ALIBI MUSIC, LP DATA PRIVACY FRAMEWORK PROGRAM POLICY

NON-HR PERSONAL DATA

Effective Date: February 2, 2026

Alibi Music, LP (“we,” “us,” or “our”) complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce.

We have certified to the U.S. Department of Commerce that we adhere to the Data Privacy Framework Principles as stated at

regarding the processing of personal data received from the European Union, the United Kingdom, and Switzerland. If there is any conflict between the terms in this policy and the DPF Principles, the Principles shall govern.

1. Notice

We notify individuals about the purposes for which we collect and use their personal data.

  • Data Collected: We collect identifiers (name, email, IP address), commercial history (orders), and device metadata.
  • Purpose: Data is used to fulfill online sales, provide customer support, and comply with legal obligations.
  • Inquiries: Individuals may contact our Privacy Officer at with questions.
  • Authorities: We are subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

2. Choice

We offer individuals the opportunity to choose (opt-out) whether their personal data is to be disclosed to a third party or used for a purpose that is materially different from the purpose for which it was originally collected.

  • Sensitive Data: For "sensitive" personal data (e.g., health, philosophical beliefs, or trade union membership), we will obtain affirmative express consent (opt-in) before any such disclosure or use. At this time Alibi does not collect sensitive data for any person, including employees.

3. Accountability for Onward Transfer

To transfer personal data to a third party acting as a controller or agent, we comply with the Notice and Choice Principles. We enter into contracts with third-party agents to ensure they provide the same level of protection as required by the DPF.

Liability: Alibi Music, LP remains liable under the DPF Principles if an agent processes personal data in a manner inconsistent with the Principles, unless we prove we are not responsible for the event giving rise to the damage.

4. Personal Data Processing

We process a variety of categories of Personal Data about the visitors, purchasers, and users of our website as well as the Personal Data of Alibi Music employees and contractors. For instance, we process the Personal Data of users of website to provide products and services as well as improving user experience.

For a detailed description of the categories of Personal Data that we process about Alibi Music website visitors, purchasers, users, and others, the purposes for which we process such Personal Data, and the service providers to whom we disclose such Personal Data, please see our

.

For a detailed description of the categories of Personal Data that we process about Alibi Music website visitors, purchasers, users, and others who reside in the European Economic Area, United Kingdom and Switzerland, the purposes for which we process such Personal Data, and the service providers to whom we disclose such Personal Data, please see our

.

Role of Service Providers

We may disclose Personal Data to our service providers, who process Personal Data on our behalf. Our service providers may be located outside of your jurisdiction; however, we will either obtain your explicit consent to transfer your Personal Data to such third parties, or we will require those third parties to maintain at least the same level of confidentiality that we maintain for such Personal Data ourselves. Alibi Music remains liable for the protection of your Personal Data that we transfer to our service providers, except to the extent that we are not responsible for the event giving rise to any unauthorized or improper processing.

Other Disclosure of Your Personal Data

We may disclose your Personal Data (i) to the extent required by law or if we have a good-faith belief that such disclosure is necessary in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, or private parties, including but not limited to: in response to subpoenas, search warrants, or court orders, or (ii) if we sell or transfer all or a portion of our company’s business interests, assets, or both, or in connection with a corporate merger, consolidation, restructuring, or other company change, or (iii) to our subsidiaries or affiliates only if necessary for business and operational purposes as described in the section above.

We reserve the right to use, transfer, sell, and share aggregated, anonymous data, which does not include any Personal Data, for any legal business purpose, such as analyzing usage trends and seeking compatible advertisers, sponsors, clients, and customers.

If we must disclose your Personal Data in order to comply with official investigations or legal proceedings initiated by governmental and/or law enforcement officials, we may not be able to ensure that such recipients of your Personal Data will maintain the privacy or security of your Personal Data.

5. Security

We take reasonable and appropriate measures to protect personal data from loss, misuse, and unauthorized access, disclosure, alteration, and destruction, taking into account the risks involved in the processing and the nature of the personal data.

6. Data Integrity and Purpose Limitation

Consistent with the Principles, personal data must be limited to the information that is relevant for the purposes of processing.

  • We do not process personal data in a way that is incompatible with the purposes for which it has been collected or subsequently authorized by the individual.
  • To the extent necessary for those purposes, we take reasonable steps to ensure that personal data is reliable for its intended use, accurate, complete, and current.

7. Access

Individuals have the right to access the personal data that we hold about them. They may request to correct, amend, or delete that information where it is inaccurate or has been processed in violation of the DPF Principles, except where the burden or expense of providing access would be disproportionate to the risks to the individual’s privacy.

8. Recourse, Enforcement, and Liability

We have implemented mechanisms to ensure compliance with the DPF Principles.

  • Internal Complaints: We commit to resolve complaints within 45 days. Contact: privacy@alibimusic.com.
  • Independent Recourse: If a complaint is not resolved, we have designated ICDR-AAA as our independent dispute resolution body (provided at no cost to the individual).
  • Binding Arbitration: Under certain conditions, you may invoke binding arbitration for complaints not resolved by any of the other DPF mechanisms.
  • Compliance: We perform periodic self-assessments to verify that this policy is accurate and comprehensively implemented.

9. Alternative Dispute Resolution

In compliance with the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF, Alibi Music, LP commits to refer unresolved complaints concerning our handling of personal data received in reliance on the EU-U.S. DPF and the UK Extension to the EU-U.S. DPF and the Swiss-U.S. DPF to VeraSafe an alternative dispute resolution provider based in the United States. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, please visit

for more information or to file a complaint. The services of VeraSafe are provided at no cost to you.

Verification and Disclosure

In compliance with the DPF, Alibi Music, LP is required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.