Whole Sovereign LLC (the "Company") respects the privacy of its online visitors and customers of its products and services (including, but not limited to, Wholenesslab.com) and complies with applicable laws for the protection of your privacy, including, without limitation, the European Union General Data Protection Regulation ("GDPR"), the UK GDPR, and applicable United States state privacy laws including the California Consumer Privacy Act as amended by the California Privacy Rights Act ("CCPA/CPRA"). Where your personal data is transferred outside your jurisdiction, we rely on appropriate safeguards (such as Standard Contractual Clauses) where required.

1. Definitions

Wherever we talk about Personal Data below ("Personal Data"), we mean any information that can either itself identify you as an individual ("Personally Identifying Information") or that can be connected to you indirectly by linking it to Personally Identifying Information, for example: (i) your account registration information on our website and in our App; (ii) when you request any support from us or report any problem to us; (iii) information provided from using certain services or features; (iv) information from completion of a survey or questionnaire; (v) technical information, including the Internet protocol (IP) address used; (vi) your log-in information, browser, time zone setting, browser plug-in types and versions, operating system and platform; (vii) details of any transactions, purchases and payments you made; (viii) your general interaction with the website, including the full Uniform Resource Locators (URLs), clickstream to, through and from our site, products you viewed or searched for, page response times, download errors, length of visits to certain pages, page interaction information; (ix) information received from third parties, such as business partners, sub-contractors, payment and delivery services, and referrals by other users.

The Company also processes anonymous data, aggregated or not, to analyze and produce statistics related to the habits, usage patterns, and demographics of customers as a group or as individuals. Such anonymous data does not allow the identification of the customers to which it relates. The Company may share anonymous data, aggregated or not, with third parties.

Please be aware that the Company may choose to permit third parties to offer subscription and/or registration-based services through the Company's site. The Company shall not be responsible for any actions or policies of such third parties, and you should check the applicable privacy policy of such party when providing personally identifiable information. By using the Company's website, you signify your assent to this privacy policy. If you do not agree to this policy, please do not use the Company's website(s).

2. Why the Company Collects and Processes Data

The Company collects and processes Personal Data for the following reasons: (a) performing our agreement with you to provide content and services, including providing, improving and developing our services; (b) researching, designing and launching new features or products; (c) providing you with alerts, updates, materials or information that you requested or signed up to; (d) collecting overdue amounts; (e) responding to or taking part in legal proceedings, including seeking professional advice, or for the legitimate and legal interests of the Company or a third party; (f) compliance with legal obligations to which we are subject; (g) communicating with you and responding to your questions or requests; (h) direct marketing — we require your consent specifically for this purpose and you may opt out at any time; (i) purposes directly related or incidental to the above; or (j) where you have given consent to it.

These reasons for collecting and processing Personal Data determine and limit what Personal Data we collect and how we use it (section 3), how long we store it (section 4), who has access to it (section 5), and the rights and control mechanisms available to you (sections 6 and 7).

3. What Data We Collect and Process

3.1 Basic Account Data. When setting up an account, the Company collects your email address and country of residence. You also choose a user name and password. This information is necessary to register a User Account. You are responsible for keeping your password confidential. During setup, your account is automatically assigned a number (the "ID") used to reference your account without directly exposing Personally Identifying Information.

3.2 Transaction and Payment Data. To make a transaction online, you may need to provide payment data. If you pay by card, you provide typical card information (name, address, card number, expiration date and security code), which the Company transmits to your chosen payment service provider to enable the transaction and perform anti-fraud checks. The Company will likewise receive data from your payment service provider for the same reasons.

3.3 Other Data You Explicitly Submit. We collect and process Personal Data whenever you explicitly provide it or send it as part of communication with others, e.g. in forums, chats, feedback, or other user-generated content. This includes: (a) information you post, comment on, or follow in our Content and Services; (b) information sent through chat; (c) information you provide when you request information or support or purchase Content and Services, including information necessary to process your orders; (d) information you provide when participating in competitions or surveys, e.g. your contact details.

