GRANDIN ROAD PRIVACY POLICY

FINANCIAL INCENTIVES

We may from time-to-time offer “Incentives” such as discounts on goods, discounts on shipping, prizes for participating in contests, and other similar incentives. In connection with offering Incentives, we may collect a name, email address, phone/text number, or other personal data; t, as further described in in the specific Incentive. To the extent that we collect personal data of a California consumer participating in connection with offering an Incentive, then the value of the personal data provided in connection with the Incentive is generally calculated as the value of the Incentive less our expenses in operating the Incentive program and other costs associated with our business activities related to the Incentive.

A California consumer participating in an Incentive may opt-in to the Incentive by following the method of participation used for the Incentive. California consumers also have the right to withdraw from an Incentive at any time through the methods described in the terms and conditions of the Incentive program. Additionally, if an Incentive is related to receiving marketing emails or marketing text messages, a participating California consumer can withdraw from the Incentive by unsubscribing from the relevant communications, using the methods described in our Privacy Policy.

CCPA RIGHTS Following are rights of California consumers under CCPA. To exercise these rights, please submit a request through the form available at this link or call us at 1 (800) 491-5194. Please note that, if you submit a request to know, request to delete or request to correct, you may be asked to provide 2-3 pieces of personal information that we will match against our records to verify your identity.

Deletion A California consumer has the right to request the deletion of personal information we have collected from the consumer, but CCPA permits some personal information to be retained, notwithstanding a consumer’s deletion request.

Correction Taking into account the nature of personal information and the purposes of processing personal information, a California consumer has the right to request the correction of the consumer’s personal information if it is inaccurate.

Right to Know A California consumer has the right to request the disclosure of (1) the categories of personal information we have collected about that consumer; (2) the categories of sources from which that personal information is collected; (3) the business or commercial purpose for collecting, selling or sharing the personal information; (4) the categories of third parties to whom we disclosed personal information; (5) the categories of personal information that we sold, and for each category identified, the categories of third parties to which we sold that particular category of personal information; and (6) the categories of personal information that we sold, and for each category identified, the categories of third parties to which we sold that particular category of personal information.

A California consumer also has the right to request the specific pieces of personal information we have collected about that consumer.

Opt-out of sales and sharing A California consumer has the right to opt out of sales and sharing of personal information about that consumer. If you choose to use the Global Privacy Control (GPC) browser signal, you will only be opted out of online sales or sharing of personal information, and you will need to log in to retain settings or turn it on for each browser you use. To submit a request to opt out of offline sales and sharing, please use our form available above.

Non-Discrimination. A California consumer has the right that a business shall not discriminate against you because you exercised your rights under CCPA.

Agents Authorized agents may submit requests on a consumer's behalf by submitting the request through the same means listed under the rights above. Authorized agents must establish their qualification to act as an agent and we will still require verification directly from the consumer, unless the authorized agent possesses an appropriate power of attorney.

YOUR CALIFORNIA PRIVACY RIGHTS

If you are a resident of California, in addition to the rights set forth above, you have the right to request information from us regarding the manner in which we share certain categories of personal information with third parties and Affiliates for their direct marketing purposes. California law gives you the right to send us a request at a designated address to receive the following information:

1. the categories of information we disclosed to third parties for their direct marketing purposes during the preceding calendar year;
2. the names and addresses of the third parties that received that information; and
3. if the nature of the third party's business cannot be determined from their name, examples of the products or services marketed.

We may provide this information in a standardized format that is not specific to you. The designated email address for these requests is ps@grandinroad.com.

COLORADO PRIVACY DISCLOSURE

(Last Updated July 1, 2024)

This section is referred to as the "Colorado Privacy Disclosure" and is provided in connection with the Colorado Privacy Act (or “CPA”). Some terms in this Colorado Privacy Disclosure are defined in CPA.

This Colorado Privacy Disclosure only applies to people who are consumers under CPA.

This Colorado Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under CPA or to information or activity that is subject to exemptions under CPA.

This Colorado Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Colorado Privacy Disclosure or other privacy notices and policies. However, if any other notice about CPA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Colorado Privacy Disclosure as permitted by applicable law.

We process personal data when you use our services, including personal data in the following categories:

• Account information, such as credentials to access your accounts with us including password; security questions and answers; user names
• Communication information, such as the content messages sent through chat functions, emails, texts, or information that you send to us; recorded calls; technical information related to communications such as time, date or length of the communication
• Contact information, such as your name; email address; street address; zip code; telephone number; texting number
• Event information, such as information you provide if you participate in contests or sweepstakes; customer group or focus group information; in-person or remote attendance or participation in broadcasts or other events
• External information obtained from other sources, such as demographic information; updated shipping information
• Financial information, such as payment card information; gift card information; installment payment information; information related to private label credit card programs associated with our business
• Forum or feedback information, such as comments you make in any forum that we make available; product reviews; answers you provide in surveys
• Government identifier information, such as social security number (e.g., if you apply for a private label credit card); or driver’s license or identification card information
• Information about others, such as name and shipping details of people to whom you send gifts or other purchases; people who you refer to our services through referral features included in our services
• Location information, such as your location when you use our services or make a purchase
• Order and purchase information, such as items you add or remove to a shopping cart; items you purchase; items you return; items you activate (e.g., computer) after purchase; wish list information
• Preferences information, such as preferred sizes or colors of clothing
• Technical and online information, such as identifiers of devices you use to connect to our services; internet protocol addresses; social media or other online identifiers; information from other platforms where we interact including social media platforms operated by other companies
• User interaction information, such as pages you were visiting when you came to our websites and pages you went to when you left our website; pages browsed; items you look at, hover over or click; information you type into the services; interactions with advertisements; information collected through cookies, pixels, beacons, and other tracking technology
• Video and audio information, such as video or images that you send to us or upload into the services; recordings we make if you participate in events that we are recording
• Other information that you provide in your use of our services; information that we collect in the operation of our business
• Information created or inferred based on the categories above, such as analytics information

The examples in the categories above are not exclusive, and other kinds of personal data are included in these categories.

Please see below for details about our purposes for using certain categories of personal data.

When we de-identify data for purposes of CPA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

SALES TO THIRD PARTIES. We sell personal data that is within the categories in the table below. Beside each category of personal data are the categories of third parties to which such personal data is sold.

CPA Rights. Following are rights of Colorado consumers under CPA. To exercise these rights, please submit a request through our webform at this link or call us at 1-(800)-491-5194. Please note that we will need to authenticate you to a reasonable degree of certainty before we can process your request.

Access. A Colorado consumer has the right to ask us to confirm whether or not we process personal data about the Colorado consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

Copy. A Colorado consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Correction. Taking into account the nature of personal data and the purposes of processing personal data, a Colorado consumer has the right to have inaccuracies in the consumer’s personal data corrected.

Deletion. A Colorado consumer has the right to request the deletion of the consumer’s personal data, but CPA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. A Colorado consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under CPA, you may opt out of such sales if we do so in the future.

Profiling. A Colorado consumer has the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. While we do not engage in activities that come within the scope of profiling under CPA, you may opt out of such profiling if we do so in the future.

Targeted Advertising. We engage in targeted advertising. A Colorado consumer has the right to opt out of targeted advertising.

Appeal. A Colorado consumer has the right to appeal our decision with respect to a request to exercise a CPA right.

Agents. Authorized agents may submit requests on a Colorado consumer's behalf by submitting the request through the same means listed under the rights above. Authorized agents must establish their qualification to act as an agent, and we will still require verification directly from the consumer, unless the authorized agent possesses an appropriate power of attorney.

Universal Opt-outs. A Colorado consumer has the right to use the Universal Opt-outs authorized by the Colorado Department of Law to submit some requests. At this time, by using the Global Privacy Control (GPC) browser signal, you will only be opted out of online sales and sharing of personal information, and you will need to log in to retain settings or turn the opt-out on for each browser you use. To submit a request to opt out of offline sales and sharing, please either log in or use our form available above.

