DWT Farm Privacy Policy

Effective Date: September 15, 2026 Last Updated: September 16, 2026

This Privacy Policy explains how DWT Farm L.L.C., doing business as DWT Farm (“DWT Farm,” “we,” “us,” or “our”), collects, uses, discloses, retains, and protects personal information when you use our websites, mobile applications, marketplace, producer storefronts, APIs, communications, and related products and services (collectively, the “Service”).

This Privacy Policy also describes choices and privacy rights that may be available to you.

DWT Farm operates a marketplace that allows independent local food producers, including cottage-food producers (“Producers”), to offer products to customers (“Customers”).

This Privacy Policy applies to personal information processed by DWT Farm in connection with the Service.

It does not necessarily apply to information independently collected or processed by third parties under their own privacy policies, including payment processors, independent Producers, and third-party delivery providers.

Please read this Privacy Policy carefully.

1. Who We Are

For purposes of applicable privacy laws, the entity responsible for the personal information described in this Privacy Policy is:

DWT Farm L.L.C. d/b/a DWT Farm

Privacy inquiries may be sent to:

Email: [email protected]

Where applicable law uses terms such as “business,” “controller,” or similar terms, DWT Farm generally acts as the business or controller with respect to personal information described in this Privacy Policy.

2. Scope of This Privacy Policy

This Privacy Policy applies when you:

• visit dwtfarm.com or another DWT Farm website;
• use a DWT Farm mobile application;
• create an account;
• browse the marketplace;
• purchase Products;
• register or operate as a Producer;
• create a Producer storefront;
• communicate with Customers or Producers;
• contact customer support;
• use pickup or delivery features;
• receive transactional or marketing communications from us;
• participate in surveys or promotions;
• submit reviews or other content;
• interact with DWT Farm through another service; or
• otherwise interact with DWT Farm where this Privacy Policy is displayed.

3. Personal Information

“Personal information” or “personal data” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to an individual or household, where applicable under law.

Personal information does not generally include properly deidentified, aggregated, or publicly available information to the extent excluded under applicable law.

4. Notice at Collection

The following summarizes categories of personal information DWT Farm may collect, the reasons we collect them, and the general criteria we use to determine how long they are retained.

4.1 Identifiers and contact information

Examples include:

• name;
• username;
• email address;
• telephone number;
• mailing address;
• billing address;
• pickup address;
• delivery address;
• Producer business address;
• account identifier;
• internal user identifier; and
• other similar identifiers.

We may use this information to:

• create and administer accounts;
• process Orders;
• enable delivery and pickup;
• communicate with you;
• provide customer support;
• operate Producer storefronts;
• prevent fraud;
• enforce our Terms;
• comply with legal obligations; and
• maintain business records.

We generally retain account and transaction-related identifiers for the duration of the account relationship and afterward for periods reasonably necessary for legal, tax, accounting, fraud-prevention, dispute-resolution, and recordkeeping purposes.

4.2 Account and authentication information

Examples include:

• password hashes;
• authentication credentials;
• session identifiers;
• login history;
• authentication tokens;
• account status;
• security events; and
• password-reset information.

We use this information to:

• authenticate Users;
• maintain account security;
• prevent unauthorized access;
• investigate suspicious activity;
• prevent fraud; and
• operate the Service.

We retain authentication information for as long as reasonably necessary to provide and secure an account.

Expired sessions and security records may be retained for shorter or longer periods depending on their security and fraud-prevention value.

DWT Farm does not store your password in readable plaintext.

4.3 Customer transaction and commercial information

Examples include:

• Products viewed;
• Products purchased;
• shopping cart contents;
• Orders;
• Order dates;
• purchase amounts;
• refunds;
• cancellations;
• fulfillment selections;
• delivery methods;
• pickup selections;
• transaction history;
• discount or promotional information; and
• communications relating to an Order.

We use this information to:

• provide the marketplace;
• process and fulfill Orders;
• calculate amounts due;
• provide receipts;
• facilitate refunds;
• resolve disputes;
• provide customer support;
• prevent fraud;
• perform accounting;
• analyze marketplace performance; and
• satisfy legal and tax obligations.

Transaction records may be retained for several years where reasonably necessary for taxation, accounting, payment disputes, legal compliance, fraud prevention, or defense of legal claims.

5. Producer Information

Because Producers conduct commercial activity through DWT Farm, we collect additional information from Producers.

