Privacy policy

Effective date: January 23, 2026

The purpose of this Privacy Policy is to share how TOP Brands LLC d/b/a LoLo Lemonade (“COMPANY”) collects, uses, and shares some of your Personal Information and how to exercise the choices and rights you have in your information. By using or accessing the Services in any manner, you acknowledge that you accept the practices and policies outlined in this Privacy Policy.

We may update this Privacy Notice from time to time. Any material changes will be reflected by updating the “Effective Date” noted above.

1. SCOPE OF THE PRIVACY POLICY

This policy covers our treatment of information that identifies or is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with you or your household ("Personal Information") in connection with our Services. It applies to all COMPANY consumers, and visitors, including job applicants to COMPANY, and to all COMPANY platforms, including our mobile apps, website (lololemonade.com and subdomains), features, content, products, email distribution lists, and other services offered by COMPANY (collectively, the “Services”). Please remember that your use of the Services is also subject to our Terms of Service. This Policy does not apply to the practices of third parties we don’t own or control unless specifically stated. Our Services may contain links to other websites that are not operated by us. If you click on a third party link, you will be directed to that third party's site. We have no control over and assume no responsibility for the content, privacy policies or practices of any third party sites or services.

2. KEY TERMS

We, us, our: COMPANY and all of our affiliate entities, successors, and assigns.

Personal information: Any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked with a particular consumer or household, including your first name, last name, email, and phone number.

3. PERSONAL INFORMATION WE COLLECT ABOUT YOU

In the preceding 12 months, we have collected the following categories of consumer personal information (as defined by applicable privacy laws) from adult consumers who visit or interact with our website, purchase products, or otherwise use our Services.

Categories of Personal Information We Collect

Category Examples of Personal Information Collected
Identifiers First name, last name, email address, telephone number, shipping address, billing address, account username (if applicable)
Customer Records / Account Information Customer account credentials (e.g., password) if you create an account through our Services; contact preferences; customer support communications
Commercial Information Products purchased, order history, order dates, items viewed or added to cart, purchase amounts, shipping method, return/exchange history
Payment and Transaction Information Transaction details and payment confirmation information. We do not store full debit/credit card numbers; payment card information is collected and processed directly by our third-party payment processors.
Internet or Other Network Activity Device and browser information, IP address, pages visited, links clicked, referring/exit pages, and other usage data, including analytics data (e.g., via Google Analytics).
Geolocation Data Approximate location derived from IP address (not precise location).
Inferences / Derived Data Information inferred from your activity on our site to improve our Services, such as preferences, likely interests, or product trends.

Additional Notes

  • Some personal information may be collected automatically through cookies and similar technologies when you browse our website.
  • The specific information collected may vary depending on your interactions

4. HOW YOUR PERSONAL INFORMATION IS COLLECTED

We collect most of this personal information directly from you—in person or via this website when you place an order for pick-up from one of our retail dispensary locations. We use cookies and similar tracking technologies to track the activity of our Services and store certain information. Tracking technologies used are beacons, tags, and scripts to collect and track information and to improve and analyze the Services.

5. WHY WE USE YOUR PERSONAL INFORMATION

We collect and use personal information for the following business and commercial purposes:

Business Purposes

  • To provide and operate our Services, including processing orders, shipping products, handling returns/exchanges, and providing customer support.

  • To process payments and prevent fraud, including verifying customer information and authenticating transactions.

  • To communicate with you, including sending transactional communications (order confirmations, shipping updates) and responding to inquiries.

  • For marketing and promotional purposes, such as sending newsletters and promotional emails where you have opted in (or where permitted by law).

  • To administer customer programs, such as promotions, loyalty programs, rewards, or discount programs (if offered).

  • To measure and improve website performance, including analytics and understanding how visitors interact with our website (e.g., via Google Analytics).

  • To maintain the security and integrity of our website, including detecting security incidents, preventing abuse, and protecting against malicious activity.

  • To debug and repair errors that impair intended functionality.

  • To comply with legal and regulatory obligations, including maintaining records required by law, responding to lawful requests, and enforcing our terms.

  • For internal business purposes, including reporting, auditing, training, and improving operational efficiency.

