Privacy Policy

Zips Management LLC, doing business as Zips Cannabis ("Zips," "we," "us," or "our") operates licensed cannabis dispensary locations in Ohio and the Zips Cannabis mobile application ("App"). We are committed to protecting the privacy of our customers and being transparent about how we collect, use, and protect your information.

This Privacy Policy applies to information collected through the App and in connection with your purchases at our Ohio dispensary locations. It is intended to comply with applicable Ohio law, including ORC Chapter 1345 (Consumer Sales Practices Act), ORC 1349.19 (data breach notification), ORC Chapter 1354 (Ohio Data Protection Act), and applicable DCC regulations under OAC 3796:6-3-17.

This App is intended for adults 21 years of age and older who are physically located within the State of Ohio. We do not knowingly collect personal information from persons under 21 years of age.

2.1 Information You Provide Directly

When you create an account, place an order, or interact with the App, we may collect:

• Identity information: Full name and date of birth
• Contact information: Email address, phone number
• Account credentials: Username and password
• Order information: Products ordered, quantities, prices, order history
• Medical patient information: Ohio patient registry identification card number (stored locally on your device only — this information is not transmitted to or stored on Zips Cannabis servers)

2.2 Information Collected Automatically

When you use the App, we may automatically collect:

• Device information: Device type, operating system, unique device identifiers, mobile network information
• Usage data: Pages viewed, features used, session duration, click patterns, search queries within the App
• Location information: Location access is required to use this App. We verify that you are physically located within the State of Ohio as a condition of access, consistent with Ohio cannabis regulatory requirements. We also use location data to identify your nearest Zips Cannabis dispensary location.
• Log data: IP address, access times, App version, crash reports

2.3 Information from Third Parties

We may receive information from:

• Point-of-sale systems: Transaction data from in-store purchases linked to your account
• State tracking systems: We are required by Ohio law (ORC 3796.07) to report transaction data to the state's cannabis tracking system (METRC). Data reported to METRC is governed by state law and DCC regulations, not this Privacy Policy.

We use the information we collect for the following purposes:

3.1 Order Fulfillment and Operations

• Processing and fulfilling your advance pickup orders
• Verifying your identity and age at the time of order fulfillment (as required by OAC 1301:18-8-02)
• Managing your account and preferences

3.2 Regulatory Compliance

• Maintaining records as required by OAC 3796:6-3-17 (minimum three-year retention)
• Reporting transaction data to state cannabis tracking systems as required by Ohio law
• Enforcing daily purchase limits required under ORC 3796.221
• Verifying patient/caregiver registration status for medical purchases
• Making records available to the DCC upon lawful request as required by OAC 3796:6-3-17(B)(2)

3.3 Communications

• Sending order confirmations and updates
• Responding to your customer service inquiries
• Sending promotional communications (only with your opt-in consent, and subject to applicable advertising rules under OAC 1301:18-4-22)

3.4 App Improvement and Security

• Analyzing usage patterns to improve the App experience
• Detecting and preventing fraud, unauthorized access, and other security incidents
• Maintaining the integrity and security of our systems

As a DCC-licensed dispensary, we are subject to regulatory oversight that may require us to disclose your information:

4.1 DCC Access. Under OAC 3796:6-3-17(B)(2), our electronic systems must be accessible by the DCC. Your transaction and account records maintained in our systems may be reviewed by DCC personnel during inspections or investigations.

4.2 METRC Reporting. Ohio law requires all licensed dispensaries to report cannabis transaction data to the state's seed-to-sale tracking system (METRC) under ORC 3796.07. Information reported to METRC is subject to state law and DCC data governance, not this Privacy Policy.

4.3 Law Enforcement. We may disclose information when required by valid legal process, including court orders, subpoenas, or lawful law enforcement requests, or when we believe disclosure is necessary to prevent imminent harm.

We will not disclose your personally identifiable information to third parties for their independent marketing or commercial purposes without your consent.

We take the confidentiality of registered medical marijuana patient information seriously. Ohio patient registry identification card information entered into the App is stored locally on your device only and is not transmitted to or retained on Zips Cannabis servers. This design ensures that sensitive patient credential information remains in your control at all times.

Other patient-related information, such as purchase history associated with a medical patient account, is maintained with heightened confidentiality controls consistent with OAC 3796:6-3-17(B)(1).

