This Privacy Policy is available in accessible formats upon request. Please contact us at info@thenaturecollective.net if you require an alternative format.

1. Who We Are

The Nature Collective, LLC ("Company," "we," "us," or "our") is a corporation registered in Washington, District of Columbia, United States. We operate the website located at thenaturecollective.net (the "Site").

Data Controller (for GDPR purposes): The Nature Collective, LLC, Washington, District of Columbia, United States Email: info@thenaturecollective.net

We are committed to protecting your personal data and your right to privacy. This Privacy Policy explains what data we collect, why we collect it, how we use it, who we share it with, and your rights regarding that data. Please read it carefully. If you disagree with its terms, please discontinue use of the Site.

2. Information We Collect

2a. Information Collected Automatically

When you visit our Site, the following information is collected automatically through analytics tools:

• Browser type and version
• Operating system
• IP address (anonymized where technically possible)
• Pages visited and time spent on each page
• Referring URLs (the page you came from)
• Date and time of your visit
• General geographic location (country/city level, derived from IP address)
• Device type (desktop, mobile, tablet)

Source of this data: Collected directly from your device and browser when you visit the Site, via Google Analytics tracking code.

2b. Information You Provide Voluntarily

If you contact us directly (e.g., by email), we may collect your name, email address, and the content of your message.

2c. What We Do NOT Collect

We do not collect payment information, precise geolocation data, biometric data, health data, government ID numbers, financial account information, or any other sensitive personal information. We do not collect personal information from children under the age of 13.

3. How and Why We Use Your Information

We use the information we collect only for the following specific, documented purposes:

Legitimate Interests Assessment: We have assessed that our use of analytics data for Site improvement purposes is not overridden by your data protection rights, given the limited, anonymized nature of the data collected and the reasonable expectation of analytics use on websites.

We do not use personal data for profiling, targeted advertising, or automated decision-making that produces legal or similarly significant effects on you.

4. Cookies and Tracking Technologies

Our Site uses cookies and similar tracking technologies. A cookie is a small file placed on your device when you visit a website.

Cookies We Use

No other first-party or third-party cookies are currently in use on this Site.

Your Cookie Choices

Cookie Consent (EU/UK Visitors): If you are visiting from the European Union or the United Kingdom, a cookie consent banner will be presented before any analytics cookies are set. You may accept or decline non-essential cookies at that time. You may change your preference at any time.

Browser Controls: You may control or disable cookies through your browser settings. Disabling cookies may affect certain Site functionality.

Google Analytics Opt-Out: You may opt out of Google Analytics tracking by installing the Google Analytics Opt-out Browser Add-on.

Global Privacy Control (GPC) and Do Not Track (DNT)

We honor Global Privacy Control (GPC) opt-out signals as required under California law. When a valid GPC signal is detected from your browser:

1. We will not set analytics or tracking cookies for your session.
2. A visible on-screen confirmation will be displayed to notify you that your opt-out signal has been recognized and honored.

We also respect Do Not Track (DNT) browser signals. When a DNT signal is detected, we do not plant tracking cookies or share browsing data with third parties.

5. Do Not Sell or Share My Personal Information

We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising.

This applies to all users, including California residents. Because we do not engage in these activities, we do not display a "Do Not Sell or Share My Personal Information" link. If our practices change, we will update this policy and implement the required opt-out mechanisms prior to any such activity.

6. Third-Party Service Providers

We share limited personal data with the following service provider solely to operate our Site. This provider is contractually prohibited from using your data for their own independent purposes.

California Disclosure: The above table reflects all service providers and contractors to whom we have disclosed personal information for a business purpose in the preceding 12 months. The categories of personal information disclosed are: browsing and usage data and anonymized IP addresses.

We do not disclose personal information to any other third parties except as required by law.

7. Advertising

We do not display third-party advertisements on our Site. We do not use remarketing or retargeting services (such as Google Ads remarketing or Meta retargeting) to advertise our business.

8. Email Communications

We do not send marketing emails, newsletters, or promotional communications. We do not offer email subscription or opt-in services. We will only contact you by email if you have reached out to us directly and only to respond to your inquiry.

9. Children's Privacy

Our Site is not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected information from a child under 13, please contact us immediately at info@thenaturecollective.net, and we will promptly delete that information in accordance with the Children's Online Privacy Protection Act (COPPA).

10. Your Privacy Rights

California Residents – CCPA / CPRA

California residents have the following rights under the California Consumer Privacy Act (CCPA) and California Privacy Rights Act (CPRA), as amended by regulations effective January 1, 2026:

• Right to Know – Request the specific categories and pieces of personal information we have collected about you, including the names of any service providers or contractors who received your information, in the preceding 12 months.
• Right to Delete – Request deletion of your personal information, subject to certain legal exceptions.
• Right to Correct – Request correction of inaccurate personal information we hold about you.
• Right to Opt Out of Sale or Sharing – We do not sell or share personal information. You may still submit an opt-out request at any time and we will honor it.
• Right to Limit Use of Sensitive Personal Information – We do not collect sensitive personal information as defined under CPRA.
• Right to Non-Discrimination – We will not discriminate against you for exercising any CCPA/CPRA rights.

Opt-Out Signals: We honor opt-out preference signals, including Global Privacy Control (GPC), as required under California law. When a GPC signal is detected, we will process it as a valid opt-out request and display a visible on-site confirmation.

