PRIVACY POLICY.

Effective Date: January 1, 2023

This Privacy Policy (“Privacy Policy”) explains how the Correct Craft Group, including the Correct Craft Holding Company, LLC, its affiliates, subsidiaries, and holding companies and any subsidiaries of those holding companies (collectively “Correct Craft Group,” “we,” “our”, or “us”) processes and collects information, including personal information, relating to our visitors, users, customers, dealers, any successors and assigns, and any people using products manufactured by us (“Products”) under their authority (collectively, “you”).

By accessing and using the http://www.correctcraft.com, the Nautique App, or any of our affiliates’, subsidiaries’, or holding companies’ websites and web applications containing a link to this Privacy Policy (collectively, the “Site”), receiving our Products, or otherwise providing us with personal information, you agree to the terms and conditions of this Privacy Policy and any updates we make to it. If you do not agree to the terms and conditions of this Privacy Policy, then please do not provide us with your information. Please note, however, that if you choose to limit the information that you provide to us while using the Site, you may not be able to use or participate in certain features of the Site.

Certain portions of this Privacy Policy also apply to other personal information collected or maintained by Correct Craft Group, for example, under “California Privacy Rights,” “EU Privacy Rights,” and “Australian Privacy Rights” sections below. If you are located in the European Union or if the processing of your data is subject to the laws of a member state of the European Union, please review carefully the “EU Privacy Rights” section below for more information regarding your rights and our activities relating to your personal data. If the EU Privacy Rights section is applicable to your information, then other sections in this Privacy Policy still may apply to you but are subject to (and considered modified by) the EU Privacy Rights section.

By accessing, visiting, browsing, using or attempting to interact with any part of the Site, or otherwise providing us with information, e.g., calling a call center, purchasing a product, requesting a service or sending us an email, you are consenting to the practices described in this Privacy Policy.

Changes and Updates to This Privacy Policy
We reserve the right to revise or update this Privacy Policy at any time, and you should periodically read the Privacy Policy to learn of any revisions or updates. We will notify you of any changes to the Privacy Policy by posting the revised or updated Privacy Policy and its “Effective Date” on the Site. Using the Site thereafter constitutes your agreement to and acceptance of the Privacy Policy and its revisions or updates.

Collection of Personal Information
We collect both personally identifiable information and non-personally identifiable information about you to help you use the Site. “Personal Information” is information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household, as defined by applicable privacy laws.

We collect Personal Information about you in various ways, including:

directly from you

automatically when you use the Site

from third parties

Information We Collect Directly from You

You may provide Personal Information to us directly in numerous ways. For example, when you:

buy our Products

communicate with us via email, phone, chat, or otherwise

We collect the following types of Personal Information from you directly:

Identifiers, including real name, account name, postal address, online identifier, email address, signature, telephone number, insurance policy number, driver’s license number, social security number, passport number

Information Listed in the California Customer Records Statute, including real name, postal address, telephone number, driver’s license number, education, employment, employment history, credit card number, debit card number

Legally Protected Characteristics Under California or Federal Law, including age, citizenship, race, ethnic origin

Professional/Employment Information, including application file, personnel file, payroll, employment status and history, resume, contract, benefits, 401k enrollment, leave requests, disciplinary record

Sensitive Personal Information, including driver’s license number, passport number, social security number, race, ethnic origin, contents of mail, email, or texts, precise geolocation (for boats equipped with Osmosis Telematics Platforms)

Information We Collect About You

The Correct Craft Group and third-party service providers may automatically collect data about you when you use the Site. This information is primarily needed to maintain the security an operation of the Site, and for our internal analytics so that we can improve our Products and Site. This information includes:

Commercial Information, including products or services purchased, obtained, considered, and other tendencies

Internet or Other Electronic Network Activity Information, including browsing history, browser and device information, hardware model, software, preferred language, unique device identifiers, advertising identifiers, network information, clickstreams, search history, information regarding your interaction with our Site, IP address, cookies, pixel tags, browser version, operating system

Geolocation, including IP address

Information We Receive from Third Parties

In some instances, the Correct Craft Group may receive Personal Information and/or anonymous data about you from other parties, such as our affiliates, business partners, and service providers. That information may be obtained online, offline, or through publicly available resources. We may combine this data with the information you provide, and other data we already have about you.

