Last Updated: December 30, 2022

Privacy Notice

Version 4.3

PURPOSE

This Privacy Notice (“Notice”) describes certain personal information collected by or on behalf of Car Wash Partners, Inc. and/or its affiliates and subsidiaries (“Mister”, “we”, “us”, or “our”) and their service providers through the www.mistercarwash.com website and related online service (collectively, the “Site”), our mobile apps (collectively, “App”), physical store and kiosk locations, and our phone interactions with you, along with how that information is used, shared, and protected. If you have questions or concerns about this Notice, please contact us.

Please note that this Notice does not apply to information that is publicly available as contemplated by applicable laws. This Notice also does not apply to those websites that are solely operated and maintained by third-party vendors. For information about the data collection practices of the vendor that operates our employee application portal, please visit the Employee and Applicant Privacy Notice, and for information about the data collection practices of the vendor that operates our investor relations website, please visit the Investor Relations Privacy Notice as made available through the Investor Relations Terms of Use. Mister does not control the website terms and conditions or any data collection or privacy practices of any third-party websites.

STATEMENT

By using the Site or the App, you acknowledge on behalf of yourself and any organization that you represent (together, “you”) that you have read and understand this Notice. We may modify this Notice at any time. Material changes will be conspicuously posted on the Site or otherwise communicated to you. Our Mister Car Wash Website Terms of Service are also specifically incorporated herein.

Your California Privacy Rights

If you are a California resident, additional information applicable to California residents is below in the section entitled “Your California Privacy Rights”.

We Collect Personal Information You Provide

We will collect information that personally identifies you (“Personal Information”), which may include your name, email address, mailing address, phone number, payment information, month and day of birth, vehicle identification number, and license plate, and we will use and share such Personal Information pursuant to this Notice and applicable law.

Information Collected

Mister collects Personal Information that you provide directly to us. Personal Information is required to use certain Site or App features, for example, to create a Mister Account (see below), to purchase an Unlimited Wash Club® (“UWC”) membership, and to purchase a retail car wash.

Unlimited Wash Club Membership

If you purchase an Unlimited Wash Club membership, you may be required to provide certain Personal Information, including, but not limited to, your name, mobile phone number, payment information, mailing address, email address, and any other Personal Information as may be required to complete your UWC membership purchase at the point of sale, whether online or at a store location. This Personal Information will be saved as a profile in connection with your UWC membership. If you are an existing UWC member purchasing an additional UWC membership for an additional vehicle, you will need to provide your current UWC membership number to facilitate the transaction. If you contact us with any requests or inquiry regarding your UWC membership, such as updating your profile information, modifying your existing UWC membership, or transferring your UWC membership to another vehicle, then the information in your request or inquiry may be connected to your UWC membership profile. When you purchase a UWC membership, you will be assigned a membership number which appears on the corresponding RFID tag that will be affixed to your vehicle’s windshield. This UWC membership number belongs to Mister and does not constitute your Personal Information.

Mister Account

You may have the option of creating an online account with us on our Site or App (your “Mister Account”). To create a Mister Account, you must provide your first and last name, email address, and mobile number, and create a password, which password is collected with your email address at login. You can also add your payment information to your Mister account to facilitate faster purchases. Other information is optional, such as a profile picture, but if provided will be used to populate your Mister Account. If you link your UWC membership to your Mister Account, any profile information previously collected will be added to your Mister Account. Any other information that we may receive from you, such as through phone or email communications with our Customer Care Team or otherwise, may also be received by us and added to your Mister Account.

Mobile Phone Number

If you elect to communicate with us via text or provide us a mobile phone number, we may send you text messages from our systems, which may include the use of an automated dialing system, regarding our services and your business transactions and requests to us. Your mobile carrier’s message and data rates apply to all texts that you may send to or receive from us, including marketing texts as set forth below. Data obtained from you in connection with any text messaging may include your mobile phone number, your carrier’s name, and the date, time, and content of your messages and other information you provide to us. To opt out of receiving texts, see “Communication Opt-Out” below.

Vehicle Identification Number (VIN) and License Plate

If you make a vehicle damage claim against Mister, we may collect your VIN and license plate number, name, phone number, email, automobile make and model, and auto insurance information, and use the same for processing and handling your claim. This information may be collected directly by Mister or through Mister’s online claims platform. Your VIN and license plate information may also be received at the time of UWC enrollment at our locations. This information may be added to your UWC membership profile or your Mister Account, as applicable.

Payment Information

When you purchase a UWC membership or retail wash, your credit or debit card or other financial information is transmitted directly to a third-party payment processor in accordance with applicable Payment Card Industry Data Security Standards. For UWC membership purchases, your credit or debit card or other financial information in a tokenized version is automatically retained by Mister in your UWC membership profile or Mister Account, as applicable, and we maintain a record of your UWC membership purchases. In the case of a retail wash purchase, your credit or debit card or other financial information in a tokenized version is retained by Mister only if you choose to save your payment information in your Mister Account. We will also maintain a record of your retail wash purchases.

Location Services

Our Site allows you to opt into geolocation tracking. If you opt into such location tracking, we will collect information and data about your precise geographic location from time to time. As a result of the location data we collect, we may deliver information or content specific to your location to you via the Site. If you disable the collection of geolocation information, some features of our Site may be limited. Additionally, the opt-out mechanism on some devices and operating systems may not be persistent, which may require you to opt out of such collection each time you access the Site through your device.

Communication Opt-Out

General. We, or third parties on our behalf, may use your Personal Information to deliver communications to you, either by hard copy in the mail or electronically via email, text message, or App push notifications. If you provide us more than one email or mobile phone number, you should review your communications settings for each email and mobile phone number. Opting out of communications for one email address or mobile phone number does not opt out any other email address or mobile phone number that may be associated with your UWC membership profile, Mister Account, or App.

For any text messages, your mobile carrier’s standard message rates and other charges will apply. All such charges for text messages are billed by and payable to your mobile carrier. We will not be liable for any delays in your receipt of any text messages. Delivery is subject to effective transmission from your mobile phone carrier. Maximum number of text messages per month will vary based on your transactions and whether you opt in to receive marketing communications from us via text.

Transactional Communications. Transactional communications contain information necessary for you to use our car wash services. Legal notices are a form of transactional communications that contain information we are required to provide you by applicable law. The number of transactional communications (whether via email or text) may vary per month. If you prefer to receive transactional communications via email, set up your Mister Account (see above). To opt out of transactional communication texts, other than legal notices, you may text STOP to 26379, the number that appears in your transactional communication texts, or to 737-637-3463. We may send you a confirming message via email or text that you have been unsubscribed or have opted out. If you opt out of transactional communication texts, you will also be automatically opted out of marketing communication texts (but not legal notice texts). If you want to opt out of receiving any communications from Mister, whether transactional, marketing, or legal notices, you must terminate your UWC membership, close your Mister Account, and/or uninstall the App, as applicable. If you opt out of receiving all messages from us and later purchase online a retail wash as a guest or provide us with a new mobile number, you may nonetheless receive new transactional and marketing communications from us via email and/or text. Note that if you request to opt out by another means, it may take several days for your opt-out to be effective, and you may continue to receive email or text messages in the interim.

