COTTON INCORPORATED PRIVACY POLICY

This Privacy Policy was last updated on December 8, 2020.

INTRODUCTION

Cotton Incorporated ("Cotton" or "we" or "us" or "our") is a not-for-profit company headquartered in North Carolina, U.S.A., providing resources and research to help companies develop and market superior, innovative, and profitable cotton products.

We endeavor to protect the privacy of your Personal Data. This Privacy Policy applies to the website from which it is linked and any other website owned and operated by Cotton (collectively, the "Websites" and each, a "Website"). It also applies to other Personal Data provided to us. In this Privacy Policy, we describe how we collect, store, use, disclose and transfer the Personal Data you provide to us, including without limitation through any of the Websites.

"Personal Data" is any information that can be used to uniquely identify you, either directly or indirectly, or that is otherwise defined as personal information or personal data under applicable laws. This includes information such as a name, an identification number, location data, and an online identifier. We strongly encourage you to read this Privacy Policy as well as our Terms and Conditions before you use our Websites. By accessing any of our Websites, you signify that you accept and agree to the terms of this Privacy Policy, and the practices described in it. If you do not agree with any term of this Privacy Policy, please do not use our Websites or submit any Personal Data to us. Before you affirmatively submit certain Personal Data to us, we may request your explicit consent to our collection and use of such Personal Data.

THE PERSONAL DATA WE COLLECT AND HOW WE USE IT

Personal Data We May Collect From You
When you visit and use the Websites, or contact us through e-mail and other communication methods, you may provide us with Personal Data. Depending on the information and/or services you request, you may be asked to provide your name, email address, mailing address and other identifying information, all of which constitutes Personal Data. We do not ask you to provide any Personal Data to simply browse our Websites.

Your submission of demographic information, such as race, age, gender, income level, or marital status, is generally optional and rarely required. When non-personally identifiable information, such as demographic information, is tied to you personally (i.e., with other personally identifiable information), it will be treated as Personal Data. In some instances, if you choose not to provide requested information, for example, in connection with your use of the Cottonseed Marketplace feature on wholecottonseed.com, or in order to register with one of our Websites or to participate in sweepstakes, contests and surveys, you may not be able to access all of the areas on the Websites or participate in all of their features.

Personal Data We May Collect From Other Sources
With your permission and under your direction, we may receive certain information about you from other businesses or organizations that maintain data about you, such as LinkedIn or Google.

Cookies and Other Information We May Collect Automatically When You Use Our Website
"Cookies" are small files placed on your computer's hard drive by a website when you access the website, so that the website remembers your preference when you visit subsequently. Cookies can be temporary, or session cookies, which are deleted as soon as you close your browser, or permanent, which remain on your computer and preserve your preferences for a website, remember your password for future visits and save items in a shopping cart, among other things. Like many other websites, our Websites use cookies. Most web browsers automatically accept cookies but allow you to modify security settings so you can allow or block cookies on a case-by-case basis. If you do not accept our use of cookies on the Websites, you may modify your browser settings to block cookies. If you modify your browser settings so that your computer does not accept cookies from us, then we cannot guarantee that all functions of the Websites will operate as intended.

As with many websites, we also may use other technology (e.g., web bugs, email bugs, clear GIFs, web beacons and tracker GIFs) in our Websites and/or in our communications with you to enhance the functionality of our Websites and to make your activities at our Websites more convenient and efficient. These technologies may be used by us to store and collect information relating to your viewing and use of our Websites and our correspondence with you. We also may collect your IP (Internet Protocol) address and other publicly available information, such as Internet browser information, operating system information, dates and times of a particular users visit and/or click path taken through the site, lookup information, and information that may be publicly available in connection with an IP address, such as general location of the user, business names and contact information, to help diagnose problems with our server, administer our Websites and identify our users. This aggregate information provides statistics that we use to analyze, market and improve our Websites and business.

We may also use third-party web analytics services, including Google Analytics, to help us analyze how our Website visitors use interact with and use our Websites. To understand the information shared with Google, how it is processed, and how you can control the information collected by Google on the Site, visit https://policies.google.com/technologies/partner-sites.

Our Websites are not designed to respond to "do not track" signals received from browsers.

HOW WE USE PERSONAL DATA

We may use Personal Data, for the following purposes:

• respond to your inquiries
• confirm registration information or your desire to opt-in to newsletters, subscription services, or marketing communications from us, and to fulfill your requests to receive these items
• inform users when they have won a sweepstakes or contest, and deliver any prizes or rewards
• keep you informed about the status of any transactions
• protect the security and integrity of our Websites, including to correct technical problems and malfunctions on our Websites
• take precautions against liability
• provide information concerning our products or services, including services, promotions or offers that may be of interest.
• identify your product and service preferences
• improve our promotional offers, customer service and overall user experience
• research, develop, manage and improve our Websites.