We may also receive information about you from social media platforms, such as when you interact with us on those platforms or access our social media content. Please note that the information we may receive from those third-party sites (such as Facebook, Instagram, Twitter and YouTube) is governed by the privacy settings, policies and/or procedures of the applicable platform, and we strongly encourage you to review them before submitting any information using a social media platform.

Processing Purposes

The Correct Craft Group processes your Personal Information for the following lawful business and commercial purposes, in accordance with the practices described in this Privacy Policy, and based upon the legal justifications set forth in the parenthetical:

create, maintain, customize, and secure your account (CONSENT, LEGITIMATE INTEREST);
identity verification (LEGITIMATE INTEREST);
fulfill and provide our Products (CONSENT, CONTRACT, LEGITIMATE INTEREST);
process payment (CONTRACT, LEGITIMATE INTEREST)
provide customer service and support (CONSENT, CONTRACT, LEGITIMATE INTEREST);
respond to your inquiries and communicate with you (CONSENT);
protect against fraud, illegal activities, or intellectual property infringement and provide security (CONTRACT, LEGITIMATE INTEREST);
improve, analyze, and maintain the Site and our Products (LEGITIMATE INTEREST);
analyze trends and statistics regarding use of our Products and future Product models (LEGITIMATE INTEREST);
market our Products, services and materials (LEGITIMATE INTEREST);
comply with applicable legal and regulatory requirements, including valid court orders (LEGITIMATE INTEREST);
fulfill or meet the reason you provided the information (CONSENT); and
as otherwise set forth in this Privacy Policy (CONSENT).

Legal Basis for Processing
We process your Personal Information with your consent, for a legitimate interest, or subject to the performance of a contract to which you are a party or, alternatively, in order to take steps at your request to enter into an agreement. For Personal Information processed based only on your consent, you have the right to withdraw your consent at any time, subject to legal exceptions.

Cookies
We use cookies on the Site to help us analyze the traffic on the Site.

Google Analytics
We use Google Analytics on the Site to help us analyze the traffic on the Site. For more information on Google Analytics’ processing of Personal Information, please see http://www.google.com/policies/privacy/partners/ You may opt out of the use of Google Analytics here: https://tools.google.com/dlpage/gaoptout.

Meta Pixel
We use Meta Pixel Tags to better measure, optimize, and retarget our marketing campaigns. More information about the protection of your privacy can be found in Facebook’s Data Policy: https://www.facebook.com/about/privacy/. For information about Facebook pixel opt-out options, please visit: https://www.facebook.com/help/568137493302217.

Disclosure of Personal Information

We may share some information we collect with our service providers, partners, and dealers who assist us in operating the Site and providing our Products, and in some cases, legal authorities.

Dealers, Service Providers, and Sponsors

Dealers. Customers largely purchase our Products and services via our dealership network. Such dealers are not part of the Correct Craft Group, but such dealers must comply with this Privacy Policy regarding any information disclosed by us. The dealers’ use of any information shall be limited to the performance of their duties and in line with the reason for processing. Our employees and dealers are required to keep that information confidential and are not permitted to use it for any purposes other than to provide our Products and services, to deal with requests which are submitted to us, or for the purposes of facilitating our use of that information in accordance with this Privacy Policy (please note, however, that use of information you provide to dealers is subject to the dealer’s privacy policies);

Service Providers and Vendors. We use third party providers and vendors to help us operate and improve the Site on our behalf, such as web-hosting companies, information technology providers, web-development consultants, analytics providers, delivery of goods and services, processing of credit card payments, billing and debt collection, customer services, marketing and communications services and event hosting; and

Sponsors. We use third parties who sponsor, co-sponsor, promote, or co-promote an event or a competition, sweepstake, promotion, survey, or other activity or offering in which you participate

Other Situations. We may use and disclose information outside of our day-to-day business practices and in ways unrelated to the Site and Products.

In the Event of Merger, Sale, Divestitures or Change of Control. We may transfer or assign Personal Information to an entity that acquires or is merged with us as part of a merger, acquisition, sale of ownership or assets, or other change of control.

