Primo Water North America Privacy Policy Issue Date:  December 31, 2019 Updated: January 13, 2023

This Privacy Policy applies to DS Services of America, Inc. dba Primo Water North America in respect of users in the United States (“U.S.”) and Aquaterra Corporation dba Primo Water North America in respect of users in Canada (each referred to, as applicable, as “Primo,” the “Company”, “we,” or “us,”). Primo has developed this Privacy Policy to help you understand what information we collect about you, how we use it, who we share it with, how we protect it, and your rights as relates to its use. This Privacy Policy applies to information collected through:

• Your use of our products and services;

• Transacting via water.com (in the U.S.), aquaterracorp.ca (in Canada) and any other websites, mobile apps, or other online products and services that display or link to this Privacy Policy (collectively, "online environments");

• Offline services, including our Customer Care Center and door-to-door sales and delivery activities (collectively, "offline environments"); and

• Information shared with us by other sources for our own internal purposes.

As indicated below we have provided additional information about how we collect and share your Personal Information and your rights with respect to your Personal Information. Subject to applicable law in your jurisdiction of residence, you may have the right to request a copy of the information we store about you, inquire as to how we use that information, who we share it with, or to request its deletion when it is no longer subject to regulatory or compliance retention requirements.  This Privacy Policy applies to both our online and offline activities.

If you have any questions or comments about this Privacy Policy or the ways in which Primo uses the information we collect about you, please do not hesitate to contact us using the information provided in the “Contact Us” section of this Privacy Policy.

WHEN THIS PRIVACY POLICY DOES NOT APPLY

This Privacy Policy does not apply to:

• Websites, mobile apps, or other products and services that have their own privacy policies;

• Websites, mobile apps, or other products and services that do not display or link to this Privacy Policy; or

• Information collected for employment-related or business-to-business related purposes.

If you have any questions as to whether this Privacy Policy applies to you, please do not hesitate to contact us using the information provided in the "Contact Us" section of this Privacy Policy.

INFORMATION WE COLLECT

Personal Information means any information that identifies, relates to, describes, or is capable of being associated with you and in some cases, your household, whether directly or indirectly. Companies generally need to collect and share consumers’ Personal Information for everyday business purposes, marketing, and maintenance of the safety, security, and integrity of their websites and other assets, among other reasons. Where required by applicable law, Personal Information will only be collected with your consent. We collect the information you provide when you:

• Order our products and services or create an account with us;

• Request support or submit an inquiry to our Customer Care Center;

• Sign up to receive information about our Company, our products and our services;

• Respond to surveys or participate in contests or promotions; or

• Post information to message boards or discussion forums accessible through our online environments.

This information may include:

• Identifiers, such as your real name, alias, postal address, e-mail address, phone numbers, or username;

• Financial information, such as your bank account number, credit or debit card number, or other financial information, which we pass on to our third party payment provider as described under “HOW WE USE THE INFORMATION WE COLLECT” below.

• Transactional information, such as products or services purchased, obtained, or considered, or other purchasing or consuming histories, dispenser maintenance data to provide on-demand services, contract details, written signatures, or recordings of your calls to our Customer Care Center.

TECHNICAL INFORMATION COLLECTED AUTOMATICALLY

We automatically collect certain technical information when you transact through our online environments without you actively submitting such information, such as:

• Identifiers, such as your internet protocol (IP) address and geolocation data

• Network activity data, such as browsing history, search history, and information regarding your individual interactions with an internet website, application, or advertisement

This information can make your use of our online environments easier and more meaningful by allowing us to provide better service, customize our online environments based on your consumer preferences, compile statistics, provide you with more relevant advertisements, analyze trends, and otherwise administer and improve our online environments. Where such information is used to identify you, it is treated as Personal Information. For more information, refer to our Cookies Policy.

We may also combine the information we collect through one or more of our online environments with information we collect through other online environments. We may also combine information collected through our online environments with information collected through our offline environments, as well as with information provided by our partners. We use this consolidated information to help us improve our online environments, products, and services; to communicate information to you; to enhance our marketing and research activities; and to engage in any other uses described in the "HOW WE USE THE INFORMATION WE COLLECT" section below.

