Privacy Policy

This Privacy Policy describes how XWELL, Inc. (collectively with its subsidiaries, “XWELL,” “we,” “us,” or “our”) collects, uses, shares, and safeguards personal information. This Privacy Policy also tells you about your rights and choices with respect to your personal information, and how you can reach us to get answers to your questions. You can jump to particular topics by going to the headings below:

• Types Of Information We Collect
• Use And Processing Of Information
• Sharing Of Information
• Your Choices
• How We Protect Personal Information
• Cookies and Tracking Technologies
• Other Important Information
• Information for EEA and UK Residents (GDPR)
• Information for US Residents (State Privacy Laws)

XWELL is committed to protecting all information we collect, use, and share. XWELL will deploy reasonable safeguards aligned with industry standards in order to maintain the security and privacy of information processed by XWELL. We will continue to practice privacy by design to ensure only the necessary Information is being collected and/or transmitted.

Types Of Information We Collect

The following provides examples of the type of information that we collect from you and how we use that information.

In addition to the information that we collect from you directly, we may also receive information about you from other sources, including third parties, business partners, our affiliates, or publicly available sources. For example, if you submit a job application, or become an employee, we may conduct a background check.

Please note, this Privacy Policy does not address the privacy practices of third parties, including those incorporated through the services. Please review the privacy policies of any third parties before you disclose information to them. Through your use of the services, you consent to these practices when directed to the Policy.

Use And Processing Of Information

In addition to the purposes and uses described above, we use information in the following ways:

• To identify you when you visit our websites or our stores.
• To provide products and services or to process returns.
• To improve our services and product offerings.
• To streamline the checkout process.
• To conduct analytics.
• To respond to inquiries related to support, employment opportunities, or other requests.
• To send marketing and promotional materials including information relating to our products, services, sales, or promotions, or those of our business partners.
• For internal administrative purposes, as well as to manage our relationships.

Although the sections above describe our primary purpose in collecting your information, in many situations we have more than one purpose. For example, if you complete an online purchase, we may collect your information to perform our contract with you, but we also collect your information as we have a legitimate interest in maintaining your information after your transaction is complete so that we can quickly and easily respond to any questions about your order. As a result, our collection and processing of your information is based in different contexts upon your consent, our need to perform a contract, our obligations under law, and/or our legitimate interest in conducting our business.

Sharing Of Information

In addition to the specific situations discussed elsewhere in this policy, we disclose information in the following situations:

• Affiliates and Acquisitions. We may share information with our corporate affiliates (g., parent company, sister companies, subsidiaries, joint ventures, or other companies under common control). If another company acquires, or plans to acquire, our company, business, or our assets, we will also share information with that company, including at the negotiation stage.
• Other Disclosures with Your Consent. We may ask if you would like us to share your information with other unaffiliated third parties who are not described elsewhere in this policy. As a data controller and data processor, we may also provide your information to third parties that provide us with data processing services. We only make such disclosures to the extent they are necessary and appropriate, at our discretion, to perform certain services on our behalf. These third parties are required to keep the information confidential and are not authorized to process your information for any other purpose other than as instructed by us. They are also required to ensure appropriate safeguards are in place to protect your information. We will not make third-party disclosures of any personal information we process in our role as a data processor for our customers unless we are instructed or authorized to do so by our customers. We will also update the list of third-party service providers with whom we share your personal information as needed. The following is an inexhaustive list of current third-party vendors that may either directly or indirectly collect information from you in their capacity as a processor:
• Shopify Payment Processing Services
• Cloud Based Databases and Software Hosting Services
• Other Disclosures without Your Consent. We may disclose information in response to subpoenas, warrants, or court orders, or in connection with any legal process, or to comply with relevant laws. We may also share your information in order to establish or exercise our rights, to defend against a legal claim, to investigate, prevent, or take action regarding possible illegal activities, suspected fraud, safety of person or property, or a violation of our policies, or to comply with your request for the shipment of products to or the provision of services by a third-party intermediary.
• Public. Some of our websites may provide the opportunity to post comments, or reviews, in a public forum. If you decide to submit information on these pages, that information may be publicly available.
• Partner Promotion. We may offer contests, sweepstakes, or other promotions with third party partners. If you decide to enter a contest, sweepstakes, or promotion that is sponsored by a third party partner the information that you provide will be shared with us and with them. Their use of your information is not governed by this privacy policy.
• Service Providers. We may share your information with service providers. Among other things service providers may help us to administer our website, conduct surveys, provide technical support, process payments, and assist in the fulfillment of orders.
• Advertising. We do not sell your personal information to third parties for monetary compensation. However, we may use advertising and targeting cookies on our website which may be considered a “sale” of personal information or “sharing for targeted advertising purposes,” as those terms are defined under applicable privacy laws. For more information about how to opt out, please see the “Cookies and Tracking Technologies” and “Information for US Residents (State Privacy Laws)” sections below.