This may include:

• legal name;
• business name;
• storefront name;
• business address;
• telephone number;
• email address;
• business description;
• logo;
• photographs;
• Product listings;
• fulfillment availability;
• delivery radius;
• Producer application information;
• food permits;
• cottage-food registrations;
• food-safety certifications;
• compliance records;
• business licenses;
• tax-related information;
• payout information;
• identity-verification information;
• payment-account status;
• Order information;
• sales data;
• refund history;
• dispute information;
• compliance communications; and
• marketplace performance information.

We use Producer information to:

• determine marketplace eligibility;
• establish and administer Producer accounts;
• display Producer storefronts;
• facilitate Orders;
• facilitate payouts;
• provide marketplace analytics;
• prevent fraud;
• investigate complaints;
• administer regulatory compliance;
• respond to Product-safety incidents;
• satisfy tax-reporting requirements;
• comply with marketplace laws;
• enforce our Terms of Service; and
• protect Customers and DWT Farm.

Some Producer information may be publicly displayed because it is part of the Producer’s storefront or Product listing.

We distinguish information intended for public display from confidential Producer information.

6. Identity Verification Information

DWT Farm or its service providers may request information reasonably necessary to verify the identity or eligibility of a Producer.

Depending on circumstances, this could include:

• date of birth;
• government-issued identification;
• driver’s-license information;
• passport information;
• taxpayer identification information;
• employer identification number;
• Social Security number where legally required;
• beneficial-owner information;
• business-registration information; and
• verification results.

Where possible, highly sensitive identity information may be submitted directly to a specialized verification or payment provider rather than stored directly by DWT Farm.

For example, Stripe may collect identity, tax, banking, or ownership information necessary to establish and maintain a connected payment account.

DWT Farm may receive verification status, account status, limited identifying information, or information necessary to operate the marketplace.

We use identity information only for appropriate purposes such as:

• identity verification;
• fraud prevention;
• payment processing;
• marketplace compliance;
• tax reporting;
• regulatory requirements; and
• account security.

We do not use government-identification information for advertising.

7. Payment Information

Payments are processed using third-party payment providers such as Stripe.

When a Customer enters payment-card information, that information may be provided directly to Stripe or another payment processor.

DWT Farm does not intend to store complete payment-card numbers or card-security codes on its own servers.

We may receive information such as:

• payment method type;
• card brand;
• last four digits;
• expiration information where made available;
• payment status;
• transaction identifier;
• billing address;
• refund status;
• dispute status; and
• payment-provider customer or account identifiers.

For Producers, Stripe or another payment provider may also process:

• bank-account information;
• payout information;
• identity information;
• tax information;
• beneficial ownership information; and
• financial-account verification information.

Payment providers process information under their own privacy terms as applicable.

8. Location Information

DWT Farm uses location information to operate a local marketplace.

Location information may include:

• addresses you provide;
• delivery addresses;
• pickup locations;
• Producer business locations;
• postal codes;
• city or region;
• approximate location derived from technical information; and
• precise device location if you affirmatively permit the application or device to provide it.

We may use location information to:

• show Products or Producers near you;
• calculate marketplace availability;
• determine delivery availability;
• calculate delivery distances;
• configure Producer delivery areas;
• provide map functionality;
• geocode addresses;
• determine time zones;
• facilitate pickup;
• facilitate delivery; and
• prevent fraud.

DWT Farm does not use precise geolocation information for targeted advertising.

We do not intentionally collect precise device location in the background unless we have separately disclosed that functionality and obtained any permission required by applicable law or your device platform.

You may generally control device-location permission using your operating system or browser settings.

Disabling location access may affect location-dependent features.

9. Delivery Information

If you request delivery, we may process:

• recipient name;
• telephone number;
• delivery address;
• delivery instructions;
• Order information;
• Producer information;
• delivery status;
• estimated delivery times; and
• communications relating to delivery.

We may disclose information reasonably necessary to fulfill the delivery to:

• the applicable Producer;
• a third-party delivery provider;
• mapping providers; and
• service providers supporting the transaction.

For example, if a third-party delivery service such as DoorDash is used to fulfill an Order, information necessary to perform that delivery may be transmitted to that provider.

Third-party delivery providers may independently process information under their own privacy policies.

10. Product, Dietary, Allergy, and Other Sensitive Communications

Customers may communicate with Producers about ingredients, allergies, dietary restrictions, food preferences, or other matters.