3.4 Your Use of the Websites. We collect information through your general interaction with our websites, Content and Services, which may include browser and device information, data collected through automated electronic interactions, and application usage data. We also track activity to verify that you are not a bot and to optimize our services.

3.5 Your Use of Services and Other Subscriptions. To provide services, we collect, store and use information about your activity in our Content and Services. "Content-Related Information" includes your ID and information about your preferences, progress, time spent, and the device you are using (operating system, device settings, unique device identifiers, and crash data).

3.6 Tracking Data and Cookies. We use cookies and similar technologies (e.g. web beacons, pixels, ad tags and device identifiers) to recognize you and your device(s), improve our services, and support marketing and analytics. Most browsers accept cookies automatically, but the decision is yours — you may adjust your browser settings to refuse or be notified of cookies, though some functionality may then be unavailable. See our [Cookie Policy](https://www.wholenesslab.com/cookie-policy) for details. When you visit our services, our servers log your IP address.

3.7 Third-Party Services. This website uses third-party services including Google Analytics, Meetn, Hiro, Make, Stripe, Paperform, Systeme.io, and Heartbeat ("Third-Party Services"). These services use cookies and similar technologies to help analyze how visitors use the site; the information is generally transmitted to and stored by the Third-Party Service on servers in the United States. The Company does not control the use of cookies or resulting information by a Third-Party Service. We encourage you to review each provider's own privacy policy.

3.8 Content Recommendations and Marketing. We may process information collected under this section so that content, products and services are tailored to your needs. Subject to your consent or where permitted under applicable email-marketing law, the Company may send you marketing messages and may measure whether you opened them and which links you followed. You can opt out or withdraw consent at any time by using the unsubscribe link in any marketing email or by withdrawing consent where you provided it. Regardless of any marketing opt-out, we may still contact you about account status, changes to the user agreement, and other matters relevant to the service.

3.9 Information Required to Detect Violations. We collect certain data required to detect, investigate and prevent fraud and other violations of applicable law, used only for those purposes and stored only for the minimum time needed, except where a violation requires longer retention for the establishment, exercise or defense of legal claims.

4. How We Store Data

4.1 Period of Storage. We store your information as long as necessary to fulfill the purposes for which it was collected, or for any longer storage and retention period required by law. If you terminate your User Account, your Personal Data is marked for deletion except where legal requirements or other prevailing legitimate purposes require longer storage.

4.2 Deletion of Data. Where Personal Data cannot be completely deleted to ensure system consistency or the user experience, it will be permanently anonymized. The Company is required to retain certain transactional data under commercial and tax law for up to ten (10) years. If you withdraw consent on which processing was based, we will delete the affected Personal Data without undue delay. If you object to processing, we will review and delete the data processed for the purpose you objected to, unless another legal basis or law requires retention.

4.3 Location of Storage and International Transfers. Data we collect may be transferred to and stored in the United States or another destination outside your jurisdiction, and may be processed by third parties operating outside your jurisdiction. Where we transfer Personal Data internationally, we put appropriate safeguards in place where required by law (such as Standard Contractual Clauses or reliance on an adequacy decision). We take all steps reasonably necessary to ensure your data is treated securely in accordance with this policy.

5. Who Has Access to Data

5.1 The Company and its affiliates may share your Personal Data with each other to the degree necessary to achieve the purposes in section 2, on a need-to-know basis. In a reorganization, sale or merger we may transfer Personal Data to the relevant or proposed transferee.

5.2 We may share your Personal Data with third-party providers that provide customer-support services, used only as necessary to perform those services and in accordance with this policy.

5.3 We may share your information with our personnel, agents, advisers, contractors, financial institutions, and service providers in connection with our operations (for example, order fulfillment, payment processing, and support); persons under a duty of confidentiality to us; or persons to whom we are required to disclose under applicable law.