Your Choices

You can make the following choices regarding your personal information. If you are located in the EEA or UK, please also see the “Information for EEA and UK Residents” section below for additional rights and choices. If you are located in the US, please also see the “Information for US Residents” section below for additional rights and choices.

• Promotional Emails. You may choose to provide us with your email address for the purpose of allowing us to send free newsletters, surveys, offers, and other promotional materials to you, as well as targeted offers from third parties. You can stop receiving promotional emails by following the unsubscribe instructions in e-mails that you receive. If you decide not to receive promotional emails, we may still send you service-related communications.
• Promotional Text Messages. If you receive a text message from us that contains promotional information you can opt-out of receiving future text messages by replying “STOP.”

How We Protect Personal Information

No method of transmission over the Internet, or method of electronic storage, is fully secure. While we use reasonable efforts to protect your personal information from unauthorized access, use, or disclosure, we cannot guarantee the security of your personal information. In the event that we are required by law to inform you of a breach of your personal information we may notify you electronically, in writing, or by telephone, if permitted to do so by law.

Some of our websites permit you to create an account. When you do you will be prompted to create a password. You are responsible for maintaining the confidentiality of your password, and you are responsible for any access to or use of your account by someone else that has obtained your password, whether or not such access or use has been authorized by you. You should notify us of any unauthorized use of your password or account.

Cookies and Tracking Technologies

In order to personalize and enhance your experience on our website, we may collect information through “cookies.” Cookies are small strings of text sent by our website to your browser and then stored by your browser on your computer’s hard drive. Our cookies allow us to personalize your experience on our website, make your visit more convenient, and understand how you and others are using our website so we can improve your experience. We use cookies to identify repeat visitors to our website and to determine the paths visitors take on our website. We also use cookies to determine whether you visited our website from a particular Internet link or advertisement.

Most web browsers automatically accept cookies, but it is possible to change your browser setup so it does not accept cookies. However, not utilizing cookies may prevent you from using certain functions and features of the Website.

Through cookies we place on your browser or device, we may collect information about your online activity after you leave our website. This information allows us to improve the Website and customize your online experience.

Additionally, we use certain advertisement networks that use retargeting cookies or pixels to collect certain information about you (including the pages and content you view, the date and time of such views, and location information associated with your IP address).

@* TODO: wire pp-cookie-link to the OneTrust preference center, e.g. onclick="OneTrust.ToggleInfoDisplay();return false;" *@

To opt-out or adjust your preferences for retargeting cookies that may collect information about your online activity while you are using the website, please click here.

Some browsers and browser extensions support the Global Privacy Control (“GPC”) that can send a signal to process your request to opt out from certain types of data processing. When we detect such a signal, we will make reasonable efforts to respect your choices indicated by a GPC setting as required by applicable law.

Other Important Information

The following additional information relates to our privacy practices:

• Transmission Of Information To Other Countries – As a multinational company we transmit information between and among our affiliates. As a result, your information may be processed in a foreign country where privacy laws may be less stringent than the laws in your country. Nonetheless, where possible we take steps to treat personal information using the same privacy principles that apply pursuant to the law of the country in which we first received your information. By submitting your personal information to us you agree to the transfer, storage, and processing of your information in a country other than your country of residence including, but not necessarily limited to, the United States. If you would like more information concerning our attempts to apply the privacy principles applicable in one jurisdiction to data when it goes to another jurisdiction you can contact us using the contact information below.
• Third Party Applications/Websites – We have no control over the privacy practices of websites or applications that we do not own.
• Changes To This Privacy Policy – We may change our privacy policy and practices over time. To the extent that our policy changes in a material way, the policy that was in place at the time that you submitted personal information to us will generally govern that information unless we receive your consent to the new privacy policy. Our privacy policy includes an “effective” and “last updated” date. The effective date refers to the date that the current version took effect. The last updated date refers to the date that the current version was last substantively modified.
• If you are visually impaired, you may access this notice through your browser’s audio reader.
• We do not knowingly collect the personal information of minors under 16 years of age.

Contact Information

If you have any questions, comments, or complaints concerning our privacy practices please contact us at the appropriate address below. We will attempt to respond to your requests and to provide you with additional privacy-related information.

privacyoffice@@xwell.com
254 W 31st Street
New York, New York 10001
877-SPA-3434

Information for EEA and UK Residents

This section provides additional information for individuals located in the European Economic Area (EEA) or the United Kingdom (UK). We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and applicable local data protection laws.

Data Protection Officer. Our Data Protection Officer can be contacted at privacyoffice@@xwell.com.

