Polycor Inc.

Global Consumer Privacy Notice

Polycor Inc. and each of its subsidiaries, including without limitation Swenson Granite Company LLC, Rock of Ages Corporation, Rock of Ages Canada Inc., Indiana Limestone Acquisition LLC, Georgia Stone Quarries, Inc., The North Carolina Granite Corporation, Polycor France SAS and Rocamat SAS (“Polycor” or “we“) values its customers and respects your privacy. We want you to be familiar with how we collect, use, disclose or otherwise process your personal information and we encourage you to read this Global Consumer Privacy Notice (“Notice”), which consists of the Privacy Notice and the Digital Privacy Notice, before using our website or other online properties or providing your personal information to us. By using our website or other online properties or providing personal information to us, you acknowledge that we may collect, use, disclose or otherwise process your personal information in accordance with this Notice.

UPDATES TO THIS PRIVACY NOTICE

Polycor may change this Notice at any time. Please take a look at the “Date Updated” at the top of this page to see when this Notice was last revised and in effect.

PRIVACY NOTICE

1. USEFUL INFORMATION

We have appointed a person in charge of the protection of personal information, also commonly known as a Privacy Officer or Data Protection Officer. This individual ensures that we are clear and fair about how we use your personal information and comply with privacy laws in all jurisdictions in which we operate. You can contact the Privacy and Data Protection Officer at:

Privacy and Data Protection Officer
Polycor Inc.
100-76, rue Saint-Paul, Québec (Québec) G1K 3V9
privacy@polycor.com

You are the consumer, customer, data subject or individual. You may be someone who visits our online properties or engages with us in person, by phone, or in writing. You may also be an owner or employee of a company with which we conduct business.

By personal information (also called personal data), we mean any information that relates to an identifiable individual, like your name, e-mail address, account data or digital identifiers, like your internet protocol (IP) address, or a combination of information. We do not mean business contact information used solely for the purposes of communicating for business purposes or other information not related to a natural person. In certain jurisdictions, privacy rights extend posthumously.

If you are a resident of the European Economic Area (the “EEA”), the data controller of your personal information is the Polycor legal entity with which you conduct business or interact. This means that they decide why, how and where your personal information is processed.

Processing your personal information means anything we do with it – collecting it, using it, storing it, sharing it, and deleting it.

Our online properties are websites and mobile applications that we own and control and which contain a link to this Privacy Notice.

2. THE PERSONAL INFORMATION WE COLLECT

We may collect the following categories of personal information:

• Basic personal information like your name and preferred language.
• Contact information like your postal address (including billing and shipping addresses), telephone number and email address.
• Transaction information related to purchases or other activities or interactions you may have with us.
• Payment information like credit and debit card numbers and banking information.
• Our insights like generated information about products or services we think you may be interested in based on our analytics of our interactions with you.
• Your likeness if you visit our facilities where CCTV or other recording is in place. We will make it clear wherever recording devices are present.
• Digital data like your IP address, preferences, operating system and browser type, behavioral and browsing data (see details about how we manage digital data the Digital Privacy Notice below).

We will not intentionally collect sensitive personal information or special category information (in the EEA) about you.

If you submit any personal information relating to anyone other than yourself, you represent that you have obtained any necessary consent from that individual for the use and disclosure of that individual’s personal information as described in this Notice.

3. HOW WE COLLECT YOUR PERSONAL INFORMATION

We use different methods to collect data from and about you including:

• From you, when you interact with us through e-mail, phone, in person or online. We may also collect information you share on social media or other publicly viewable platforms such as message boards, chat, profile pages, blogs and other places where you are able to post information and materials. We urge you to use caution when deciding to disclose your personal information online.
• By using technology that includes functions allowing the individual to be identified, located or profiled.
• From third parties who have lawfully collected your personal information and have your consent to disclose it to us.

4. HOW WE USE PERSONAL INFORMATION

If you live or do business in the EEA, the use of personal data must be justified under one of a number of legal bases. The principal legal bases that justify our use of your personal data are:

• Consent – You have given consent to the processing of your personal information for one or more specific purposes.
• Performance of a Contract – Processing is necessary for the performance of a contract with you.
• Legal Obligation – Processing is necessary for compliance with a legal obligation to which Polycor is subject.
• To Protect a Vital Interest – Processing is necessary in order to protect the vital interests of you or of another person.
• For the Public interest – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
• Legitimate Interests of Polycor or a Third Party – Processing is necessary for the purposes of the legitimate interests of Polycor or by a third party except where these interests are overridden by your interests or fundamental rights and freedoms.