CONNECTICUT PRIVACY DISCLOSURE

(Last Updated December 29, 2023)

This section is referred to as the "Connecticut Privacy Disclosure" and is provided in connection with the Connecticut Data Privacy Act (or “CTDPA”). Some terms in this Connecticut Privacy Disclosure are defined in CTDPA.

This Connecticut Privacy Disclosure only applies to people who are consumers under CTDPA.

This Connecticut Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under CTDPA or to information or activity that is subject to exemptions under CTDPA.

This Connecticut Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Connecticut Privacy Disclosure or other privacy notices and policies. However, if any other notice about CTDPA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Connecticut Privacy Disclosure as permitted by applicable law.

Categories of personal data.We process personal data when you use our services, including personal data in the following categories:

• Account information, such as credentials to access your accounts with us including password; security questions and answers; user names
• Communication information, such as the content messages sent through chat functions, emails, texts, or information that you send to us; recorded calls; technical information related to communications such as time, date or length of the communication
• Contact information, such as your name; email address; street address; zip code; telephone number; texting number
• Event information, such as information you provide if you participate in contests or sweepstakes; customer group or focus group information; in-person or remote attendance or participation in broadcasts or other events
• External information obtained from other sources, such as demographic information; updated shipping information
• Financial information, such as payment card information; gift card information; installment payment information; information related to private label credit card programs associated with our business
• Forum or feedback information, such as comments you make in any forum that we make available; product reviews; answers you provide in surveys
• Government identifier information, such as social security number (e.g., if you apply for a private label credit card); or driver’s license or identification card information
• Information about others, such as name and shipping details of people to whom you send gifts or other purchases; people who you refer to our services through referral features included in our services
• Location information, such as your location when you use our services or make a purchase
• Order and purchase information, such as items you add or remove to a shopping cart; items you purchase; items you return; items you activate (e.g., computer) after purchase; wish list information
• Preferences information, such as preferred sizes or colors of clothing
• Technical and online information, such as identifiers of devices you use to connect to our services; internet protocol addresses; social media or other online identifiers; information from other platforms where we interact including social media platforms operated by other companies
• User interaction information, such as pages you were visiting when you came to our websites and pages you went to when you left our website; pages browsed; items you look at, hover over or click; information you type into the services; interactions with advertisements; information collected through cookies, pixels, beacons, and other tracking technology
• Video and audio information, such as video or images that you send to us or upload into the services; recordings we make if you participate in events that we are recording
• Other information that you provide in your use of our services; information that we collect in the operation of our business
• Information created or inferred based on the categories above, such as analytics information

The examples in the categories above are not exclusive, and other kinds of personal data are included in these categories.

When we de-identify data for purposes of CTDPA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

Purposes for processing personal data. We process personal data for the purposes described in the section above titled “How we may use personal information we collect”.

Third parties. We use third parties to help us in the operation of our business, and these third parties may have access to any of the personal data described in the categories of personal data above. Please see the section above titled “Who we share personal information with” for the categories of third parties with which we share personal data.

CTDPA Rights. Following are rights of Connecticut consumers under CTDPA. To exercise these rights, please submit a request through our webform at this link or call us at 1-(800)-491-5194. Please note that we will need to authenticate you to a reasonable degree of certainty before we can process your request.

Access. A Connecticut consumer has the right to ask us to confirm whether or not we process personal data about the Connecticut consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

Copy. A Connecticut consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Correction. Taking into account the nature of personal data and the purposes of processing personal data, a Connecticut consumer has the right to have inaccuracies in the consumer’s personal data corrected.

Deletion. A Connecticut consumer has the right to request the deletion of the consumer’s personal data, but CTDPA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. A Connecticut consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under CTDPA, you may opt out of such sales if we do so in the future.

Profiling. A Connecticut consumer has the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. While we do not engage in activities that come within the scope of profiling under CTDPA, you may opt out of such profiling if we do so in the future.

Targeted Advertising. We engage in targeted advertising. A Connecticut consumer has the right to opt out of targeted advertising.

Appeal. A Connecticut consumer has the right to appeal our decision with respect to a request to exercise a CTDPA right.