Legal Bases for Processing. We process your personal data based on the following legal bases under the GDPR: (i) your consent, where you have given clear consent for us to process your personal data for a specific purpose; (ii) performance of a contract, where processing is necessary to fulfill our contractual obligations to you or to take steps at your request prior to entering into a contract; (iii) compliance with a legal obligation, where we must process your personal data to comply with applicable laws; and (iv) our legitimate interests, where processing is necessary for purposes that are in our legitimate interests as a business, provided those interests are not overridden by your rights and interests.

International Data Transfers. We transfer personal data to countries outside of the EEA and UK, including to the United States. When we transfer personal data internationally, we implement appropriate safeguards to protect your personal data, such as standard contractual clauses approved by the European Commission or other lawful transfer mechanisms.

Data Retention. We retain personal data only for as long as necessary to fulfill the purposes for which it was collected, to comply with our legal obligations, to resolve disputes, and to enforce our agreements. The retention period may vary depending on the context of the processing and our legal obligations. For information about how long we keep specific types of personal data, or the criteria used to determine retention periods, please contact us using the contact information below.

Automated Decision-Making. We do not use automated decision-making, including profiling, that produces legal effects or similarly significant effects on individuals without human involvement. If this practice changes, we will update this Privacy Policy.

Your Rights Under GDPR. If you are located in the EEA or UK, you may have the following rights under the GDPR:

• Right of Access. You have the right to request access to your personal data and to obtain information about how we process it. Upon request, we will provide you with a copy of your personal data.
• Right to Rectification. You have the right to request correction of inaccurate personal data and to have incomplete personal data completed.
• Right to Erasure. You have the right to request deletion of your personal data in certain circumstances, such as when the data is no longer necessary for the purposes for which it was collected or when you withdraw consent.
• Right to Object. You have the right to object to the processing of your personal data in certain circumstances, including processing based on legitimate interests or for direct marketing purposes.
• Right to Withdraw Consent. Where we rely on your consent to process your personal data, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to Data Portability. You have the right to request that we provide you with a copy of your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller where technically feasible.
• Right to Restriction of Processing. You have the right to request that we restrict the processing of your personal data in certain circumstances, such as when you contest the accuracy of your data or object to our processing.
• Right to Lodge a Complaint. If you are not satisfied with our response, you have the right to lodge a complaint with your local supervisory authority.

Information for US Residents (State Privacy Laws)

This section provides additional information for residents of US states with comprehensive privacy laws, including California, Virginia, Colorado, Connecticut, Utah, and other states that have enacted similar legislation. We process personal information in accordance with applicable state privacy laws, including the California Consumer Privacy Act (CCPA).

Your Rights Under US State Privacy Laws. Depending on your state of residence, you may have the following rights under applicable state privacy laws:

• Right to Know. You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected your personal information, the business or commercial purposes for collecting, selling, or sharing your personal information, and the categories of third parties to whom we disclose your personal information.
• Right to Delete. You have the right to request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct. You have the right to request correction of inaccurate personal information we maintain about you.
• Right to Opt-Out of Sale or Sharing. You have the right to opt out of the “sale” or “sharing” of your personal information (as those terms are defined under applicable law). We do not sell your personal information. You may opt out of the “sharing” of your personal information by emailing us at privacyoffice@@xwell.com or through the “Do Not Sell or Share My Personal Information” link at the bottom of our Website.
• Right to Limit Use of Sensitive Personal Information. You have the right to limit the use and disclosure of your sensitive personal information to uses necessary to perform the services or provide the goods reasonably expected by an average consumer.
• Right to Non-Discrimination. We will not discriminate against you for exercising any of your privacy rights, including by denying you goods or services, charging you different prices, or providing a different level or quality of goods or services.
• Retention of Personal Information. We retain each category of personal information, including sensitive personal information, for as long as necessary to fulfill the purposes for which it was collected. For more information about specific retention periods, please contact us using the contact information below.

US State Privacy Law Information Sharing Disclosure

Applicable US state privacy laws, including California Civil Code Sections 1798.115(c), 1798.130(a)(5)(c), 1798.130(c), and 1798.140 and similar laws in other states (such as Virginia, Colorado, Connecticut, and Utah), may require organizations to disclose whether the following categories of personal information are collected, transferred for “valuable consideration,” or transferred for an organization’s “business purpose” (as those terms are defined under applicable law). The table below indicates the categories of personal information we collect and transfer in a variety of contexts. Please note that because this list is comprehensive, it may refer to types of information that we collect and share about people other than yourself. For example, while we transfer credit card or debit card numbers for our business purpose in order to process payments for orders placed with us, we do not collect or transfer credit card or debit card numbers of individuals that submit questions through our website’s “contact us” page.