How and With Whom We Share Personal Data
We never rent, sell, or otherwise share Personal Data with third parties for any purpose except as set forth in this Privacy Policy, unless you have given us your express permission to do so. We may provide Personal Data to third parties as set forth below:

• to third parties who provide services on our behalf. These parties may use the Personal Data solely in conjunction with the specific services they provide for us (e.g., data processing, fulfillment of an order, managing and enhancing customer data, sending you information about products, services, programs and events that we offer that may be of interest to you based on your preferences, responding to your question or comment, providing a promotional prize, deployment of a consumer survey, and investigation of a complaint,). Our service providers are obligated to protect your Personal Data.
• We may also provide third parties with aggregate statistics about traffic patterns and related Website information. This data reflects Website usage patterns gathered during customer visits to our Websites each month, but it does not contain behavioral, profile, or identifying information about any individual user.
• We reserve the right to disclose any Personal Data as needed if such information is requested by law enforcement agencies or if we are required to do so by law, regulation, subpoena, court order or by a government entity. We also may disclose Personal Data to third parties in response to legal requests, such as court orders, subpoenas, and specific requests from law enforcement agencies, if we have reason to believe that disclosing such information is necessary to conduct investigations of possible breaches of law, to cooperate in any legal investigation, or to identify, contact, or bring legal action against someone who may be violating the Terms and Conditions.

In the event all or a portion of the business or assets of Cotton are sold or transferred, including in connection with a sale, merger, consolidation, change in control, transfer of assets, reorganization or liquidation of our business, user information is usually one of the business assets that is transferred. Prior to any transfer of your Personal Data in these circumstances, we will notify you via email of the transfer. If your Personal Data is transferred, you will be subject to the Privacy Policy and Terms and Conditions of the new organization.

Cottonseed Marketplace
One of our Websites, wholecottonseed.com, offers the option for a user to submit a request through one of our product price quote or service inquiry services on the Cottonseed Marketplace, and we forward the user’s contact information to one or more seed merchants and suppliers, none of which are affiliated with Cotton. We will explicitly request the user’s consent to forward the user’s Personal Data, including contact information, to such seed merchants and suppliers. We do not collect or store the Personal Data users submit through wholecottonseed.com; thus, once the Personal Data are sent to the seed suppliers, their use, storage and handling of a user’s Personal Data are not governed by this Privacy Policy but are governed by the recipient supplier’s own privacy policy. We cannot control, and are not responsible for, the manner in which such merchants use, store or handle your Personal Data. Do not submit a request to us via the Cottonseed Marketplace at wholecottonseed.com if you do not agree to these terms.

WHERE WE PROCESS AND STORE YOUR PERSONAL DATA

Please note that all Personal Data we collect is stored on our servers in the United States. If you are located outside of the United States, any Personal Data we collect, including location data and online identifiers, will be processed and stored in the United States. The data protection and privacy laws and regulations in the United States may be different from those of the country, territory or region where you reside or are a citizen and may offer less protection than the laws and regulations in your country, territory or region. By using our online services, you consent to the transfer and processing of your Personal Data in the United States, and we use this consent as the legal basis for that transfer. As noted above, when we initially ask you to provide us with your Personal Data on our Websites to receive services and/or communications from us, we will request your explicit consent to the transfer and processing of your Personal Data. For more information on transfers of your Personal Data to the United States, please see the "Transfer of Personal Data to the United States" section below.

LEGAL BASIS FOR PROCESSING

Under applicable data protection laws, Cotton is the controller of the Personal Data you provide to us. As a controller, we will process the Personal Data we collect from you in accordance with this Privacy Policy. For more information on how we process the Personal Data of persons located in the European Economic Area ("EEA") at the time of data collection, please refer to the "Your General Data Protection Regulation Rights" section below. We may request your explicit consent before collecting and processing certain of your Personal Data; however, we may collect and process your Personal Data without your express consent for the following purposes:

1. To perform any contractual obligations to you in our Terms and Conditions and any contractual obligations arising under services we are providing to you;
2. To comply with laws, regulations, court orders, or other legal obligations, to defend legal claims, or to assist in an investigation;
3. To protect your vital interests or the vital interest of other persons, when necessary; and
4. For the purposes of our legitimate interests, including providing you with important notices about changes to our Terms and Conditions and this Privacy Policy, responding to your requests, inquiries, complaints, and any other communications you initiate, keeping our services safe and secure, and improving our services to enhance your experience with our services.

We will not perform any automated processing, including profiling, to provide our services to you without first obtaining your explicit consent to do so.

