Finder: Retailer Child Safety Information Handling Policy

RETAILER CHILD-SAFETY & INFORMATION-HANDLING POLICY

Program: Dearist Finder | Company: Chapter Group LLC

Effective Date: September 1, 2026

1. Purpose

This Policy establishes the procedures that Participating Retailers and their employees must follow when operating as a location for Dearist Finder (the “Program”).

The Program is designed to allow children to participate in a supervised pen pal experience while minimizing the personal information collected and preventing participating children from exchanging home addresses or direct contact information.

This Policy establishes requirements for Parent/Guardian registration; collection of participant information; Parent/Guardian authorization and consent; handling of letters; notifying Parents/Guardians; protecting children’s information; child-safety practices; incident reporting; and secure handling and destruction of Program records.

This Policy supplements the Retailer Participation Agreement and does not replace it. If there is a conflict, the Retailer Participation Agreement controls unless the Parties agree otherwise in writing. No provision of this Policy requires conduct prohibited by applicable law.

2. Program Workflow

The standard Program workflow is:

Parent/Guardian completes the Program’s designated registration process.
Retailer or the designated registration channel collects only the authorized information.
The Parent/Guardian completes the Program’s designated authorization/consent process before participation begins, including any legally required verifiable parental consent where applicable.
Registration information is entered into or transmitted to the Program’s designated system.
Company manages the Program database and matching process.
A participating child’s letter is routed to the designated Participating Retailer location.
Retailer receives and securely holds the letter.
Retailer notifies the Parent/Guardian that a Program letter is ready for pickup.
Parent/Guardian or other authorized person picks up the letter from the Retailer.
Retailer records or confirms pickup according to Program procedures.

Retailers do not exchange residential addresses between participants.

3. Retailer Role

The Retailer’s role is limited to the activities assigned by Company. Unless specifically authorized, Retailers do not:

select pen pals;
independently match children;
exchange participant contact information;
communicate with participating children outside ordinary Program administration;
determine whether a child is suitable for another participant;
conduct independent background investigations of participants;
retain Program records for unrelated purposes; or
create independent participant databases.

Company controls the Program’s matching and participant-management processes.

4. Employee Access

Only employees or personnel who need access to the Program to perform their assigned duties should handle Program information or correspondence. Retailers should limit access to the minimum number of personnel reasonably necessary.

Retailer management is responsible for ensuring that employees understand this Policy before they begin handling Program registrations, information, or correspondence.

5. Registration Procedure

When a Parent/Guardian registers a child, the employee or designated registration process should communicate that:

the child is being registered for the Program;
the Program requires Parent/Guardian registration and authorization;
the Program is designed for children currently in 2nd to 8th school grades;
The Program will match children based on school grade matching criteria;
the Program does not require children to exchange home addresses; and
the Parent/Guardian must review Program’s Terms of Service and Privacy Policy before emailed by Program in order to confirm registration.

Authorized information is limited to:

Parent/Guardian: full name and email address.
Child: first name or approved nickname and current school grade.

Do not collect additional information unless the Program expressly authorizes it.

Employees must not ask for or record the child’s date of birth, exact age, home address, telephone number, personal email, school name, teacher’s name, classroom, social-media information, or other unnecessary identifying information.

If a Parent/Guardian voluntarily provides information that is not required, employees should not enter that information into the Program system unless the system specifically requests it.

6. Parent/Guardian Authorization and Consent

The Parent/Guardian must complete the Program’s designated authorization and consent process before the child’s participation begins.

Where the Program uses separate acknowledgments or confirmations, these may include: (1) agreement to the Program Terms of Service; (2) acknowledgment that the Parent/Guardian has reviewed the Privacy Policy; and (3) Parent/Guardian authorization for the child’s participation. These are distinct actions and should not be treated as interchangeable.

Where applicable law requires a particular form or method of verifiable parental consent, the Program’s designated consent process must be followed.

Retailer employees must not:

accept a child’s verbal permission as a substitute for required Parent/Guardian authorization or consent;
register a child without the required Parent/Guardian authorization;
alter or falsify a consent record;
sign on behalf of a Parent/Guardian; or
tell a Parent/Guardian that consent or authorization is unnecessary.