How to Submit a Request: Contact us at info@thenaturecollective.net with the subject line "California Privacy Request." We will respond to verifiable requests within 45 days (extendable by an additional 45 days with prior notice).

Authorized Agents: You may designate an authorized agent to submit requests on your behalf. We may require verification of the agent's authorization.

California Residents – CalOPPA

In compliance with the California Online Privacy Protection Act (CalOPPA):

• This Privacy Policy is posted conspicuously and accessible from all pages of our Site.
• Users may visit our Site anonymously.
• We honor Do Not Track (DNT) and Global Privacy Control (GPC) signals.
• We do not allow third-party behavioral tracking on our Site.
• We will notify users of material changes to this policy via a site notice before changes take effect.
• This policy is available in English. Accessible format versions are available upon request.

EU and UK Residents – GDPR / UK GDPR

If you are located in the European Union or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) or UK GDPR:

• Right of Access (Art. 15) – Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16) – Request correction of inaccurate or incomplete data.
• Right to Erasure (Art. 17) – Request deletion of your personal data where there is no overriding legal basis to retain it.
• Right to Restriction of Processing (Art. 18) – Request that we limit how we use your data in certain circumstances.
• Right to Data Portability (Art. 20) – Request your data in a structured, machine-readable format.
• Right to Object (Art. 21) – Object to processing based on legitimate interests. We will stop processing unless we can demonstrate compelling legitimate grounds.
• Right to Withdraw Consent (Art. 7) – Where processing is based on consent (e.g., analytics cookies), you may withdraw consent at any time without affecting the lawfulness of prior processing.
• Right Not to Be Subject to Automated Decision-Making (Art. 22) – We do not engage in automated decision-making or profiling that produces significant legal effects.

Legal Basis for Processing: We rely on legitimate interests (Article 6(1)(f) GDPR) for analytics processing, having concluded this interest is not overridden by your rights, given the limited and anonymized nature of data collected.

Transparency and Disclosure (Articles 12–14): We provide this information concisely, transparently, and in plain language, in accordance with our obligations under GDPR Articles 12–14, which are the subject of the EDPB's 2026 Coordinated Enforcement Action.

Data Controller: The Nature Collective, LLC, Washington, District of Columbia, United States. Contact: info@thenaturecollective.net

Data Protection Officer (DPO): We have determined that appointment of a DPO is not required under our current processing activities. If this changes, we will update this policy and make DPO contact information available.

International Data Transfers:

• Transfers to the United States: Data processed by Google LLC (Google Analytics) is transferred to and stored in the United States. Google participates in the EU-U.S. Data Privacy Framework (DPF), which provides an adequate level of protection. Details are available at google.com/about/datacenters/locations.
• Transfers to the United Kingdom: The European Commission renewed its adequacy decision for the United Kingdom in December 2025 (valid through December 27, 2031), confirming the UK provides an essentially equivalent level of data protection. No additional transfer mechanisms (such as SCCs) are required for EU-to-UK transfers during this period.

Supervisory Authority: You have the right to lodge a complaint with your national data protection authority (e.g., your country's DPA in the EU, or the Information Commissioner's Office (ICO) in the UK at ico.org.uk).

To exercise your GDPR/UK GDPR rights, contact us at info@thenaturecollective.net. We will respond within 30 days.

11. Data Retention

We retain personal data only as long as necessary for the purpose for which it was collected or as required by applicable law. The following table covers all categories of personal information we process:

After the applicable retention period, data is deleted, anonymized, or archived in a manner that prevents re-identification.

12. Data Security

We implement reasonable and appropriate technical and organizational measures to protect personal information against unauthorized access, disclosure, alteration, or destruction, including:

• HTTPS/TLS encryption for data in transit
• Access controls limiting data access to authorized personnel
• Regular review of third-party service provider security practices

No method of Internet transmission or electronic storage is 100% secure. We cannot guarantee absolute security. In the event of a data breach likely to result in a risk to your rights and freedoms, we will notify affected individuals and applicable regulatory authorities as required by law (within 72 hours under GDPR; applicable state law timelines for U.S. residents).

13. AI and Automated Decision-Making

We do not currently use artificial intelligence tools, machine learning systems, or automated decision-making processes that collect, analyze, or profile your personal data in ways that produce legal or significant effects. If this changes, this policy will be updated and appropriate disclosures will be made prior to any such use taking effect.

14. Third-Party Links

Our Site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies independently before providing any personal information.

15. Changes to This Privacy Policy

We review this Privacy Policy at least annually (next scheduled review: March 2027) and whenever our data practices or applicable law changes materially. When we make material changes, we will:

1. Update the "Last Updated" date at the top of this page.
2. Display a notice on our Site homepage prior to the changes taking effect.

Your continued use of the Site after any changes constitutes acknowledgment of the updated policy. Where required by law, we will obtain fresh consent.

16. Contact Us

For questions, concerns, or to exercise any of the privacy rights described in this policy, please contact:

The Nature Collective, LLC, Washington, District of Columbia, United States

Preferred Contact Method: Email Email: info@thenaturecollective.net

We aim to respond to all privacy-related inquiries within 30 days. For California residents submitting formal CCPA requests, the statutory deadline of 45 days applies.

If you require this policy in an accessible format or an alternative language, please contact us at the email above.