Affiliates. We may disclose Personal Information about you to our affiliates.

Other Disclosures. We may disclose Personal Information about you if we have a good faith belief that disclosure of such information is helpful or reasonably necessary to: (i) comply with any applicable law, regulation, legal process or governmental request; (ii) enforce our Terms of Service, including investigations of potential violations thereof; (iii) detect, prevent, or otherwise address fraud or security issues; or (iv) protect against harm to our, your, or third parties’ rights, property, or safety.

Authorized Representatives. If another individual is managing your account on your behalf (for example, a wife managing the account of her husband), as authorized by you or as a personal representative under applicable law, that person can view all Personal Information about you.

With Your Consent. We may share your information for other purposes pursuant to your consent or at your direction.

We do not sell, rent or otherwise share any information with unaffiliated entities except as described in this Privacy Policy, or with your prior permission. We may share or use anonymized information in any manner we choose. Anonymized information, which is also referred to as de-identified or non-personal information, is information assembled into groupings that can no longer be reasonably used to identify you or your organization.

Other than as set out above, you will receive notice when information about you might go to third parties, and you will have an opportunity to choose not to share the information.

Third Party Links
The Site may link to third-party websites, online services, mobile applications and/or contain advertisements from third parties that are not affiliated with us—and which may link to other websites, services, or applications. Please be aware that we are not responsible for the privacy or practices of other websites or third parties, including those using the Correct Craft Group branding. We do not make any guarantee regarding those third-party websites, services, or applications, and we are not liable for any loss or damage caused by the use of such sites. Any data collected by third parties is not covered by this Privacy Policy. You should review the policies of the third parties and contact them directly if you have any questions about their services or practices.

Public Activities
We may offer publicly available spaces on the Site where you and other users may communicate, interact, and engage with each other as well as add information about yourself and your content (“Public Activities”). If you choose to engage in Public Activities on the Site, please be aware that any information you share may be read, collected, or used by other users, third parties, and the public, including those that do not adhere to our Privacy Policy. The protections described in this Privacy Policy do not apply when you provide information, including any Personal Information, in connection with Public Activities. You should use caution in disclosing Personal Information on your profile or on any other publicly available space on the Site. Depending on the permissions you grant, the third party may be able to obtain your account information and other information you choose to provide. We are not responsible for events arising from the distribution of any information you choose to publicly post or share throughout the Site.

We ask that you do not send us or disclose any sensitive information on or through the Services or otherwise, including personal information relating to: racial or ethnic origins; political opinions; membership of a political association; religion or other beliefs; health or medical conditions; genetic or biometric information; trade union membership; membership of a professional or trade association; sex life or sexual orientation; or criminal background. Unless you are located in Australia, if any sensitive information is freely available or accessible in the public domain, we will not have any obligations to you regarding that information.

Choices About Your Personal Information

You have choices about how we use your information. Please understand that if you choose not to disclose information to us, it may affect your ability to use some features of the Site or Products.

Marketing
If you have provided your email address to us, we may send you emails or notifications to provide you with information, to inform you of new events or content, to solicit your feedback, or to keep you up to date on us. You can opt out of our marketing communications at any time by clicking ‘Unsubscribe’ or otherwise following the opt-out prompts on these communications. You also may ask us not to send you other marketing communications by contacting us as specified in the “Contact Us” section below, and we will honor your request. Please note that even after you are removed from our marketing lists, we may still send you non-promotional communications, such as responding to service requests.

Advertisements
Advertisements appearing on the Site may be delivered by advertising partners, who may set cookies. These cookies allow the ad server to recognize your computer each time they send you an online advertisement to compile information about you or others who use your computer. This information allows ad networks to, among other things, deliver targeted advertisements that they believe will be of most interest to you. This Privacy Policy covers the use of cookies by us and does not cover the use of cookies by any advertisers.

We and our service providers may use information about your interactions with the Site to predict your interests and select the ads you see on and off the Site. This is known as interest-based advertising. In providing interest-based ads, we follow the Self-Regulatory Principles for Online Behavioral Advertising developed by the Digital Advertising Alliance (“DAA“). For more information about interest-based advertising and how you can opt out, visit:

Digital Advertising Alliance: http://www.aboutads.info/choices

Network Advertising Initiative: http://www.networkadvertising.org/choices/

Do-Not-Track Disclosure
Many web browsers include a Do Not Track (“DNT”) feature or setting that signals your preference not to have data about your online browsing activities monitored and collected. However, there is currently no uniform standard for recognizing and implementing the DNT signals. As such, the Correct Craft Group does not monitor or respond to DNT browser requests. If a standard is adopted that we must follow in the future, then we will inform you about that practice in a revised version of this Privacy Policy.

Cookies
You may stop or restrict the placement of cookies on your device or remove them by adjusting your preferences as your browser or device permits.

Correcting and Updating Your Personal Information
You may correct and update your information by editing your profile or by contacting us as directed in the “Contact Us” section below. We will use reasonable commercial efforts to make changes you request, but it is not always possible or commercially reasonable to modify database or backup information. We may retain certain information unaltered for legal or other appropriate reasons. To the extent that personal information was provided to third parties, we will not be able to make changes to it. Information may not be completely removed from our database(s) due to technical constraints and the fact that we back-up our systems.

Information Retention

We retain the information we collect for as long is reasonably necessary to provide you with our Products, to fulfill the purposes for which we collect the information, and for any legitimate and essential business purpose, such as maintaining the performance of the Site, making data-driven business decisions about new features and offerings, complying with legal obligations, resolving disputes and to serve our reasonable interests (e.g., until termination of any statutes of limitation). Following completion of the services provided by us, we will either retain the related papers or store these records digitally.

Please note, Osmosis Telematics information may be retained for as long as your Osmosis Telematics device is providing information to us and for two years after the end of transmission of Osmosis Telematics information or such longer period as described above (e.g., as required to fulfill the purposes for its collection and to comply with legal obligations).

Confidentiality and Security

The Correct Craft Group values your privacy and is committed to protecting your information. We have appropriate administrative, technical, and physical safeguards in place to ensure the integrity and security of your information. We undertake commercially reasonable efforts to guard against unauthorized access, use, alteration, or destruction of Personal Information, which efforts you agree are sufficient, adequate, and complete. When contracting with suppliers and/or service providers, the Correct Craft Group takes appropriate steps to ensure that such third parties are required to maintain adequate protection of Personal Information.

Children
The Correct Craft Group (with the exception of Aktion Parks, LLC, Elite Cable Park, Miami Wakeboard-Cable Complex, LLC and Orlando Watersports Complex where information may be provided by parents or guardians for minors under their authority) do not knowingly collect or solicit Personal Information on individuals under the age of 16. You are required to verify that you are 18 years of age or older when you register. If you are under the age of 16, please do not use or provide any information to or on the Site or through any of its features, or use any of the interactive or public comment features of the Site, or provide any Personal Information about yourself to the Correct Craft Group. If we learn that we have inadvertently collected or received Personal Information from a person under the age of 16, other than where such Personal Information has been provided by an adult (such as a parent or guardian), we will delete that information as quickly as possible. If you believe that we, with the exception of where such personal information has been provided by an adult (such as a parent or guardian) may have any Personal Information from or about a person under the age of 16, please contact us using the information listed in the “Contact Us” section below. We encourage parents to monitor their children’s Internet usage and/or to use web filtering technology to supervise their children’s access to the Internet.

The Correct Craft Group seeks to comply with the Children’s Online Privacy Protection Act instituted on April 21, 2000. The entire COPPA documentation can be viewed here.

Career Inquiries
The Correct Craft Group accepts inquiries and applications regarding our open job postings through the Site. This may include resume files. Without limiting the applicability of the rest of this Privacy Policy, personal information submitted by job applicants when applying for a position is used for the purpose of evaluating the candidate for a position at the Correct Craft Group and for related recruiting, reporting, employment and recordkeeping purposes and is managed according to the Correct Craft Group’s human resources department policies.

Visiting The Site from Outside of the United States
The Site and data we receive from other sources are hosted in the United States and are governed by United States law. Your Personal Information may be transferred to, and maintained on, computers located outside of your state, province/territory, or country where the privacy laws may not be as protective as those where you live. If you are located outside the United States and choose to provide Personal Information to us, please be aware that we transfer your Personal Information to the United States and process and store it there. As a result, this Personal Information may be subject to access requests from governments, courts, law enforcement officials and national security authorities in the United States according to its laws. Subject to the applicable laws, we will use reasonable efforts to ensure that appropriate protections are in place to maintain protections on the Personal Information. By submitting your Personal Information, you consent to having your Personal Information transferred to, processed, and stored in the United States.

California Privacy Rights

This section is applicable to residents of California. If you are a resident of California, you have certain rights described below. The following do not apply to individuals who do not live in California on a permanent basis, individuals we do not collect personal information about, or individuals for whom all of the information we collect is exempt from the statutes.

Shine the Light Law
Under California’s “Shine the Light” law (California Civil Code §1798.83), California residents have the right to request in writing from businesses with whom they have an established business relationship, (a) a list of the categories of Personal Information, such as name, e-mail and mailing address and the type of services provided to the customer, that a business has disclosed to third parties (including affiliates that are separate legal entities) during the immediately preceding calendar year for the third parties’ direct marketing purposes; and (b) the names and addresses of all such third parties. To request the above information, please contact us as set forth in the “Contact Us” section below with a reference to California Disclosure Information. Please note that we are only required to respond to two requests per California resident each year under §1798.83.

California Consumer Privacy Act of 2018
This section of our Privacy Policy provides California residents with a comprehensive description of the Correct Craft Group’s online and offline practices regarding the collection, use, disclosure, and sale of personal information and the rights of California consumers regarding their personal information that is subject to the California Consumer Privacy Act of 2018 (CCPA) or any amendments or acts thereto upon their effective dates. The section will not apply, however, if the Correct Craft Group does not collect any personal information about you or if all of the information we collect is exempt from the statute (for example, the CCPA does not protect information that is already protected by certain other privacy laws, and it does not protect information that is already publicly available). “Personal Information,” for purposes of this section regarding the rights of California consumers, means identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household and does not include de-identified or aggregate information or publicly available information.

Rights under CCPA
Under CCPA, consumers have certain rights regarding their Personal Information, as described below.

Right of Access: You have the right to request, twice in a 12-month period, that we disclose to you the following information about you, limited to the preceding twelve (12) months:
- The categories of Personal Information that we collected about you;
- The categories of sources from which the Personal Information is collected;
- The business or commercial purpose for collecting or selling Personal Information;
- The categories of third parties with whom we share Personal Information;
- The specific pieces of Personal Information that we have collected about you;
- The categories of Personal Information that we disclosed about you for a business purpose or sold to third-parties; and
- For each category of Personal Information identified, the categories of third parties to whom the information was disclosed or sold.
Right of Deletion: You have the right to request that we delete any Personal Information about you which we have collected from you, subject to exceptions within the law.
Right to Opt-Out: You have the right to opt-out of the disclosure of Personal Information about you for monetary or other valuable consideration. However, we do not sell any Personal Information.
Right to Opt-In: With the exception of Aktion Parks, LLC, Elite Cable Park, Miami Wakeboard-Cable Complex, LLC and Orlando Watersports Complex, where information may be provided by parents or guardians with consent for minors under their authority, we do not knowingly collect, share, or sell Personal Information of individuals under the age of 16.
Right to Limit Use and Disclosure of Sensitive Personal Information: You may request specific limitations on further sharing, use, or disclosure of your Sensitive Personal Information that is collected or processed for purposes outside of those permissible under the CCPA. However, we do not collect or process Sensitive Personal Information for this purpose.
Right to Correction: You have the right to request that we maintain accurate Personal Information about you and correct any Personal Information about you which we have collected from you, subject to exceptions within the law.

If you would like to exercise your rights, please refer to the “Consumer Requests and Verification” section below.

Right to Non-Discrimination: We may not discriminate against you because you exercise any of your rights under the CCPA, including, but not limited to:
- Denying goods or services to you;
- Charging different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties;
- Providing a different level or quality of goods or services to you; or
- Suggesting that you will receive a different price or rate for goods or services or a different level or quality of goods or services.