5.4 In accordance with internet standards, we may share certain information (including your IP address and the identification of content you wish to access) with content-delivery-network and server providers to deliver the digital content you requested.

5.5 The Company may allow you to link your User Account to a third-party account. If you consent, we may combine information you allow us to receive from that third party with your account information to the degree your consent allows. The third party's use of your information is subject to its own privacy policy.

5.6 The Company may release Personal Data to comply with court orders or applicable law.

5.7 Certain data related to your account (at minimum, the public persona name you choose) may be accessible to other users by querying your ID. You can control additional profile information through your profile settings. Anything you share on your public profile may be accessed, including information that could make you identifiable.

5.8 Any community message boards, forums, or chat areas are public. Information you post there is made publicly available and may be collected and used by third parties beyond our control. If your Personal Data is posted against your will, use the reporting function to request removal.

5.9 We do not sell your Personal Data, and we do not share it for cross-context behavioral (targeted or retargeting) advertising.

6. Your Rights (GDPR / UK GDPR)

You have the right to: (a) check whether we hold personal data about you; (b) access any personal data we hold about you; (c) require us to correct any inaccuracy; and (d) request deletion of your personal data. We make tools to exercise these rights available to customers worldwide. As a resident of the European Economic Area or the United Kingdom you have the following rights:

6.1 Right of Access. You may obtain confirmation of whether we hold your Personal Data, access to it, and copies of it, free of charge. If a request is manifestly unfounded or excessive, we may charge a reasonable fee or decline to act.

6.2 Right to Rectification. If your Personal Data is inaccurate or incomplete, you may have it corrected by contacting us at info@wholenesslab.com or through your account settings.

6.3 Right to Erasure. You may obtain deletion of your Personal Data by deleting your User Account. We allow you to restore your account during a grace period of thirty (30) days from your deletion request, to protect against accidental loss or account compromise; during this period we may finalize financial or other activities you initiated. After the grace period, Personal Data associated with your account is deleted subject to section 4. In complex cases, the erasure period may be extended by no more than two further months.

6.4 Right to Object. Where our processing is based on legitimate interests, you have the right to object, and we will stop processing unless there are compelling legitimate grounds or the data is needed to establish, exercise or defend legal claims.

6.5 Right to Lodge a Complaint. You have the right to lodge a complaint with your local data-protection supervisory authority (in the UK, the Information Commissioner's Office; in the EEA, your national authority).

7. California and U.S. State Privacy Rights (CCPA/CPRA)

If you are a California resident (and, to the extent applicable, a resident of another U.S. state with comparable privacy law), you have the following rights regarding the personal information we collect (described in section 3):

- Right to know what personal information we collect, use, disclose, and the categories of sources and recipients.

- Right to delete personal information we hold about you, subject to legal exceptions.

- Right to correct inaccurate personal information.

- Right to opt out of the "sale" or "sharing" of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral (targeted) advertising. If this ever changes, we will update this policy and provide an opt-out method before doing so.

- Right to non-discrimination for exercising your rights.

To exercise these rights, contact us at info@wholenesslab.com. We will verify your request through your account or other reasonable means before responding.

8. Children

The minimum age to create a User Account is 18. The Company does not knowingly collect Personal Data from children under this age. Where a country applies a higher age of consent, the Company requires parental consent before an account is created. We encourage parents to instruct their children never to give out personal information online. If you believe a child has provided us personal data, contact info@wholenesslab.com and we will delete it.

9. Contact

You can contact the Company's Privacy Officer at info@wholenesslab.com (Attention: Privacy Officer). To combat fraud, harassment and identity theft, we verify your identity — through your User Account or other reasonable means — before acting on a request to access, correct, or delete your data.

10. Revision Date

This privacy policy was last updated on June 26, 2026 ("Revision Date"). If you were a user before the Revision Date, it replaces the prior Privacy Policy. The Company may change this policy and will notify users of a new privacy statement. This policy does not create any contractual or legal rights on behalf of any party.