INFORMATION COLLECTED FROM OUR BUSINESS PARTNERS

Our advertising vendors may share information with us regarding our ads on websites or apps where such ads run. This enables us to measure and improve those ads by including information such as whether clicks on ads led to purchases, or a list of criteria to use in targeting ads. We may obtain information from our other partners, such as co-sponsors who we may partner with to run special contests or other co-branded promotions. We may obtain information from other commercially available sources such as data aggregators, marketing firms, and public databases to provide us with additional information about our existing consumers (this is known as “data appending”). This information may include name, demographic information, contact information, interests, and publicly observed data such as from social media and shopping behavior. We may receive information about consumers when we acquire all or part of other companies. We assess this data to determine how it was collected and what consent was given for its use.

HOW WE USE THE INFORMATION WE COLLECT

We use the information we collect to:

• Manage and fulfill orders, deliver products, process payments, manage returns;

• Respond to requests for information and services; and

• Improve our products and services.

We also use the information we collect in anonymized, aggregated form for customer preference analyses, and to:

• Develop new products and services;

• Develop co-branded partner relationships; and

• Determine how to best protect the data of our company and our consumer.

Identifiers – We may use the information you provide to us to:

• Send you advertisements, notices, and other information regarding our products and services, including notifying you about special promotions, in accordance with applicable law;

• Respond to your inquiries or support requests;

• Invite you to participate in surveys regarding our products or services;

• Determine your eligibility for, and to register you in, our contests and other promotions, fulfill and deliver prizes, and contact you regarding such contests or other promotions;

• Furnish and maintain our online environments; and

• Secure our networks and online environments

Financial information – If you make a purchase through our online or offline environments and authorize us to use your credit or debit card information, we will provide this information to our third party payment provider, Elavon (for U.S. users) and Moneris (for Canadian users) to charge you as authorized. Primo only stores a tokenized version of your credit or debit card information (using commonly accepted security measures) so that you can use them the next time you want to order something from us. U.S. users who wish to view Elavon’s privacy policy may click here. Canadian users who wish to view Moneris’s privacy policy may click here. Transactional information – If you register or open an account with us, the information we collect may be used to maintain your account, provide you with access to some features of our online environments, or offer you the benefits and privileges that typically come along with account registration. This may include purchasing products or services, use of exclusive or personalized content or activities (such as message boards), and participation in special events and promotions (contests, sweepstakes, coupons, etc.). Technical information – We may also use the information we collect to offer you customized content by:

• Recognizing new or past visitors to our online environments;

• Remembering your personal preferences;

• Showing you more relevant and meaningful advertisements;

• Better understanding the interests of our consumers and visitors to our online environments; and

• Conducting research and analyzing the use of our online environments, products, services, and advertisements.

Some of our applications and mobile-optimized online environments may have location-based features. To deliver these features, we may access and use location data provided by your mobile device, if you have activated the geolocation/location services settings on your device. For example, we may offer shopping features that allow you to get information about local merchants. Location information will be collected solely to deliver the requested feature and will not be further retained or stored by us.

With regard to our mobile apps’ communications, the default settings on application download enable us to send you notifications about your account, product deliveries, and product offerings. These settings may be modified through the notification settings feature of your mobile device.

We may use both manual and automated systems, such as machine learning and artificial intelligence, to: analyze Personal Information and technical information to improve our services; personalize your experience; automate certain aspects of our online environments; aggregate and anonymize information; provide you certain features; and protect the safety and security of our online environments.

SHARING YOUR PERSONAL INFORMATION

WE DO NOT SELL YOUR PERSONAL INFORMATION to third parties. We may share some or all of your Personal Information as required or permitted by applicable law and to the following persons or entities:

Vendors and Suppliers – We have relationships with different vendors and suppliers who help us design and maintain our online environments, systems, and computer security, respond to consumer inquiries, fulfill orders, mail invoices, analyze our data, create special promotions, and engage in any other information uses described in this Privacy Policy.

Co-Branding and Co-Marketing – We may partner with other companies to offer you products, services, or content on a joint or "co-branded" or “co-marketed” basis. If we offer products, services, or content in this manner, you will see both our logo and the logo of our partner. To access such products, services, or content, you may be redirected to their website and should then refer to their privacy policy to understand how they use your data.

Legal Requests and Preventing Harm – We will disclose information as reasonably necessary to comply with a law, regulation, or legal request; to protect the safety, rights, or property of the public, any person, or Primo; or to detect, prevent, or otherwise address fraud, security, or technical issues.