Authorized Representatives
You may designate an authorized agent to request any of the above rights on your behalf. You may make such a designation by providing the agent with written permission, signed by you, to act on your behalf. Your agent may contact us as described in the “Contact Us” section below to make a request on your behalf. Even if you choose to use an agent, we may, as permitted by law, require:

The authorized agent to provide proof that you provided signed permission to the authorized agent to submit the request;
You to verify your identity directly with us; or
You to directly confirm with us that you provided the authorized agent permission to submit the request.

Selling, Sharing, and Disclosing Personal Information
We do not sell or share your Personal Information in exchange for monetary consideration. However, the definitions of Personal Information, ‘share,’ and ‘sale’ under CCPA are broad. Like many companies, we use services that help deliver interest-based ads and personalization to you, which may involve transfer Personal Information to business partners for their use, such as Google Analytics. Because the definitions of ‘Personal Information,’ ‘share,’ and ‘sale’ under CCPA are broad, making Personal Information available to these companies may be considered a “sale” or “sharing” under CCPA. Because of the breadth of these definitions under CCPA, we have provided opt-out links. You have the right to direct us not to sell or share your Personal Information. You may exercise your opt-out rights by contacting us using a method listed in the “Contact Us” section.

During the 12-month period prior to the effective date of this Privacy Policy, we may have shared or disclosed the following categories of Personal Information about you for a business or commercial purpose with certain categories of third parties, as described below:

Categories of Personal Information that May Be Sold, Shared, or Disclosed	Sources of Collected Information	Categories of Third Parties to whom Personal Information May Be Sold, Shared, or Disclosed	Business or Commercial Purpose of Selling, Sharing, or Disclosing Personal Information
Identifiers	Directly from you; Automatically when you use the Site; From Third Parties	· Service Providers · Dealers	Provide Products Provide customer support Process or fulfill your transactions Rectify any complaints about a service or feature Support our internal and business operations Fulfill your request
Additional Information Subject to Cal. Civ. Code § 1798.80	Directly from you; From Third Parties	Service Providers Dealers	Provide Products Provide customer support Process or fulfill your transactions Rectify any complaints about a service or feature Support our internal and business operations Fulfill your request
Legally Protected Characteristics under California or Federal Law	Directly from you; From Third Parties	Service Providers Dealers	Support our internal and business operations
Commercial Purchase Information	Automatically when you use the Site	Service Providers Dealers Advertising Partners	Market our products and services to you
Internet or Other Electronic Information Activity	Automatically when you use the Site	Service Providers Advertising Partners	Maintain and operate our Services and Site Support our internal and business operations Market our products and services to you Research and understand how you use our products and services
Professional and Employment Information	Directly from you; From Third Parties	Service Providers Dealers	Support our internal and business operations
Geolocation	Automatically when you use the Site	Service Providers Dealers	Maintain and operate our Services and Site Support our internal and business
Sensitive Personal Information	Directly from you; From Third Parties; Automatically when you use the Site	Service Providers Dealers	Provide Products Provide customer support Process or fulfill your transactions Rectify any complaints about a service or feature Support our internal and business operations Fulfill your request

The categories of parties with whom we disclose Personal Information are described in detail in the “Disclosure of Personal Information” section of this Privacy Policy.
The retention periods for Personal Information collected by us are described in detail in the “Information Retention” section of this Privacy Policy.
The purpose for collection of the categories are described in detail in the “Processing Purposes” section of this Privacy Policy.

EU Privacy Rights

Individuals (“Data Subjects”) in the European Economic Area (“EEA”) and the United Kingdom (“UK”) have certain privacy rights under EU and UK law, including the General Data Protection Regulations (“GDPR”) and UK Data Protection Act 2018. In the event, we collect Personal Data (as defined in the GDPR) that is subject to the GDPR, this section shall apply. Terms in this section are to be understood in a manner consistent with GDPR including the definitions of such terms in the GDPR. Such terms may have a different definition or meaning in other portions of this Privacy Policy because GDPR may not apply to those sections.