Your General Data Protection Regulation Rights
Under the European Union's General Data Protection Regulation ("GDPR"), persons whose Personal Data is collected while they are located in the EEA have certain rights that they may exercise in relation to the collection and processing of their Personal Data. If you are in this category of persons, you have the following rights:

1. Right of access to your Personal Data (Art. 15 GDPR): You have the right to obtain from us confirmation as to whether or not Personal Data concerning you is being processed, and where that is the case, access to the Personal Data and certain information related to the processing, such as the purposes of the processing, the categories of Personal Data involved, and the recipients of the Personal Data.
2. Right to rectification (Art. 16 GDPR): You have the right to obtain from us without undue delay the rectification of any inaccurate Personal Data. You can update certain Personal Data on the Websites yourself using your login information.
3. Right to erasure ('right to be forgotten') (Art. 17 GDPR): You have the right to request that we erase your Personal Data, and we must erase your Personal Data following your request, when: (a) the Personal Data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) you withdraw the consent you gave to the processing of your Personal Data, including special categories of Personal Data, for one or more specific purposes (pursuant to Art. 6(1)(a) or Art. 9(2)(a)) and there is no other legal basis for the processing; (c) you object to processing necessary for the performance of a task carried out in the public interest or for purposes of carrying out our legitimate interests and there are no overriding legitimate reasons for the processing (pursuant to Art. 21(1)), or you object to the processing carried out for direct marketing purposes (pursuant to Art. 21(2)); or (d) your Personal Data have been unlawfully processed.
4. Right to restriction of processing (Art. 18 GDPR): You have the right to request the restriction of processing where: (a) the accuracy of your Personal Data is contested by you, for a period enabling us to verify the accuracy of your Personal Data; (b) the processing is unlawful and you oppose the erasure of your Personal Data and request the restriction of their use instead; (c) we no longer need your Personal Data for the purposes of the processing but your Personal Data are required by you for the establishment, exercise, or defense of legal claims; or (d) you have objected to processing pursuant to Art. 21(1) pending the verification of whether our legitimate interests override your interests, rights, and freedoms.
5. Right to data portability (Art. 20 GDPR): You have the right to receive your Personal Data, which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller, where technically feasible, without interference from us.
6. Right to object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, at any time to processing of Personal Data concerning you which is based on processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of our legitimate interests or those of a third party (Art. 6(1)(e) and Art. 6(1)(f), respectively), including profiling based on those types of processing, as well as processing of Personal Data for direct marketing purposes and any profiling related to such direct marketing. Upon notice of your objection to processing of Personal Data which is based on Art. 6(1)(e) and Art. 6(1)(f), we will no longer process your Personal Data for such purposes, unless we are able to show compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims. Upon notice of your objection to processing of Personal Data for direct marketing purposes, we will no longer process your Personal Data for such purpose.
7. Automated individual decision-making, including profiling (Art. 22 GDPR): You have the right to not be subject to a decision based solely on automated processing, including profiling, which significantly affects you, unless the decision is necessary for entering into, or performance of, a contract between you and us, or is based on your explicit consent.
8. Right to withdraw consent (Art. 13 and Art. 14 GDPR): If our processing of your Personal Data is based on your consent, you have the right to withdraw this consent at any time.
9. Right to lodge a complaint with the Data Protection Authority (Art. 77 GDPR): You have the right to lodge a complaint with a supervisory authority, in particular in the EEA member country of your habitual residence, place of work, or place of the alleged infringement if you believe the processing of your Personal Data infringes the GDPR. A list of Data Protection Authorities and their contact information can be found here: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm.

If you reside, or are otherwise located, in the EEA at the time we collect your Personal Data, we will only use your Personal Data as described in this Privacy Policy under the "HOW WE COLLECT AND USE PERSONAL DATA" section, and we will only transfer your Personal Data to the United States upon obtaining your explicit consent to do so as detailed in the "WHERE WE PROCESS AND STORE YOUR PERSONAL DATA" and "Transfers of Personal Data to the United States" sections herein.

For more information on the GDPR, you may follow this link: https://gdpr-info.eu/.

HOW WE PROTECT YOUR PERSONAL DATA

Cotton implements appropriate technical and organizational security precautions to maintain the security and accuracy of Personal Data we collect, including limiting the number of people who have physical access to our database servers, as well as employing electronic security systems and password protections that guard against unauthorized access, loss, misuse or alteration. Only authorized Cotton personnel, including service providers, have access to the data. Notwithstanding the above, due to the open nature of the Internet, we cannot fully guarantee that any Personal Data stored on our servers, or transmitted to or from a user, will be free from unauthorized access. By using our Websites and where applicable, explicitly consenting to our collection and use of your Personal Data, you acknowledge that you understand and agree to assume these risks. Please note that email is not encrypted and is not considered to be a secure means of sharing Personal Data with us.

HOW WE HANDLE LINKS

This Privacy Policy does not apply to the practices of entities that we do not own or control or persons that we do not employ or manage. For the convenience of our users, our Websites often contain links to other websites that are not under our control ("Linked Websites"). Cotton is not responsible for the privacy practices or the content of such Linked Websites. You acknowledge that Cotton is not responsible for privacy policies of Linked Websites it does not operate or control. Accessing the links to any other off-site pages or other Linked Websites is at your own risk and subject to the applicable privacy policies and terms and conditions of such Linked Websites. We recommend that you make your own independent judgment regarding your use of, and submission of information to, Linked Websites.

YOUR CHOICES REGARDING USE OF THE INFORMATION WE COLLECT

At any time after you have opted in and provided us with your Personal Data you may opt-out of having your Personal Data used for commercial purposes. If you would prefer to no longer be contacted about our special offers, products or services, or if your Personal Data changes (such as email address, phone number, or mailing address), you may correct, update or delete/deactivate your Personal Data at any time by notifying us via one of the "How to Contact Us" options provided below.

If you choose to write to us, please include your name, address and any contact information that you want removed from our promotional contacts list, including phone numbers and email addresses, and state one of the following:

• "NO MAIL OFFERS" (if you do not want to receive offers by mail);

• "NO PHONE OFFERS" (if you do not want to receive offers by telephone, including cell); or

• "NO PHONE OR MAIL OFFERS" (if you do not want to be contacted by either method).

If you opted in to mobile messaging (e.g., SMS and MMS) offer but later decide you no longer wish to receive the mobile messages, please follow the opt-out instructions included in the mobile message. If you receive any online newsletter or similar promotional email communication from us, and you wish to unsubscribe or change your preferences, you will always have the option to follow the "Update Email Profile", "Manage Preferences or Unsubscribe" or "Unsubscribe" link located in the Email footer or Website footer, or emailing us your changed preferences at any one of our Websites. If you use more than one email address, then send your opt-out email from, or ask to unsubscribe for, each of your email addresses. Because customer lists generally are prepared well in advance of a communication, you may continue to receive some offers after you send us a request not to use your information for specified marketing purposes, but we will work to remove your information from that list as soon as possible. We appreciate your patience and understanding in giving us time to implement your request.

DATA RETENTION

Cotton will retain your Personal Data only for as long as you maintain an account with us or as otherwise necessary to provide services to you. We will also retain your Personal Data as necessary to comply with our legal obligations, to resolve legal disputes, and to enforce our agreements. Once we no longer need to process your Personal Data for the purposes described in this Privacy Policy, we will delete your Personal Data from our servers and systems. We will also delete your Personal Data upon your request to do so, where permissible. To request the deletion of your Personal Data, you may contact us using one of the "How to Contact Us" options listed at the end of this Privacy Policy.

MINORS AND INTERNATIONAL USERS

OUR WEBSITES ARE ONLY INTENDED FOR VIEWING IN THE UNITED STATES IF YOU ARE EIGHTEEN (18) YEARS OR OLDER and not a minor in your state of residence. If you are not an intended user, kindly do not use or view our Websites.

Cotton does not knowingly collect Personal Data from children under 13. If we learn that we have collected the Personal Data of a child under 13, we will take steps to delete the information as soon as possible.

We control and operate the Websites from our offices in the United States of America. Cotton makes no representation that materials on the Websites are appropriate or available for use in other countries, and access to them from countries, territories or regions where the Website content is illegal is prohibited. Those who choose to access our Websites from locations outside the United States do so on their own initiative and are responsible for compliance with applicable local laws and regulations.

Transfer of Personal Data to the United States
The Websites are governed by and operated in accordance with the laws of the United States. By participating in our Website activities, you certify that you meet the age and other eligibility requirements for the Websites as set forth herein and in our Terms and Conditions. If you are located outside of the United States, please be advised that any information you provide to us will be transferred to the United States. As necessary, you hereby consent to the transfer of your Personal Data to the United States as outlined herein. Children under the age of majority in any jurisdiction outside of the United States should not provide Personal Data without their parent's or legal guardian's consent.

NOTIFICATION OF CHANGES

Cotton reserves the right to change this Privacy Policy from time to time. If we believe the changes are material, we will notify you that the Privacy Policy has changed by posting a notice thereof on the homepage of our Websites and in other places we deem appropriate. Your continued use of our Websites following the posting of changes means you accept those changes.

HOW TO CONTACT US

Write to us at the following address:
Cotton Incorporated
Attention: Intellectual Property, Contracts & Legal Department
6399 Weston Parkway
Cary, North Carolina 27513

Email us by filling in the boxes below.