our Websites from locations outside the United States do so on their own initiative and are responsible for compliance with applicable local laws and regulations. You may not use or export the materials in violation of United States or any other jurisdiction's export, re-export or import laws and regulations.

Transfer of Personal Data to the United States

The Websites are designed and targeted to users who reside in the United States and are governed by and operated in accordance with the laws of the United States. By participating in our Website activities, you certify that you meet the age and other eligibility requirements for the Websites as set forth herein and in our Terms and Conditions. If you are located outside of the United States, please be advised that any information you provide to us will be transferred to the United States. As necessary, we will ask for your explicit consent to the transfer of your Personal Data to the United States as outlined herein. Children under the age of majority in any jurisdiction outside of the United States should not provide Personal Data without their parent's or legal guardian's consent.

NOTIFICATION OF CHANGES

Cotton reserves the right to change this Privacy Policy from time to time. If we believe the changes are material, we will notify you that the Privacy Policy has changed by posting a notice thereof on the homepage of our Websites and in other places we deem appropriate. Your continued use of our Websites following the posting of changes means you accept those changes.

HOW TO CONTACT US

Write to us at the following address:

Cotton Incorporated
Attention: Intellectual Property, Contracts & Legal Department
6399 Weston Parkway
Cary, North Carolina 27513

Email us by filling in the boxes below.