Depending on what a User voluntarily discloses, these communications could reveal information considered sensitive under some privacy laws.

DWT Farm does not require Customers to disclose medical diagnoses or unnecessary health information to use the marketplace.

You should avoid providing sensitive information that is unnecessary to complete your transaction.

Where information concerning allergies or dietary restrictions is provided for an Order, we use or disclose it only as reasonably necessary to:

• facilitate that Order;
• communicate with the Producer;
• provide customer support;
• investigate a food-safety issue; or
• satisfy legal obligations.

We do not use this information to target advertising based on a person’s health condition, religion, ethnicity, or other sensitive characteristic.

11. Communications

We collect information when you communicate with:

• DWT Farm;
• customer support;
• a Producer;
• a Customer; or
• another marketplace participant through the Service.

This may include:

• message contents;
• email communications;
• support requests;
• attachments;
• complaint information;
• food-safety reports; and
• metadata associated with communications.

We use communications to:

• facilitate transactions;
• provide support;
• prevent fraud;
• investigate disputes;
• protect marketplace safety;
• enforce our Terms; and
• comply with legal obligations.

12. Reviews and User Content

If you submit:

• a review;
• rating;
• photograph;
• profile image;
• Producer logo;
• Product photograph;
• Product description;
• public profile information; or
• other content,

we process that information to provide the relevant feature.

Information you intentionally publish through a public storefront, Product listing, review, or profile may be visible to the public.

Do not post information publicly that you do not want publicly available.

13. Device and Usage Information

When you use DWT Farm, we may automatically collect technical information such as:

• IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• application version;
• language;
• referring URL;
• pages or screens viewed;
• links clicked;
• date and time of access;
• session activity;
• errors and crashes;
• performance information;
• security logs; and
• interactions with Service features.

We use this information for:

• Service operation;
• security;
• fraud detection;
• debugging;
• analytics;
• capacity planning;
• product improvement;
• abuse prevention; and
• understanding how the Service is used.

14. Cookies and Similar Technologies

Our website may use cookies, local storage, SDKs, pixels, and similar technologies.

These technologies may be used for:

Strictly necessary purposes

Including:

• authentication;
• shopping carts;
• security;
• fraud prevention;
• load balancing;
• session management; and
• remembering privacy preferences.

Functional purposes

Including:

• remembering settings;
• language preferences;
• marketplace configuration; and
• usability improvements.

Analytics purposes

We may use privacy-appropriate analytics tools or service providers to understand aggregate use, performance, errors, and feature effectiveness.

Where consent for nonessential cookies is required by applicable law, we will request it before activating those technologies.

15. Advertising and Sale of Personal Information

DWT Farm does not sell personal information for money.

As of the effective date of this Privacy Policy:

DWT Farm does not sell personal information as “sale” is defined by applicable U.S. comprehensive state privacy laws, and DWT Farm does not share personal information for cross-context behavioral advertising as “sharing” is defined by the California Consumer Privacy Act.

DWT Farm does not use personal information to target advertisements based on activity across unrelated businesses or websites.

DWT Farm does not use sensitive personal information to infer characteristics about individuals for advertising.

If our practices materially change, we will update this Privacy Policy and provide any legally required opt-out mechanism before engaging in covered sale, sharing, or targeted advertising.

16. Global Privacy Control

Where applicable law requires us to recognize an opt-out preference signal, DWT Farm will process supported signals such as Global Privacy Control (“GPC”) in accordance with applicable law.

If DWT Farm is not selling, sharing, or processing personal information for targeted advertising at the time a GPC signal is received, the signal may not change how your information is processed because there is no covered activity from which to opt out.

If we later engage in covered processing, we will honor recognized opt-out preference signals as required by law.

17. Push Notifications

If you enable push notifications, DWT Farm may receive and process:

• device push tokens;
• platform information;
• notification preferences; and
• information necessary to send requested notifications.

We may send notifications regarding:

• Orders;
• fulfillment;
• account security;
• Producer activity;
• Customer activity;
• marketplace alerts; and
• other requested features.

You can disable push notifications through your device settings or applicable DWT Farm settings.

18. Search Alerts and Saved Preferences

If you create saved searches, alerts, favorites, or similar marketplace preferences, we may store:

• search criteria;
• Product categories;
• location preferences;
• alert settings;
• saved Producers;
• saved Products; and
• notification settings.

We use this information to provide the feature you requested.

19. Blocked Users, Reports, and Marketplace Safety

If you block another User or report:

• a User;
• Product;
• Producer;
• Order;
• review;
• communication; or
• other marketplace activity,

we may collect:

• the identities of involved accounts;
• the reason for the report;
• supporting evidence;
• communications;
• Order information; and
• investigation results.

We use this information to enforce our Terms, prevent fraud and abuse, protect Users, comply with law, and maintain marketplace safety.

20. Information We Receive From Other People

We may receive personal information from other Users when reasonably necessary to provide the Service.

For example:

• a Customer may provide information about an Order involving a Producer;
• a Producer may provide information concerning delivery to a Customer;
• a User may identify another User in a complaint;
• a delivery provider may provide delivery status;
• a payment provider may provide transaction status; or
• a User may provide another person’s name or address for delivery.

Users should provide another person’s personal information only when authorized or otherwise legally permitted to do so.

21. Information From Service Providers and Other Sources

We may receive information from:

• payment providers;
• identity-verification providers;
• fraud-prevention services;
• delivery providers;
• mapping providers;
• email providers;
• cloud-hosting providers;
• security providers;
• analytics providers;
• governmental or public records where appropriate; and
• other service providers supporting DWT Farm.

We combine this information with other information where reasonably necessary for the purposes described in this Privacy Policy.

22. How We Use Personal Information

We may use personal information to:

Provide the Service

Including to:

• create accounts;
• authenticate Users;
• maintain Producer storefronts;
• display Products;
• maintain carts;
• process Orders;
• facilitate payments;
• facilitate payouts;
• support pickup;
• support delivery;
• send receipts;
• maintain Order history; and
• provide requested marketplace features.

Communicate

Including to:

• send transactional emails;
• send Order notifications;
• respond to inquiries;
• provide customer support;
• send security alerts;
• provide Producer notifications; and
• send legally required notices.

Personalize marketplace functionality

Including to:

• display relevant local Products;
• remember preferences;
• provide saved-search alerts; and
• improve marketplace navigation.

Improve DWT Farm

Including to:

• analyze Service usage;
• troubleshoot errors;
• develop features;
• understand marketplace performance;
• perform testing; and
• improve usability.

Protect Users and DWT Farm

Including to:

• authenticate accounts;
• detect fraud;
• detect abuse;
• investigate suspicious activity;
• enforce Terms;
• protect food safety;
• investigate complaints;
• resolve disputes; and
• protect legal rights.

Comply with law

Including to:

• comply with tax obligations;
• respond to legal process;
• maintain required records;
• respond to lawful government requests;
• administer recalls;
• satisfy marketplace-verification requirements; and
• comply with other legal obligations.

23. Automated Processing

DWT Farm may use automated systems to assist with activities such as:

• fraud detection;
• spam prevention;
• marketplace security;
• ranking or sorting;
• Product recommendations;
• detecting technical abuse; and
• identifying suspicious transactions.

We do not use solely automated decision-making to make decisions producing legal or similarly significant effects about individuals unless permitted by applicable law and accompanied by any notices and rights required by that law.

Where applicable law provides a right to opt out of certain forms of legally significant profiling or automated decision-making, we will provide that right.

24. How We Disclose Personal Information

We may disclose personal information to the following categories of recipients.

Producers

When a Customer places an Order, we provide the applicable Producer with information necessary to fulfill it.

This may include:

• Customer name;
• Order contents;
• contact information;
• pickup information;
• delivery information;
• instructions; and
• relevant messages.

A Producer must use Customer information only for lawful marketplace purposes and as otherwise permitted by applicable law.

Customers

We may provide Customers with information about the Producer necessary to conduct the transaction, comply with marketplace laws, facilitate pickup or delivery, or address a dispute.

Some Producer information is publicly available through Producer storefronts.

Payment providers

We disclose information to Stripe and other payment providers as necessary to:

• process payments;
• operate connected accounts;
• verify identities;
• process payouts;
• administer refunds;
• address disputes; and
• comply with financial and legal requirements.

Delivery providers

We provide information necessary to perform requested delivery services.

Mapping and location providers

We may provide addresses or geographic information to mapping providers where necessary to:

• geocode addresses;
• determine distances;
• calculate delivery eligibility;
• provide maps; or
• determine relevant time zones.