Regardless of where you live or do business, we may use your data for the following purposes:

• To communicate with you in your preferred language for purposes like responding to your inquiries and fulfilling your order and requests. We may send you important information regarding changes to our terms, conditions and policies and other administrative information.
  EEA Legal Basis: Contract performance, legitimate interests
• To process your order and otherwise conduct our business, for example by confirming your order, billing and shipping information, processing your payments, and delivering your products. We may use your information to provide you with a

personalized online experience and tailored communications. We may keep records of our business or other interactions.
EEA Legal basis: Contract performance, legitimate interests

• To collect payments owed, we may need to process credit card, e-transfer, cheque or other types of payment methods. We may also use the information to issue a credit or payment as required. We may need to assess the risk of extending credit to you through a payment plan or otherwise. If you fail to pay us in accordance with our contractual terms, to recover what we are owed.
  EEA Legal basis: Contract performance, legitimate interests
• To promote our products through e-mail, postal mail, telephone and other means about our products, services and promotions.
  EEA Legal basis: Consent

We will provide you with the opportunity to unsubscribe from further marketing communication on any electronic communication sent to you.

• To administer and fulfill our promotions (please note that certain promotions may have additional rules or policies, which could contain different or additional information about how we use and disclose your personal information; we suggest that you read any such rules or policies carefully. In the event of a conflict between such rules or policies and this Notice, such rules or policies will govern).
  EEA Legal basis: Contract performance, legitimate interests
• To improve the customer experience, including by learning more about your preferences to help personalize your experience with us.
  EEA Legal basis: Legitimate interests
• To analyze trends and statistics in connection with our businesses and online properties, including to measure the success of marketing campaigns and to compile statistics about usage and response rates. We may use this information to understand what you and people or businesses like you require so that we can meet your needs as a consumer.
  EEA Legal basis: Legitimate interests

We will provide you with the opportunity to unsubscribe from the use of your personal information for analytical purposes. Anonymized or sufficiently aggregated data is not considered personal information.

• For safety and security required to protect the security or integrity of our businesses and online properties.
  EEA Legal basis: Legitimate interest, legal obligation
• To address claims, issues or concerns about or from our employees or customers. We may need to enforce our terms and conditions, protect our operations, protect our rights, privacy, safety or property, or that of you or others. We may be required to respond to and defend against legal claims, pursue available remedies or to limit the damages that we may sustain.
  EEA Legal basis: Legitimate interest, legal obligation
• To comply with legal or regulatory obligations, as we believe to be necessary or appropriate under applicable law, including laws outside your country of residence to comply with legal process. We may also need to respond to requests from public and government authorities, including public and government authorities outside your country of residence.
  EEA Legal basis: Legal obligation
• To make changes to our business, if at any time, we sell, transfer or assign any or all of our rights to any part of our business, including our interests, rights or obligations regarding your account with us. If we do so, we may share your personal information with prospective purchasers, transferees or assignees.
  EEA Legal basis: Legitimate interests

5. HOW YOUR PERSONAL INFORMATION IS DISCLOSED

Your personal information may be disclosed by Polycor:

• To employees and contractors of Polycor. Access will be limited to those who have a need to access your personal information to perform their role.
• To our third-party service providers, who provide services such as website hosting, data storage, data analysis, payment processing, order fulfillment and delivery, IT services and infrastructure, customer service, e-mail delivery and administration, credit card or other payments processing, auditing and other similar services to enable them to provide the services necessary for us to provide products and services to you.
• To our subsidiaries and affiliated entities for marketing and certain other purposes. You may opt-out of the sharing of your personal information for this purpose (see Section 9 – Your Privacy Rights).
• To selected third party promotional partners, to permit them to send to you marketing communications. We seek to select as promotional partners only reputable companies that offer what we believe to be high-quality products and services. Promotional partners may include third-party sponsors of promotions. You may opt- out of the sharing of your personal information for this purpose (see Section 9 – Your Privacy Rights).
• To a prospective third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in connection with any bankruptcy or similar proceeding).
• To governmental or regulatory authorities, as we believe to be necessary or appropriate: under applicable law, including laws outside your country of residence; to comply with legal process; to respond to requests from public and government authorities, including public and government authorities outside your country of residence; to enforce our terms and conditions; to protect our operations or those of any of our affiliates; to protect our rights, privacy, safety or property, or that of you, our affiliates or others; and to allow us to pursue available remedies or limit the damages that we may sustain.