Data Controller
The organization within the Correct Craft Group which collected Personal Data about you and determines the purposes and means of the processing of your Personal Data will be the data controller for that Personal Data. Although other organizations within the Correct Craft Group may also act as data controllers where they control the use or processing of such personal information, there is a single point of contact for all the Correct Craft Group data controllers. You may use the information in the “Contact Us” section below.

Processing Purposes and Legal Basis
The Correct Craft Group processes your Personal Data for the lawful purposes, and under the legal basis, set forth in the “Processing Purposes” section above.

Onward Transfer
The Correct Craft Group will not disclose Personal Data to a third party except as stated below:

We may disclose Personal Data to subcontractors and third-party agents. Before disclosing Personal Data to a subcontractor or third-party agent, we will obtain assurances by contractual agreement from the recipient that it will: (i) transfer such data only for limited and specified purposes; (ii) ascertain that the subcontractor or third-party agent is obligated to provide at least the same level of privacy protection as is required by the GDPR; (iii) take reasonable and appropriate steps to ensure that subcontractors and third-party agents effectively process the personal information transferred in a manner consistent with the organization’s obligations under the GDPR; (iv) require subcontractors and third-party agents to notify the organization if it makes a determination that it can no longer meet its obligation to provide the same level of protection as is required by the GDPR; (v) upon notice, including under (iv), take reasonable and appropriate steps to stop and remediate unauthorized processing; and (vi) provide a summary or a representative copy of the relevant privacy provisions of its contract with subcontractors and third-party agents to the Supervisory Authorities upon request.

The Correct Craft Group also may be required to disclose, and may disclose, Personal Data in response to lawful requests by public authorities, including for the purpose of meeting national security or law enforcement requirements, or in the event of a merger or acquisition.

Rights under GDPR
Data Subjects have the following rights under the GDPR:

Right of Access. You have the right to obtain confirmation from us as to whether or not we process personal data from you and you also have the right to at any time obtain access to your personal data stored by us.
Right to Rectification. If we process your Personal Data, we use reasonable measures to ensure that your Personal Data is accurate and up-to-date for the purposes for which your Personal Data was collected. If your Personal Data is inaccurate or incomplete, you have the right to require us to correct it.
Right to Erasure. You may have the right to require us to delete your Personal Data.
Right to Restrict Processing. You may have the right to request the restriction or suppression of Personal Data.
Right to Withdraw Consent. If you have given your consent to the processing of your Personal Data, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing based on the consent before the withdrawal.
Right to Data Portability. You may have the right to receive the Personal Data concerning you and which you have provided to us, in a structured, commonly used and machine-readable format or to transmit this data to another controller.
Right to Object. You may have the right to object to the processing of your Personal Data as further specified in this Privacy Policy and you may have the right to object to decisions being made with your Personal Data based solely on automated decision making or profiling.
Right to Lodge a Complaint with Supervisory Authority. You have the right to lodge a complaint with a data protection supervisory authority located in the European Union or UK. Further information about how to contact your local data protection authority is available at the website of the European Commission.

If you wish to exercise any of these rights, please contact us as set forth in the “Contact Us” section below. The Correct Craft Group will process such requests in accordance with applicable law. We may also ask you to provide further information in certain circumstances, such as to clarify the terms of your request or to confirm your identity. However, please note that for practical and/or technical reasons it may not be possible to remove or correct certain information.

Choices under GDPR
Data Subjects have the right to opt out of (a) disclosures of their Personal Data to third parties not identified at the time of collection or subsequently authorized, and (b) uses of Personal Data for purposes materially different from those disclosed at the time of collection or subsequently authorized. Data Subjects who wish to limit the use or disclosure of their Personal Data should submit that request to our Data Protection Officer. We will cooperate with Data Subjects’ instructions regarding Data Subjects’ choices.

All our general emails also contain an unsubscribe link at the bottom and you can unsubscribe to such emails at any time by clicking on that link.

Retention of Personal Data
For more information, please visit the “Information Retention” section above.

Security
For more information, please visit the “Confidentiality and Security” section above.