Medical patient information will not be disclosed except as required by applicable law, DCC regulation, or valid legal process.

We maintain a written information security program designed to protect your personal information from unauthorized access, use, disclosure, alteration, and destruction. Our security measures include:

• Encryption of data in transit and at rest
• Access controls limiting employee access to personal information on a need-to-know basis
• Audit trails for all access, edits, and deletions to records, as required by OAC 3796:6-3-17(B)(4)
• Regular system backups to ensure reconstruction within three business days in the event of a malfunction, as required by OAC 3796:6-3-17(B)(5)
• Physical and technical safeguards against unauthorized system access
• Employee training on data privacy and security obligations

Our security program is designed to conform to recognized frameworks as contemplated by ORC Chapter 1354 (Ohio Data Protection Act), providing an affirmative defense basis under Ohio law.

We retain your personal information for as long as necessary to fulfill the purposes described in this Privacy Policy and to comply with our legal and regulatory obligations.

Transaction records, including purchase history and identity verification records, are maintained for a minimum of three years as required by OAC 3796:6-3-17(F).

Account information is retained for the duration of your active account and for a reasonable period thereafter to comply with legal obligations and resolve disputes.

We do not sell your personal information. We may share your information in the following limited circumstances:

8.1 Service Providers. We work with third-party service providers who assist us in operating the App and our business (such as payment processors, technology vendors, and analytics providers). These vendors are authorized to use your information only as necessary to provide services to us and are contractually obligated to maintain appropriate confidentiality and security standards. Our third-party vendor relationships are documented as required by OAC 3796:6-3-17(E)(6)(b).

8.2 Regulatory Authorities. As described in Section 4 above, we disclose information to the DCC and state tracking systems as required by Ohio law.

8.3 Legal Requirements. We may disclose information in response to valid legal process or to protect the rights, property, or safety of Zips Cannabis, our customers, or others.

8.4 Business Transfers. In the event of a merger, acquisition, or sale of all or substantially all of our assets, your information may be transferred as part of that transaction, subject to applicable law and DCC licensing requirements.

8.5 With Your Consent. We may share your information for other purposes with your explicit consent.

9.1 Account Information

You may update or correct your account information at any time through the App settings or by contacting us. Note that we are required by law to retain certain records even after account closure.

9.2 Marketing Communications

You may opt out of promotional email or text communications at any time by following the unsubscribe instructions in those communications or by contacting us. Opting out of marketing communications will not affect transactional communications related to your orders.

9.3 Location Data

Location access is required to use this App and cannot be disabled while using the App. We use location data to verify that you are physically located within the State of Ohio, as required for regulatory compliance, and to identify your nearest dispensary location. If you disable location permissions through your device settings, you will be unable to access the App.

9.4 Data Requests

While Ohio has not enacted a comprehensive consumer data privacy law, we are committed to responding to reasonable requests to access, correct, or delete personal information we hold about you, to the extent not prohibited by our regulatory retention obligations. To make a data request, contact us at the information below.

In the event of a data breach involving your personal information, we will provide notification as required by ORC 1349.19. If a breach involves your name in combination with your Social Security number, driver's license number, financial account number, or other sensitive identifiers, we will notify you in the most expedient time possible and without unreasonable delay, consistent with Ohio law and legitimate law enforcement needs.

This App is not directed to persons under 21 years of age and we do not knowingly collect personal information from persons under 21. If you believe we have inadvertently collected information from a minor, please contact us immediately and we will take steps to delete that information.

We may update this Privacy Policy from time to time. We will notify you of material changes by updating the "Last Updated" date and, where appropriate, providing notice through the App. Your continued use of the App after any changes constitutes your acceptance of the updated Privacy Policy.

For privacy-related questions, data requests, or to report a concern, contact us at:

Zips Management LLC

d/b/a Zips Cannabis

Privacy / Compliance

Admin@zipscannabis.com

206-799-4343

Dispensary Locations

• 1801 Central Parkway, Cincinnati, OH 45214
• 6415 Glenway Avenue, Cincinnati, OH 45248
• 4066 Morse Road, Columbus, OH 43230

Ohio Division of Cannabis Control

com.ohio.gov/cannabis-control

Ohio Department of Commerce

77 South High Street, 23rd Floor

Columbus, OH 43215