  • For business transfers, such as evaluating or completing a merger, acquisition, financing, reorganization, or sale of assets.

  • With your consent, for any other purpose disclosed to you at the time of collection.

Detailed Purpose Table

What we use personal information for Examples Our reason / legal basis (if applicable)
Order processing and fulfillment Processing purchases, shipping, returns, customer support Performance of contract; legitimate interests
Payments and fraud prevention Processing payments, preventing fraud, chargebacks Performance of contract; legal obligations; legitimate interests
Communications Order emails, shipping updates, customer support Performance of contract; legitimate interests
Marketing (opt-in) Email newsletters and promotions (Klaviyo) Consent / legitimate interests (as permitted)
Analytics and performance Website analytics (Google Analytics), improving site UX Legitimate interests
Security and debugging Preventing misuse, detecting attacks, troubleshooting Legitimate interests; legal obligations
Compliance and enforcement Tax/accounting records, responding to legal requests Legal obligations; legitimate interests
Business operations Internal reporting and administration Legitimate interests
Business transfers M\&A diligence / asset transfer scenarios Legitimate interests

Note: We do not use your personal information for purposes that are materially different, unrelated, or incompatible with the purposes described above without providing you notice and, where required, obtaining your consent.

6. WHO WE SHARE YOUR PERSONAL INFORMATION WITH

In the preceding 12 months, we may have disclosed personal information to the following categories of recipients for business purposes:

A. E-Commerce Platform and Hosting

  • Shopify (e-commerce platform and storefront provider), which supports our website operations, checkout, order management, and customer account features.

B. Payment Processing and Fraud Prevention

  • Bankful (payment processing services)
  • Authorize.net (payment gateway services)

Important: Payment card information (such as debit/credit card numbers) is collected and processed directly by our payment processors. We do not store full payment card numbers.

C. Order Fulfillment, Shipping, and Logistics

  • Veracore (fulfillment and warehousing)
  • ShipStation (shipping label creation, shipment management, and logistics support)
  • Shipping carriers (e.g., UPS, USPS, FedEx), as needed to deliver your order

D. Marketing and Communications

  • Klaviyo (email marketing service provider, used for promotional emails where you opt in, and may be used for certain transactional communications)

E. Analytics and Website Performance

  • Google Analytics (analytics provider used to understand site traffic, usage, and performance)

F. Internal Systems / Business Operations

  • Stakt (internal business systems and operations support)
  • Top Brands (business operations/partner support as applicable)

G. Professional Advisors and Compliance

We may disclose personal information to:

  • professional advisors (lawyers, accountants, auditors)
  • insurers and brokers
  • banks and payment-related financial institutions

H. Legal and Business Transfers

We may disclose personal information:

  • to law enforcement or government agencies when required by law or to protect our rights
  • to a buyer, seller, successor, or other party in connection with a business transaction (merger, acquisition, restructuring, or asset sale)

How We Control Sharing

We only share personal information with service providers and vendors who are authorized to use it as needed to provide services to us (e.g., payment processing, fulfillment, email delivery, analytics). We require appropriate safeguards and contractual restrictions consistent with applicable law.

7. CATEGORIES OF PERSONAL INFORMATION WE SHARE

In the preceding 12 months, we have shared the following categories of personal information:

• Identifiers
• Personal information
• Commercial information
• Internet or other similar network activity information (e.g., website usage and analytics data) disclosed to analytics and website service providers such as Google Analytics and Shopify for business purposes.

8. CATEGORIES OF PERSONAL INFORMATION WE DISCLOSED FOR A BUSINESS PURPOSE

In the preceding 12 months, we have disclosed the following categories of personal information for a business purpose:

• Identifiers
• Personal information
• Commercial information
• Internet or other similar network activity information [SW1] [NK2] [SL3] (e.g., website usage and analytics data) disclosed to analytics and website service providers such as Google Analytics and Shopify for business purposes.

9. HOW LONG YOUR PERSONAL INFORMATION WILL BE KEPT

We will keep your personal information while you have an account with us or while we are providing products and/or services to you. Thereafter, we will keep your personal information for as long as is necessary:

• To respond to any questions, complaints or claims made by you or on your behalf
• To show that we treated you fairly
• To keep records required by law
We will not retain your personal information for longer than necessary for the purposes set out in this policy. When it is no longer necessary to retain your personal information, we will delete or anonymize it.