Marketing Communications. If you opt in to receive marketing communications from us, you must submit your name, email, and/or mobile number. Consent to receive marketing communications is not a condition of making any purchase. The number of marketing communications (whether via email or text) may vary per month. You may opt out of marketing communication emails by using the unsubscribe link in the email. You may opt out of marketing communication texts by texting STOP to 222999 or replying STOP to the message you received. We may send you a confirming message via email or text to confirm that you have been unsubscribed or have opted out. Note that if you request to opt out by another means, it may take several days for your unsubscribe or opt-out to be effective, and you may continue to receive email or text messages in the interim. To opt out of other marketing communications (e.g., postal marketing and live or prerecorded call marketing), please contact us as set forth below. Opting out of marketing communications does not opt you out of transactional communications whether by email or text. If you want to opt out of transactional communication (other than legal notices) or all communications, please see below.

Sweepstakes and Contests

Mister may offer sweepstakes or contests. To participate, you must submit certain Personal Information, which may include your name, email, employer name and type, mobile phone number, physical address, work address, and other Personal Information related to the sweepstakes or contest. You acknowledge and agree that data collected via sweepstakes and contests will be (i) used to contact you with marketing communications, (ii) shared with third-party vendors to send surveys and emails on behalf of Mister, and (iii) subject to additional terms provided to you at such time. Personal Information collected via sweepstakes and contests may also need to be shared with state regulatory agencies if required for the sweepstakes or contests.

Data Automatically Collected

RFID Tag

We will automatically scan and collect data from the UWC RFID tag affixed to your vehicle each time you obtain services at any location. We use this information to facilitate the provision of services to you, to track your usage of our services, and to personalize our marketing communications to you.

Site IP Addresses, Cookies, and Similar Tracking Technologies

When you use the Site, we and our Site vendors use technologies such as cookies (i.e., small pieces of data stored on your device’s hard drive by your browser), web beacons, pixel tags, and similar technologies to automatically collect internet protocol (“IP”) addresses assigned to the computers, mobile phones, and other devices you use, your internet service provider, device ID number, approximate geographic location, browser type, Site pages visited, websites you access before and after visiting the Site, and data related to how and when you use the Site (e.g., date and time stamps, clickstream data, browsing activity, and data about search terms and websites that direct you to the Site). We may combine this Personal Information with other collected data (including other Personal Information) and data obtained from third parties and save this information to your UWC membership profile, Mister Account, or elsewhere in our systems. For more information about cookies, or to opt out of certain cookies, visit our Privacy Preference Center. Most browsers automatically accept cookies. You can disable this function by changing your browser settings, but disabling cookies may impact your use and enjoyment of the site. Not all features or functions of the Site may work properly if you disable cookies. You cannot disable all cookies, such as cookies that are essential to the functionality of the site.

Do Not Track Requests

Due to the automatic collection of data using cookies, we do not honor “do not track” requests.

App Device IDs, Widgets, and Similar Tracking Technologies

Analytics. We may occasionally enable and implement various analytics tools, such as Google Tag Manager and Google Analytics, which are analytics tools provided by Google to collect and process Personal Information consisting of certain telematics about your use of the Site, identifiers for mobile devices (e.g., Android Advertising Identifiers and Advertising Identifiers for iOS) and, in certain instances, IP addresses. Google sets and reads cookies to collect such Personal Information and your web browser will automatically send such Personal Information to Google.

We may also enable and implement additional add-on services to Google Analytics, such as Demographics and Interest Reporting. Demographics and Interest Reporting gathers aggregate information such as the age and gender of users, along with certain interests those users express through their purchasing activities and other online activities, by tracking users across websites and across time.

Google uses this data to provide us and our third-party vendors with aggregated and anonymized reports that we use to improve the Site’s structure and content. To learn more about how Google uses data, visit Google’s Privacy Policy and Google’s page on “How Google uses information from sites or apps that use our services”. You may download and install the Google Analytics Opt-out Browser Add-on for each web browser you use. Using the Google Analytics Opt-out Browser Add-on does not prevent the use of other analytics tools. To learn more about Google Analytics cookies, visit Google Analytics Cookie Usage on Sites.

Online Behavioral Advertising. We may occasionally use advertising networks and services provided by third-party vendors. These services collect data about your interactions with the Site and the App and other websites across the internet and use such data to target personal content and advertisements to you for goods and services. The data collected may be associated with your Personal Information. The targeted content and advertisements may appear on the Site and on other websites and may be sent to you via email. Advertising networks often gather data about consumers who view advertisements to make inferences about a consumer’s interests and preferences, which enables the delivery of advertisements directly targeted to the consumer’s specific interests. This practice is often referred to as “online behavioral advertising”.

For example, we may use Google Ads to serve ads on our behalf across the internet and on the Site. Google uses cookies and similar technologies to collect data about your visits to the Site and your interaction with our services to generate targeted advertisements to you on other websites that you visit across the internet. To opt out of remarketing advertising provided through Google, to customize your ad preferences, or to limit Google’s collection or use of such data, visit Google’s Safety Center and Google’s Ad Settings and follow Google’s personalized ad opt-out instructions. Opting out will not affect your use of the Site.

To change your preferences with respect to certain online ads and to obtain more information about third-party ad networks and online behavioral advertising, visit the National Advertising Initiative Consumer opt-out page or the Digital Advertising Alliance Self-Regulatory Program. Changing your settings with individual browsers or ad networks will not necessarily carry over to other browsers or ad networks. As a result, depending on the opt-outs you request, you may occasionally still see our ads.

Social Media. We are active on social media, including Facebook, YouTube, Twitter, Instagram, and LinkedIn (“Social Media”). Anything you post on Social Media is public information and will not be treated confidentially. We may post (or re-post) any comments or content that you post on our Social Media pages. You agree to hold Mister and its affiliates harmless and without liability for the results of any and all content you post on Mister’s Social Media.

The Site allows you to connect and share data with Social Media. These features may require us to use cookies, plug-ins, and APIs provided by such Social Media to facilitate those communications and features and may result in the Social Media provider sharing additional information back to us regarding you and your Social Media profile that you elect to link to your Mister Account.

The Site may use advertising networks and services offered by Social Media to deliver advertising content. Use of these services requires Social Media to implement cookies or pixel tags to deliver ads to you while you access the site.

Your use of Social Media is governed by the privacy policies and terms of the third parties that own and operate those websites and not by this Notice. We encourage you to review those policies and terms.