We do not sell your personal information.

6. SAFEGUARDING YOUR PERSONAL INFORMATION

We seek to use reasonable organizational, technical and administrative measures all designed to protect personal information under our control. For example, we seek to use Secure Sockets Layer (“SSL”) technology for the placement of orders. Unfortunately, no data storage system or data transmission over the Internet can be guaranteed to be 100% secure. We may use third- party cloud service providers that provide hosting, data storage and other services pursuant to standard terms and conditions that may be non-negotiable. These service providers have informed us or have publicly confirmed that they apply security measures they consider adequate for the protection of information within their system, or they have a general reputation for applying such measures.

Please exercise caution in submitting personal information via our online properties, especially if you are accessing them through a WIFI hotspot or public network. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account that you might have with us has been compromised, or if you are unable to utilize our SSL technology in connection with our online properties), please immediately notify us of the problem and place any orders with us over the telephone or in person, instead of using our online properties.

7. CROSS-BORDER TRANSFERS OF YOUR PERSONAL INFORMATION

As an international company, we cannot limit our processing of your personal information to the country where you are based. Your personal information may be transferred outside of the country where you are doing business and may be subject to the laws governing privacy in those countries. Polycor will only transfer your personal information outside of the jurisdiction where you are based if we are confident that the same data protection safeguards that we deploy will be put in place, for example we may take contractual or other measures to ensure that your personal information is protected in accordance with applicable privacy laws.

8. RETENTION OF YOUR PERSONAL INFORMATION

Unless a longer retention period is required by law, we will keep your personal information for as long as we need in order to fulfill the purposes outlined in this Notice. When we have no ongoing legitimate business need (or legal basis for processing in the EEA) to process your personal information, we will either delete or anonymize it in accordance with our retention processes wherever possible.

9. YOUR PRIVACY RIGHTS

At Polycor, we respect privacy rights. Individual privacy rights vary based on where you are located, therefore the extension of the rights explained in this section will depend on the nature of the personal information processing activity and the jurisdiction in which the processing takes place. If you contact us to exercise any of these privacy rights, we may ask for identification and check your entitlement.

If you opt out of our sharing your personal information with our affiliates,
promotional partners and other third parties after we have provided your contact
information to them, we may not be able to remove your personal information
from their databases.

• The right to be informed of a decision based solely on automated processing (Quebec) and to not be subject to such a decision (EEA).
• The right to deletion of personal information held about you, in certain circumstances. Where you have access, you can delete your personal information from the relevant systems so that we can no longer use it (although it may remain in back-ups and linked systems until it is deleted in accordance with our retention procedures).
• The right to request the transfer of certain pieces of your personal information to another organization in a common electronic format. Also known as the right to portability.
• The right to make a complaint to a regulatory authority or challenge Polycor’s compliance with privacy laws (see Section 11 – Challenging Compliance and Exercising Your Privacy Rights).
• The right to restrict processing of your personal information in scenarios where you require us to retain the data but not use it, and the right to object to processing of personal information, in certain circumstances, such as where we have used legitimate interest as a legal basis for processing (EEA only).

We do our best to respond within a month, however it may take us longer if your request is complex. We may ask you for clarification about your request to speed up our response and to make sure that we meet your needs. If we suspect our response to take more than a month, we will let you know. We do not discriminate against individuals who exercise their privacy rights. In some instances, we may be permitted to refuse compliance with your request. For example, where the data relates to another individual, where an access exception applies, like legal privilege, where we cannot delete your personal information for legal reasons or other permitted exceptions. If we refuse your request, we will inform you of the reason, and you can challenge our refusal.

10. THE PERSONAL INFORMATION OF MINORS

Polycor does not intentionally collect or process the personal information of minors. We request that individuals under the age required for consent to process personal information in their jurisdiction (Quebec 14 years; the rest of Canada and the USA 13 years; EEA 16 years; and France 15 years of age respectively) do not provide personal information to Polycor, including through our online properties.

11. CHALLENGING COMPLIANCE AND EXERCISING YOUR PRIVACY RIGHTS

You can make a request to exercise your privacy rights, ask any questions about this Notice or challenge our compliance with applicable privacy laws by contacting the person in charge of the protection of personal information at:

Privacy and Data Protection Officer
Polycor Inc.
100-76, rue Saint-Paul, Québec (Québec) G1K 3V9
privacy@polycor.com

DIGITAL PRIVACY NOTICE

This section of the Notice describes our practices in connection with digital information that we collect through our websites and mobile software applications (collectively our online properties) operated by or on behalf of Polycor.