10. YOUR RIGHTS UNDER THE CCPA/CPRA (APPLICABLE TO CALIFORNIA RESIDENTS)

You have the right under the California Consumer Privacy Act of 2018 (CCPA), as amended by the California Privacy Rights Act of 2020 (CPRA), and certain other privacy and data protection laws, as applicable, to exercise free of charge:

Right to Know About Personal Information Collected

You have the right to know, and request disclosure of:

• The categories of personal information we have collected about you, including sensitive personal information
• The categories of sources from which the personal information is collected
• Our business or commercial purpose for collecting, selling, or sharing personal information
• The categories of third parties to whom we disclose personal information, if any
• The specific pieces of personal information we have collected about you

Please note that we are not required to:

• Retain any personal information about you that was collected for a single one-time transaction if, in the ordinary course of business, that information about you is not retained
• Reidentify or otherwise link any data that, in the ordinary course of business, is not maintained in a manner that would be considered personal information
• Provide the personal information to you more than twice in a 12-month period

Right to Know About Personal Information Sold, Shared, or Disclosed

In connection with any personal information we may sell, share, or disclose to a third party for a business purpose, you have the right to know:

• The categories of personal information about you that we sold or shared and the categories of third parties to whom the personal information was sold or shared
• The categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom the personal information was disclosed for a business purpose

Right to Opt-Out of Sale or Sharing

You have the right to opt-out of the sale of your personal information or sharing of your personal information for targeted behavioral advertising. If you exercise your right to opt-out of the sale or sharing of your personal information, we will refrain from selling or sharing your personal information, unless you subsequently provide express authorization for the sale or sharing of your personal information.

To opt-out of the sale or sharing of your personal information, please email us stating “Do Not Sell or Share My Personal Information” to support@lololemonade.com.

Right to Limit Use of Sensitive Personal Information

You have the right to limit the use and disclosure of your sensitive personal information to the use which is necessary to: • Perform the services or provide the goods reasonably expected by an average consumer who requests those goods or services • Perform specific enumerated services including security, short-term transient use, service provision, and quality verification • As authorized by further regulations

To limit the use of your sensitive personal information, please contact us stating "Limit the Use of My Sensitive Personal Information" to support@lololemonade.com.

Right to Deletion

Subject to certain exceptions, on receipt of a verifiable request from you, we will: • Delete your personal information from our records • Direct any service providers or contractors to delete your personal information from their records • Direct third parties to whom the business has sold or shared your personal information to delete your personal information unless this proves impossible or involves disproportionate effort

Please note that we may not delete your personal information if it is reasonably necessary for specific enumerated purposes including transaction completion, security, debugging, legal compliance, research, internal use, or legal obligations.

Right of Correction

If we maintain inaccurate personal information about you, you have the right to request us to correct that inaccurate personal information. Upon receipt of a verifiable request from you, we will use commercially reasonable efforts to correct the inaccurate personal information.

Protection Against Retaliation

You have the right to not be retaliated against by us because you exercised any of your rights under the CCPA/CPRA. This means we cannot, among other things: • Deny goods or services to you • Charge different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties • Provide a different level or quality of goods or services to you • Suggest that you will receive a different price or rate for goods or services or a different level or quality of goods or services

11. HOW TO EXERCISE YOUR RIGHTS

If you would like to exercise any of your rights as described in this Privacy Policy, you can do so by emailing us at support@lololemonade.com or write to us at 4792 Potato House Court, Wilson, NC 27893 USA.

If you choose to contact us directly by website, email or in writing, you will need to provide us with:

• Enough information to identify you [(e.g., your full name, email address and phone number)]
• Proof of your identity and address (e.g., a copy of your driving license or passport and a recent utility or credit card bill)
• A description of what right you want to exercise and the information to which your request relates
We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information, or is someone authorized to act on such person's behalf.

Any personal information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.

12. APPEALS PROCESS

If we decline to take action on your request, you may appeal our decision by contacting us at support@lololemonade.com. We will respond to appeals within the period required by law and provide information on how to submit a complaint to any applicable state authority.