1. Definitions

Account — a unique account created to access our Service.

Company / We / Us / Our — Fire & Oak Dispensary, 5 Washington St, Mt Holly, NJ 08060. NJ Cannabis License # RE000776.

Consumer — a New Jersey resident as defined under the NJDPA.

Controller — the entity that determines the purposes and means of processing personal data. Fire & Oak acts as Controller for data collected through our main website, in-store operations, and loyalty program.

Cookies — small files placed on your device by a website.

Personal Data — any information that relates to an identified or identifiable individual.

Sensitive Data — Personal Data revealing racial or ethnic origin, health or medical conditions, sexual orientation, citizenship or immigration status, biometric or genetic data, precise geolocation, financial account access credentials, or data of a known minor.

Service — the Fire & Oak website at faomtholly.com, in-store operations, social media channels, and loyalty program.

Service Provider — any third party that processes data on behalf of Fire & Oak, including Sweed, Aeropay, point-of-sale systems, loyalty program providers, email/SMS marketing platforms, age-verification tools, analytics providers, and delivery coordination tools.

Sale of Personal Data — any sharing of Personal Data for monetary payment or other valuable consideration. Fire & Oak does not directly sell Personal Data. The Sweed platform may share certain activity data under its own terms (see Section 4).

Targeted Advertising — displaying advertisements based on Personal Data from cross-site activity.

Usage Data — data collected automatically from your use of the Service.

2. Sources of Data We Collect

We collect Personal Data from the following sources:

• Directly from you: information you provide when creating an account, placing an order, enrolling in our loyalty program, contacting customer support, or interacting with our website or in-store.
• Automatically from your device: Usage Data collected when you visit our website, including IP address, browser type, pages visited, and device identifiers.
• From service providers: data received from loyalty platform providers, point-of-sale systems, age-verification vendors, and payment processors in connection with transactions.
• From social media platforms: publicly available interaction data when you engage with our content on Instagram, Facebook, Twitter/X, Google, or LinkedIn.
• From the Sweed e-commerce platform: order and transaction data generated when you place online orders through our shop.

3. Data We Collect

Personal Data

Through our main website, in-store operations, and loyalty program, we may collect:

• Full name and date of birth (age verification — required by NJ-CRC)
• Email address, phone number, mailing address
• Government-issued ID attributes (age-gating only)
• Purchase history and order information
• Loyalty program activity and tier status
• Usage Data

Cannabis Purchase Data

Cannabis-related information may include order details, purchase history, product type and preferences, loyalty activity, pickup or delivery details, and transaction records. We use this information exclusively for lawful retail operations, regulatory compliance, order fulfillment, loyalty administration, customer service, and consented marketing. Cannabis purchase history may reveal consumption patterns or health-related preferences and is treated with heightened care.

Sensitive Data (Opt-In Consent Required)

We may process the following Sensitive Data only with your explicit opt-in consent:

• Precise geolocation — for store locator, curbside pickup, or delivery services
• Government-issued ID attributes — for age verification; not copied or retained per NJ-CRC

ACH payments are processed by Aeropay. Fire & Oak does not store, view, or retain full bank account credentials. Financial account data is processed exclusively by Aeropay.

Cookies & Tracking Technologies

We use the following categories of cookies and tracking technologies:

• Strictly Necessary: required for the website to function; cannot be disabled (e.g., authentication, session management)
• Functional: remember your preferences and personalize your experience
• Analytics: help us understand how visitors use our site (e.g., Google Analytics). You may opt out at tools.google.com/dlpage/gaoptout
• Advertising / Retargeting: used to display relevant ads based on your browsing activity across sites. You may opt out via our cookie preference center or by enabling Global Privacy Control (GPC) in your browser

Note: GPC is the universal opt-out standard honored by Fire & Oak. Legacy "Do Not Track" (DNT) signals are not separately processed.

Usage Data

Automatically collected: IP address, browser type, pages visited, visit duration, and unique device identifiers. We use Google Analytics to analyze website usage.

Social Media Data

Our social media channels are managed by a third-party marketing agency. Social media platforms act as independent data controllers and may collect your information under their own policies. Fire & Oak does not control how those platforms process your data.

4. How We Use Your Data

We use your data for the following purposes:

• Service delivery and maintenance
• Age and legal compliance verification as required by NJ-CRC
• Account management and registered-user access
• Order fulfillment and delivery coordination
• Customer communications (email, SMS, push notifications)
• Loyalty program administration and opted-in promotional offers
• Analytics and service improvement
• Business transfers in the event of a merger or acquisition

Fire & Oak does not directly sell your Personal Data. If any data sharing constitutes a "sale" or "targeted advertising" under applicable law, you may opt out through our cookie preference center, GPC, or by contacting us.

Automated Decision-Making

Fire & Oak does not use automated decision-making or profiling that produces legal or similarly significant effects on consumers. Our loyalty tier system is based on straightforward point accumulation rules and does not constitute automated decision-making under the NJDPA.

5. Sharing Your Data

We share your information with the following categories of third parties:

Payment Processors
Aeropay (Aero Payments, Inc.) — ACH bank transfer processing for online orders.

E-Commerce & Order Management Platforms
Sweed — online ordering platform. Sweed processes data collected through the shop under its own Privacy Policy, which permits sharing certain activity data with third parties. Review Sweed's policy at faomtholly.com/shop/policies/privacy-policy.