MONTANA PRIVACY DISCLOSURE

(Last Updated July 1, 2024)

This section is referred to as the "Montana Privacy Disclosure" and is provided in connection with the Montana Consumer Data Privacy Act (or “MCDPA”). Some terms in this Montana Privacy Disclosure are defined in MCDPA.

This Montana Privacy Disclosure only applies to people who are consumers under MCDPA.

This Montana Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under MCDPA or to information or activity that is subject to exemptions under MCDPA.

This Montana Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Montana Privacy Disclosure or other privacy notices and policies. However, if any other notice about MCDPA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Montana Privacy Disclosure as permitted by applicable law.

Categories of personal data. We process personal data when you use our Services. Please see the section in the Grandin Road Privacy Policy titled “Kinds of personal information we use” for a description of the kinds of personal data we use. When we de-identify data for purposes of MCDPA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

Purposes for processing personal data. We process personal data for the purposes described in the section in the Grandin Road Privacy Policy titled “How we use personal information”.

Third parties. We use third parties to help us in the operation of our business, and these third parties may have access to any of the personal data described in the categories of personal data. Please see the section in the Grandin Road Privacy Policy titled “Who we share personal information with” for the categories of third parties with which we share personal data.

MCDPA Rights. Following are rights of Montana consumers under MCDPA. To exercise these rights, please submit a request through our webform at this link or call us at 1 (800) 491-5194. Please note that we will need to authenticate you to a reasonable degree of certainty before we can process your request.

Access. A Montana consumer has the right to ask us to confirm whether or not we process personal data about the Montana consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

Copy. A Montana consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Correction. Taking into account the nature of personal data and the purposes of processing personal data, a Montana consumer has the right to have inaccuracies in the consumer’s personal data corrected.

Deletion. A Montana consumer has the right to request the deletion of the consumer’s personal data, but MCDPA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. A Montana consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under MCDPA, you may opt out of such sales if we do so in the future.

Profiling. A Montana consumer has the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. While we do not engage in activities that come within the scope of profiling under MCDPA, you may opt out of such profiling if we do so in the future.

Targeted Advertising. We engage in targeted advertising. A Montana consumer has the right to opt out of targeted advertising.

Appeal. A Montana consumer has the right to appeal our decision with respect to a request to exercise a MCDPA right.

NEVADA PRIVACY DISCLOSURE

(Last Updated July 1, 2024)

If you are a Nevada resident and would like to make a request under Chapter 603A of the Nevada Revised Statutes, to not sell your information, you may submit a request through the webform at this link, or email us at ps@grandinroad.com. Please include "Nevada" in your email subject line and include the following information in your email: your name, Nevada resident address, and email address.

OREGON PRIVACY DISCLOSURE

(Last Updated July 1, 2024)

This section is referred to as the "Oregon Privacy Disclosure" and is provided in connection with the Oregon Consumer Privacy Act (or “OCPA”). Some terms in this Oregon Privacy Disclosure are defined in OCPA.

This Oregon Privacy Disclosure only applies to people who are consumers under OCPA.

This Oregon Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under OCPA or to information or activity that is subject to exemptions under OCPA.

This Oregon Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Oregon Privacy Disclosure or other privacy notices and policies. However, if any other notice about OCPA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Oregon Privacy Disclosure as permitted by applicable law.

Categories of personal data. We process personal data when you use our Services. Please see the section in the Grandin Road Privacy Policy titled “Kinds of personal information we use” for a description of the kinds of personal data we use. When we de-identify data for purposes of OCPA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

Purposes for processing personal data. We process personal data for the purposes described in the section in the Grandin Road Privacy Policy titled “How we use personal information”.

Third parties. We use third parties to help us in the operation of our business, and these third parties may have access to any of the personal data described in the categories of personal data. The categories of third parties that we use include payment and collection services, marketing and advertising companies.

OCPA Rights. Following are rights of Oregon consumers under OCPA. To exercise these rights, please submit a request through our webform at this link or call us at 1 (800) 491-5194. Please note that we will need to authenticate you to a reasonable degree of certainty before we can process your request.

Access. An Oregon consumer has the right to ask us to confirm whether or not we process personal data about the Oregon consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

If you would like to obtain a list of third parties that we have disclosed any consumer personal data to in the past year, please email ps@grandinroad.com a request for “List of third party disclosures”.

Copy. An Oregon consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Correction. Taking into account the nature of personal data and the purposes of processing personal data, an Oregon consumer has the right to have inaccuracies in the consumer’s personal information corrected.

Deletion. An Oregon consumer has the right to request the deletion of the consumer’s personal data, but OCPA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. An Oregon consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under OCPA, you may opt out of such sales if we do so in the future.

Profiling. An Oregon consumer has the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. While we do not engage in activities that come within the scope of profiling under OCPA, you may opt out of such profiling if we do so in the future.

Targeted Advertising. We engage in targeted advertising. An Oregon consumer has the right to opt out of targeted advertising.

Appeal. An Oregon consumer has the right to appeal our decision with respect to a request to exercise a OCPA right.

TEXAS PRIVACY DISCLOSURE

(Last Updated July 1, 2024)

This section is referred to as the "Texas Privacy Disclosure" and is provided in connection with the Texas Data Privacy and Security Act (or “TDPSA”). Some terms in this Texas Privacy Disclosure are defined in TDSPA.

This Texas Privacy Disclosure only applies to people who are consumers under TDPSA.

This Texas Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under TDPSA or to information or activity that is subject to exemptions under TDPSA.

This Texas Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Texas Privacy Disclosure or other privacy notices and policies. However, if any other notice about TDPSA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Texas Privacy Disclosure as permitted by applicable law.

Categories of personal data. We process personal data when you use our Services. Please see the section in the Grandin Road Privacy Policy titled “Kinds of personal information we use” for a description of the kinds of personal data we use. When we de-identify data for purposes of TDPSA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

Purposes for processing personal data. We process personal data for the purposes described in the section in the Grandin Road Privacy Policy titled “How we use personal information”.

Third parties. We use third parties to help us in the operation of our business, and these third parties may have access to any of the personal data described in the categories of personal data. The categories of third parties that we use include payment, collection, marketing and advertising companies.

TDPSA Rights. Following are rights of Texas consumers under TDPSA. To exercise these rights, please submit a request through our webform at this link or call us at 1 (800) 491-5194. Please note that we will need to authenticate you to a reasonable degree of certainty before we can process your request.

Access. A Texas consumer has the right to ask us to confirm whether or not we process personal data about the Texas consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

Copy. A Texas consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Correction. Taking into account the nature of personal data and the purposes of processing personal data, a Texas consumer has the right to have inaccuracies in the consumer’s personal information corrected.

Deletion. A Texas consumer has the right to request the deletion of the consumer’s personal data, but TDPSA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. A Texas consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under TDPSA, you may opt out of such sales if we do so in the future.

Profiling. A Texas consumer has the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. While we do not engage in activities that come within the scope of profiling under TDPSA, you may opt out of such profiling if we do so in the future.

Targeted Advertising. We engage in targeted advertising. A Texas consumer has the right to opt out of targeted advertising.

Appeal. A Texas consumer has the right to appeal our decision with respect to a request to exercise a TDPSA right.

UTAH PRIVACY DISCLOSURE

(Last Updated December 29, 2023)

This section is referred to as the "Utah Privacy Disclosure" and is provided in connection with the Utah Consumer Privacy Act (or “UCPA”). Some terms in this Utah Privacy Disclosure are defined in UCPA. This Utah Privacy Disclosure only applies to people who are consumers under UCPA.

This Utah Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under UCPA or to information or activity that is subject to exemptions under UCPA.

This Utah Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Utah Privacy Disclosure or other privacy notices and policies. However, if any other notice about UCPA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Utah Privacy Disclosure as permitted by applicable law.

Categories of personal data. We process personal data when you use our services, including personal data in the following categories:

• Account information, such as credentials to access your accounts with us including password; security questions and answers; user names
• Communication information, such as the content messages sent through chat functions, emails, texts, or information that you send to us; recorded calls; technical information related to communications such as time, date or length of the communication
• Contact information, such as your name; email address; street address; zip code; telephone number; texting number
• Event information, such as information you provide if you participate in contests or sweepstakes; customer group or focus group information; in-person or remote attendance or participation in broadcasts or other events
• External information obtained from other sources, such as demographic information; updated shipping information
• Financial information, such as payment card information; gift card information; installment payment information; information related to private label credit card programs associated with our business
• Forum or feedback information, such as comments you make in any forum that we make available; product reviews; answers you provide in surveys
• Government identifier information, such as social security number (e.g., if you apply for a private label credit card); or driver’s license or identification card information
• Information about others, such as name and shipping details of people to whom you send gifts or other purchases; people who you refer to our services through referral features included in our services
• Location information, such as your location when you use our services or make a purchase
• Order and purchase information, such as items you add or remove to a shopping cart; items you purchase; items you return; items you activate (e.g., computer) after purchase; wish list information
• Preferences information, such as preferred sizes or colors of clothing
• Technical and online information, such as identifiers of devices you use to connect to our services; internet protocol addresses; social media or other online identifiers; information from other platforms where we interact including social media platforms operated by other companies
• User interaction information, such as pages you were visiting when you came to our websites and pages you went to when you left our website; pages browsed; items you look at, hover over or click; information you type into the services; interactions with advertisements; information collected through cookies, pixels, beacons, and other tracking technology
• Video and audio information, such as video or images that you send to us or upload into the services; recordings we make if you participate in events that we are recording
• Other information that you provide in your use of our services; information that we collect in the operation of our business
• Information created or inferred based on the categories above, such as analytics information

The examples in the categories above are not exclusive, and other kinds of personal data are included in these categories.

When we de-identify data for purposes of UCPA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

Purposes for processing personal data. We process personal data for the following purposes:

• Performing services, such as:
  • Account provision and maintenance, including creating and managing your account with us; providing customer service; verifying customer information; and providing other services in the course of our business operations
  • Product sales and fulfillment, including selling products; processing and shipping orders to you or to recipients you designate; managing returns; processing refunds; managing warranties
  • Customer service and communications, including responding to requests, comments, or questions through email, text message, telephone calls, postal mail, chat functions; maintaining user forms and product review capabilities; reviewing recorded calls or content of other communications for quality or customer service purposes; responding to requests for information and taking action that may be requested under the UCPA
  • Marketing and advertising, such as contextual marketing and advertising; personalizing user experience and marketing, including targeted product display; targeted marketing and advertising through the services; marketing through emails, text messages, and other communications methods; re-targeted marketing and advertising across other websites, devices, and platforms; auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards; engaging in analytics to personalize user experience; managing and communicating through our presence on social media platforms and other platforms
  • Payment-related activities, including processing payments, checking creditworthiness, evaluating payment options, providing financing, managing installment payment programs, participating in private label credit card programs
  • Providing technology to enable use and operation of services; providing storage
• Maintaining and improving services and user experience, including:
  • Creating and updating applications, websites, and other features or functionality that we use
  • Debugging to identify and repair errors that may affect how the services function
  • Engaging in analytics related to improving services or user experience
  • Product safety or quality activities
• Fraud prevention and information security, including:
  • Measures to verify identity when an account is used for ordering or when the account is otherwise accessed
  • Helping to ensure security and integrity, including by detecting and responding to fraud or security incidents
  • Limiting payment fraud
  • Protecting against other malicious, deceptive, or illegal activity
• Internal research, including:
  • Developing and demonstrating technology
  • Conducting research, analytics, surveys, and focus groups to improve customer experiences, develop services and products, provide better marketing and advertising
• Other business purposes for which we provide notice, including:
  • Legal obligations, including prosecuting people responsible for fraudulent, malicious, deceptive or illegal activities; defending claims; notifying of product recalls or other issues related to products; enforcing and notifying of our terms and conditions, privacy policy, forum guidelines, and other policies and changes to such terms and conditions, privacy policy and other policies; and for records retention purposes
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, made, or controlled by us, and to improve, upgrade, or enhance a service or device that is owned, made, or controlled by us
• Any other purposes consistent with our applicable privacy policies

Third parties. We use third parties to help us in the operation of our business, and these third parties may have access to any of the personal data described in the categories of personal data above. The categories of third parties that we use include payment, collection, marketing and advertising companies.

UCPA Rights. Following are rights of Utah consumers under UCPA. Please see below with respect to the right to opt out of profiling. To exercise any other right, please submit a request through the form available at this link or call us at 1 (800) 491-5194.

Access. A Utah consumer has the right to ask us to confirm whether or not we process personal data about the Virginia consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

Copy. A Utah consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Deletion. A Utah consumer has the right to request the deletion of the consumer’s personal data, but UCPA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. A Utah consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under UCPA, you may opt out of such sales if we do so in the future.

Targeted Advertising. We engage in targeted advertising. A Utah consumer has the right to opt out of targeted advertising.

Appeal. A Utah consumer has the right to appeal our decision with respect to a request to exercise a UCPA right.

VIRGINIA PRIVACY DISCLOSURE

(Last Updated December 29, 2023)

This section is referred to as the "Virginia Privacy Disclosure" and is provided in connection with the Virginia Consumer Data Protection Act (or “VCDPA”). Some terms in this Virginia Privacy Disclosure are defined in VCDPA

This Virginia Privacy Disclosure only applies to people who are consumers under VCDPA.

This Virginia Privacy Disclosure does not apply to information that is excluded from the definition of “personal data” under VCDPA or to information or activity that is subject to exemptions under VCDPA.

This Virginia Privacy Disclosure supplements our other privacy notices and policies and shall govern in the event of a conflict between this Virginia Privacy Disclosure or other privacy notices and policies. However, if any other notice about VCDPA is provided at the point of collection, then that other notice shall govern in the event of a conflict with this Virginia Privacy Disclosure as permitted by applicable law.

Categories of personal data We process personal data when you use our services, including personal data in the following categories:

• Account information, such as credentials to access your accounts with us including password; security questions and answers; user names
• Communication information, such as the content messages sent through chat functions, emails, texts, or information that you send to us; recorded calls; technical information related to communications such as time, date or length of the communication
• Contact information, such as your name; email address; street address; zip code; telephone number; texting number
• Event information, such as information you provide if you participate in contests or sweepstakes; customer group or focus group information; in-person or remote attendance or participation in broadcasts or other events
• External information obtained from other sources, such as demographic information; updated shipping information
• Financial information, such as payment card information; gift card information; installment payment information; information related to private label credit card programs associated with our business
• Forum or feedback information, such as comments you make in any forum that we make available; product reviews; answers you provide in surveys
• Government identifier information, such as social security number (e.g., if you apply for a private label credit card); or driver’s license or identification card information
• Information about others, such as name and shipping details of people to whom you send gifts or other purchases; people who you refer to our services through referral features included in our services
• Location information, such as your location when you use our services or make a purchase
• Order and purchase information, such as items you add or remove to a shopping cart; items you purchase; items you return; items you activate (e.g., computer) after purchase; wish list information
• Preferences information, such as preferred sizes or colors of clothing
• Technical and online information, such as identifiers of devices you use to connect to our services; internet protocol addresses; social media or other online identifiers; information from other platforms where we interact including social media platforms operated by other companies
• User interaction information, such as pages you were visiting when you came to our websites and pages you went to when you left our website; pages browsed; items you look at, hover over or click; information you type into the services; interactions with advertisements; information collected through cookies, pixels, beacons, and other tracking technology
• Video and audio information, such as video or images that you send to us or upload into the services; recordings we make if you participate in events that we are recording
• Other information that you provide in your use of our services; information that we collect in the operation of our business
• Information created or inferred based on the categories above, such as analytics information

The examples in the categories above are not exclusive, and other kinds of personal data are included in these categories.

When we de-identify data for purposes of VCDPA, we will maintain and use such de-identified data only in de-identified form and will not attempt to reidentify the information unless permitted by applicable law.

Purposes for processing personal data. We process personal data for the following purposes:

• Performing services, such as:
  • Account provision and maintenance, including creating and managing your account with us; providing customer service; verifying customer information; and providing other services in the course of our business operations
  • Product sales and fulfillment, including selling products; processing and shipping orders to you or to recipients you designate; managing returns; processing refunds; managing warranties
  • Customer service and communications, including responding to requests, comments, or questions through email, text message, telephone calls, postal mail, chat functions; maintaining user forms and product review capabilities; reviewing recorded calls or content of other communications for quality or customer service purposes; responding to requests for information and taking action that may be requested under the VCDPA
  • Marketing and advertising, such as contextual marketing and advertising; personalizing user experience and marketing, including targeted product display; targeted marketing and advertising through the services; marketing through emails, text messages, and other communications methods; re-targeted marketing and advertising across other websites, devices, and platforms; auditing related to counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards; engaging in analytics to personalize user experience managing and communicating through our presence on social media platforms and other platforms
  • Payment-related activities, including processing payments, checking creditworthiness, evaluating payment options, providing financing, managing installment payment programs, participating in private label credit card programs
  • Providing technology to enable use and operation of services; providing storage
• Maintaining and improving services and user experience, including:
  • Creating and updating applications, websites, and other features or functionality that we use
  • Debugging to identify and repair errors that may affect how the services function
  • Engaging in analytics related to improving services or user experience
  • Product safety or quality activities
• Fraud prevention and information security, including:
  • Measures to verify identity when an account is used for ordering or when the account is otherwise accessed
  • Helping to ensure security and integrity, including by detecting and responding to fraud or security incidents
  • Limiting payment fraud
  • Protecting against other malicious, deceptive, or illegal activity
• Internal research, including:
  • Developing and demonstrating technology
  • Conducting research, analytics, surveys, and focus groups to improve customer experiences, develop services and products, provide better marketing and advertising
• Other business purposes for which we provide notice, including:
  • Legal obligations, including prosecuting people responsible for fraudulent, malicious, deceptive or illegal activities; defending claims; notifying of product recalls or other issues related to products; enforcing and notifying of our terms and conditions, privacy policy, forum guidelines, and other policies and changes to such terms and conditions, privacy policy and other policies; and for records retention purposes
• Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, made, or controlled by us, and to improve, upgrade, or enhance a service or device that is owned, made, or controlled by us
• Any other purposes consistent with our applicable privacy policies

Third parties, We use third parties to help us in the operation of our business, and these third parties may have access to any of the personal data described in the categories of personal data above.

The categories of third parties that we use include payment, collection, marketing and advertising companies.

VCDPA Rights. Following are rights of Virginia consumers under VCDPA. Please see below with respect to the right to opt out of profiling. To exercise any other right, please submit a request through the form available at this link or call us at 1 (800) 491-5194.

Access. A Virginia consumer has the right to ask us to confirm whether or not we process personal data about the Virginia consumer and to access such personal data. We provide access to such personal data by providing you with a copy of such personal data.

Copy. A Virginia consumer has the right to obtain a copy of the consumer's personal data that the consumer previously provided to the controller.

Correction. Taking into account the nature of personal data and the purposes of processing personal data, a Virginia consumer has the right to have inaccuracies in the consumer’s personal information corrected.

Deletion. A Virginia consumer has the right to request the deletion of the consumer’s personal data, but VCDPA permits some personal data to be retained, notwithstanding a consumer’s deletion request.

Sale of personal data. A Virginia consumer has the right to opt out of sales of personal data. While we do not engage in sales of personal data under VCDPA, you may opt out of such sales if we do so in the future.

Profiling. A Virginia consumer has the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. While we do not engage in activities that come within the scope of profiling under VCDPA, you may opt out of such profiling if we do so in the future. To opt out of future profiling, please contact us at ps@grandinroad.com.

Targeted Advertising. We engage in targeted advertising. A Virginia consumer has the right to opt out of targeted advertising.

Appeal. A Virginia consumer has the right to appeal our decision with respect to a request to exercise a VCDPA right.