INFORMATION WE COLLECT

When you visit us online at any of our online properties, we may collect your digital information, which is any information that does not directly identify you as a specific individual, such as:

• Browser information;
• Server log files;
• Information collected through cookies, pixel tags and other technologies; and
• The physical location of your device.

HOW WE COLLECT DIGITAL INFORMATION

We and our third-party service providers may collect digital information in a variety of ways, including:

• Through your browser: Certain information is collected through most devices, such as your Media Access Control (“MAC”) address, device manufacturer and model, device identifier, screen resolution, and the type and version of your operating system and browser.
• Through server log files: An internet protocol (“IP”) address is a number that is automatically assigned to a device by an internet service provider (“ISP”), and is identified and logged automatically in our server log files whenever a user visits our online properties, along with the time of the visit and the pages that were visited. We and our service providers use IP addresses for purposes such as calculating usage levels, helping diagnose server problems and administering our online properties.
• Using cookies: Cookies allow a web server to transfer data to a device for recordkeeping and other purposes. We and our service providers use cookies and other technologies to, among other things, enhance and personalize your online browsing and shopping experience and facilitate your ongoing access to and use of our online properties, as well as for online tracking purposes. If you do not want information collected through the use of cookies, there is a simple procedure in most browsers that allows you to decline the use of cookies. If you choose to decline cookies, some or all of the features, functionality and promotions available through our online properties, such as the shopping cart, ability to view certain pages, andeven placing orders or reviewing your order history may not be available to you.
• Third-party analytics. We may use third-party services, such as Google Analytics or IBM Coremetrics, in connection with our online properties. Such services use cookies and similar technologies to analyze how visitors use our online properties, to compile statistical reports on activity related to our online properties, and to provide other services related to our online properties. Such services may also collect information about visitors’ use of other websites or other online resources. For more information about Google Analytics, including how to opt out, please go to: https://tools.google.com/dlpage/gaoptout . For more information about IBM Coremetrics, you may review its privacy policy located at: http://www.ibm.com/privacy/us/en/.
• Using pixel tags and other similar technologies: Pixel tags (also known as web beacons and clear GIFs) are small images that may be used by us and our service providers in connection with some pages of our online properties and HTML-formatted email messages to, among other things, render such pages to you on various hardware devices and operating system versions, track the actions of users and email recipients, measure the success of marketing campaigns and compile statistics about usage and response rates. Pixel tags may collect information such as the pages, features and links accessed by a user, and the IP address, browser type and operating system of such user’s device.
• Physical location: We and our service providers may collect the physical location of your device by, for example, using satellite, cell phone tower or wifi signals. We may use your device’s physical location to provide you with personalized location-based services and content, including for marketing purposes, based on the choices that have been made with respect to such uses. We may also share your device’s physical location, combined with information about what advertisements you viewed and other information we collect, with our third-party marketing partners, such as our promotional partners, to enable them to provide you with more personalized content and to study the effectiveness of advertising campaigns, based on the choices that have been made with respect to such disclosures. In some instances, you may be permitted to allow or deny such uses and/or sharing of your device’s location, but if you choose to deny such uses and/or sharing, we, our service providers, and/or our third-party marketing partners may not be able to provide you with the applicable personalized services and content.

THIRD PARTIES AND THIRD-PARTY SITES

To the extent that you submit any personal information to any third party (for example, via a third-
party software application or service including any social media service that is included in, available through or linked to from our online properties), such third party’s collection, use and disclosure of such information may be governed by its own privacy practices, and not by this Notice.

We are not responsible for the information collection, usage, disclosure or other privacy practices of any third parties, including our affiliates, third-party service providers, any third-party social media platform (such as Facebook inc.), any third party making available the devices or operating systems for which certain online properties are available (such as Apple Inc. or Google Inc.) and any third party operating any site to which our online properties contain a link. The inclusion of a link on our online properties does not imply endorsement of the linked site by us or by our affiliates.

THIRD PARTY ADVERTISERS

We may use third-party advertising companies to serve ads when you visit our online properties. Please note that these companies may use information about your visit to our online properties to provide advertisements about goods and services that may be of interest to you. In the course of serving advertisements to our online properties, these companies may place or recognize a unique cookie on your browser.

DO NOT TRACK SIGNALS

Our online properties will continue to operate as described in this Notice whether or not a “Do Not Track” signal or similar mechanism is received from your browser.