Personal Information Collected. We want you to understand the types of personal information that we may collect about you. The personal information we collect, and how we use it, depends largely upon how you use our Platform and may include the following categories of personal information. We may also collect other personal information that is not specifically listed here, which we will use as described in this Privacy Policy or as otherwise disclosed at the time of collection.

• Contact Information, such as your name, email address, mailing address, phone number, and social media handle.
• Account Registration Information, such as the contact information listed above, birth date, and account login credentials.
• Order History, such as records of subscriptions and Products you have purchased from us, shipping addresses, and other details about your orders submitted through the Platform.
• Marketing Information, such as any preferences you set in your account and any marketing or communications preferences, and details about how you engage with our communications.
• Payment Information, such as payment amounts and payment methods used to complete transactions. Payment processing services connected with your use of the Platform may be provided to you by us or a third-party payment processor.
• Survey Responses, such as the information you provide in response to our surveys, questionnaires, sweepstakes, or contests.
• Online Activity Information, such as the website you visited before browsing to the Platform, pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.
• Browser & Device Information used to access our Platform, such as unique identifiers, browser type and settings, device type and settings, operating system, and mobile network information including carrier name and phone number. We also collect personal information about the interaction of your browsers and devices with our Platform, including IP address, crash reports, system activity, and general location information such as city, state, or geographic area.
• Communications, such as the information associated with your requests or inquiries, including for support, assistance, or order information, and any feedback you provide when you communicate with us. We may also record or monitor any call or chat you have with us for quality control or training purposes, or to enforce our rights.

Sources of Personal Information. We obtain personal information from a variety of sources, including the following sources:

• Personal Information You Provide. Company collects personal information when you voluntarily submit it to us, including through offline interactions, such as when you register for our waitlist or an account, make a tasting reservation at one of our wineries, fill out a form on the Site, submit an order for Products, participate in a survey, call customer service, or communicate with us.
• Personal Information Automatically Collected. Company, our service providers, and our advertising partners may automatically log information about you, your computer, or mobile device, and your activity over time on our Platform and other sites and online services, such as the online activity information and device information listed above. Like many online services, we use cookies and similar technologies to facilitate some of the automatic data collection described above, which may include the following:
• Cookies, which are text files that websites store on a visitor's device to uniquely identify the visitor's browser or to store information or settings in the browser for the purpose of helping you navigate between pages efficiently, remembering your preferences, enabling functionality, helping us understand user activity and patterns, and facilitating online advertising.
• Flash cookies, or locally-stored objects, which are used on websites for purposes similar to cookies but allow storage of a larger amount of data.
• Web beacons, also known as pixel tags or clear GIFs, which are typically used to demonstrate that a webpage or email was accessed or opened, or that certain content was viewed or clicked, typically to compile statistics about usage of websites and the success of marketing campaigns.
• Local storage, which is used to save data on a visitor's device. We may use data from local storage to, for example, turn on web navigation, store multimedia preferences, customize what we show you based on your past interactions with our Platform, remember your preferences, and measure ad effectiveness.
• Session replay technologies, which are third-party software used to record a video replay of Users' interactions with the Site. The video replay may include Users' clicks, mouse movements, scrolls, mobile app touches, typing, and other activity taken during the session. We may use these replays for research and development purposes, such as to help us troubleshoot problems with the Site, understand how Users interact with and use the Site, and identify areas for improvement.

Personal Information Obtained from Third Parties. In some circumstances, we may collect personal information about you from third party or publicly available sources, such as our service providers, advertising partners, data analytics partners, operating systems and platforms, social media platforms, event sponsors, or data providers. We may merge or combine such personal information with the personal information we collect from you directly or automatically.

Referrals. Users of our Platform may have the opportunity to mail wine or other Products to their contacts. Please do not provide us with someone's contact information unless you have their permission to do so.

Company's primary purpose in collecting personal information is to provide the Products, Content, and Services and to operate our business. We also use personal information for the purposes set forth below and as otherwise described in this Privacy Policy or at the time of collection.

To Provide the Platform. We may use personal information to operate our business. For example, we use personal information to:

• process your transactions, including purchasing Products and subscriptions;
• establish, manage, monitor, and maintain your account;
• improve and personalize your experience on or with the Platform;
• verify your identity or determine your eligibility for offers and promotions;
• communicate with you, including providing notices about your account or transaction and responding to any of your requests, feedback, or questions;
• provide any contests, surveys, sweepstakes, or other promotions you participate in;
• provide maintenance and support; and
• fulfill any other purpose for which you provide personal information.