Email and communications providers

We may use providers such as Mailgun or similar services to deliver:

• account communications;
• password resets;
• welcome messages;
• Order receipts;
• Producer Order notifications; and
• other communications.

Hosting, cloud, and infrastructure providers

Service providers may process information in connection with:

• application hosting;
• data storage;
• content delivery;
• database infrastructure;
• network security;
• logging; and
• backups.

Professional advisers

We may disclose information to:

• attorneys;
• accountants;
• auditors;
• insurers; and
• other professional advisers

where reasonably necessary for professional services or legal obligations.

Government and legal recipients

We may disclose information when reasonably necessary to:

• comply with applicable law;
• comply with a valid subpoena, warrant, court order, or other lawful process;
• respond to regulators;
• investigate fraud;
• protect public safety;
• address food-safety emergencies;
• establish or defend legal claims; or
• protect the rights of DWT Farm or others.

Corporate transactions

Information may be disclosed in connection with:

• financing;
• due diligence;
• merger;
• acquisition;
• reorganization;
• bankruptcy;
• sale of assets; or
• similar corporate transaction.

Where legally required, appropriate protections will apply.

25. Service Providers and Contractors

When another company processes personal information on DWT Farm’s behalf, we seek to use appropriate contractual, organizational, and technical safeguards based on the nature of the service and information involved.

Service providers are authorized to process information for purposes associated with providing their services and other purposes permitted under applicable law and applicable agreements.

26. Public Information

Certain information is inherently public because DWT Farm is a marketplace.

For example, a Producer may choose or be required to publicly display:

• business name;
• logo;
• Product photographs;
• Product descriptions;
• Producer biography;
• approximate business location;
• pickup information where appropriate;
• legally required seller information; and
• ratings or reviews.

Reviews submitted by Customers may also be public.

Search engines and third parties may index or copy publicly available information.

Information removed from DWT Farm may therefore remain available elsewhere if it was previously copied or indexed by others.

27. Sensitive Personal Information

Depending on your use of the Service, DWT Farm or its service providers may process information classified as “sensitive personal information” or “sensitive data” under certain laws.

Examples may include:

• government identification information;
• account login credentials;
• financial-account information;
• precise geolocation if enabled;
• contents of private communications;
• information supplied for identity verification; and
• information voluntarily disclosed by a User that may reveal health or other sensitive characteristics.

We process sensitive information only for legitimate purposes associated with providing, securing, administering, or legally operating the Service.

We do not use sensitive personal information to infer characteristics about you for advertising.

We do not sell sensitive personal information.

Where applicable law requires consent before processing certain sensitive information, we will obtain that consent.

Where applicable law provides a right to limit or withdraw consent for such processing, we will honor that right.

28. Information We Ask You Not to Provide

Unless specifically requested for a legitimate DWT Farm purpose, please do not provide:

• Social Security numbers;
• passport numbers;
• driver’s-license numbers;
• full bank credentials;
• payment-card security codes;
• medical records;
• genetic information;
• biometric identifiers;
• information concerning children; or
• other highly sensitive information.

If we require sensitive information, we may direct you to a secure workflow operated by DWT Farm or a specialized service provider.

29. Data Retention

DWT Farm does not intend to retain personal information indefinitely merely because it might someday be useful.

We retain information based on factors including:

• how long your account remains active;
• whether the information is necessary to provide the Service;
• the nature and sensitivity of the information;
• the length of the transaction relationship;
• applicable tax and accounting requirements;
• applicable food-safety or regulatory requirements;
• payment-provider requirements;
• fraud-prevention needs;
• security needs;
• dispute-resolution periods;
• applicable statutes of limitation;
• litigation or anticipated litigation;
• legal holds; and
• other legal obligations.

Typical retention approaches include:

Account information

Generally retained while the account is active and for a reasonable period afterward for legal, security, fraud-prevention, and recordkeeping purposes.

Order and transaction records

Generally retained for the period reasonably necessary for financial reporting, taxation, disputes, refunds, fraud prevention, and legal compliance.

Producer compliance records

Retained for as long as reasonably necessary to establish marketplace eligibility and afterward as required for regulatory, safety, or legal purposes.

Security logs

Generally retained for periods appropriate to investigating security events, preventing fraud, and maintaining Service integrity.

Marketing preferences

Retained while relevant and afterward as needed to maintain suppression lists so that an opt-out can continue to be honored.

Deleted accounts

Certain account information may be deleted, anonymized, or restricted after closure, subject to legitimate legal and business retention requirements.

Backups

Information deleted from active systems may remain temporarily in secured backups until those backups rotate or are securely destroyed.

When information is no longer reasonably necessary, we seek to delete, anonymize, aggregate, or otherwise securely dispose of it.

30. Deidentified and Aggregated Information

We may create aggregated or deidentified information that cannot reasonably be linked to an identified individual.

We may use such information for lawful purposes including:

• marketplace statistics;
• analytics;
• business planning;
• Product development;
• research;
• security; and
• Service improvement.

Where required by law, we will maintain deidentified information in deidentified form and will not attempt to reidentify it except as permitted to test deidentification processes or comply with law.

31. Security

DWT Farm uses administrative, technical, and organizational safeguards designed to protect personal information appropriate to the nature of the information and risks involved.

Measures may include:

• encrypted network communications;
• access controls;
• authentication;
• password hashing;
• least-privilege access;
• security logging;
• cloud security controls;
• restricted administrative access;
• backup procedures;
• dependency and system updates;
• monitoring;
• secure development practices; and
• incident-response procedures.

No information system, internet transmission, or storage technology can be guaranteed to be completely secure.

You are responsible for protecting your account credentials and should notify us promptly if you believe your account has been compromised.

32. Security Incidents and Breach Notification

If DWT Farm becomes aware of a security incident affecting personal information, we will investigate and take appropriate steps based on the nature and circumstances of the incident.

Where applicable law requires notification to affected individuals, regulators, law enforcement, or other parties, we will provide such notification in accordance with applicable requirements.

33. Your Privacy Rights

Depending on where you live and which privacy laws apply to DWT Farm, you may have one or more of the following rights.

Right to know or access

You may have the right to request information concerning:

• whether we process your personal information;
• categories of information we process;
• purposes of processing;
• categories of sources;
• categories of recipients; and
• specific personal information maintained about you.

Right to correction

You may have the right to request correction of inaccurate personal information.

Right to deletion

You may have the right to request deletion of personal information, subject to legal exceptions.

Right to portability

You may have the right to obtain certain personal information in a portable format.

Right to opt out of sale

Where applicable, you may have the right to opt out of the sale of personal information.

DWT Farm currently does not sell personal information as described in Section 15.

Right to opt out of targeted advertising or sharing

Where applicable, you may have the right to opt out of processing for targeted advertising or cross-context behavioral advertising.

DWT Farm currently does not engage in the practices described in Section 15.

Right to opt out of certain profiling

Some jurisdictions provide rights regarding profiling used to make decisions producing legal or similarly significant effects.

Rights concerning sensitive data

You may have rights to consent to, limit, or withdraw consent for certain processing of sensitive information.

Right to appeal

Residents of certain states may have the right to appeal our decision regarding a privacy request.

Right against unlawful discrimination

We will not unlawfully discriminate against you because you exercised a privacy right.

34. Exercising Your Privacy Rights

You may submit a privacy request using:

Privacy email: [PRIVACY EMAIL]

and/or:

Privacy request form: [PRIVACY REQUEST URL]

You may also be able to make certain changes directly through your account settings.

Please describe your request sufficiently for us to understand and process it.

We will respond within the period required by applicable law.

35. Verification of Privacy Requests

We may need to verify your identity before completing certain privacy requests.

Verification procedures will depend on:

• the nature of the request;
• sensitivity of the information;
• risk of unauthorized disclosure; and
• information reasonably available to us.

We may request information reasonably necessary to match you to an account or transaction.

Information collected solely to verify a privacy request will be used for verification and related security purposes.

We will not disclose highly sensitive credentials such as passwords, full payment-card information, or security codes in response to an access request.

36. Authorized Agents

Where applicable law permits use of an authorized agent, you may designate an authorized agent to submit certain privacy requests on your behalf.

We may require evidence that:

• the agent is authorized to act for you; and/or
• you have independently verified your identity or confirmed the authorization.

We will not require more information than reasonably necessary to verify the request.

37. Appeals

If applicable law gives you a right to appeal a decision concerning a privacy request, you may submit an appeal to:

[PRIVACY EMAIL]

Use the subject line:

Privacy Request Appeal

Include information sufficient to identify the prior request.

We will process the appeal within the period required by applicable law and provide any required information concerning further complaint rights.

