Woodcraft Supply, LLC – Consumer Privacy Policy

[Download PDF]

Last Updated: October 14, 2026

NOTICE AT COLLECTION

This overview concisely details how we collect, use, share, and safeguard your personal information when you engage with us through our website (www.woodcraft.com), retail stores, catalogs, phone orders, or any of our other service offerings.

1. What We Collect: We collect details like your name, contact information, payment details, information about your purchases and interactions with our services, and preferences to improve your experience. We may collect certain sensitive information such as account login credentials and payment card information, which is processed securely by our payment processors. For the full details on personal information we collect, click here.
2. How We Use It: We use your information to fulfill orders, deliver products and services to you, market to you, improve our services, and for other related purposes. To view the full details on how we use your personal information, click here.
3. Whom We Disclose Information To: We may disclose your information to trusted partners and service providers to deliver our services to you, fulfill orders, process payments, and otherwise improve your experience; we may also disclose your information when required by law. For more information, click here.
4. Retention of Information: We will retain your personal information for as long as necessary or permitted considering the purpose(s) for which it was obtained and consistent with applicable law. For more details on our information retention policies, click here.
5. Your Right to Opt Out from Sale/Sharing Your Data: Some of our information practices may be defined as “sale” or “sharing” under applicable laws. Specifically, we use cookies and other technologies for targeted advertising and analytics to deliver personalized, interest-based advertising to you. You can opt out at any time. To opt out, click here.
6. Your Choices: Depending on where you live, the laws afford you certain privacy rights, including the ability to access, delete, or opt out of certain personal information uses. For United States residents, click here. For residents of jurisdictions outside of the United States, click here. To exercise your rights, please email us at custserv@woodcraft.com or call 1-800-535-4482.

If you do not agree with our policies and practices, please do not use our services. If you have any questions or concerns, please contact us at custserv@woodcraft.com or 1-800-535-4482.

Table of Contents

1. Scope

2. Our Information Practices

a. Categories of Personal Information We Collect

b. Use or Disclosure of Sensitive Personal Information

c. Categories of Sources from Which We Collect Personal Information

d. Business and Commercial Purposes of Collecting Personal Information

e. Disclosure of Personal Information to Our Service Providers

f. Categories of Personal Information We Have Sold or Shared in the Preceding 12 Months; Categories of Third Parties to Whom Such Information Was Sold or Shared

g. Cookies and Other Tracking Technologies

h. Opt-Out Preference Signal

i. How Long Your Personal Information Will Be Kept

j. Keeping Your Personal Information Secure

k. Personal Information of Children

l. Websites Operated by Third Parties

m. Disclaimer / Limitation of Liability for Data Input Errors

n. Territoriality

3. U.S. Consumer Privacy Rights and Choices

4. International Privacy Laws

a. Australia

b. Canada

c. European Union / European Economic Area

d. Japan

5. Changes to this Notice

6. Contact Information

PRIVACY NOTICE

1. Scope

Woodcraft Supply, LLC (“Woodcraft,” “we,” “our,” or “us”) values the privacy of our customers, prospective customers, and website visitors (“you” or “your”). This Privacy Notice describes how and why we might access, collect, store, use, and/or share (collectively, “process”) your personal information when you use our websites, retail stores, catalog, and services (collectively, “our Platform”), including when you:

• Visit our website at www.woodcraft.com or any affiliated sites
• Visit one of our retail franchise store locations
• Place an order through our website, catalog, phone, or fax
• Use our Buy Online Pick Up In Store (BOPIS) service
• Sign up for our email/SMS communications
• Attend classes or demonstrations at a company-owned location
• Communicate with us via phone, email, chat, or social media
• Sign up for our marketing or promotional materials

This Privacy Notice describes the information practices of Woodcraft Supply, LLC in connection with our corporate operations, our website at www.woodcraft.com, our catalog and phone order channels, and our company-owned retail locations. Other retail stores are independently owned and operated by franchisees. Franchisees determine their own in-store information practices and are independently responsible for compliance with applicable privacy and data protection laws. Where a franchisee collects your personal information in its store, that franchisee is the controller of that information, and Woodcraft Supply, LLC acts as a controller only with respect to information the franchisee transmits to us through the shared order management, customer database, and payment platforms we make available to franchisees, as described in Section 2(e). Please contact the store directly, or contact us using the Contact Information below, with questions about a specific location. This Privacy Notice applies to both our online and offline information practices. The term “personal information” (or “personal data”) in this Privacy Notice refers to any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked to you or your household, directly or indirectly. Where applicable law uses a different definition, the definition under that law governs for residents of that jurisdiction.