Age-Verification Vendors
Third-party providers that verify government-issued ID. Prohibited from reusing verification data for unrelated purposes.

Delivery Logistics Providers
Platforms used to manage cannabis delivery logistics and coordinate order fulfillment.

Marketing & Analytics Providers
Email and SMS marketing platforms (opted-in communications only); Google Analytics and similar analytics tools; social media advertising platforms including Meta, Google, LinkedIn, and X/Twitter. For email: unsubscribe via the link in any email. For SMS: reply STOP. Transactional messages related to orders, delivery, or compliance may still be sent.

Loyalty Program Vendors
Platforms that administer Fire & Oak's loyalty tiers, point tracking, and member communications.

Point-of-Sale Systems
In-store transaction management, inventory, and compliance reporting platforms.

Other Disclosures
We may also share data for: Business Transfers (merger/acquisition with prior notice); Legal Compliance (law or valid government request); With Your Consent (any other purpose you expressly authorize).

6. Your Rights Under the NJDPA

Fire & Oak's privacy practices are aligned with the New Jersey Data Privacy Act (NJDPA), effective January 15, 2025, where applicable. We honor the following consumer rights for all New Jersey residents.

Right to Access
Confirm whether we process your Personal Data and request a copy of what we hold.

Right to Correct
Request correction of inaccurate Personal Data.

Right to Delete
Request deletion of your Personal Data, subject to legal exceptions. NJ-CRC requires retention of cannabis transaction and compliance records for a minimum of 7 years.

Right to Data Portability
Receive a copy of your data in a portable, machine-readable format where technically feasible.

Right to Opt Out of Targeted Advertising
Opt out of your data being used for Targeted Advertising. We will process your request within 15 days as required by the NJDPA.

Right to Opt Out of Profiling
Opt out of profiling used to make decisions with legal or similarly significant effects. As stated above, Fire & Oak does not use such profiling.

Right to Opt Out of Sale of Personal Data
Fire & Oak does not directly sell Personal Data. For data collected through the Sweed platform, exercise your rights directly with Sweed at their published privacy policy.

Global Privacy Control (GPC)
As of July 15, 2025, Fire & Oak honors GPC signals as an automatic opt-out from Targeted Advertising — no separate action required.

Verification Requirements for Rights Requests
To protect your privacy, we verify your identity before processing any rights request. We do this by matching information you provide with information already in our records. We may request additional identifying information solely for verification purposes and will not use it for any other purpose.

How to Submit a Rights Request
Contact us at info@faomtholly.com or (609) 901-0698. We respond to verified requests within 45 days, with a possible 45-day extension with advance notice.

Right to Appeal
If we deny your privacy request, you have the right to appeal our decision. Submit your appeal to info@faomtholly.com with the subject line "Privacy Request Appeal." We will respond within 45 days with a written explanation of our decision. If your appeal is denied, you may contact the New Jersey Division of Consumer Affairs to submit a complaint.

Non-Discrimination
Exercising your NJDPA rights will never result in denial of service, different pricing, or reduced service quality.

7. Loyalty Program & Financial Incentives

Fire & Oak operates a tiered loyalty program that rewards customers based on purchase activity. Participation is voluntary. The following disclosures apply:

• Data collected: purchase history, transaction amounts, product preferences, tier status, and account activity
• How value is calculated: points are awarded per dollar spent at rates determined by your tier (1x to 1.5x). Points may be redeemed for purchase discounts as described in our Terms of Service
• How to withdraw: you may opt out of the loyalty program at any time by contacting info@faomtholly.com. Accrued points will be forfeited upon opt-out

Fire & Oak does not condition the provision of cannabis products or services on participation in the loyalty program. Loyalty data is used solely for program administration and opted-in marketing communications.

8. Data Retention & Minimization

• Transaction, compliance, tax, and regulatory records: minimum 7 years per NJ-CRC requirements
• Loyalty and marketing data: while your account is active or until you opt out. Points and tier status reset after 48 months of inactivity.
• Age verification data: not retained beyond the transaction per NJ-CRC
• Usage Data: shorter retention period unless required for security or compliance

9. Data Transfers

Your information may be processed outside your jurisdiction by third-party Service Providers. All transfers are subject to adequate security safeguards consistent with this Policy.

10. Security

We implement commercially reasonable technical and organizational safeguards. No Internet transmission is 100% secure. We will promptly notify affected users and relevant authorities in the event of a confirmed data security incident.

11. Minors & Age-Gating

Our Service is strictly limited to individuals 21 years of age or older under the CREAMM Act. We do not knowingly collect Personal Data from anyone under 21. Data of known minors is Sensitive Data under the NJDPA. Contact info@faomtholly.com immediately if you believe a minor has submitted data.

12. Third-Party Links & Platforms

Our Site may link to external websites. We are not responsible for their privacy practices. The Sweed e-commerce platform operates under its own separate privacy policy.

13. Social Media Management

Our social media channels are managed by a third-party marketing agency as our Service Provider, contractually bound to process data only per our instructions. Social media platforms act as independent data controllers under their own privacy policies.

14. Changes to This Policy

Material changes will be communicated via email or a prominent notice on our website prior to taking effect. Continued use constitutes acknowledgment of the revised Policy.

15. Contact Us

For questions, rights requests, appeals, or data inquiries: