Privacy Policy — This Rock Entertainment, LLC

1. Introduction and Scope

This Privacy Policy explains how This Rock Entertainment, LLC ("This Rock," "TRE," "we," "us," or "our"), a Texas limited liability company based in Humble, Texas, collects, uses, discloses, retains, and protects personal information.

We operate globally, and our websites, landing pages, email communications, and advertising may be accessed from and directed to audiences around the world. This Policy is intended to apply to visitors wherever they are located, including the United States, the European Economic Area ("EEA"), the United Kingdom, and Switzerland. Our practices are designed to meet both United States and European requirements.

This Rock is a faith-based film and television production company committed to creative excellence, biblical truth, and values-driven storytelling.

This Policy applies to the whole business, including:

• Our main website: https://this-rock.com/
• Film landing pages and pages for individual films, including the Why Wait? page at https://this-rock.com/why-wait/
• Landing pages for other films now or in the future;
• Email communications, newsletters, and film-link messages we send to a global audience;
• Social-media and advertising pages we operate or use, including Meta platforms such as Facebook and Instagram; and
• Other interactions and communications connected with those websites, landing pages, email communications, social-media pages, and advertising activities.

This Policy applies only to This Rock Entertainment, LLC and describes only our own privacy practices. Production partners and other companies that work with us on individual films or projects are separate businesses with their own privacy practices. Those companies do not have access to our email list or our website and advertising data unless separately authorized in writing or required by law. Their handling of personal information is governed by their own privacy policies, not this Policy.

By using our websites or submitting information to us, you acknowledge that you have read this Policy. Where consent is required by applicable law, we will request it through the applicable website, form, consent tool, or other process.

2. Information We Collect

We may collect the following categories of personal information.

Information You Provide Directly. Depending on how you interact with us, you may provide:

• Your email address when you sign up to watch a film, receive a film link, or join our email list;
• Your name;
• Postal or mailing address;
• Telephone number;
• Casting-application information, where a casting form is used, including date of birth, emergency-contact information, food allergies, availability, union status, and role applied for; and
• Information you provide in correspondence, inquiries, customer-service requests, social-media communications, or other messages.

You should not send Social Security numbers, financial-account information, medical information, passwords, or other highly sensitive information through a website form, social-media message, or ordinary email unless we specifically request it through a secure process.

Information Collected Automatically. When you visit our websites and landing pages, we and our service providers may automatically collect:

• Internet Protocol address;
• Browser type and version;
• Device type;
• Operating system;
• Pages viewed;
• Date and time of access;
• Time spent on a page;
• Referring website or URL;
• Approximate location derived from an IP address;
• Cookie and advertising identifiers; and
• Website navigation and usage information.

Information Received from Service Providers and Advertising Partners. We may receive information from service providers and advertising or measurement partners, including email engagement data such as whether messages were opened or links were clicked, signup information, campaign information, advertising interactions, conversion information, and other measurement data reported by the applicable platform.

3. Tracking Technologies, the Meta Pixel, and Advertising

Our websites and landing pages, including the Why Wait? page, use tracking technologies such as cookies, pixels, web beacons, and similar tools.

Our film landing pages use the Meta Pixel, provided by Meta Platforms, Inc., formerly Facebook, as an advertising and measurement technology. When you load a page that uses the Meta Pixel, the pixel automatically collects and transmits information to Meta, including:

• Internet Protocol address;
• Browser type and version;
• Device type;
• Operating system;
• Pages viewed;
• Date and time of access;
• Time spent on a page;
• Referring website or URL;
• Approximate location derived from an IP address;
• Cookie and advertising identifiers; and
• Website navigation and usage information.

This collection and transmission may occur whether or not you submit an email form and whether or not you click anything on the page.

We use this information to measure advertising and campaign performance, understand how visitors reach and use our pages, build and refine advertising audiences, and support remarketing or cross-context behavioral advertising, including on Meta platforms such as Facebook and Instagram.

Our advertising is global, including on Meta platforms such as Facebook and Instagram.

Our advertising accounts and Meta dataset are owned by This Rock Entertainment, LLC and are used for our own films and campaigns. Meta acts as a separate business and handles information under its own privacy policy.

Consent for cookies and tracking in Europe and the United Kingdom. Where you are located in the European Economic Area, the United Kingdom, or Switzerland, we do not set non-essential cookies, including advertising and measurement cookies such as the Meta Pixel, and we do not allow the pixel to fire, until you have given your consent through a consent banner or preference center shown when you first visit the page. Before you consent, the pixel is initialized in a revoked state so that no information is transmitted to Meta. You may accept or reject non-essential cookies, and you may change or withdraw your consent at any time through the "Your Privacy Choices" link in the website footer. Rejecting non-essential cookies does not prevent you from using our websites, viewing our film pages, or watching our films.

For more information about Meta's practices, review:

• Meta Privacy Policy: https://www.facebook.com/privacy/policy/
• Meta Ad Preferences: https://www.facebook.com/adpreferences/
• Meta Off-Facebook Activity controls: https://www.facebook.com/off_facebook_activity

If we enable advanced matching or a similar feature in the future, a hashed, not readable, version of your email address may be transmitted to Meta for matching. We will update this Policy before enabling that feature. A hashed email address remains personal information under most privacy laws even though Meta cannot read it in plain text.

We may also use additional analytics, advertising, or measurement tools now or in the future. Those tools may collect similar categories of technical, device, usage, and identifier information.

4. Cookies and Similar Technologies

Cookies are small data files stored on a browser or device. Pixels, web beacons, local storage, software-development kits, and similar technologies may collect or receive information about website visits, device activity, or interactions.

We use strictly necessary cookies to support website operation, security, navigation, and forms. We also use advertising and measurement cookies and similar technologies to measure campaigns, understand visitor activity, and support advertising related to our films.

The following table describes cookies and similar technologies that may be used on our websites and landing pages:

Cookie names and durations may change as our websites, providers, and configurations change. This table will be updated when those changes materially affect the cookies or similar technologies used.

You can control or delete cookies through your browser settings. Disabling or deleting certain cookies may affect website functionality, forms, film-link delivery, or other services.

You may also manage certain advertising choices through:

• Meta Ad Preferences: https://www.facebook.com/adpreferences/
• Meta Off-Facebook Activity controls: https://www.facebook.com/off_facebook_activity
• Digital Advertising Alliance opt-out page: https://optout.aboutads.info/
• Network Advertising Initiative opt-out page: https://optout.networkadvertising.org/
• Google Ads Settings: https://adssettings.google.com/

5. Email Communications, Signups, and Kit

Our signup forms and email marketing are operated through third-party email service providers, currently Kit (formerly ConvertKit).

When you submit your email address to watch a film or join our email list, the applicable provider receives and stores your email address and related signup and email engagement data. We use that information to deliver film links, send occasional updates about This Rock Entertainment films and ministry news, and manage our subscriber list.

Signing up is voluntary. Watching a film does not require you to consent to receive marketing email. Where a form offers both film-link delivery and marketing communications, those purposes will be described clearly and separately where required by law.

Every commercial email includes an unsubscribe link. You may opt out of marketing email at any time by using that link or contacting us at info@this-rock.com.

For visitors in the EEA, the UK, or Switzerland, we send marketing email only with your consent, obtained separately from your request to watch a film, and you may withdraw that consent at any time using the unsubscribe link or by contacting us.

Our commercial emails are intended to use accurate sender and subject information, identify commercial messages where required, and include a valid postal address and an unsubscribe link in the email footer as required by applicable law, and include the following valid postal address in the email footer:

This Rock Entertainment, LLC
4830 Wilson Rd
Suite 300 #1130
Humble, TX 77396

The specific third-party email service providers we use may change from time to time. When they do, this Policy will be updated and the "Last Updated" date will change, without any change to the categories of data collected or the purposes for which it is used.

6. How We Use Information

We may use personal information to:

• Provide and operate our websites and landing pages;
• Deliver film links and other requested content;
• Send email updates, newsletters, and production-related communications;
• Respond to questions, requests, and inquiries;
• Receive and review casting applications;
• Coordinate auditions, productions, schedules, travel, and related activities;
• Maintain emergency-contact and safety information;
• Measure and improve our advertising, websites, landing pages, email communications, and content;
• Build and refine audiences for our films;
• Understand campaign performance and visitor engagement;
• Operate, maintain, secure, and improve our systems;
• Prevent fraud, misuse, unauthorized access, and security incidents;
• Comply with legal, accounting, insurance, tax, regulatory, and recordkeeping obligations;
• Establish, exercise, or defend legal claims; and
• Carry out purposes disclosed when information is collected or for which you provide consent.

7. How We Share Information

We may disclose personal information to the following categories of recipients.

Internal Personnel. We may share personal information with This Rock personnel who need it to operate the business, provide services, review casting applications, coordinate productions, respond to inquiries, manage communications, or perform legal, safety, administrative, or technical functions.

Service Providers. We may share personal information with service providers acting on our behalf and subject to appropriate confidentiality and data-protection obligations. Categories include:

• Hosting and website-infrastructure providers;
• Third-party email service providers, currently Kit (formerly ConvertKit);
• Advertising, analytics, and measurement platforms, currently Meta Platforms, Inc.;
• Cloud-storage, spreadsheet, and database providers;
• Payment and donation processors; and
• Information-technology, security, legal, accounting, and administrative providers.

The specific providers we use may change from time to time. When they do, this Policy will be updated and the "Last Updated" date will change, without any change to the categories of data collected or the purposes for which it is used.

Production and Casting Vendors. Where reasonably necessary for a casting or production purpose, we may share relevant information with production-related vendors, including casting professionals, production coordinators, crew managers, payroll providers, insurers, safety personnel, and other vendors supporting a production.

Legal, Safety, and Compliance Disclosures. We may disclose personal information:

• To comply with a subpoena, court order, law, regulation, or legal process;
• To respond to a lawful request from a governmental authority;
• To establish, exercise, or defend legal rights;
• To investigate fraud, abuse, security incidents, or unlawful activity;
• To protect the rights, safety, property, or operations of This Rock or others; or
• In an emergency involving a person's health or safety, when reasonably necessary.

Business Transfers. Personal information may be disclosed in connection with an actual or proposed merger, acquisition, financing, reorganization, bankruptcy, sale of assets, or other business transaction.

We do not sell personal information for monetary consideration. However, we transmit information collected through the Meta Pixel to Meta for advertising measurement, audience building, and remarketing. This activity may be treated as "sharing" for cross-context behavioral advertising under certain state privacy laws.

Visitors may opt out as described in the "Your Privacy Choices" section. Where applicable law requires consent, we obtain consent before the pixel fires. We honor recognized universal opt-out preference signals where required by law.

8. Data Retention

We retain personal information for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law.

Email and subscriber information may be retained until you unsubscribe or request deletion, plus a reasonable period afterward for suppression lists, records, fraud prevention, and legal compliance.

Casting-application information may be retained for approximately one to two years from submission or from the conclusion of the applicable production, whichever is later.

Correspondence may be retained for as long as needed to respond to the communication, administer the relationship, resolve disputes, maintain records, and satisfy legal or business obligations.

Website, advertising, campaign, and measurement data may be retained according to the periods established by the applicable providers and the settings in our accounts.

We may retain information for a longer period when:

• A longer period is required by law;
• The information is reasonably necessary for a legal claim or defense;
• The information is needed to resolve a dispute;
• The information is needed to complete a transaction or production obligation; or
• The information is contained in a secure backup scheduled for deletion in the ordinary course.

9. Security

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure.

Our safeguards may include:

• Limiting access to personnel and vendors with a business need;
• Using reasonable access controls;
• Using encryption in transit where supported by the applicable service;
• Reviewing service-provider practices;
• Maintaining reasonable administrative procedures;
• Taking steps to protect email, files, and application records; and
• Retaining information only as long as reasonably necessary.

No method of transmission over the Internet or method of electronic storage is completely secure. Accordingly, we cannot guarantee the absolute security of personal information.

10. Children's Privacy

Our websites, landing pages, email communications, and services are not directed to children under 13. We do not knowingly collect personal information from children under 13 without legally required parental consent.

Where a production involves a minor, a parent or legal guardian must submit the application and provide any consent required by applicable law. We may request information reasonably necessary to verify parental or guardian authority.

If we learn that we have collected personal information from a child under 13 without the required consent, we will take reasonable steps to notify the parent or guardian and delete the information, subject to legal obligations and legitimate safety or recordkeeping needs.

A parent or legal guardian who believes a child under 13 has submitted information without appropriate consent may contact us at info@this-rock.com with the subject line "Children's Privacy Request." The request should identify the child's name and the information believed to have been submitted. We may request reasonable information to verify the requester's identity and parental or guardian authority.

Where we rely on consent for information-society services offered to a child in the European Economic Area or the United Kingdom, we require consent from a parent or guardian where the child is below the applicable age of digital consent. The age of digital consent is 16 in some countries and as low as 13 in others depending on the member state. We will not knowingly collect personal information from a child below the applicable age without the required parental consent, and we will delete such information on notice.

We intend to comply with the Children's Online Privacy Protection Act ("COPPA") and other applicable laws concerning children's information.

11. Your Rights and Choices

Depending on where you live and whether a particular law applies to This Rock, you may have rights under the Texas Data Privacy and Security Act, the California Consumer Privacy Act, the California Privacy Rights Act, CalOPPA, the GDPR, the UK GDPR, or other applicable privacy laws.

These rights may include the right to:

• Know or access the categories and specific pieces of personal information we collect, use, disclose, or retain;
• Request correction of inaccurate personal information;
• Request deletion of personal information, subject to legal exceptions;
• Obtain a copy of personal information in a portable format;
• Opt out of the sale of personal information;
• Opt out of targeted or cross-context behavioral advertising;
• Limit certain uses or disclosures of sensitive personal information where applicable;
• Withdraw consent where processing is based on consent;
• Appeal a decision denying a privacy request;
• Receive equal treatment and not be discriminated against for exercising privacy rights; and
• Use an authorized agent to submit a request where permitted by law.

We do not sell personal information for monetary consideration. However, our Meta Pixel activity may be treated as "sharing" for cross-context behavioral advertising under certain laws.

These rights depend on applicable law, the individual's location, the nature of the information, and the circumstances of the processing.

California Residents. California residents may have rights under the CCPA, CPRA, and CalOPPA, including rights to know, access, correct, delete, obtain a copy of personal information, opt out of sale or sharing, limit certain uses of sensitive personal information, and receive non-discriminatory treatment.

This Rock does not currently believe it falls within the CCPA or CPRA thresholds, including:

• Annual gross revenue of approximately $26.6 million or more, as adjusted by applicable law;
• Buying, selling, or sharing the personal information of 100,000 or more California consumers or households; or
• Deriving 50 percent or more of annual revenue from selling or sharing personal information.

Nevertheless, we provide the mechanism described in the "Your Privacy Choices" section. California residents may also use an authorized agent, subject to legally permitted verification and authorization procedures.

Texas Residents. Texas residents may have rights under the Texas Data Privacy and Security Act, including rights to access, correct, delete, and obtain a copy of personal data, as well as rights concerning consent withdrawal and certain targeted-advertising or sale practices.

This Rock is likely an exempt small business under the Texas Data Privacy and Security Act. The SBA size standard for motion picture and video production under NAICS 512110 is currently $40 million in average annual receipts. Eligibility under Texas law may depend on the company's actual circumstances, applicable statutory definitions, and future legal developments.

Nevertheless, we provide the mechanism described in the "Your Privacy Choices" section and intend to honor valid opt-out signals as a matter of practice.

European Economic Area, United Kingdom, and Switzerland Visitors. If the GDPR, UK GDPR, or another applicable data-protection law applies to your personal information, you may have rights to:

• Access your personal information;
• Correct inaccurate or incomplete information;
• Request erasure;
• Request restriction of processing;
• Object to processing;
• Request data portability;
• Withdraw consent when processing is based on consent; and
• Lodge a complaint with a competent data-protection or supervisory authority.

Legal bases for processing (EEA, UK, and Switzerland). For visitors in the EEA, the UK, or Switzerland, we process personal information on the following bases:

• Consent, for advertising and measurement cookies, the Meta Pixel, remarketing, and marketing email;
• Performance of a contract or steps at your request, to deliver a film link or content you have asked for;
• Legitimate interests, to operate and secure our websites, prevent fraud and misuse, and understand aggregate usage, provided those interests are not overridden by your rights; and
• Legal obligation, to comply with applicable law.

Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing that occurred before withdrawal. Where we rely on legitimate interests, you have the right to object.

Date of birth, food-allergy, and other safety or health-adjacent information in casting applications may be treated as sensitive, and we will request consent where the law requires it.

International Data Transfers. This Rock is based in the United States, and our service providers, including our advertising and measurement platforms and our email service provider, may process and store personal information in the United States and in other countries.

Where we transfer personal information out of the EEA, the UK, or Switzerland, we rely on appropriate safeguards, which may include the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, an adequacy decision, or another lawful transfer mechanism. You may contact us for more information.

We have appointed or will appoint a representative in the European Union or the United Kingdom where required by applicable law. If none is required, you may still contact us at info@this-rock.com.

EEA, UK, and Swiss visitors have the right to lodge a complaint with their local supervisory authority.

Do Not Track and Global Privacy Control. Some browsers transmit "Do Not Track" signals. Because there is no uniform industry standard for responding to all Do Not Track signals, our websites may not respond to those signals except where required by applicable law.

Where required by law, we honor a valid Global Privacy Control ("GPC") signal or other recognized universal opt-out mechanism as an opt-out of sale or sharing for cross-context behavioral advertising. We also intend to honor valid opt-out signals as a matter of practice.

Your Privacy Choices. You have the right to opt out of the transmission of your information to advertising and measurement platforms, including Meta, for advertising, audience building, and remarketing. We provide the "Your Privacy Choices" link in the website footer to exercise that right.

Visitors in the EEA, the UK, and Switzerland have the right to consent to non-essential cookies before they are set and to withdraw consent at any time.

Submitting an opt-out request does not limit access to our websites, our film pages, or the films.

We honor recognized universal opt-out preference signals, including Global Privacy Control, as an opt-out of sale or sharing where the law requires it.

You may also use Meta's own controls, including Meta Ad Preferences and Meta Off-Facebook Activity controls, to limit how Meta uses information about your activity.

12. Submitting a Privacy Request

You may submit a privacy request by emailing info@this-rock.com with the subject line "Privacy Rights Request" or by mailing a written request to:

This Rock Entertainment, LLC
Attn: Privacy
4830 Wilson Rd
Suite 300 #1130
Humble, TX 77396

Please include:

• Your name;
• The type of request;
• The email address or other information associated with your interaction with us;
• The website, landing page, or service involved, if known; and
• Any additional information reasonably necessary to locate the applicable records.

We may need to verify your identity before completing a request. Verification may require confirming information already associated with your records. We will not request more information than reasonably necessary for verification.

You may use an authorized agent where permitted by law. We may require proof of the agent's authority and may separately verify your identity.

For visitors in the European Economic Area, the United Kingdom, and Switzerland, we respond to authenticated privacy requests without undue delay and in any event within one month of receipt. Where a request is complex or we have received a number of requests, we may extend that period by up to two further months; if we do so, we will inform you within one month of receipt and explain the reason for the delay.

For other visitors, including California and Texas residents, we generally respond to authenticated privacy requests within 45 days of receipt. If additional time is reasonably necessary, we may extend the response period by up to an additional 45 days where permitted by applicable law. We will provide notice of the extension and its reason within the initial response period.

If we decline to act on a request, we will explain the reason to the extent required by law and provide instructions for appealing the decision.

You may appeal a denied request by emailing info@this-rock.com with the subject line "Privacy Appeal." Please include the original request, the date of our response, and the reason you believe the decision should be reconsidered.

We will process privacy requests without charge unless applicable law permits a reasonable fee for requests that are manifestly unfounded, excessive, repetitive, or otherwise permitted to be charged.

13. Third-Party Links and Platforms

Our websites may link to third-party websites, platforms, and services, including streaming platforms, social-media platforms, advertising platforms, email-service providers, production resources, and GoFundMe at:

https://www.gofundme.com/f/ThisRock

Information collected by Meta, our third-party email service provider, YouTube, Tubi, other streaming platforms, or social-media platforms is governed by those parties' own privacy policies. You should review the applicable privacy policy before submitting information to a third-party platform.

We are not responsible for the privacy, security, content, or data practices of third-party websites, platforms, or services.

14. Changes to This Privacy Policy

We may update this Policy from time to time to reflect new films, landing pages, advertising platforms, service providers, technologies, business practices, or legal requirements.

When we make changes, we will post the revised Policy on our website and update the "Last Updated" date above.

The current version of this Policy is always the version posted on our website. It applies to all of our websites, landing pages, and email communications described in Section 1, whether or not those websites, landing pages, communications, films, platforms, or providers existed when this Policy was last updated.

The specific providers we use may change from time to time. When they do, this Policy will be updated and the "Last Updated" date will change, without any change to the categories of data collected or the purposes for which it is used.

If a change is material, we will provide additional notice or obtain consent where the law requires it.

If we begin offering our websites or advertising to audiences in additional countries, we will update this Policy and provide any additional notices or consent mechanisms those jurisdictions require.

Continued use of our websites after a revision takes effect means that you acknowledge the updated Policy, except where applicable law requires additional consent.

15. Contact Us

Questions, concerns, privacy requests, consent withdrawals, and appeals may be submitted to:

This Rock Entertainment, LLC
Attn: Privacy
4830 Wilson Rd
Suite 300 #1130
Humble, TX 77396
Email: info@this-rock.com
Phone: 281-326-6084

Privacy-rights requests should use the subject line "Privacy Rights Request." Appeals should use the subject line "Privacy Appeal."

16. Governing Law

This Privacy Policy is governed by the laws of the State of Texas, without regard to conflict-of-law principles, except to the extent applicable privacy or consumer-protection laws provide rights that cannot lawfully be waived or limited.

17. Our Commitment

This Rock Entertainment, LLC is committed to creating faith-based, values-driven entertainment with excellence, integrity, and respect for the people and communities we serve.

We seek to handle personal information responsibly and transparently while building stories that inspire audiences and point toward the transformative power of Jesus Christ.

We use advertising tools such as the Meta Pixel to share our films with audiences, and we undertake to do so transparently and with respect for visitor choices.