Coral Club respects your privacy. This Privacy Policy outlines our practices for users in Canada and is designed to comply with Canadian private-sector privacy laws. These include the Personal Information Protection and Electronic Documents Act (PIPEDA, S.C. 2000, c. 5) and, where applicable, substantially similar provincial laws such as Alberta's PIPA, British Columbia's PIPA, and Québec’s private-sector law as amended by Law 25. The data controller for this Site and our related services is CCI Worldwide LLC, based in the United States. As the data controller, CCI Worldwide LLC determines the purposes for processing your personal information and is accountable for the information under its control.

By accessing the Coral Club website (“Site”) or using any of its services, you acknowledge and agree to this Privacy Policy. For users in Canada, please note that our commercial electronic messages also comply with Canada’s Anti-Spam Legislation (CASL). In accordance with the fair information principles of PIPEDA, we: -Identify the purposes for data collection at or before the time it is collected. -Limit the collection of personal information to what is necessary for the identified purposes. -Obtain appropriate consent, which may be express or implied as permitted by law. -Safeguard all personal information with appropriate security measures. -Provide individuals with access to their personal information and the ability to request corrections.

Cross-border processing. We collect, store and process personal information primarily in the United States. Your information may be transferred to, stored in, or accessed from the U.S. and be subject to U.S. laws. We use contractual, organizational and technical safeguards to ensure a level of protection comparable to that required by Canadian law. For residents of Québec, prior to communicating personal information outside Québec we perform a transfer impact assessment and inform you that your information may be communicated outside Québec, as required by Law 25.

Effective date: October 20, 2025. We describe how to submit questions and complaints to our Privacy Officer and to the Office of the Privacy Commissioner of Canada in section 14.

This Policy covers the following areas:

• What personally identifiable information is collected by Coral Club through the Site;
• How Coral Club uses this information;
• With whom Coral Club may share this information;
• What types of security procedures are in place to protect the loss, misuse or alteration of information under our control; and
• How you can correct any inaccuracies in the information.

Coral Club collects information on the Site at two different stages. First, we collect de-identified or aggregated technical information (such as domain name or IP address) from all visitors to the Site; where such information may be considered personal information under PIPEDA, we handle it accordingly. We do not use this information to identify you and use it only in aggregate to generate statistical reports about Site use, except where limited linkage is necessary for security or fraud-prevention, consistent with PIPEDA’s purpose-limitation and safeguards principles.

Purposes of collection. We collect and use personal information to: (i) create and manage your account; (ii) process orders, payments, delivery and returns; (iii) provide customer support; (iv) operate the direct-selling program (including limited sharing with designated “upline” distributors if you enable it); (v) prevent fraud and secure the Site; (vi) personalize content and measure usage; and (vii) comply with legal requirements.

Second, we require the submission of certain personally identifiable information when you use the services available on the Site. For example, your use of your username and password allows us to identify you as a Customer of Coral Club® products. We also collect billing and payment information such as your name, postal and email addresses.

On the Site, each user may choose to make available information about products they purchased over the past six months to support quality service and consultations, only after providing explicit opt-in consent (PIPEDA — consent principle). Access to this information can be activated from your personal account settings and may be withdrawn at any time, consistent with PIPEDA’s consent and withdrawal principles. By opting in to share purchase information, the user authorizes access by designated upline users to the following data, and may withdraw such access at any time through account settings (PIPEDA — consent/withdrawal):

• order number,
• order date,
• reporting month of the order,
• order type,
• country of ordering,
• number of points,
• the cost of the order in the currency of the country,
• order description: product code and name, quantity, points, and amount for the product.

The user independently controls whether other Site users may access their data and may withdraw consent at any time (PIPEDA — consent/withdrawal). When this access is activated, order data will become viewable by the other users as specified in your settings; you can change or revoke this access at any time. While Coral Club remains accountable under PIPEDA for personal information under its control (Accountability principle), once you choose to share information with other users we cannot control how they use it; please share cautiously and review your settings regularly (to the extent permitted by law).

Except as outlined in this Privacy Policy, Coral Club does not sell, rent, or share user information with unaffiliated third parties, except for trusted service providers who assist us with functions such as data storage, payment processing, and account management. We will not provide your personal information to third parties for their own unsolicited marketing purposes without your consent, in compliance with Canada’s Anti-Spam Legislation (CASL) and PIPEDA. Coral Club will only send commercial electronic messages with your consent or as otherwise permitted by law. You may withdraw your consent at any time. Please note that we may still contact you for non-marketing, transactional purposes, such as service updates and account management; these communications are not subject to CASL's consent requirements, though you may manage certain notification preferences where available. To unsubscribe from our marketing communications, please follow the instructions provided in any of our marketing emails.

We may share personal information with service providers (e.g., shipping, customer support) under contracts that require them to use the information only to perform services for us and to protect it with safeguards comparable to those required by PIPEDA (Accountability principle).