Account Authentication. As a convenience, we may leverage third-party platforms, such as Google, Facebook and/or Apple, to provide login authentication to access your Mister Account (i.e., single sign-on). Implementation of single sign-on may require us to use cookies, plug-ins, and/or APIs provided by such third-party platforms. If you elect to use this feature, we will be required to pass through to the applicable third-party platform certain of your Personal Information, and the third-party platform may provide us additional information about you, which information we will collect and attach to your Mister Account.

Videos and Embedded Content. The Site and App may contain videos and embedded content provided by Mister or third parties, including visible content and/or embedded feed scripts. Mister and such third parties may collect data about how you interact with such content. By watching the videos and interacting with such content, you agree to the collection, sharing, and use of such data.

Data Collected from Third-Party Sources

We obtain data, which may include Personal Information, about individuals from various third-party sources, and we may combine that data with Personal Information or other data we collect. This enhances our existing data about our users, improves our ability to contact users, and enhances our marketing capabilities.

How We Use and Share Personal Information

Beyond the uses and sharing described above, Mister may use and share Personal Information as described below.

Purpose for Collection and Communication with You

We use and share Personal Information for the purpose for which it was collected or for purposes reasonably contemplated at the point at which it was collected. For example, if you contact us for support or assistance, we may use Personal Information to contact you and assist you with your request. We may use Personal Information to notify you of changes to the Site or App (e.g., changes to our Terms of Use or this Notice), authenticate and verify your identity, and send you marketing communications and transactional receipts and messages, including legal notices.

Account and Management

We use Personal Information for administrative purposes, such as managing your account, facilitating transactions, providing customer service, evaluating applications, and managing profiles, and more generally to inform our business strategies and understand the Site’s and App’s demographics and for user preferences.

Administration

We may use Personal Information for Site and App management, such as troubleshooting problems, improving the content and functionality of the Site, facilitating statistical and other analyses of the Site or App, and customizing the Site or App to you and our users.

Employees and Affiliates

We may share Personal Information with our employees and affiliates who have a need to know the information for our business purposes.

Vendors and Other Partners

We may share Personal Information with our third-party vendors, service providers, suppliers, consultants, agents, sales representatives, and other partners (including Site and App management and hosting, payment processors, marketing and public relations, and email services) that provide data processing services to us (e.g., to support the delivery of, provide functionality on, or help to enhance the security of the Site or App) or otherwise process Personal Information for the purposes described in this Notice or communicated to you when we collect such data. The parties described in this paragraph are authorized and may use and disclose Personal Information as needed to provide the applicable services to us. For example, we may share Personal Information with service providers to help us host and manage the Site or App; provide targeted advertising and other marketing; improve the content and functionality of the Site or App; perform data analysis and statistical analysis; troubleshoot problems with the Site or App; provide payment processing services and online storefronts; provide public relations; provide learning management systems; provide email services; provide data processing; and support or provide the security of the Site or App.

Professional Advisors

We may share Personal Information with certain service providers that are our professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to Mister.

Aggregated Data

We may use Personal Information to create de-identified or anonymous aggregate data. We may use and share such de-identified or aggregate data in our sole discretion with our affiliates, subsidiaries, vendors, and other third parties to: analyze, develop, and improve the content and services that we make available, inform business strategies, understand user demographics and user preferences, customize promotional emails and user experience, and for other lawful purposes. Mister is the sole and exclusive owner of such de-identified and aggregated information.

Government Officials and Law Enforcement

We will cooperate with law enforcement and other governmental agencies, and may disclose Personal Information: if we believe in good faith we are legally required to disclose that Personal Information, if we are advised to disclose Personal Information by our legal counsel, or when necessary to identify, contact, or bring a legal action against someone who may cause or be causing harm to, or interfering with the legal rights of, Mister or any other party.

Legal Purposes

If there are legal claims between you and Mister, Mister will use your Personal Information for purposes of pursuing, defending, processing, and handling such legal claims. We also may share information that we collect from you as needed to enforce our rights, protect our property, or protect the rights, property, or safety of others.

Business Transactions

If we undergo a change or contemplated change in control, acquisition, merger, reorganization, or asset or equity sale, or in the event of a bankruptcy, receivership, or similar transaction, all Personal Information may be transferred, sold, or otherwise shared with potential and actual successors, which will be bound by this Notice as it applies to Personal Information.

With Your Consent

With your consent, we may use or share Personal Information in ways not specifically described in this Notice.

Sales

We do not sell, rent, or loan any of your Personal Information to any third party for money. However, we may engage in transactions sharing and leveraging your data that may be seen as a “sale” of your data under certain applicable laws. You may notify us at privacy@mistercarwash.com or 1-866-254-3229 or via our Privacy Preference Center to opt-out of any sale of your information.

We do not share your Personal Information with third parties for those third parties’ direct marketing purposes.

Nevada Residents

Under Nevada law, we do not sell your Personal Information. However, if you are a Nevada resident, you may submit a request that we not sell any Personal Information we have collected about you by contacting us at privacy@mistercarwash.com or 1-866-254-3229 or via our Privacy Preference Center.

Data We Do Not Intend to Collect

Sensitive or Personal Information

“Sensitive Data” is any data that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that involves genetic or biometric data or data concerning health or sexual orientation. We do not intend to collect any Sensitive Data from you. Please do not provide Sensitive Data to us through the Site, App, Social Media, or any other form of communication.

Children

We are committed to protecting children’s privacy. The Site is not directed at children under 16 years of age. We do not knowingly collect, use, or share Personal Information from children under 16. If a parent or legal guardian learns that their child provided us with Personal Information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such Personal Information.

Data Security

We use commercially reasonable technical and organizational measures to help secure all Personal Information against loss, misuse, and alteration. While we cannot guarantee it, we use industry-standard protections to help safeguard against such occurrences. If a breach of our systems occurs, we will notify you of the breach only if and as required under applicable law.

You understand that no data transmission over the internet or a mobile device can be guaranteed to be 100% secure. While we strive to protect your personal information, we do not guarantee the security of personal information and you provide personal information at your own risk.

Data Retention

The factors that influence how long we retain data about you include what information is needed to facilitate our relationship, provide services and experiences to you, and meet legal and contractual retention requirements. We retain information for specific business and legal purposes. Sometimes business and legal requirements require us to retain certain information for specific purposes for an extended period of time.

Access from Outside the United States

This Site and App are operated and maintained by Mister and its vendors from the United States and is intended solely for a United States audience. If you access the Site or the App from outside the United States, please be aware that Personal Information will be transferred to, stored in, and processed in the United States. U.S. data protection and related laws may not be as comprehensive as those from where you access the Site or App.

Third-Party Sites

The Site and App may link to, or be linked to, websites not controlled by us. We are not responsible for third parties’ privacy policies or practices. This Notice does not apply to any third-party websites or to any data that you provide to third parties. You should read the privacy policy for each website that you visit.