38. California Privacy Notice

This section supplements the remainder of this Privacy Policy for California residents when the California Consumer Privacy Act, as amended (“CCPA”), applies.

Categories of personal information

During the preceding 12 months, DWT Farm may have collected the following CCPA categories depending on how a person used the Service:

• identifiers;
• personal information described in California Civil Code § 1798.80;
• commercial information;
• internet or other electronic network activity;
• geolocation data;
• sensory information such as photographs;
• professional or employment-related information supplied in connection with a Producer business;
• inferences derived from marketplace activity where applicable; and
• sensitive personal information.

Examples and purposes are described throughout this Privacy Policy.

Sources

We may obtain personal information from:

• you;
• other Users;
• your device or browser;
• Producers;
• Customers;
• payment providers;
• delivery providers;
• identity-verification services;
• service providers;
• public sources where appropriate; and
• other sources described in this Privacy Policy.

Business or commercial purposes

We collect and use personal information for purposes described in Sections 22 and elsewhere in this Privacy Policy, including:

• providing the Service;
• processing transactions;
• security;
• fraud prevention;
• customer support;
• marketplace operations;
• compliance;
• analytics; and
• Service improvement.

Categories of recipients

We may disclose applicable categories to:

• Producers;
• Customers;
• payment providers;
• delivery providers;
• hosting and infrastructure providers;
• mapping providers;
• communications providers;
• security providers;
• professional advisers;
• government entities; and
• corporate transaction counterparties.

Sale and sharing

DWT Farm does not sell personal information for monetary consideration.

As of the effective date of this Privacy Policy, DWT Farm does not sell personal information or share personal information for cross-context behavioral advertising as those terms are defined by the CCPA.

Sensitive personal information

We use sensitive personal information for purposes reasonably necessary to:

• provide requested goods and services;
• process transactions;
• maintain security;
• prevent fraud;
• verify identities;
• comply with law; and
• perform other purposes permitted without a right to limit under applicable California law.

We do not use sensitive personal information to infer characteristics about California consumers for advertising.

If we begin using sensitive personal information in a manner for which California law provides a right to limit, we will provide the required mechanism.

California rights

Subject to applicable exceptions, California residents may have the right to:

• know;
• access;
• delete;
• correct;
• opt out of sale or sharing;
• limit certain use or disclosure of sensitive personal information; and
• exercise privacy rights without discriminatory treatment.

California consumers may also use an authorized agent as permitted by law.

39. Privacy Rights for Residents of Other U.S. States

Residents of Colorado, Connecticut, Delaware, Iowa, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah, Virginia, and other states with applicable comprehensive privacy laws may have rights that vary by jurisdiction.

Depending on applicable law, these may include rights to:

• confirm whether we process personal data;
• access personal data;
• correct inaccurate data;
• delete personal data;
• obtain portable data;
• opt out of sale;
• opt out of targeted advertising;
• opt out of certain profiling;
• consent to or withdraw consent for sensitive-data processing; and
• appeal a denied privacy request.

DWT Farm will provide the rights required by the law applicable to your request.

You do not need to identify the specific statute governing your request.

40. Nevada Residents

Nevada residents may have rights under Nevada law to direct certain operators not to make certain sales of covered information.

DWT Farm does not currently sell covered information as contemplated by Nevada privacy law.

Eligible requests may nevertheless be submitted to:

[PRIVACY EMAIL]

41. Children’s Privacy

DWT Farm is intended for adults.

You must generally be at least 18 years old to create an account, make purchases through an account, or operate as a Producer.

The Service is not directed to children under 13.

DWT Farm does not knowingly collect personal information online from children under 13 in circumstances requiring parental consent under the Children’s Online Privacy Protection Act (“COPPA”).

If we learn that we collected personal information from a child under 13 in violation of applicable law, we will take reasonable steps to delete it.

A parent or legal guardian who believes a child has improperly provided information may contact:

[PRIVACY EMAIL]

We do not knowingly sell or share personal information of individuals under 16 for cross-context behavioral advertising.

42. Email Communications

We send transactional communications that may include:

• account verification;
• password-reset messages;
• Order confirmations;
• receipts;
• Producer Order notifications;
• marketplace security messages;
• compliance notices;
• account notices; and
• service announcements.

Because these communications relate to your account or transactions, you may not be able to opt out of all transactional messages while maintaining an active account.

If we send promotional email, you may unsubscribe using the link included in the message or applicable account settings.