If an employee is uncertain whether a person is authorized to register a child, the employee should stop the registration and contact the Program. Program Contact: info@hellodearist.com

7. Registration Accuracy

Employees should enter information carefully and accurately. Before completing registration, the employee should confirm with the Parent/Guardian the Parent/Guardian name, Parent/Guardian email, child’s name or approved nickname, and child’s current school grade.

Employees should not make assumptions about a child’s grade or alter information without the Parent/Guardian’s direction.

8. Handling Registration Information

Paper registration forms, if used, must be kept out of public view, stored in a secure location, inaccessible to unauthorized customers, transferred to the Program system promptly, and securely destroyed when Company instructs the Retailer to do so.

Employees must not photograph registration forms; keep personal copies; write participant information in personal notebooks; store participant information in personal phones; email participant information through personal email accounts; or maintain unofficial participant lists.

9. Program Database

Where the Program provides an electronic registration system, employees must use only that system.

Employees must not share usernames or passwords; allow customers to use employee accounts; leave the Program system logged in and unattended; download participant information unless authorized; export participant lists; screenshot participant records; enter information into unrelated Retailer systems; or use Program information for other business purposes.

Employees must log out or otherwise secure the system when leaving the workstation unattended.

Program-Designated Correspondence Address

The Program is designed so that participating pen pals correspond with one another using the designated mailing address of a Participating Retailer. The Participating Retailer’s address serves as the Program-designated correspondence address for receiving and distributing Pen Pal correspondence.

Correspondence between participants that is sent to, from, or through an address other than a Participating Retailer’s designated Program address is outside the scope of the Program. Retailer personnel should not treat such correspondence as Program correspondence or represent that it is subject to the Program’s procedures, safeguards, or information-handling practices.

The Program does not authorize or facilitate the exchange of participants’ residential addresses, personal telephone numbers, personal email addresses, school addresses, social-media contact information, or other direct-contact information for purposes of communicating outside the Program’s designated retailer-based correspondence process.

10. Letter Receipt

Letters will be routed to the designated Participating Retailer location rather than to a child’s home.

When a Program letter arrives, the employee should:

Confirm that it is addressed to the Program or designated recipient.
Place it in the designated secure Program storage area.
Do not leave the letter in a publicly accessible location.
Do not photograph, copy, reproduce, or alter the letter.
Do not discuss the letter’s contents with customers or employees who do not need to know.
Follow Company procedures for logging or recording receipt.

Retailer personnel should not open or read correspondence for the purpose of routine content screening unless specifically authorized by Company or required by applicable law.

11. Letter Storage

Program letters must be stored in a secure location that is not accessible to ordinary customers.

Retailers should not display children’s letters; leave letters on a public counter; place letters in an unlocked public mailbox; allow customers to sort through letters; take letters home; store letters in personal vehicles; or retain letters indefinitely.

Company may establish additional storage and retention requirements.

12. Letter Distribution

When a Parent/Guardian is notified that a letter is ready, the Retailer should follow the Program’s identification or verification procedure. The letter should be provided only to the authorized Parent/Guardian or other person authorized under Program procedures.

Employees should not provide letters directly to a child unless Company has expressly authorized that procedure, and should not provide letters to unrelated third parties.

The Retailer should not disclose information about the sender beyond what is displayed or authorized by the Program.

13. Parent/Guardian Notification

The Retailer should follow Program procedures for logging or recording receipt, which will generate a notification to the Parent/Guardian using the contact method authorized by the Program. The notification will contain only the information reasonably necessary to tell the Parent/Guardian that a Program letter is available.

14. Identity Verification at Pickup

Retailers should follow the Program’s designated procedure for verifying that the person collecting a letter is authorized.

If the Retailer is unable to verify the person’s authorization, the employee should not release the letter until the issue is resolved through the Program.

Employees should not create their own identification requirements unless permitted by Company policy and applicable law.

15. No Direct Contact

Retailer employees must not facilitate direct contact between participating children outside the Program.

Employees must not provide home addresses; telephone numbers; email addresses; social-media accounts; school information; or other direct-contact information.

If a child or Parent/Guardian asks an employee for another participant’s contact information, the employee should politely explain that the Program does not provide that information.

16. Employee Conduct Around Children

Retailer employees must maintain appropriate professional boundaries.

Employees must not seek private relationships with participating children; communicate privately with participating children; request personal contact information; offer personal social-media accounts; arrange private meetings; give inappropriate gifts; make sexualized comments; engage in inappropriate physical contact; make discriminatory or degrading comments; or otherwise engage in conduct that could reasonably make a child feel unsafe.

All Program-related interactions should occur in ordinary, visible business settings.

17. No Independent Marketing to Children

Retailers may not use Program participation to market unrelated products or services directly to children.

Employees must not use information learned through the Program to solicit children; add children to marketing lists; contact children outside the Program; invite children to unrelated activities; sell products directly to children; or create customer profiles about children.

Communications regarding the Program should generally be directed to the Parent/Guardian.

18. Child Privacy

Employees must treat all Program information concerning children as confidential.

Employees must not discuss a child’s participation, a child’s pen pal, a child’s correspondence, a child’s grade, a Parent/Guardian’s contact information, or other Program information with customers or unauthorized persons.

19. Personal Information in Correspondence

Children and Parents/Guardians should be instructed not to include unnecessary personal or direct-contact information in correspondence, including home addresses, personal telephone numbers, personal email addresses, social-media accounts, school location information, classroom information, teacher information, or other information that could facilitate direct contact.

Retailer personnel should not open or read correspondence for the purpose of searching for personal information.

If a participant, Parent/Guardian, employee, or other person independently reports that correspondence may contain prohibited personal information or presents a safety concern, Retailer personnel should notify the Program through the designated safety contact and follow Company instructions.

Employees should not conduct their own investigation or attempt to determine a participant’s identity, location, or other personal information.

20. Safety Concerns

Employees must promptly report serious safety concerns to Company. Safety concerns may come from a report, direct interaction, visible condition, or other information obtained without routine content review.

Examples include:

a child reporting that another participant made them uncomfortable;
a participant requesting another participant’s home address or direct-contact information;
a participant attempting to arrange a private meeting;
a report of threatening or sexualized communication;
suspected grooming behavior;
bullying or harassment;
attempts to obtain personal information;
suspicious behavior by an adult involving a child; or
any situation that causes an employee to reasonably believe a child may be at risk.

Safety Contact: Jennifer Yang / info@hellodearist.com

Employees should not open or read correspondence to look for these conditions unless Company specifically authorizes such review or applicable law requires it.

21. Emergency Situations

If an employee reasonably believes that a child or another person faces an immediate threat of serious harm, the employee should contact appropriate emergency services or law enforcement as appropriate. Company should also be notified as soon as reasonably practicable.

Nothing in this Policy prevents an employee or Retailer from making a report required by law.

22. Suspected Abuse or Exploitation

If an employee becomes aware of information suggesting that a child may be experiencing abuse, exploitation, or another serious threat, the employee must follow applicable law and Company reporting procedures.

Employees should not conduct their own investigation, interrogate a child, or attempt to obtain unnecessary details.

Instead, employees should:

Ensure the child is in an appropriate safe environment.
Notify the designated Program safety contact.
Follow applicable mandatory-reporting requirements.
Contact emergency services or appropriate authorities when required or appropriate.
Document only the information reasonably necessary under Program procedures.

23. Lost or Misdelivered Letters

If a Program letter cannot be located, notify the Program promptly; do not attempt to recreate or replace the letter without instruction; do not disclose the sender’s information to other customers; document the incident according to Program procedures; and cooperate with any investigation.

24. Incorrectly Delivered Letters

If a letter is received for the wrong Participating Retailer or appears to be intended for another location, do not open the letter unless authorized; secure it; notify Company; and follow Company’s instructions for return or forwarding.

25. Lost or Stolen Information

If registration information, a letter, computer, device, file, or other Program material is lost or stolen, the Retailer must notify Company promptly.

Examples include lost registration paperwork; a stolen computer containing Program information; a misplaced letter; unauthorized access to the Program system; an employee sending information to the wrong person; or an unauthorized person viewing participant information.

Security/Privacy Contact: Jennifer Yang / info@hellodearist.com

26. Privacy Incident Response

Retailer must promptly report any actual or suspected privacy or security incident. Employees should not attempt to conceal an incident.