We collect personal information in accordance with applicable privacy laws, including: the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), and other U.S. state consumer privacy laws; the Australia Privacy Act 1988 and Australian Privacy Principles (APPs); the Canada Personal Information Protection and Electronic Documents Act (PIPEDA); the Quebec Law 25; the Alberta Personal Information Protection Act (AB PIPA); the British Columbia Personal Information Protection Act (BC PIPA); the European Union General Data Protection Regulation (GDPR); and the Japan Act on the Protection of Personal Information (APPI).

The data controller or business responsible for operating the website and collecting your personal information is Woodcraft Supply, LLC, located at 5300 Briscoe Rd Parkersburg, West Virginia 26105. To contact us with questions about this Privacy Notice, please see the Contact Information section below.

Please review this Privacy Notice carefully. By using our websites, visiting our retail stores, placing orders, or otherwise interacting with our services, you acknowledge that your personal information will be collected, used, and disclosed as described in this Privacy Notice. This acknowledgment does not constitute consent to the processing of your personal information in circumstances where applicable law requires your specific, freely given, informed, and unambiguous consent. Where such consent is required (for example, for the use of non-essential cookies, the processing of sensitive personal information, or cross-border transfers to certain jurisdictions), we will obtain it separately through appropriate consent mechanisms. You may withdraw your consent at any time by contacting us or using the tools described in this Privacy Notice. If you do not agree with the practices described in this Privacy Notice, please do not use our services.

2. Our Information Practices

a. Categories of Personal Information We Collect

We collect information when you access our website, visit our retail stores, place orders by phone or catalog, create an account, sign up for communications, or otherwise interact with us. We collect and use certain personal information for the business purposes disclosed within this Privacy Notice. If you do not provide the information that we request, we may not be able to provide you with requested products or services.

If you disclose any personal information relating to other people to us or to our service providers in connection with our products and services, you represent that you have the authority to do so and to permit us to use the information in accordance with this Privacy Notice.

We may collect and have collected within the last twelve (12) months the following categories of personal information from consumers:

Categories of Data Collected	Examples of Datapoints Collected	Retention Criteria
A. Identifiers	We may collect information such as your real name, alias, postal address, zip code, phone number, email address, online identifiers, Internet Protocol (IP) address, account log-in information, or other similar information that helps us know who you are.	Duration of your customer relationship and thereafter for the period necessary to complete the purpose of collection, to comply with our tax, accounting, and recordkeeping obligations, and to establish or defend legal claims. In determining that period we consider the sensitivity of the information, the volume and nature of the information, the purpose of processing, and the applicable limitations period.
B. Consumer records information	We may collect information about you such as your name, address, phone number, partial credit card/debit card number, PayPal account, Amazon Pay credentials, or other financial details used to process your orders. We do not store full financial account numbers with access or security codes. Payment processing is handled by third-party providers (e.g., PayPal, Amazon Pay), and we do not retain complete payment card data.	Duration of customer relationship plus 7 years (to satisfy tax, accounting, and financial recordkeeping obligations), or longer if required to defend legal claims.
C. Protected classification characteristics under state or federal law	We may collect information about your age or gender only if voluntarily provided, for example through optional demographic surveys or account profile settings. We do not require this information for checkout, registration, or purchases. Woodcraft does not collect or store customer data based on health, disability, race, religion, sexual orientation, citizenship, or immigration status.	Duration of your customer relationship and thereafter for the period necessary to complete the purpose of collection, to comply with our tax, accounting, and recordkeeping obligations, and to establish or defend legal claims. In determining that period we consider the sensitivity of the information, the volume and nature of the information, the purpose of processing, and the applicable limitations period.
D. Commercial information	We may collect information about products you have purchased or considered, purchase history, product reviews you have submitted, wish lists, shopping cart contents, catalog requests, and order details. If you attend or register for an in-store class or demo event, we may collect information on the class level you attended or registered for.	Duration of your customer relationship and thereafter for the period necessary to complete the purpose of collection, to comply with our tax, accounting, and recordkeeping obligations, and to establish or defend legal claims. In determining that period we consider the sensitivity of the information, the volume and nature of the information, the purpose of processing, and the applicable limitations period.
E. Biometric information	We do not use biometric identification systems, and we do not collect or generate biometric identifiers, including voiceprints, facial geometry, fingerprints, or gait patterns. We do not use automated transcription or voice analytics tools that generate a voiceprint from recorded calls.	N/A
F. Internet or other electronic network activity	We may collect information when you use our website, including browsing history, pages viewed, search queries, clicks, session data, device type, browser information, app usage, referring URLs, date and time of visits, and diagnostic data. We and our service providers use cookies, pixels, and similar technologies to operate and secure our services, remember your preferences, and measure and improve performance.	Session cookies: duration of browser session. Persistent cookies: up to 24 months per our cookie consent settings. Server-side logs: 14 months.
G. Geolocation data	We may collect approximate location information (such as city and state) from your IP address when you use our website. We may also collect information when you use our store locator feature. We do not collect precise geolocation data.	Inferences derived from cookies and similar tracking technologies: retained no longer than the underlying tracking data described in Category F above, and deleted or de-identified when that data expires or when you opt out of tracking technologies. Inferences derived from your purchase and account history: duration of your customer relationship and thereafter for the period necessary to complete the purpose of collection, to comply with our tax, accounting, and recordkeeping obligations, and to establish or defend legal claims.
H. Audio, electronic, visual, or similar information	We may capture in-store security camera footage at our retail locations for security and loss prevention purposes. We may also record customer service phone calls for quality assurance and training purposes. Call recordings are used only for quality assurance and training and are not analyzed to identify or authenticate individuals.	In-store security camera footage: 30-60 days from recording, unless retained longer in connection with an investigation, claim, or legal proceeding. Customer service call recordings: 30 days from the call, unless retained longer in connection with a claim or legal proceeding.
I. Professional or employment-related information	Not collected from consumers.	N/A
J. Education information	Not collected from consumers.	N/A
K. Inferences drawn from other personal information	We and our advertising partners may draw inferences about your preferences, characteristics, and behavior trends from the other categories of information listed above for the purposes of marketing, advertising, and improving your shopping experience.	Inferences derived from cookies and similar tracking technologies: retained no longer than the underlying tracking data described in Category F above, and deleted or de-identified when that data expires or when you opt out of the sale or sharing of your personal information or of targeted advertising. Inferences derived from your purchase and account history: duration of your customer relationship and thereafter for the period necessary to complete the purpose of collection, to comply with our tax, accounting, and recordkeeping obligations, and to establish or defend legal claims.
L. Sensitive personal information	We may collect account login credentials (username and password). Payment card information is collected and processed securely by our third-party payment processors. This Privacy Notice addresses personal information we collect from consumers. It does not address information collected from prospective franchisees, employees, or job applicants. Woodcraft does not collect neural data, government-issued IDs, financial account numbers with access codes, disability/treatment information, or information related to health, race, religion, sexual orientation, or transgender/nonbinary status, or similar sensitive data from consumers.	Duration of your customer relationship and thereafter for the period necessary to complete the purpose of collection, to comply with our tax, accounting, and recordkeeping obligations, and to establish or defend legal claims. In determining that period we consider the sensitivity of the information, the volume and nature of the information, the purpose of processing, and the applicable limitations period.

b. Use or Disclosure of Sensitive Personal Information

We collect and use sensitive personal information only as needed to provide the services you request and only as permitted by law. Where consent is required by law, we obtain your affirmative consent before processing. We apply strict data-minimization and purpose-limitation principles, restrict access to those who need it to deliver services, and do not sell or share sensitive personal information for cross-context behavioral advertising or use it to infer characteristics. We retain sensitive information only as long as necessary for the stated purposes or to meet legal and safety obligations, after which we delete or de-identify it.

We only use or disclose sensitive personal information for the following purposes:

• As necessary to perform the services reasonably expected by an average consumer who purchases products or uses our Platform.
• To process and fulfill your orders, including payment processing.
• To prevent, detect, and investigate security incidents, and to protect the availability, integrity, and confidentiality of personal information.
• To resist malicious, deceptive, fraudulent, or illegal actions directed at Woodcraft and to prosecute those responsible.
• To help ensure the physical safety of customers and staff at our retail locations.
• To perform services on our behalf by processors (for example, secure payment processing, communications, or fraud prevention) under contracts that limit their use of the data.
• To verify or maintain the quality or safety of our services and to improve, upgrade, or enhance them.
• To collect or process sensitive personal information where the collection or processing is not for the purpose of inferring characteristics about you.

Your right to limit: Certain states, including California, allow you to direct us to limit our use and disclosure of your sensitive personal information to the purposes listed above. To submit a request, use the “Limit the Use of My Sensitive Personal Information” link on our website, email custserv@woodcraft.com, or call 1-800-535-4482. We will honor your request with respect to any use or disclosure that is not among the purposes listed above.

c. Categories of Sources from Which We Collect Personal Information

We may get your personal information from these sources:

• Directly from you. For example, when you create an account on our website, place an order online or by phone/catalog, sign up for email or SMS alerts, submit a product review, use our store locator, or contact customer service.
• From our website and mobile-optimized pages, which may automatically collect information about how you use them (like cookies and other tracking tools).
• From our retail store locations, when you make purchases, attend classes or demos, or interact with store personnel. Where a store is franchisee-operated, we receive that information from the franchisee through the shared systems described in Section 2(e).
• From third parties, such as advertising partners, data analytics providers (e.g., Google Analytics), email and text message marketing platforms (for example, Listrak), payment processors, shipping carriers, and social media platforms.
• From manufacturers and brand partners, for purposes such as warranty registration, product recalls, or direct-ship fulfillment.

d. Business and Commercial Purposes of Collecting Personal Information

Woodcraft collects and processes your personal information as needed to market and deliver our products and services, deliver promotional and advertising messages, and meet our contractual and other legal obligations. The specific legal basis for processing depends on the applicable law and the nature of the processing activity. For California and other U.S. states, we process personal information for the business and commercial purposes described below. In jurisdictions that require a specific legal basis for processing (such as the EU/EEA under the GDPR), please refer to the applicable module in Section 4 for the legal bases on which we rely.

We limit the personal information we collect to what is reasonably necessary and proportionate to provide the products and services you request from us. Where we process personal information for purposes beyond providing those products and services (for example, marketing, advertising, and analytics), we do so with your consent where required by applicable law, and you may opt out of those uses as described in Section 3. We collect and process sensitive personal information only where reasonably necessary to provide a product or service you have requested, and we do not sell sensitive personal information.

Maryland Residents. If you are a Maryland resident, we limit our collection of your personal information to what is reasonably necessary and proportionate to provide or maintain a specific product or service you have requested. We do not sell your sensitive personal information, and we do not process your sensitive personal information except where strictly necessary to provide or maintain a product or service you have requested. We do not sell your personal information, or process it for targeted advertising, where we know or willfully disregard that you are under 18 years of age.

We may use your personal information for the following business purposes:

• To process and fulfill your orders, including shipping, delivery, and Buy Online Pick Up In Store (BOPIS) services.
• To create and manage your customer account.
• To process payments and prevent fraud.
• To respond to your inquiries, provide customer service, and handle returns or exchanges.
• To provide warranty services and coordinate with manufacturers on your behalf.
• To send you order confirmations, shipping updates, and other transactional communications.
• To send you email alerts, text messages (SMS), catalog mailings, or other marketing communications about our products, services, promotions, or events that may interest you.
• To personalize your shopping experience and recommend products based on your interests.
• To administer loyalty programs, promotions, contests, or surveys.
• To improve our existing products, services, and website or develop new offerings.
• To follow up with you to obtain your feedback on your experiences with us.
• To meet our contractual obligations and protect our rights.
• To protect ourselves, our employees, franchisees, customers, and the public from theft, legal liability, fraud, or abuse.
• To make our website better and easier to use.
• To conduct analytics, statistics, testing, or research.
• To respond to law enforcement, legal, regulatory, or court requests, or as required by law.
• To communicate with you about changes to our procedures, policies, or services.
• To manage our franchise relationships and coordinate with independently owned store locations.
• For internal tasks like administration, data analysis, auditing, and billing.
• To store and process information for business continuity and disaster recovery.
• To evaluate or carry out a merger, reorganization, sale, or other business change.
• To verify compliance with data privacy laws.
• To understand how customers in different geographic areas use our website and services.
• For any other reason we told you about when we collected your information or as required by law.

We may also use your personal information for the following commercial purposes. To the extent any of the following commercial purposes involve the use of cookies or similar tracking technologies, such processing occurs only in accordance with your consent preferences as managed through our cookie consent banner. For more information, please see the Cookies and Other Tracking Technologies section below.

• To analyze how visitors interact with our website and identify areas for improvement, including through the use of cookies and similar technologies.
• To measure the effectiveness of our website, advertising, and promotional campaigns.
• To analyze traffic on our website and on the sites of third parties.
• To deliver personalized, interest-based advertising to you across websites and platforms.
• To conduct research and analysis regarding customer behavior and preferences.
• To learn what devices and browsers people use to visit our website.
• To help us make our website easier to use and more helpful for everyone.
• To facilitate abandoned cart recovery communications (email and SMS via Listrak).

We will not collect new types of personal information or use your information for materially different purposes than those described in this Privacy Notice unless we notify you first, and, where required by applicable law, obtain your consent.

e. Disclosure of Personal Information to Our Service Providers

We may share some or all of the personal information we collect about you with other companies or organizations that help us operate our business and deliver products and services to you (referred to as “service providers” under U.S. state privacy laws, “processors” under the GDPR, “third parties acting on our behalf” under Canadian privacy laws, or “entrusted parties” under Japan’s APPI). These service providers are contractually obligated to use your personal information only for the purposes we specify and to implement appropriate security measures. For example, personal information may be shared with technology companies that help us manage and protect your personal information, companies we hire to help us with our website, shipping carriers, payment processors, marketing partners, and other service providers.

In the last twelve months, we have disclosed some or all of the types of personal information listed above in the section called Categories of Personal Information We Collect to one or more of our service providers:

Categories of Who We Disclose Your Information To	Business Purpose	Categories of Information Processed
Customer service and communication providers (e.g., Listrak for email/SMS)	To send you marketing emails, SMS/text alerts, and transactional communications To facilitate abandoned cart recovery To handle customer service inquiries To send you newsletters and promotional offers	Identifiers (name, email, phone number) Commercial information (purchase history, cart contents) Internet or network activity (browsing behavior) Geolocation data (approximate location)
Payment processors, financial institutions, and fraud prevention vendors (e.g., PayPal, Amazon Pay, credit card processors)	To collect and process secure payments for products and services To prevent and detect fraud To process returns and refunds	Identifiers (name, email, address) Consumer records (payment card details) Internet or network activity (device and session info)
Shipping and logistics vendors (e.g., UPS, USPS, freight carriers)	To ship and deliver products to you To provide tracking information To coordinate Buy Online Pick Up In Store orders To handle freight and oversized deliveries	Identifiers (name, address, phone number, email) Commercial information (order details)
Website analytics providers (e.g., Google Analytics)	To analyze website traffic and performance To understand how visitors interact with our website To improve website functionality and user experience	Identifiers (IP address, device identifiers, cookies) Internet or network activity (browsing history, pages visited, session duration) Geolocation data (approximate location)
Advertising and marketing partners	To deliver relevant advertisements To measure advertising campaign effectiveness To facilitate retargeting and interest-based advertising To identify prospective customers	Identifiers (IP address, device identifiers, email) Internet or network activity (browsing history, pages visited) Geolocation data (approximate location) Inferences (preferences, interests)
Data storage and IT infrastructure providers (e.g., Microsoft Azure, Veeam, and Shopify)	To keep your personal information safe and secure To make backup copies of data To provide technical support and infrastructure To ensure authorized access only	Identifiers (name, email, address) Consumer records (payment details) Commercial information (purchase history) Internet or network activity Geolocation data Inferences
Manufacturers and brand partners (e.g., for warranty services, direct shipping)	To fulfill direct-ship orders from manufacturers To process warranty claims To facilitate product recalls or safety notices To coordinate product support	Identifiers (name, address, phone number, email) Commercial information (product purchased, purchase date)
Woodcraft franchisees (independently owned retail store locations)	To fulfill Buy Online Pick Up In Store orders at your selected location To process in-store returns, exchanges, and warranty support To administer gift card and stored-value balances across locations To coordinate class and event registrations	Identifiers (name, email, phone number) Commercial information (order details, purchase history, gift card balances) Consumer records (partial payment card details)
Co-marketing partners and catalog cooperatives	To send catalog mailings to prospective customers To conduct co-marketing campaigns	Identifiers (name, mailing address) Commercial information (purchase history, product interests)
Tag management, session analytics, and conversion measurement providers (e.g., Google Tag Manager, Microsoft Clarity, Elevar)	To deploy and manage the tracking technologies described in the Cookies and Other Tracking Technologies section To record page interactions in order to diagnose errors and improve site usability To measure whether website visits result in orders and to attribute those orders to the marketing channel that generated them To detect and prevent fraudulent transactions	Identifiers (Internet Protocol address, device and browser identifiers, cookie identifiers, and, for conversion measurement, hashed email address) Internet or other electronic network activity information (pages viewed, search queries, clicks, scrolling and cursor movement, session duration, referring website, device and browser characteristics) Commercial information (cart contents, order value, products purchased) Geolocation data (approximate location derived from Internet Protocol address).

Woodcraft franchisees are independent controllers of the personal information they collect in their stores. Where we disclose your personal information to a franchisee to fulfill your order or service request, that franchisee handles the information under its own privacy practices.

f. Categories of Personal Information We Have Sold or Shared in the Preceding 12 Months; Categories of Third Parties to Whom Such Information Was Sold or Shared

Under the California Consumer Privacy Act (CCPA) and other U.S. state privacy laws, a “sale” includes disclosing, making available, or communicating personal information to a third party in exchange for monetary or other valuable consideration, and “sharing” includes disclosing, making available, or communicating personal information to a third party for cross-context behavioral advertising, whether or not for monetary or valuable consideration.

For example, Woodcraft processes and “sells” personal data for targeted advertising through the use of third-party advertising and analytics platforms. Specifically, these third parties are Google, Microsoft/Bing, Elevar, Meta, and Pinterest. Certain of our cookie and similar technology practices, as described in the Cookies and Other Tracking Technologies section below, may be deemed a “sale” or “sharing” under applicable U.S. state law, and may involve cross-context behavioral advertising as defined under applicable laws.” These practices are subject to your consent preferences as managed through our cookie consent banner and, where applicable, to your opt-out submitted through the “Your Privacy Choices” link or an opt-out preference signal. Some conversion measurement occurs through server-side integrations that we suppress when you have opted out.

Category of Recipient	Categories of Personal Information Sold or Shared	Purpose
Website analytics providers (e.g., Google Analytics, GA4)	Identifiers (e.g., IP address, device identifiers, cookies); Internet or other electronic network activity information (e.g., browsing history, pages visited, session duration); Approximate geolocation data	To analyze website traffic and performance; to understand how visitors interact with our website; to improve our website’s functionality and user experience
Advertising and targeting vendors, specifically CJ Affiliate, Google (Google Ads Conversion, Google Ads Remarketing, Google Marketing Platform, Floodlight), Microsoft (Bing Ads), MNTN, Pinterest, and Yotpo, subject to your consent through our cookie consent banner	Identifiers (e.g., IP address, device identifiers, cookies); Internet or other electronic network activity information (e.g., browsing history, pages visited); Approximate geolocation data	To deliver relevant advertisements; to measure the effectiveness of advertising campaigns; to facilitate retargeting
Third-party marketing identification partners (for example, Listrak)	Identifiers (e.g., email address, device identifiers); Internet or other electronic network activity information (browsing behavior on our website, device information)	To send marketing communications you have requested, to facilitate abandoned cart recovery communications, and to measure the performance of those communications

Sometimes, we must also share your information if the law requires us to, or if we believe it is necessary to:

• Follow the law or respond to legal requests
• Protect our rights, property, or the safety of the public or our customers

In these cases, we may share your information with lawyers, auditors, courts, regulators, or government authorities as needed. In addition, if our company is ever sold, merges with another company, undergoes a reorganization, or if our assets are transferred, we may transfer the information we have about you as part of that process, subject to applicable law. Where required by your jurisdiction’s privacy law (including GDPR, PIPEDA, and APPI), we will notify you before any such transfer or provide you with an opportunity to exercise your rights.

We do not use personal information collected through our retail stores, phone orders, or catalog orders to deliver cross-context behavioral advertising. We do disclose name, mailing address, purchase history, and product interest information to catalog cooperatives and co-marketing partners for the purpose of catalog mailings, including mailings to prospective customers. Depending on your state of residence, that disclosure may constitute a “sale” of personal information. You may opt out of that disclosure at any time using the “Your Privacy Choices” link on our website, by emailing custserv@woodcraft.com, or by calling 1-800-535-4482. We do not use or sell your personal information for the purpose of training large language models or other artificial intelligence systems, and our contracts with our advertising, analytics, and marketing vendors prohibit them from doing so.

We do not sell or share the personal information of any consumer we know, or willfully disregard, to be under 18 years of age, and we have no actual knowledge that any such sale or sharing has occurred. We do not process the personal information of a consumer we know, or willfully disregard, to be under 18 for purposes of targeted advertising.

g. Cookies and Other Tracking Technologies

We use cookies and similar technologies (such as pixels, web beacons, local storage, and session analytics tools that record how you navigate and interact with pages on our website for storing and honoring your preferences and settings when accessing and interacting with our website, combating fraud, analyzing how our website performs, customizing advertisements, and fulfilling other legitimate purposes. Some online tracking technologies help us maintain the security of our services and your account, prevent crashes, fix bugs, save your preferences, and assist with basic site functions. If you are a resident of Quebec or the European Union/European Economic Area, we will obtain your explicit and informed consent before deploying any technology that tracks personal information, including cookies.

Types of Cookies We Use

We use different types of cookies on our website, each serving distinct purposes:

• Strictly Necessary Cookies. These cookies are essential for the basic functionality of our website. They enable core features such as security, shopping cart management, checkout processing, network management, fraud prevention, and accessibility. Because these cookies are necessary for the website to function, they cannot be disabled, and we do not require your consent to use them.
• Functional Cookies. These cookies allow our website to remember choices you make (such as your preferred store location, recently viewed items, or other customizable settings) and provide enhanced, more personalized features. If you do not allow these cookies, some or all of these features may not function properly. Depending on your jurisdiction, we may require your consent before using these cookies.
• Analytics Cookies. These cookies help us understand how visitors interact with our website by collecting and reporting information about how you use the site, such as which pages you visit, how long you spend on each page, and any errors you may encounter. We use this information to improve our website’s performance and user experience. We use Google Analytics and similar third-party analytics providers to assist with this analysis. Depending on your jurisdiction, we may require your consent before using these cookies.
• Session Analytics Tools. We use tools that record page interactions such as mouse movement, scrolling, and clicks in order to diagnose errors and improve site usability. These tools are configured to mask text you enter into form fields, including login credentials and payment information. Depending on your jurisdiction, we may require your consent before using these tools.
• Advertising Cookies. These cookies are used to deliver advertisements that are more relevant to you and your interests. They may also be used to limit the number of times you see an advertisement and to measure the effectiveness of advertising campaigns. These cookies are usually placed by third-party advertising networks with our permission. They remember that you have visited our website and may share this information with other organizations, such as advertisers. We require your consent before using these cookies. You may withdraw your consent at any time through our cookie consent banner or by adjusting your browser settings.

You have a variety of tools to control the data collected by cookies, web beacons, and similar technologies:

• Cookies and Tracking Technologies: You may choose to accept or decline cookies. Cookies may also be disabled or removed by tools available as part of most commercial web browsers, and in some instances blocked in the future by selecting certain settings. Please review your browser’s Help menu for instructions or visit www.allaboutcookies.org for more information. Please note that if you disable all cookies, some features of our website (such as your shopping cart) may not function properly.
• Do Not Track Signals: Your browser settings may allow you to automatically transmit a “Do Not Track” (DNT) signal to online services you visit. Because our site does not currently recognize DNT signals in a manner that would differ from how we process GPC signals, we encourage you to use the Global Privacy Control (GPC) for a legally-recognized opt-out signal. We will continue to monitor developments regarding DNT and will update our practices if a uniform standard emerges.
• Global Privacy Control (“GPC”): GPC is a simple, browser-based way for a consumer to decline the sharing of personal information for the purpose of targeted advertising. We recognize and honor GPC signals. For more information, please see the Opt-Out Preference Signal section below.
• Opting Out: You may choose not to receive some interest-based advertising by submitting opt-outs. Some of the advertisers and providers that perform advertising-related services for us may participate in the Digital Advertising Alliance’s (“DAA”) Self-Regulatory Program for Online Behavioral Advertising and/or the Network Advertising Initiative (“NAI”). To learn more about how you can exercise certain choices regarding interest-based advertising, visit http://www.aboutads.info/choices/. To learn more about the NAI and your opt-out options for their members, see http://www.networkadvertising.org/choices/. Please be aware that opting out only means that those selected members should no longer deliver certain interest-based advertising to you but does not mean you will no longer receive any targeted content and/or ads.

h. Opt-Out Preference Signal

You have the right to opt out of the sale or sharing of your personal information. Our website recognizes and honors opt-out preference signals, including the Global Privacy Control (GPC), as valid requests to opt out of the sale and sharing of your personal information.

GPC is a browser-based signal available in certain web browsers (such as Mozilla Firefox, Brave, and DuckDuckGo) or as a browser extension that automatically communicates your preference to opt out of the sale and sharing of your personal information to websites you visit. To enable GPC, visit www.globalprivacycontrol.org for information on how to download and enable a GPC-compatible browser or extension.

We process GPC signals in a frictionless manner, meaning we will not charge a fee, change your experience with our services, or display pop-ups or interstitial content in response to your opt-out signal. When we receive a GPC signal, we will treat it as a valid opt-out request for that browser or device, and, if you are logged in, for your account.

In addition to GPC, we will honor other browser-based or platform-based universal opt-out mechanisms that become legally required under applicable state privacy laws, including any opt-out mechanisms designated by the California Privacy Protection Agency (CPPA) or other state regulators.

You may also submit a request to opt out of the sale or sharing of your personal information by clicking the “Your Privacy Choices” link on our website or by contacting us at custserv@woodcraft.com or 1-800-535-4482.

i. How Long Your Personal Information Will Be Kept

Whenever we collect or process your personal information, we will only keep it for as long as is necessary for the purpose for which it was collected, as required under law, to establish or defend legal claims, and to meet our legitimate business needs. At the end of that retention period, your information will either be deleted completely or anonymized (for example, by aggregation with other information so that it can be used in a non-identifiable way for research, statistical analysis, and business planning). Anonymized data is not subject to this Privacy Notice.

We will not retain your personal information for longer than necessary for the purposes set out in this Privacy Notice. Different retention periods apply for different types of personal information. In determining data retention periods, we consider contractual and legal obligations, and the expectations and requirements of customers, vendors, suppliers, and others who share their personal data with us.