Research and Develop New Services and Products. We use personal information for research and development purposes, including to study and improve the features and functionality of our Services and our business, understand and analyze the usage trends and preferences of our Users, and develop and improve our Products. As part of these activities, we may create aggregated, de-identified, or other anonymous data from personal information we collect. We make personal information into anonymous or de-identified data by removing information that makes the data personally identifiable to you or your device, whether directly or indirectly. We will maintain and use any de-identified data without attempting to reidentify the data. We may use this anonymous or de-identified data and share it with third parties for our lawful business purposes.

Direct Marketing. We may send you Company-related or other direct marketing communications as permitted by law, including materials, updates, information, special offers, and promotional material from us and our business partners. You may opt-out of our marketing communications as described in the "YOUR CHOICES" section below.

Interest-Based Advertising. We work with third-party advertising companies and social media companies to help us advertise our business and to display ads for our products and services. These companies may use cookies and similar technologies to collect information about you (including the online activity information and browser & device information described above in the section called "Personal Information Automatically Collected") over time across our Platform and other websites and services or your interaction with our emails, and use that information to serve ads that they think will interest you. In addition, some of these companies may use hashed customer lists that we share with them to deliver ads to you and to similar users on their platforms. You can learn more about your choices for limiting interest-based advertising in the "YOUR CHOICES" section below.

To Comply with Laws and Regulations. We will use personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal process, such as to respond to subpoenas or requests from government authorities.

For Compliance, Fraud Prevention, and Safety. We may use personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to: (a) maintain the safety, security, and integrity of the Platform and our products, business, databases, and other technology assets; (b) protect our, your, or others' rights, privacy, safety or property (including by making and defending legal claims); (c) audit our internal processes for compliance with legal and contractual requirements and internal policies; (d) enforce the terms and conditions that govern the Platform; and (e) prevent, identify, investigate, and deter fraudulent, harmful, unauthorized, unethical or illegal activity, including cyberattacks and identity theft.

With Your Consent. We will disclose your personal information in accordance with your prior direction or, in some cases, we may specifically ask you for your consent to collect, use, or share your personal information, such as when required by law.

In addition to the specific situations discussed elsewhere in this Privacy Policy or at the point of collection, we may share your personal information with the following entities or persons:

Related Companies. We may share your personal information with our affiliates, subsidiaries, and other related companies, for example, to fulfill your transaction.

Service Providers. We may share your personal information with third parties who perform services on our behalf that are necessary for the orderly operation of our business. For example, we work with service providers that help us perform website hosting, e-commerce, payment processing, order fulfillment, maintenance services, database management, analytics, fraud protection, marketing, customer relationship management, finances, and other purposes.

Advertising Partners. We may share your personal information with our partners and sponsors to send you information about products and services you may like. We may also share usage information about our Platform, including searches, transactions, and profile information with our partners and sponsors for online advertisement purposes, including for the purposes described in the "Interest-Based Advertising" section above.

Sweepstakes and Joint Marketing Partners. We may also share your personal information with other partners in order to provide you with content and other features through the Platform, and such partners may send you promotional materials or otherwise contact you regarding products and services that they offer. When you choose to enter a contest or sign up for a sweepstakes, we may share the personal information you provide as part of the offer with the named co-sponsors or other third parties affiliated with such offer.

Professional Advisors. We may share personal information with persons, companies, or professional firms providing Company with advice and consulting in accounting, administrative, legal, tax, financial, debt collection, and other matters.

Law Enforcement. Under certain circumstances, we may share personal information with law enforcement, government authorities, and other parties if we have a good-faith belief that access, use, preservation, or disclosure of the information is reasonably necessary to meet any applicable law, regulation, legal process, or enforceable governmental request.

Authorities and Others for Compliance, Fraud Protection, and Safety. We may disclose personal information in the good faith belief that such action is necessary to comply with a legal obligation or for the purposes described above in the section titled "For Compliance, Fraud Prevention, and Safety."

Business Transaction Participants. We may disclose personal information to third parties in connection with any business transaction (or potential transaction) involving a merger, acquisition, sale of shares or assets, financing, consolidation, reorganization, divestiture, or dissolution of all or a portion of our business (including in connection with a bankruptcy or similar proceedings).

You can make the following choices regarding your personal information:

Review and Request Changes to Your Personal Information. The accuracy of the personal information we have about you is very important. You have the right to correct and update your personal information by directly accessing your account and profile information. You may also request that we correct your information by contacting us. Note that we may keep historical information in our backup files as permitted by law.