Access and Update Your Personal Information

To access or update your Personal Information as it exists in our records, please contact us using the information below.

Car Wash Partners, Inc.

Attention: Data Privacy Officer

222 E. 5th St.

Tucson, AZ 85705

www.mistercarwash.com

1-866-254-3229

privacy@mistercarwash.com

Your California Privacy Rights

Subject to certain limitations permitted by applicable law, if you are a California resident you may make the following requests with regard to your Personal Information.

Right to Request Disclosure of Categories

Categories Collected. You have a right to request access to the following information: (a) the categories of Personal Information we collected about you in the 12-month period prior to your request, (b) the categories of sources from which the Personal Information was collected, (c) the business or commercial purpose for which we collected your Personal Information, (d) the categories of Personal Information we disclosed in the 12-month period prior to your request, and (e) the categories of third parties with whom we shared your Personal Information. If we provide such information electronically, the information will be in a portable format.

Categories Disclosed. You also have a right to request disclosure of the categories of Personal Information that we have sold or disclosed for business purposes in the 12-month period prior to your request, if any, and the categories of third parties to whom we have sold or disclosed it. If we provide such information electronically, the information will be in a portable format.

Right to Request Access. In addition, you have a right to request that we disclose to you the specific pieces of Personal Information that we have collected about you in the 12-month period prior to your request. If we provide such information electronically, the information will be in a portable format.

Right to Request Deletion. You have a right to request that we delete Personal Information we collected about you. If it is necessary for us to maintain the Personal Information for certain purposes, we are not required to comply with your deletion request. If we determine that we will not delete your Personal Information when you request us to do so, we will inform you and tell you why we are not deleting it.

Right to Opt Out of the Sale/Sharing. You have the right to request that we do not sell or share your Personal Information as defined by California law. While we do not sell your Personal Information for monetary purposes, the collection of data by certain of our third-party website analytics or digital advertising service providers may be considered a “sale” under California law. We do not have actual knowledge that we have sold any Personal Information of an individual under 16 years of age in the last 12 months.

Right to Limit the Use of My Sensitive Personal Information. You have the right to request that we limit the use and disclosure of sensitive personal information. If it is necessary for us to use the Personal Information, we are not required to comply with your request to limit the use of your Sensitive Personal Information.

Right to Request to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you. We will review your request and will consider factors relating to the information request.

Non-Discrimination. You have a right to exercise the above requests, and we will not discriminate against you for exercising any of your rights under applicable law or this Notice. This includes not (a) denying you goods or services, (b) charging you different prices, (c) providing you a different level or quality of good or services, or (d) suggesting that we will do (b) or (c), because you exercised your rights. If we choose to offer a financial incentives program in the future, additional terms will apply which may be an exception to this Section.

How to Exercise Your Rights. To exercise your rights described in this Notice, you may submit your request to us by contacting us at any of the following:

https://mistercarwash.com/privacy-portal/

1-866-254-3229

privacy@mistercarwash.com

You may also submit your opt-out request for the sale of any of your information here: DO NOT SELL MY PERSONAL INFORMATION.

Who May Exercise Your Rights. You may make a request to exercise the above rights on behalf of yourself or on behalf of a child if you are a parent or legal guardian of the child. In addition, you may authorize an agent to exercise your rights on your behalf, if you provide the agent with written permission and, if the agent is a business entity, provided the agent is registered with the California Secretary of State. If an authorized agent contacts us to exercise the above rights, we will need to verify their identity as well as your identity. We will also require proof of your written authorization to the agent to be your agent and to make the specific request submitted, unless the agent is subject to a Power of Attorney under California probate laws. If the agent is a Power of Attorney under California probate laws, we may require evidence of that status.

Verification of Your Request. Once we receive your request, we will contact you to confirm receipt of your request. In addition, we may contact you to provide us with additional information to allow us to verify your identity based on the Personal Information we have in our systems. In order to verify your request, you must provide sufficient information that allows us to reasonably verify you are the person that is the subject of the Personal Information you have requested. This information may vary depending on the Personal Information we already have. Certain types of requests may require additional verification to ensure you are who you say you are. If you have used an agent to make your request, we will also need to verify the identity of the agent. Verification of your request may require you, or your agent if applicable, to sign a declaration verifying identity under penalty of perjury.

When and How We Will Respond. We will respond to a request to opt out of the sales of data within 15 business days. For all other requests, we will confirm receipt of your request within 10 business days and we will try to respond to your request within 45 calendar days. If we require additional time to respond, we will inform you of the reason and may take an additional 45 calendar days to respond. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. We may deny your request as permitted by law if we are unable to verify your identity, or if an agent makes the request on your behalf, if we are unable to verify their identity or proof of their authorization. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.

Based on the categories required by California law, below are the lists of Personal Information collected in the prior 12 months of the effective date of this Notice, where they are sourced, why they are collected, and if we disclose them, the categories of service providers or other third parties to whom we disclose them:

Category of Personal Information Source Purpose Collected Disclosed for a Business Purpose? Categories of Entities We Disclose To Sold Categories of Entities We Sell To
Identifiers Directly from you onsite, other members (e.g. gifts), via our Site or App, via phone, or in-person at one of our locations Providing you the service, product, or communication requested and documenting the request

Contacting you regarding our services or products

Marketing our services and products to you

Legal and regulatory requirements and best practices

Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

Yes Third-party social media platforms

Third-party advertising networks and analytics providers

Third-party survey providers

Personal Information categories under California Customer Records statute (Cal. Civ. Code 1798.80(e)) Directly from you onsite, via our Site or App, via phone or email, or in person at one of our locations Providing you the service, product, or communication requested and documenting the request

Contacting you regarding our services or products

Marketing our services and products to you

Processing your vehicle damage claim

Legal and regulatory requirements and best practices

Authenticating you are who you say you are

Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

No
Commercial information Directly from you via the transactions you conduct onsite, via phone or email, or on the Site or on the App Processing your payments

Records of your activities onsite, and on our Site and App

Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

No
Sensory data (photographs and videos) Directly from you while onsite via security surveillance systems Security and legal investigations Yes Service providers involved in the provision and maintenance of our security and surveillance systems No
Geolocation Directly from you via IP address and your mobile device Tracking use of our Site and other online services Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

Yes Third party social media platforms

Third party advertising networks and analytics providers

Third party survey providers

Internet or other electronic network activity information, including, but not limited to, information regarding your interaction with the Site Directly from you, your computer, or other device

Indirectly from our service providers

Providing you the service, product, or communication requested and documenting the request

Displaying and customizing content on our Site and other online services

Improving our Site and other online services

Marketing to you on other Sites and apps

 Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

Third party social media platforms

Third party advertising networks and analytics providers

Third party survey providers

 Yes Third party social media platforms

Third party advertising networks and analytics providers

Third party survey providers

Inferences Directly from you Improving the services and products that we provide Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

No
Sensitive personal information (precise geolocation) Directly from you

Indirectly from our service providers

To provide location-based push notifications No No

Although the categories of information above are collected for the designated purposes, Personal Information may be otherwise used for the purposes set forth in this Notice as reasonably contemplated at the time of collection.