Transfer to the United States
In using the Site, your Personal Data will be transferred to the United States. In December 2022, The European Commission published its draft adequacy decision recognizing the essential equivalence of U.S. data protection standards. The Correct Craft Group relies on Article 49 of the GDPR for transfers of data collected from Data Subjects in the EU and EEA. Transfers are made to the Correct Craft Group only if the Data Subject has explicitly consented to the proposed transfer after having been informed of the possible risks of such transfers. Additionally, we transfer data as necessary for the performance of a contract between you as the Data Subject and The Correct Craft Group as the Controller, to data processors who have an agreement with us that includes protecting your privacy and the security of your data, and in cases where your Personal Data is necessary for the implementation of pre-contractual measures taken in accordance with your requests.

Australian Privacy Rights

Individuals in Australia have certain privacy rights under Australian law, including the the Privacy Act of 1988 (Privacy Act). In the event, we collect Personal Information (as defined in the Privacy Act) that is subject to the Privacy Act, this section shall apply. Terms in this section are to be understood in a manner consistent with the Privacy Act including the definitions of such terms in the Privacy Act. Such terms may have a different definition or meaning in other portions of this Privacy Policy because the Privacy Act may not apply to those sections.

Rights under The Privacy Act
Individuals have the following rights under the Privacy Act:

Right of Access. You have the right to access your data to confirm whether we process your Personal Information, how we process your Personal Information, and to obtain a copy of that Personal Information.
Right to Correction. You have the right to request that we correct or supplement inaccurate, incomplete, irrelevant, misleading, or outdated personal information we process about you.

Right to Lodge a Complaint. You have the right to lodge a complaint if you believe that you information has been mishandled. You may submit a complaint to our Data Protection Officer using the information in the “Contact Us” section below. The Data Protection Officer will consider your complaint and respond as soon as reasonably possible, but not more than 30 days from receiving the complaint. If you are unsatisfied with the outcome of your complaint you may refer your complaint to the Office of the Australian Information Commissioner. You may email the complaint to enquiries@oaic.gov.au, mail the complaint to GPO Box 5218 Sydney NSW 2001 Australia, or fax the complaint +61 2 9284 9666.

Collection of Personal Information

For more information, please visit the “Collection of Personal Information” section above.

Use and Disclosure of Personal Information
For more information, please visit the “Processing Purposes” and “Disclosure of Personal Information” sections above.

Security
For more information, please visit the “Confidentiality and Security” section above.

Overseas Disclosure
You consent to any disclosure of your Personal Information by us outside of Australia on the understanding that if the overseas recipient handles the Personal Information in breach of the Australian Privacy Principles, the entity will not be accountable under the Privacy Act, and you will not be able to seek redress under the Privacy Act. The overseas recipient may not be subject to privacy obligations or any principles similar to the Australian Privacy Principles. Individuals may not be able to seek redress in some overseas jurisdictions and overseas recipients may be subject to a foreign law that could compel the disclosure of personal information to a third party such as an overseas authority.

Consumer Requests and Verification

You may request to exercise your rights of access, deletion, correction, or complaints under CCPA, GDPR, or the Privacy Act by contacting us as described in the “Contact Us” section below. To help protect your privacy and maintain security, we will take steps to verify your identity before processing your request. If you request access to or deletion of your Personal Information, we may require you to provide any of the following information: name, date of birth, email address, telephone number, or postal address. When you make such a request, you can expect the following:

As required under applicable law, we will verify your identity. You will need to provide us with your email address and full name. We may ask for additional information if needed.
We will confirm that you want your information accessed, corrected, and/or deleted.
We will confirm our receipt of your request within 10 days. If you have not received a response within a few days after that, please let us know by contacting us at the webpage or phone number listed below.
We will respond to your request within 30 days upon receipt of your request. If necessary, we may need an additional period of time, up to another 45 days, but we will reply either way within the first 30-day period and, if we need an extension, we will explain why.
In certain cases, a request for access, correction, or deletion may be denied. For example, if we cannot verify your identity, the law requires that we maintain the information, or if we need the information for internal purposes such as providing Services or completing an order. If we deny your request, we will explain why we denied it and delete any other information that is not protected and subject to denial.

Contact Us

If you have any queries concerning your personal information or any questions on our use of that information, please contact us as noted below or as otherwise advised on the Site or other Products:

1800-950-736
orders@indmar.com.au
70 Meroo Rd Bomaderry
NSW 2541