We may retain your email address on a suppression list to honor your unsubscribe request.

43. Mobile Application Permissions

Our mobile application may request device permissions when necessary for particular functionality.

Depending on platform and features, permissions could include:

• location;
• camera;
• photo library;
• notifications; or
• other functions.

We request permissions through the device’s normal permission system.

You can modify permissions using device settings.

Some Service features may not function if a required permission is disabled.

44. Links to Third-Party Services

DWT Farm may contain links to websites, applications, or services not controlled by DWT Farm.

We are not responsible for the privacy practices of independent third parties.

Review their privacy policies before providing information.

45. Third-Party Payment Privacy

Stripe independently processes information in connection with payment and connected-account services.

The Stripe Connected Account Agreement provides that Stripe may share information concerning connected accounts and account activity with the applicable Connect platform as necessary to provide Stripe Connect and platform services.

DWT Farm’s receipt and use of information from Stripe remains subject to this Privacy Policy, applicable agreements, and applicable law.

46. Cross-Border Processing

DWT Farm is based in the United States.

Personal information may be processed or stored in the United States or other jurisdictions where our service providers operate.

Privacy and data-protection laws in those jurisdictions may differ from those where you live.

Where applicable law requires safeguards for international data transfers, we will use legally recognized safeguards.

47. Do Not Track

Some browsers provide a “Do Not Track” signal.

Because no universally applicable legal or technical standard governs traditional Do Not Track signals, DWT Farm may not respond to traditional DNT signals.

This is separate from legally recognized opt-out preference signals such as Global Privacy Control, which we process as described in Section 16 when applicable.

48. Legal Requests

DWT Farm may preserve, access, or disclose information when we reasonably believe doing so is necessary to:

• comply with applicable law;
• respond to valid legal process;
• respond to lawful governmental requests;
• enforce agreements;
• investigate fraud;
• respond to emergencies involving danger to a person;
• address food-safety incidents;
• protect DWT Farm;
• protect Users; or
• establish or defend legal claims.

Where legally permitted and appropriate, we may challenge requests that we believe are invalid or overly broad.

49. Business Transfers

If DWT Farm participates in:

• a merger;
• acquisition;
• financing;
• reorganization;
• bankruptcy;
• receivership;
• asset sale; or
• similar transaction,

personal information may be transferred as part of that transaction.

The recipient will be subject to applicable law concerning the information it receives.

If a transaction results in a materially different use of personal information, we will provide notice when required by law.

50. Changes to This Privacy Policy

We may modify this Privacy Policy periodically.

When we do, we will update the “Last Updated” date.

If changes materially affect how we use personal information, we will provide additional notice where required by law.

We will obtain consent when required before using previously collected information for a materially different purpose that legally requires consent.

We encourage you to periodically review this Privacy Policy.

51. Privacy Policy Versions

We may retain prior versions of this Privacy Policy for:

• compliance;
• auditing;
• dispute resolution; and
• historical reference.

Where practical, prior versions may be made available upon request.

52. Contact Us

For privacy questions, requests, or complaints:

Privacy: [email protected] Support: [email protected]

For security concerns:

Security: [email protected]

For food-safety concerns:

Food Safety: [email protected]

53. Summary of DWT Farm’s Privacy Commitments

Without limiting the detailed provisions above, DWT Farm’s intended privacy principles are:

1. We collect information needed to operate a local-food marketplace rather than collecting personal information simply because it is technically possible.
2. We do not sell personal information for money.
3. We do not use cross-context behavioral advertising.
4. We do not use sensitive information to target advertising based on sensitive characteristics.
5. We use payment processors such as Stripe rather than intentionally storing complete payment-card numbers ourselves.
6. We share transaction information with Producers only when reasonably necessary to conduct marketplace transactions or comply with law.
7. We share delivery information with delivery providers only when reasonably necessary to provide delivery.
8. We use precise device location only when appropriate to a requested feature and with applicable device permission or consent.
9. We seek to retain personal information only for as long as reasonably necessary for the purposes for which it was collected and legitimate legal, security, financial, or compliance needs.
10. We provide privacy rights required by applicable law and do not unlawfully discriminate against individuals for exercising those rights.
11. We recognize legally required universal opt-out mechanisms, including Global Privacy Control where applicable.
12. We use reasonable administrative, technical, and organizational safeguards designed to protect personal information.