Contact Us

If you have any questions, you may contact us as forth below:

Car Wash Partners, Inc.

Attention: Data Privacy Officer

222 E. 5th St.

Tucson, AZ 85705

www.mistercarwash.com

1-866-254-3229

privacy@mistercarwash.com

Your California Privacy Rights

Your California Privacy Rights

Subject to certain limitations permitted by applicable law, if you are a California resident you may make the following requests with regard to your Personal Information.

Right to Request Disclosure of Categories

Categories Collected. You have a right to request access to the following information: (a) the categories of Personal Information we collected about you in the 12-month period prior to your request, (b) the categories of sources from which the Personal Information was collected, (c) the business or commercial purpose for which we collected your Personal Information, (d) the categories of Personal Information we disclosed in the 12-month period prior to your request, and (e) the categories of third parties with whom we shared your Personal Information. If we provide such information electronically, the information will be in a portable format.

Categories Disclosed. You also have a right to request disclosure of the categories of Personal Information that we have sold or disclosed for business purposes in the 12-month period prior to your request, if any, and the categories of third parties to whom we have sold or disclosed it. If we provide such information electronically, the information will be in a portable format.

Right to Request Access. In addition, you have a right to request that we disclose to you the specific pieces of Personal Information that we have collected about you in the 12-month period prior to your request. If we provide such information electronically, the information will be in a portable format.

Right to Request Deletion. You have a right to request that we delete Personal Information we collected about you. If it is necessary for us to maintain the Personal Information for certain purposes, we are not required to comply with your deletion request. If we determine that we will not delete your Personal Information when you request us to do so, we will inform you and tell you why we are not deleting it.

Right to Opt Out of the Sale/Sharing. You have the right to request that we do not sell or share your Personal Information as defined by California law. While we do not sell your Personal Information for monetary purposes, the collection of data by certain of our third-party website analytics or digital advertising service providers may be considered a “sale” under California law. We do not have actual knowledge that we have sold any Personal Information of an individual under 16 years of age in the last 12 months.

Right to Limit the Use of My Sensitive Personal Information. You have the right to request that we limit the use and disclosure of sensitive personal information. If it is necessary for us to use the Personal Information, we are not required to comply with your request to limit the use of your Sensitive Personal Information.

Right to Request to Correct. You have the right to request that we correct inaccurate Personal Information that we maintain about you. We will review your request and will consider factors relating to the information request.

Non-Discrimination. You have a right to exercise the above requests, and we will not discriminate against you for exercising any of your rights under applicable law or this Notice. This includes not (a) denying you goods or services, (b) charging you different prices, (c) providing you a different level or quality of good or services, or (d) suggesting that we will do (b) or (c), because you exercised your rights. If we choose to offer a financial incentives program in the future, additional terms will apply which may be an exception to this Section.

How to Exercise Your Rights. To exercise your rights described in this Notice, you may submit your request to us by contacting us at any of the following:

https://mistercarwash.com/privacy-portal/

1-866-254-3229

privacy@mistercarwash.com

You may also submit your opt-out request for the sale of any of your information here: DO NOT SELL MY PERSONAL INFORMATION.

Who May Exercise Your Rights. You may make a request to exercise the above rights on behalf of yourself or on behalf of a child if you are a parent or legal guardian of the child. In addition, you may authorize an agent to exercise your rights on your behalf, if you provide the agent with written permission and, if the agent is a business entity, provided the agent is registered with the California Secretary of State. If an authorized agent contacts us to exercise the above rights, we will need to verify their identity as well as your identity. We will also require proof of your written authorization to the agent to be your agent and to make the specific request submitted, unless the agent is subject to a Power of Attorney under California probate laws. If the agent is a Power of Attorney under California probate laws, we may require evidence of that status.

Verification of Your Request. Once we receive your request, we will contact you to confirm receipt of your request. In addition, we may contact you to provide us with additional information to allow us to verify your identity based on the Personal Information we have in our systems. In order to verify your request, you must provide sufficient information that allows us to reasonably verify you are the person that is the subject of the Personal Information you have requested. This information may vary depending on the Personal Information we already have. Certain types of requests may require additional verification to ensure you are who you say you are. If you have used an agent to make your request, we will also need to verify the identity of the agent. Verification of your request may require you, or your agent if applicable, to sign a declaration verifying identity under penalty of perjury.

When and How We Will Respond. We will respond to a request to opt out of the sales of data within 15 business days. For all other requests, we will confirm receipt of your request within 10 business days and we will try to respond to your request within 45 calendar days. If we require additional time to respond, we will inform you of the reason and may take an additional 45 calendar days to respond. Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. We may deny your request as permitted by law if we are unable to verify your identity, or if an agent makes the request on your behalf, if we are unable to verify their identity or proof of their authorization. We may charge a fee to process or respond to your request if it is excessive, repetitive, or manifestly unfounded.

Based on the categories required by California law, below are the lists of Personal Information collected in the prior 12 months of the effective date of this Notice, where they are sourced, why they are collected, and if we disclose them, the categories of service providers or other third parties to whom we disclose them:

Category of Personal Information Source Purpose Collected Disclosed for a Business Purpose? Categories of Entities We Disclose To Sold Categories of Entities We Sell To
Identifiers Directly from you onsite, other members (e.g. gifts), via our Site or App, via phone, or in-person at one of our locations Providing you the service, product, or communication requested and documenting the request

Contacting you regarding our services or products

Marketing our services and products to you

Legal and regulatory requirements and best practices

Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

Yes Third-party social media platforms

Third-party advertising networks and analytics providers

Third-party survey providers

Personal Information categories under California Customer Records statute (Cal. Civ. Code 1798.80(e)) Directly from you onsite, via our Site or App, via phone or email, or in person at one of our locations Providing you the service, product, or communication requested and documenting the request

Contacting you regarding our services or products

Marketing our services and products to you

Processing your vehicle damage claim

Legal and regulatory requirements and best practices

Authenticating you are who you say you are

Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

No
Commercial information Directly from you via the transactions you conduct onsite, via phone or email, or on the Site or on the App Processing your payments

Records of your activities onsite, and on our Site and App

Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

No
Sensory data (photographs and videos) Directly from you while onsite via security surveillance systems Security and legal investigations Yes Service providers involved in the provision and maintenance of our security and surveillance systems No
Geolocation Directly from you via IP address and your mobile device Tracking use of our Site and other online services Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

Yes Third party social media platforms

Third party advertising networks and analytics providers

Third party survey providers

Internet or other electronic network activity information, including, but not limited to, information regarding your interaction with the Site Directly from you, your computer, or other device

Indirectly from our service providers

Providing you the service, product, or communication requested and documenting the request

Displaying and customizing content on our Site and other online services

Improving our Site and other online services

Marketing to you on other Sites and apps

 Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

Third party social media platforms

Third party advertising networks and analytics providers

Third party survey providers

 Yes Third party social media platforms

Third party advertising networks and analytics providers

Third party survey providers

Inferences Directly from you Improving the services and products that we provide Yes Service providers involved in processing or providing our products, services, and communications

Service providers involved in the provision, maintenance, and improvement of our Site and other online services

No
Sensitive personal information (precise geolocation) Directly from you

Indirectly from our service providers

To provide location-based push notifications No

Although the categories of information above are collected for the designated purposes, Personal Information may be otherwise used for the purposes set forth in this Notice as reasonably contemplated at the time of collection.