Email Communications. If you provide us with your email address in order to receive communications, you can opt-out of marketing emails at any time by following the instructions at the bottom of our emails. Please note that certain emails may be necessary for the operation of our Platform, such as those about your account, to fulfill orders for offers you have requested, or deliver notifications directly to you through the Platform. You will continue to receive these emails, even if you unsubscribe from our marketing communications.

Cookies. Most browsers let you remove or stop accepting cookies from the websites you visit. To do this, follow the instructions in your browser's settings. Many browsers accept cookies by default until you change your settings. If you do not accept cookies, however, you may not be able to use all functionality of the Platform and our Site may not work properly. Also, the offers we provide when you use our Site may not be as relevant to you or tailored to your interests. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org.

Analytics. The Site uses Google Analytics to help us analyze how the Site is being accessed and used. You can learn more about Google Analytics cookies by clicking here and about how Google protects your data by clicking here. To opt-out of Google Analytics, you can download and install the Google Analytics Opt-out Browser Add-on, available here.

Advertising Choices. If you wish to minimize the amount of targeted/interest-based advertising you receive, you may block third-party cookies in your browser settings, use browser plug-ins/extensions, and use your mobile device settings to limit the use of the advertising ID associated with your mobile device. You can also opt out of interest-based ads from companies participating in the following industry opt-out programs by visiting the linked websites: the Network Advertising Initiative (http://www.networkadvertising.org/managing/opt_out.asp) and the Digital Advertising Alliance (https://optout.aboutads.info). Some of the companies we work with may offer their own opt-out mechanisms. For example, you can learn more about how Google uses cookies for advertising purposes by clicking here and opt-out of ad personalization by Google by clicking here.

Many of the opt-out preferences described in this section must be set on each device or browser for which you want them to apply. Please note that some of the advertising companies we work with may not participate in the opt-out mechanisms described above, so even after opting-out, you may still receive interest-based advertisements from other companies. If you opt-out of interest-based advertisements, you will still see advertisements online but they may be less relevant to you.

Do Not Track. Some browsers may be configured to send "Do Not Track" signals to the online services that you visit. The Site currently does not respond to "Do Not Track" signals. To find out more about "Do Not Track," please visit http://www.allaboutdnt.com.

We build security into our Platform to protect your information. Our Platform is built with reasonable security features designed to protect personal information. The insights we gain from maintaining our Platform help us detect and block certain security threats.

We exercise reasonable care in providing secure transmission of personal information from your devices to our servers. We try our best to safeguard personal information once we receive it, but please understand that no transmission of data over the Internet or any other public network can be guaranteed to be 100% secure.

Our Platform is not directed to people who are under 21 years old. We do not knowingly collect personal information from children under 13 years of age. Individuals under the age of 13 should not attempt to provide us with any personal information. If you think we have received personal information from children under the age of 13, please contact us immediately.

Our Platform may contain links to other websites and apps not operated or owned by us. Please be advised that the practices described in this Privacy Policy do not apply to information gathered through these third-party websites and apps. These links are not an endorsement of, or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or online services that are not associated with us. We have no control over, and are not responsible for, the actions and privacy policies of third parties and other websites and apps. We encourage you to read the privacy policies of the other websites and online services you use.

Company is based in the United States, and we have service providers in the United States and potentially other countries. Your personal information may be collected, used, and stored in these countries or other locations outside of your home country. Privacy laws in the locations where we handle your personal information may not be as protective as the privacy laws in your home country. By providing your personal information, where applicable law permits, you specifically and expressly consent to such transfer and processing and the collection, use, and disclosure set forth herein.

We do not disclose personal information obtained through our Platform to third parties for their direct marketing purposes. Accordingly, we have no obligations under California Civil Code §1798.83.

Nevada Revised Statutes Chapter 603A allows Nevada residents to opt-out of the "sale" of certain types of personal information. Subject to several exceptions, Nevada law defines "sale" to mean the exchange of certain types of personal information for monetary consideration to another person. We do not currently sell personal information as defined in the Nevada law. However, if you are a Nevada resident, you still may submit a verified request to opt-out of sales using the contact information provided below and we will record your instructions and incorporate them in the future if our policy changes.

If you have questions, concerns, or would like to update or correct your personal information, you can always contact us at privacy@thehiltestate.com. For your protection, we may need to verify your identity before assisting with your request, such as verifying that the information used to contact us matches the information that we have on file. Please only contact the email address above for privacy related questions.