Employees should:

Immediately secure the affected information if possible.
Notify the Retailer’s designated manager.
Notify Company through the designated security/privacy contact.
Preserve relevant information and records.
Follow Company’s instructions.

Retailer must not make public statements about a Program privacy incident without Company authorization unless legally required.

27. Photography and Recording

Employees must not photograph or record participating children for Program purposes unless expressly authorized by Company and all required permissions have been obtained.

Employees must not photograph registration forms, children’s letters, Program database screens, participant lists, or other participant information for personal or unrelated business purposes.

28. Social Media

Retailer employees must not post or share children’s names, children’s letters, Program registration information, screenshots of Program records, photographs identifying participating children, or other participant information on personal or business social-media accounts without Company’s prior authorization and all required permissions.

29. Employee Questions

Employees should contact the Retailer’s designated Program manager or Company when uncertain about a Program procedure.

Employees should ask rather than improvise when dealing with child-safety concerns; privacy questions; unusual requests; disputed registrations; requests for participant information; questionable correspondence; or requests from law enforcement or other authorities.

30. Law Enforcement and Government Requests

If law enforcement, a government agency, or another authority requests Program information, employees should remain professional and cooperative; not alter or destroy records; notify Retailer management; notify Company when legally permitted; and follow Company’s instructions unless applicable law requires immediate disclosure.

Nothing in this Policy requires Retailer to delay or prevent a disclosure legally required by an authorized governmental authority.

31. Record Retention

Retailer must follow Company’s record-retention requirements. Retailers must not maintain independent permanent copies of Program information unless expressly authorized.

When instructed, Retailer must securely destroy or return registration forms; participant lists; correspondence; printed reports; notes containing participant information; and other Program records.

32. Secure Destruction

Paper records containing participant information should be destroyed using a method reasonably designed to prevent reconstruction, such as cross-cut shredding or an approved secure document-destruction service.

Electronic information must be deleted using the procedures specified by Company. Simply placing confidential records in ordinary trash is not sufficient where secure destruction is required.

33. Training

Retailer must ensure that personnel responsible for Program activities receive appropriate instruction concerning Program workflow; registration; Parent/Guardian authorization and consent; information minimization; confidentiality; letter handling; child safety; prohibited conduct; incident reporting; and privacy and security.

Company may provide training materials or require completion of Company-provided training.

34. Violations

A violation of this Policy may result in retraining; removal of an employee from Program duties; suspension of Program access; corrective action; termination of Retailer’s participation; or other action permitted under the Retailer Participation Agreement.

Serious violations involving child safety, intentional misuse of personal information, or unlawful conduct may result in immediate termination.

35. Policy Updates

Company may update this Policy when reasonably necessary to improve child safety; protect participant privacy; respond to changes in law; address operational issues; improve Program procedures; or respond to identified risks.

Company will provide Retailer with reasonable notice of material changes.

36. Acknowledgment

By participating in the Program, Retailer acknowledges that:

the Program involves children;
protecting children’s privacy and safety is a fundamental Program requirement;
Retailer will collect only authorized information;
the Program does not require children to exchange home addresses;
Program information is confidential;
Retailer personnel must maintain appropriate professional boundaries;
safety and privacy concerns must be promptly reported;
Program information may not be used for unrelated marketing;
Retailer must follow Company’s information-handling procedures; and
violations may result in suspension or termination of Program participation.

EMPLOYEE ACKNOWLEDGMENT

I acknowledge that I have received and reviewed the Dearist Finder Retailer Child-Safety & Information-Handling Policy.

I understand that I am responsible for following the Program’s requirements when handling participant information, registrations, correspondence, or interacting with Program participants.

Program correspondence must use the designated Participating Retailer address. Correspondence using a different address is outside the scope of the Program and should be referred to the Retailer’s designated Program contact rather than treated as ordinary Program correspondence.

37. Electronic Signatures

The Parties agree that electronic signatures and electronically transmitted copies of this Agreement may be treated as originals and will have the same legal effect as an original signature to the extent permitted by applicable law.

Employee Name: __________________________________

Retailer: ________________________________________

Position: ________________________________________

Signature: _______________________________________

Date: ___________________________________________

Manager/Supervisor: ______________________________

Manager Signature: _______________________________

Date: ___________________________________________