Change of Ownership or Control – We may engage in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction or proceeding that involves the transfer of the information described in this Privacy Policy.

OTHER IMPORTANT INFORMATION ABOUT OUR RELATIONSHIP WITH THIRD PARTIES

Links to Other Sites – We may feature links to websites that we believe you might find useful and informative. Please be aware, however, that we do not endorse or recommend these sites' content, products, or services, and we are not responsible for the privacy practices of these other sites. We encourage you to be aware of and read the privacy policy of each site you visit. Remember, this Privacy Policy applies solely to information collected or used by Primo.

Social Media Plugins – Our online environments may use social media plugins (for example, the Facebook "Like" button or "Share to Twitter" button) to enable you to easily share information with others. When you visit our online environments, the operator of the social plugin can place a cookie on your device, enabling that operator to recognize individuals who have previously visited our online environments. Please view our Cookie Policy for more information about removing cookies. If you are logged into the social media website (for example, Facebook, Twitter, Google+) while browsing on our online environments, the social plugins allow that social media website to receive information that you have visited our online environments. The social plugins also allow the social media website to share information about your activities on our online environments with other users of their social media website. For example, Facebook Social Plugins allow Facebook to show your "Likes" and comments on our online environments to your Facebook friends. Facebook Social Plugins also allow you to see your friends' Facebook activity on our online environments. We do not control any of the content from the social media plugins. For more information about social plugins from other social media websites, you should refer to those sites' privacy and data sharing policies.

RIGHTS AND CHOICES YOU HAVE ABOUT YOUR PERSONAL INFORMATION

Depending on your jurisdiction of residence, you may have the following rights with respect to your Personal Information:

• Right to Notice/Consent. Before or at the time we collect Personal Information from you, you have the right to receive notice of the Personal Information to be collected and the purposes for which we use it. This Privacy Policy is intended to satisfy this requirement. You may also have the right to consent (or to withdraw your consent) to our collection, use or disclosure of your Personal Information. Where required by applicable law, such consent could take the form of express (opt-in) consent, or implied consent by virtue of your use of our online environments and/or offline environments, having received notice of this Privacy Policy. You also have the right to request that we disclose to you the categories of Personal Information we have collected about you (limited to the preceding 12 months in certain cases), along with the categories of sources from which the Personal Information was collected, the purpose for collecting the Personal Information, and the categories of third parties with whom we shared the Personal Information.

• Right of Access/Rectification. You have the right to request that we disclose or provide you with access to the specific pieces of Personal Information we have collected about you (limited to the preceding 12 months in certain cases). Where required by applicable law, you may also have the right to request that we correct any errors contained in your Personal Information.

• Right to Deletion. You have the right to request that we delete the Personal Information we collect from you. However, in certain situations we are not required to delete your Personal Information, such as when the information is necessary in order to complete the transaction for which the Personal Information was collected, to provide a good or service requested by you, to comply with a legal obligation, to engage in research, to secure our websites or other online services, or to otherwise use your Personal Information internally in a lawful manner that is compatible with the context in which you provided the information.

• Right Not to Be Subject to Discrimination. You have the right to be free from discrimination or retaliation for exercising any of your rights as described above. Where permitted by applicable law, we may, however, charge a different price or rate, or provide a different level or quality of goods or services to you, if that difference is reasonably related to the value provided to Primo by your Personal Information. Further, we may offer you financial incentives in return for your Personal Information.

You can exercise any of your rights by using the information in the “Contact Us” section below.

PRIMO DOES NOT SELL YOUR PERSONAL INFORMATION.

VERIFICATION OF YOUR IDENTITY We value the security and confidentiality of your Personal Information. Therefore, if you exercise your right to notice, right of access, or right to deletion, we must first verify your identity to make sure that you are the person about whom we have collected Personal Information. We verify every request carefully. You may also authorize someone else to submit these requests on your behalf. To do so, you may designate directly with us another person who may act on your behalf by emailing your request to the address shown below in the “Contact Us” section of this Privacy Policy and providing us with a notarized copy of a power of attorney, or by asking the authorized agent to provide us with a copy of your written permission and a scanned copy of their own government-issued ID.

ALTERNATIVE FORMATS OF THIS PRIVACY POLICY If you are unable to review or access this Privacy Policy due to a disability, you may contact us via the options defined in the “Contact Us” section below to request information in an alternative format.

HOW WE SECURE YOUR INFORMATION

We have instituted physical, technical, organizational and procedural safeguards to store and maintain information we collect in a secure environment. You may also be required to use a password to access certain pages on our online environments where certain types of your information can be changed or deleted. It is therefore important for you to protect against unauthorized access to your password and to your device. You take full responsibility for maintaining the complexity and confidentiality of your password. While we have implemented safeguards, you should be aware that Internet security technology rapidly changes. We cannot guarantee that the safeguards we employ today can protect your information from the threats of tomorrow. You should also be aware that despite our efforts, factors beyond our control may result in disclosure of information. Accordingly, we are not able to guarantee that your information will be secure under all circumstances. We retain Personal Information collected through the online and offline services as long as necessary to provide the services, products, and information you request or as permitted by applicable law.

MESSAGE BOARDS AND DISCUSSION FORUMS

Some of our online environments may allow you to share comments or other information. Any information that you may disclose through message boards, discussion forums, blogs, or on other public areas on our online environments becomes public information.

OUR POLICY ON CHILDREN’S INFORMATION

We do not knowingly collect or use any information from children (we define "children" as minors younger than 16 (sixteen) years of age) on our online or offline environments. We do not knowingly allow children to order our products or services, communicate with us, or use any of our online environments. If you are a parent and become aware that your child has provided us with information, please contact us using one of the methods specified below, and we will work with you to address this issue.

INTERNATIONAL TRANSFERS

Our online environments and offline environments are designed for and targeted to audiences in the U.S. and Canada and are governed by and operated in accordance with the laws of those counties, as indicated. While users from other countries may access our online environments and offline environments, we make no representation that such environments are operated in accordance with the laws or regulations of, or governed by, other nations.

Please be aware that by accessing our online environments and offline environments, or providing us with information, you understand and agree that:

• Information collected from you may be transferred to and stored on servers located outside your jurisdiction and may be accessible by the courts, law enforcement and national security authorities of the jurisdiction to which your information is transferred;

• To the extent you are a resident of a country other than the U.S., you consent to the transfer of such information to the U.S. for our use in accordance with this Privacy Policy; and

• To the fullest extent permitted by applicable law, this Privacy Policy, and the collection and use of information pursuant to this Privacy Policy, shall be governed by and construed in accordance with the laws of the state of Georgia without giving effect to any principles of conflicts of law, with all actions or proceedings arising in connection with this policy to be tried and litigated only in the state courts or federal courts located in Cobb County, Georgia.

Providing us with information or continuing to use our online environments or offline environments indicates that you are agreeing to the collection, use, disclosure, management, and storage of information collected from you as described in this Privacy Policy.

LOOKBACK DISCLOSURE

Where applicable, the categories of Personal Information and their collection, use, and disclosure in the preceding twelve (12) months are the same as those defined in this Privacy Policy.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to amend this Privacy Policy without prior notice to reflect technological advancements, legal and regulatory changes, and good business practices. If we change our privacy practices, a new Privacy Policy will reflect those changes and the effective date of the revised Privacy Policy will be set forth at the top of this Privacy Policy. By continuing to provide us with Personal Information or continuing to use our online environments or offline environments after such changes become effective, you signify your agreement to the revised Privacy Policy.

CONTACT US

If you have any questions or comments about this Privacy Policy or the ways in which we use information subject to this policy or for Alberta residents, our policies and practices with respect to the use of non-Canadian service providers, please do not hesitate to contact us by:

• Clicking on the "Contact Us" link on the online environment you are visiting;

• E-mailing our Customer Care Center at customerservice@primowater.com (for U.S. residents) or info@primowater.com (for Canadian residents);

• Calling our Customer Care Center at 1-800-728-5508 (for U.S. residents) or 1-877-442-7873 (for Canadian residents); or

• Writing to us at: U.S. Residents: Primo Water North America, Attention Data Privacy Team, 200 Eagles Landing Boulevard, Lakeland, Florida 33810 Canadian Residents (English-language): Aquaterra Corporation dba Primo Water North America, Attention Data Privacy Team,1200 Britannia Road East, Mississagua, Ontario L4W 2T5 Canadian Residents (French-language): Aquaterra Corporation dba Primo Water North America, Attention Data Privacy Team, 9021 Boul, Métrepolitain Est, Anjou, Qx, H1J 3C4.