Children’s privacy. We do not knowingly collect personal information online from children under 13. In Québec, we obtain parental consent before collecting personal information from children under 14, unless collection is clearly for the minor’s benefit as permitted by law.

We store information that we collect through log files to create a profile of our users. Log files record anonymous internet protocol (IP) addresses, browser types, internet service provider (ISP), referring/exit pages, platform type, date/time stamp, and number of clicks to analyze trends, administer the Site, track a user’s movement in the aggregate, and gather broad demographic information for aggregate use. For clarity, while we typically do not link IP addresses and similar data to identified individuals, such data may constitute personal information under PIPEDA; if we associate it with you or your account, we treat it as personal information. We may create aggregated or pseudonymous usage profiles describing how users interact with the Site for internal analytics to improve user experience; these profiles are not used to directly identify you.

We use cookies and similar technologies for functionality and analytics. Where cookie data is linked to your account, we do so for stated purposes and, where required by law, with your consent. If we link cookie data to your account, we treat it as personal information.

We use both session ID cookies and persistent cookies. We use session cookies to make it easier for you to navigate the site. A session ID cookie expires when you close your browser. A persistent cookie remains on your hard drive for an extended period of time. You can remove persistent cookies by following directions provided in your Internet browser’s “help” file.

We may set a persistent cookie to remember your login and to understand usage to improve the Site; if you reject cookies, some features may not function. Where applicable law requires, we will obtain your consent before setting non-essential cookies (PIPEDA/CASL).

Cookies set by our partners and service providers are governed by their privacy policies; however, we require contractual safeguards and oversight to ensure a comparable level of protection as required by PIPEDA (Accountability principle). Our partners, affiliates, tracking utility company, and service providers use session ID cookies to make it easier for you to navigate the site.

We and certain service providers may use a software technology called clear gifs (also known as Web Beacons/Web Bugs) to help us evaluate the effectiveness of content on the Site. Clear gifs are small graphics with a unique identifier, similar to cookies, but embedded invisibly on web pages. They are used for aggregate analytics and are not directly tied to personally identifiable information. Where such information could be linked to an individual under Canadian privacy law, it is treated as personal information and safeguarded in compliance with PIPEDA.

We may use local shared objects (Flash cookies) to store certain user preferences, such as volume control or display settings, to personalize your visit. Some of our service providers may also use similar technologies to provide features or advertising. Where these involve personal information, they are subject to contractual safeguards and consent requirements consistent with PIPEDA.

Flash cookies differ from standard browser cookies in the way and amount of data stored. Standard browser cookie management tools do not remove Flash cookies. To learn how to manage privacy and storage settings for Flash cookies, please refer to Adobe’s official documentation here: Flash Player Settings Manager. Users should review these settings regularly in line with their privacy preferences.

Each registered User may opt in to access extended information on the products they purchase. This feature is designed to share purchase-related experiences with other Users. By subscribing, the User gives explicit consent for their purchase data to be shared in accordance with PIPEDA’s consent principle, and such consent may be withdrawn at any time.

If the User explicitly consents by adjusting their personal account settings, their purchase-related data may be made available to other Users for the purpose of advanced notifications. The following information may be shared, subject to user consent and withdrawal rights under PIPEDA:

• Contact details: e-mail, mobile phone.
• Notification settings (e.g., number of days before a status change).
• Events for which the User is registered.
• Optional messenger contacts for fast communication (e.g., Skype, Telegram, WhatsApp, Viber).
• List of purchases for the current month and up to six months of purchase history.

By using the extended information resource, Users may share personal opinions about purchased products. These opinions are subjective and represent individual experiences only. They should not be interpreted as medical or professional advice, and we strongly recommend following the official product instructions and applicable Canadian consumer protection standards.

After purchasing and using a product, Users are welcome to share impressions with others, provided that such impressions reflect personal experience and are not presented as product performance guarantees under the Canadian Food and Drugs Act.

This feature is a platform for Users to exchange personal opinions about products. Please note that Users are not employees or partners of the Company. The Company cannot control or be held responsible for how other Users use shared data once consent is given. Publicly shown resources may be visible to all Users. All communication with the Website Administration is subject to the Terms of Use and the accountability principle under PIPEDA.

Cookie consent. Where required by applicable law (including Québec privacy law), we obtain your consent before setting non-essential cookies or similar technologies. You can change preferences via browser settings and our on-site controls. Where our analytics or providers process data in the U.S., cross-border safeguards described in section 1 apply.

If you do not agree with the above data access terms or prefer not to share product information with others, please disable the relevant option(s) in your personal account settings. You may withdraw consent at any time, consistent with Canadian privacy law.