We Collect Personal Information You Provide

We will collect information that personally identifies you (“Personal Information”), which may include your name, email address, mailing address, phone number, payment information, month and day of birth, vehicle identification number, and license plate, and we will use and share such Personal Information pursuant to this Notice and applicable law.

Information Collected

Mister collects Personal Information that you provide directly to us. Personal Information is required to use certain Site or App features, for example, to create a Mister Account (see below), to purchase an Unlimited Wash Club® (“UWC”) membership, and to purchase a retail car wash.

Unlimited Wash Club Membership

If you purchase an Unlimited Wash Club membership, you may be required to provide certain Personal Information, including, but not limited to, your name, mobile phone number, payment information, mailing address, email address, and any other Personal Information as may be required to complete your UWC membership purchase at the point of sale, whether online or at a store location. This Personal Information will be saved as a profile in connection with your UWC membership. If you are an existing UWC member purchasing an additional UWC membership for an additional vehicle, you will need to provide your current UWC membership number to facilitate the transaction. If you contact us with any requests or inquiry regarding your UWC membership, such as updating your profile information, modifying your existing UWC membership, or transferring your UWC membership to another vehicle, then the information in your request or inquiry may be connected to your UWC membership profile. When you purchase a UWC membership, you will be assigned a membership number which appears on the corresponding RFID tag that will be affixed to your vehicle’s windshield. This UWC membership number belongs to Mister and does not constitute your Personal Information.

Mister Account

You may have the option of creating an online account with us on our Site or App (your “Mister Account”). To create a Mister Account, you must provide your first and last name, email address, and mobile number, and create a password, which password is collected with your email address at login. You can also add your payment information to your Mister account to facilitate faster purchases. Other information is optional, such as a profile picture, but if provided will be used to populate your Mister Account. If you link your UWC membership to your Mister Account, any profile information previously collected will be added to your Mister Account. Any other information that we may receive from you, such as through phone or email communications with our Customer Care Team or otherwise, may also be received by us and added to your Mister Account.

Mobile Phone Number

If you elect to communicate with us via text or provide us a mobile phone number, we may send you text messages from our systems, which may include the use of an automated dialing system, regarding our services and your business transactions and requests to us. Your mobile carrier’s message and data rates apply to all texts that you may send to or receive from us, including marketing texts as set forth below. Data obtained from you in connection with any text messaging may include your mobile phone number, your carrier’s name, and the date, time, and content of your messages and other information you provide to us. To opt out of receiving texts, see “Communication Opt-Out” below.

Vehicle Identification Number (VIN) and License Plate

If you make a vehicle damage claim against Mister, we may collect your VIN and license plate number, name, phone number, email, automobile make and model, and auto insurance information, and use the same for processing and handling your claim. This information may be collected directly by Mister or through Mister’s online claims platform. Your VIN and license plate information may also be received at the time of UWC enrollment at our locations. This information may be added to your UWC membership profile or your Mister Account, as applicable.

Payment Information

When you purchase a UWC membership or retail wash, your credit or debit card or other financial information is transmitted directly to a third-party payment processor in accordance with applicable Payment Card Industry Data Security Standards. For UWC membership purchases, your credit or debit card or other financial information in a tokenized version is automatically retained by Mister in your UWC membership profile or Mister Account, as applicable, and we maintain a record of your UWC membership purchases. In the case of a retail wash purchase, your credit or debit card or other financial information in a tokenized version is retained by Mister only if you choose to save your payment information in your Mister Account. We will also maintain a record of your retail wash purchases.

Location Services

Our Site allows you to opt into geolocation tracking. If you opt into such location tracking, we will collect information and data about your precise geographic location from time to time. As a result of the location data we collect, we may deliver information or content specific to your location to you via the Site. If you disable the collection of geolocation information, some features of our Site may be limited. Additionally, the opt-out mechanism on some devices and operating systems may not be persistent, which may require you to opt out of such collection each time you access the Site through your device.

Communication Opt-Out

General. We, or third parties on our behalf, may use your Personal Information to deliver communications to you, either by hard copy in the mail or electronically via email, text message, or App push notifications. If you provide us more than one email or mobile phone number, you should review your communications settings for each email and mobile phone number. Opting out of communications for one email address or mobile phone number does not opt out any other email address or mobile phone number that may be associated with your UWC membership profile, Mister Account, or App.

For any text messages, your mobile carrier’s standard message rates and other charges will apply. All such charges for text messages are billed by and payable to your mobile carrier. We will not be liable for any delays in your receipt of any text messages. Delivery is subject to effective transmission from your mobile phone carrier. Maximum number of text messages per month will vary based on your transactions and whether you opt in to receive marketing communications from us via text.

Transactional Communications. Transactional communications contain information necessary for you to use our car wash services. Legal notices are a form of transactional communications that contain information we are required to provide you by applicable law. The number of transactional communications (whether via email or text) may vary per month. If you prefer to receive transactional communications via email, set up your Mister Account (see above). To opt out of transactional communication texts, other than legal notices, you may text STOP to 26379, the number that appears in your transactional communication texts, or to 737-637-3463. We may send you a confirming message via email or text that you have been unsubscribed or have opted out. If you opt out of transactional communication texts, you will also be automatically opted out of marketing communication texts (but not legal notice texts). If you want to opt out of receiving any communications from Mister, whether transactional, marketing, or legal notices, you must terminate your UWC membership, close your Mister Account, and/or uninstall the App, as applicable. If you opt out of receiving all messages from us and later purchase online a retail wash as a guest or provide us with a new mobile number, you may nonetheless receive new transactional and marketing communications from us via email and/or text. Note that if you request to opt out by another means, it may take several days for your opt-out to be effective, and you may continue to receive email or text messages in the interim.

Marketing Communications. If you opt in to receive marketing communications from us, you must submit your name, email, and/or mobile number. Consent to receive marketing communications is not a condition of making any purchase. The number of marketing communications (whether via email or text) may vary per month. You may opt out of marketing communication emails by using the unsubscribe link in the email. You may opt out of marketing communication texts by texting STOP to 222999 or replying STOP to the message you received. We may send you a confirming message via email or text to confirm that you have been unsubscribed or have opted out. Note that if you request to opt out by another means, it may take several days for your unsubscribe or opt-out to be effective, and you may continue to receive email or text messages in the interim. To opt out of other marketing communications (e.g., postal marketing and live or prerecorded call marketing), please contact us as set forth below. Opting out of marketing communications does not opt you out of transactional communications whether by email or text. If you want to opt out of transactional communication (other than legal notices) or all communications, please see below.

Sweepstakes and Contests

Mister may offer sweepstakes or contests. To participate, you must submit certain Personal Information, which may include your name, email, employer name and type, mobile phone number, physical address, work address, and other Personal Information related to the sweepstakes or contest. You acknowledge and agree that data collected via sweepstakes and contests will be (i) used to contact you with marketing communications, (ii) shared with third-party vendors to send surveys and emails on behalf of Mister, and (iii) subject to additional terms provided to you at such time. Personal Information collected via sweepstakes and contests may also need to be shared with state regulatory agencies if required for the sweepstakes or contests.

Cookies & Data Automatically Collected

RFID Tag

We will automatically scan and collect data from the UWC RFID tag affixed to your vehicle each time you obtain services at any location. We use this information to facilitate the provision of services to you, to track your usage of our services, and to personalize our marketing communications to you.

Site IP Addresses, Cookies, and Similar Tracking Technologies

When you use the Site, we and our Site vendors use technologies such as cookies (i.e., small pieces of data stored on your device’s hard drive by your browser), web beacons, pixel tags, and similar technologies to automatically collect internet protocol (“IP”) addresses assigned to the computers, mobile phones, and other devices you use, your internet service provider, device ID number, approximate geographic location, browser type, Site pages visited, websites you access before and after visiting the Site, and data related to how and when you use the Site (e.g., date and time stamps, clickstream data, browsing activity, and data about search terms and websites that direct you to the Site). We may combine this Personal Information with other collected data (including other Personal Information) and data obtained from third parties and save this information to your UWC membership profile, Mister Account, or elsewhere in our systems. For more information about cookies, or to opt out of certain cookies, visit our Privacy Preference Center. Most browsers automatically accept cookies. You can disable this function by changing your browser settings, but disabling cookies may impact your use and enjoyment of the site. Not all features or functions of the Site may work properly if you disable cookies. You cannot disable all cookies, such as cookies that are essential to the functionality of the site.

Do Not Track Requests

Due to the automatic collection of data using cookies, we do not honor “do not track” requests.

App Device IDs, Widgets, and Similar Tracking Technologies

Analytics. We may occasionally enable and implement various analytics tools, such as Google Tag Manager and Google Analytics, which are analytics tools provided by Google to collect and process Personal Information consisting of certain telematics about your use of the Site, identifiers for mobile devices (e.g., Android Advertising Identifiers and Advertising Identifiers for iOS) and, in certain instances, IP addresses. Google sets and reads cookies to collect such Personal Information and your web browser will automatically send such Personal Information to Google.

We may also enable and implement additional add-on services to Google Analytics, such as Demographics and Interest Reporting. Demographics and Interest Reporting gathers aggregate information such as the age and gender of users, along with certain interests those users express through their purchasing activities and other online activities, by tracking users across websites and across time.

Google uses this data to provide us and our third-party vendors with aggregated and anonymized reports that we use to improve the Site’s structure and content. To learn more about how Google uses data, visit Google’s Privacy Policy and Google’s page on “How Google uses information from sites or apps that use our services”. You may download and install the Google Analytics Opt-out Browser Add-on for each web browser you use. Using the Google Analytics Opt-out Browser Add-on does not prevent the use of other analytics tools. To learn more about Google Analytics cookies, visit Google Analytics Cookie Usage on Sites.

Online Behavioral Advertising. We may occasionally use advertising networks and services provided by third-party vendors. These services collect data about your interactions with the Site and the App and other websites across the internet and use such data to target personal content and advertisements to you for goods and services. The data collected may be associated with your Personal Information. The targeted content and advertisements may appear on the Site and on other websites and may be sent to you via email. Advertising networks often gather data about consumers who view advertisements to make inferences about a consumer’s interests and preferences, which enables the delivery of advertisements directly targeted to the consumer’s specific interests. This practice is often referred to as “online behavioral advertising”.

For example, we may use Google Ads to serve ads on our behalf across the internet and on the Site. Google uses cookies and similar technologies to collect data about your visits to the Site and your interaction with our services to generate targeted advertisements to you on other websites that you visit across the internet. To opt out of remarketing advertising provided through Google, to customize your ad preferences, or to limit Google’s collection or use of such data, visit Google’s Safety Center and Google’s Ad Settings and follow Google’s personalized ad opt-out instructions. Opting out will not affect your use of the Site.

To change your preferences with respect to certain online ads and to obtain more information about third-party ad networks and online behavioral advertising, visit the National Advertising Initiative Consumer opt-out page or the Digital Advertising Alliance Self-Regulatory Program. Changing your settings with individual browsers or ad networks will not necessarily carry over to other browsers or ad networks. As a result, depending on the opt-outs you request, you may occasionally still see our ads.

Social Media. We are active on social media, including Facebook, YouTube, Twitter, Instagram, and LinkedIn (“Social Media”). Anything you post on Social Media is public information and will not be treated confidentially. We may post (or re-post) any comments or content that you post on our Social Media pages. You agree to hold Mister and its affiliates harmless and without liability for the results of any and all content you post on Mister’s Social Media.

The Site allows you to connect and share data with Social Media. These features may require us to use cookies, plug-ins, and APIs provided by such Social Media to facilitate those communications and features and may result in the Social Media provider sharing additional information back to us regarding you and your Social Media profile that you elect to link to your Mister Account.

The Site may use advertising networks and services offered by Social Media to deliver advertising content. Use of these services requires Social Media to implement cookies or pixel tags to deliver ads to you while you access the site.

Your use of Social Media is governed by the privacy policies and terms of the third parties that own and operate those websites and not by this Notice. We encourage you to review those policies and terms.

Account Authentication. As a convenience, we may leverage third-party platforms, such as Google, Facebook and/or Apple, to provide login authentication to access your Mister Account (i.e., single sign-on). Implementation of single sign-on may require us to use cookies, plug-ins, and/or APIs provided by such third-party platforms. If you elect to use this feature, we will be required to pass through to the applicable third-party platform certain of your Personal Information, and the third-party platform may provide us additional information about you, which information we will collect and attach to your Mister Account.

Videos and Embedded Content. The Site and App may contain videos and embedded content provided by Mister or third parties, including visible content and/or embedded feed scripts. Mister and such third parties may collect data about how you interact with such content. By watching the videos and interacting with such content, you agree to the collection, sharing, and use of such data.

Data Collected From Third-Party Sources

We obtain data, which may include Personal Information, about individuals from various third-party sources, and we may combine that data with Personal Information or other data we collect. This enhances our existing data about our users, improves our ability to contact users, and enhances our marketing capabilities.

How We Use & Share Personal Information

Beyond the uses and sharing described above, Mister may use and share Personal Information as described below.

Purpose for Collection and Communication with You

We use and share Personal Information for the purpose for which it was collected or for purposes reasonably contemplated at the point at which it was collected. For example, if you contact us for support or assistance, we may use Personal Information to contact you and assist you with your request. We may use Personal Information to notify you of changes to the Site or App (e.g., changes to our Terms of Use or this Notice), authenticate and verify your identity, and send you marketing communications and transactional receipts and messages, including legal notices.

Account and Management

We use Personal Information for administrative purposes, such as managing your account, facilitating transactions, providing customer service, evaluating applications, and managing profiles, and more generally to inform our business strategies and understand the Site’s and App’s demographics and for user preferences.

Administration

We may use Personal Information for Site and App management, such as troubleshooting problems, improving the content and functionality of the Site, facilitating statistical and other analyses of the Site or App, and customizing the Site or App to you and our users.

Employees and Affiliates

We may share Personal Information with our employees and affiliates who have a need to know the information for our business purposes.

Vendors and Other Partners

We may share Personal Information with our third-party vendors, service providers, suppliers, consultants, agents, sales representatives, and other partners (including Site and App management and hosting, payment processors, marketing and public relations, and email services) that provide data processing services to us (e.g., to support the delivery of, provide functionality on, or help to enhance the security of the Site or App) or otherwise process Personal Information for the purposes described in this Notice or communicated to you when we collect such data. The parties described in this paragraph are authorized and may use and disclose Personal Information as needed to provide the applicable services to us. For example, we may share Personal Information with service providers to help us host and manage the Site or App; provide targeted advertising and other marketing; improve the content and functionality of the Site or App; perform data analysis and statistical analysis; troubleshoot problems with the Site or App; provide payment processing services and online storefronts; provide public relations; provide learning management systems; provide email services; provide data processing; and support or provide the security of the Site or App.

Professional Advisors

We may share Personal Information with certain service providers that are our professional advisors, such as our attorneys, accountants, financial advisors, and business advisors, in their capacity as advisors to Mister.

Aggregated Data

We may use Personal Information to create de-identified or anonymous aggregate data. We may use and share such de-identified or aggregate data in our sole discretion with our affiliates, subsidiaries, vendors, and other third parties to: analyze, develop, and improve the content and services that we make available, inform business strategies, understand user demographics and user preferences, customize promotional emails and user experience, and for other lawful purposes. Mister is the sole and exclusive owner of such de-identified and aggregated information.

Government Officials and Law Enforcement

We will cooperate with law enforcement and other governmental agencies, and may disclose Personal Information: if we believe in good faith we are legally required to disclose that Personal Information, if we are advised to disclose Personal Information by our legal counsel, or when necessary to identify, contact, or bring a legal action against someone who may cause or be causing harm to, or interfering with the legal rights of, Mister or any other party.

Legal Purposes

If there are legal claims between you and Mister, Mister will use your Personal Information for purposes of pursuing, defending, processing, and handling such legal claims. We also may share information that we collect from you as needed to enforce our rights, protect our property, or protect the rights, property, or safety of others.

Business Transactions

If we undergo a change or contemplated change in control, acquisition, merger, reorganization, or asset or equity sale, or in the event of a bankruptcy, receivership, or similar transaction, all Personal Information may be transferred, sold, or otherwise shared with potential and actual successors, which will be bound by this Notice as it applies to Personal Information.

With Your Consent

With your consent, we may use or share Personal Information in ways not specifically described in this Notice.

Sales

We do not sell, rent, or loan any of your Personal Information to any third party for money. However, we may engage in transactions sharing and leveraging your data that may be seen as a “sale” of your data under certain applicable laws. You may notify us at privacy@mistercarwash.com or 1-866-254-3229 or via our Privacy Preference Center to opt-out of any sale of your information.

We do not share your Personal Information with third parties for those third parties’ direct marketing purposes.

Nevada Residents

Under Nevada law, we do not sell your Personal Information. However, if you are a Nevada resident, you may submit a request that we not sell any Personal Information we have collected about you by contacting us at privacy@mistercarwash.com or 1-866-254-3229 or via our Privacy Preference Center.

Data We Do Not Intend To Collect

Sensitive or Personal Information

“Sensitive Data” is any data that reveals your racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, or that involves genetic or biometric data or data concerning health or sexual orientation. We do not intend to collect any Sensitive Data from you. Please do not provide Sensitive Data to us through the Site, App, Social Media, or any other form of communication.

Children

We are committed to protecting children’s privacy. The Site is not directed at children under 16 years of age. We do not knowingly collect, use, or share Personal Information from children under 16. If a parent or legal guardian learns that their child provided us with Personal Information without his or her consent, please contact us and we will make commercially reasonable attempts to delete such Personal Information.

Data Security

We use commercially reasonable technical and organizational measures to help secure all Personal Information against loss, misuse, and alteration. While we cannot guarantee it, we use industry-standard protections to help safeguard against such occurrences. If a breach of our systems occurs, we will notify you of the breach only if and as required under applicable law.

You understand that no data transmission over the internet or a mobile device can be guaranteed to be 100% secure. While we strive to protect your personal information, we do not guarantee the security of personal information and you provide personal information at your own risk.

Data Retention

The factors that influence how long we retain data about you include what information is needed to facilitate our relationship, provide services and experiences to you, and meet legal and contractual retention requirements. We retain information for specific business and legal purposes. Sometimes business and legal requirements require us to retain certain information for specific purposes for an extended period of time.

Access from Outside the United States

This Site and App are operated and maintained by Mister and its vendors from the United States and is intended solely for a United States audience. If you access the Site or the App from outside the United States, please be aware that Personal Information will be transferred to, stored in, and processed in the United States. U.S. data protection and related laws may not be as comprehensive as those from where you access the Site or App.

Third-Party Sites

The Site and App may link to, or be linked to, websites not controlled by us. We are not responsible for third parties’ privacy policies or practices. This Notice does not apply to any third-party websites or to any data that you provide to third parties. You should read the privacy policy for each website that you visit.

Access and Update Your Personal Information

To access or update your Personal Information as it exists in our records, please contact us using the information below.

Car Wash Partners, Inc.

Attention: Data Privacy Officer

222 E. 5th St.

Tucson, AZ 85705

www.mistercarwash.com

1-866-254-3229

privacy@mistercarwash.com

Contact Us

If you have any questions, you may contact us as forth below:

Car Wash Partners, Inc.

Attention: Data Privacy Officer

222 E. 5th St.

Tucson, AZ 85705

www.mistercarwash.com

1-866-254-3229

privacy@mistercarwash.com