As a direct selling company operating under a network marketing model, Coral Club may disclose limited Personal Information of its registered customers and Distributors strictly for operational and administrative purposes. Such disclosures are carried out in compliance with Canadian laws, including the Personal Information Protection and Electronic Documents Act (PIPEDA) and the Competition Act, and only to the extent necessary to provide services such as lead assignment or distributor locator functions. This disclosure is not a promise or guarantee of earnings or business success, as individual results vary based on personal effort, market conditions, and compliance with applicable law.

• Invite a Friend. To comply with CASL, we generally do not send commercial electronic messages (CEMs) to third parties at your request unless an applicable consent or referral exemption applies. Where a one-time “referral” CEM is permitted, the message will identify the referrer by full name and must be sent within the limits set by CASL/CRTC guidance. Otherwise, we provide share-links for you to contact friends directly from your own email or messenger.
• Lead Assignment and Distributor Locator Features. Coral Club occasionally will assign prospective sales and new Distributor leads to Distributors. In these cases, we will provide the lead with the appropriate Distributor’s name and contact information and/or provide a distributor with the prospective lead’s name and contact information. In addition, Coral Club has a Distributor Locator feature on its website. Pursuant to this feature, a prospective customer or new Distributor can locate a nearby Coral Club Distributor. In order to make the Distributor Locator feature and the lead assignments effective, the company will provide the prospective customer or new Distributor with the Distributor’s name and contact information, which may include his/her telephone number, address, and/or email address.
• To help Distributors in Coral Club’s direct selling program manage their independent activities, we provide the sponsor and other upline Coral Club Distributors with limited information, such as the Distributor’s and registered customer’s name, rank, and contact details, as well as aggregated data relating to sales and recruitment activity through the secure Back-Office section of the Website. This information is shared solely for organizational purposes and does not imply any guarantee of income or future business success, in accordance with the requirements of Canadian law, including the Competition Act and PIPEDA.

We may disclose personal information as required by applicable law. For Canadian users, this includes obligations under Canadian privacy/consumer laws and lawful requests by Canadian authorities. Because we store/process data in the United States, information may also be disclosed to U.S. authorities pursuant to U.S. law. We assess and record such disclosures and apply safeguards permitted by law.

In the event Coral Club goes through a business transition or a transfer, such as a merger, acquisition by another company, or sale of a portion of its assets, or in the unlikely event that Coral Club goes out of business or enters bankruptcy, our users’ personal information may be part of the assets transferred. You acknowledge that such transfers may occur, and that any acquirer of Coral Club or its assets may continue to use your personal information as set forth in this Privacy Policy.

The Site contains links to other web sites. Coral Club is not responsible for the privacy practices or content of these other sites. We encourage you to be aware when you leave the Site and to read the privacy statements of each and every web site that collects personally identifiable information. This Privacy Policy applies solely to information collected by the Site.

Coral Club takes commercially reasonable precautions to protect your information. When you enter sensitive information on our order forms, we encrypt the transmission of that information using Secure Socket Layer technology (often referred to as “SSL”). However, given the nature of the Internet and the fact that network security measures are not infallible, we cannot guarantee the security of your information.

We also make an effort to protect your information off-line. All of a users’ information, not just the sensitive information mentioned above, is restricted in our offices. Only employees who need the information to perform a specific job are granted access to personally identifiable information. All employees are kept up-to-date on our security and privacy practices. Finally, the servers that store your personally identifiable information are housed in a secure environment.

When registering for access to a secure area of the Site, we will ask you to select a username and password. We recommend that you do not divulge your password to anyone. We will never ask you for your password in an unsolicited phone call or in an unsolicited email. Also, remember to sign out of the registered site and close your browser window when you have finished your work. This is to ensure that others cannot access your personal information and correspondence when accessing your computer.

Breach notification. If a breach of security safeguards creates a real risk of significant harm, we will notify the Office of the Privacy Commissioner of Canada, keep a breach record, and notify affected individuals as required by PIPEDA, including prescribed content and timing.

If your personal information changes, you may contact us to request correction, update, deletion, or deactivation of our records. We will respond to requests for access to personal information within 30 calendar days, consistent with your rights of access and correction under section 8 of the Personal Information Protection and Electronic Documents Act (PIPEDA).

Québec data portability. If you reside in Québec, you may request a copy of computerized personal information that we hold about you in a structured, commonly used technological format, subject to legal exceptions.

We retain personal information only as long as necessary for the purposes described above or as required by law (e.g., tax, accounting, warranty). When no longer needed, information is securely deleted, de-identified, or archived. Retention periods and criteria are available on request.

With your consent, we may post your testimonial along with your name. You may withdraw your consent at any time and request removal of your testimonial by contacting us at the information provided below, in line with your rights under PIPEDA to withdraw consent and control the use of your personal information.

If we make material changes to this Privacy Policy, we will post the updated policy with a new effective date and, where required by law, provide prominent notice or seek renewed consent. Non-material updates take effect upon posting.