You may request deletion of your personal information or account at any time by contacting us at custserv@woodcraft.com or 1-800-535-4482. The scope of deletion rights, and any applicable exceptions, may vary by jurisdiction (see Section 3 (U.S.) or Section 4 (International) for details).

j. Keeping Your Personal Information Secure

Woodcraft has implemented reasonable technical, physical, and administrative security measures designed to protect personal information from unauthorized access, use, alteration, disclosure, and destruction. These measures take into account the state of available technology, implementation costs, and the nature, scope, context, and purposes of processing. We limit access to your personal information to authorized personnel who have a legitimate business need to access it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality.

Payment information (such as credit card numbers) cannot be viewed in our systems after submission and is processed securely by our third-party payment processors.

We maintain incident response procedures for detecting, responding to, and mitigating suspected data security incidents. Where we are legally required to do so under the law of your jurisdiction, we will notify you and the applicable regulator of a security incident affecting your personal information. For jurisdiction-specific breach notification obligations, see Section 3 (for U.S. state requirements) and Section 4 (for international requirements).

Despite these measures, no method of transmission over the internet and no method of electronic storage is completely secure. While we strive to protect your personal information, we cannot guarantee its absolute security. Any transmission of personal information is at your own risk.

k. Personal Information of Children

Our website and services are directed to adults, not children. Woodcraft does not knowingly collect personal information directly from children under the age of 13. In accordance with Quebec Law 25, we do not collect personal information from children under the age of 14 without parental or guardian consent. We do not sell or share the personal information of any consumer we know, or willfully disregard, to be under 18 years of age, and we have no actual knowledge that any such sale or sharing has occurred. We do not process the personal information of a consumer we know, or willfully disregard, to be under 18 for purposes of targeted advertising.

We do not operate features on our website that are directed to children. If we learn that a child under the applicable age threshold has provided personal information to us without verifiable parental consent where such consent is required, we will delete that information promptly in accordance with the United States Children’s Online Privacy Protection Act (‘COPPA’), the General Data Protection Regulation (‘GDPR’), and other applicable law, and we will confirm the deletion to the parent or guardian on request.

If you have reason to believe that a minor has provided personal information to us without appropriate authorization, please contact us at custserv@woodcraft.com or using the Contact Information below, and we will endeavor to delete that information from our records.

l. Websites Operated by Third Parties

Our website may include hyperlinks and navigation to websites or applications operated by third parties, service providers, and affiliates, including social media platforms (Facebook, YouTube, Instagram, Twitter/X, Pinterest, TikTok), manufacturer websites, and advertising partner sites. These separately owned websites may use their own cookies, web beacons, and other tracking technologies to independently collect information about you and may also solicit personal information from you.

Our franchise retail stores are independently owned and operated. Franchise owners may maintain their own websites or social media pages separate from www.woodcraft.com, and Woodcraft Supply, LLC is not responsible for the privacy practices of those independently operated sites.

Woodcraft is not responsible for the privacy policies and practices, nor the content of websites or applications operated by third parties, each of which has their own privacy policies. We encourage you to read them. You agree that Woodcraft shall not be held liable for any function or content of such websites or applications operated by affiliates, service providers, and third parties.

m. Disclaimer / Limitation of Liability for Data Input Errors

Woodcraft takes reasonable steps to ensure that the personal information Woodcraft collects, uses, or discloses is accurate, up-to-date, complete, and relevant. Woodcraft is not responsible for any errors that are made by you in inputting data, nor for data entered by someone using your credentials. PLEASE SECURE YOUR CREDENTIALS AND DO NOT DISCLOSE THEM TO ANYONE ELSE. If your credentials are compromised, please contact us.

Under no circumstances shall Woodcraft be liable to you, including but not limited to any liability for the system not being available for use, for lost or corrupted data, for errors in the documentation provided to you, if any, or for the failure of data archiving. Except as expressly agreed, Woodcraft will not be liable for any consequential, special, indirect, or punitive damages, even if advised of the possibility of such damages, or for any claim by any third party.

n. Territoriality

Woodcraft and its website are based in the United States. Our website is primarily intended for customers in the United States, but we welcome customers from other jurisdictions and ship to select international locations. If you are accessing our website or services from outside of the United States, please be aware that information collected may be transferred to, processed, stored, and used in the United States. Data protection laws in the United States may differ from those of your country of residence. Information transferred to the United States may be accessed by government and law enforcement in accordance with the laws of the United States.

Where applicable law requires specific safeguards for the transfer of personal information to the United States, we implement the mechanisms described in the jurisdiction-specific module in Section 4. For residents of jurisdictions that require specific transfer safeguards (such as the EU/EEA, Canada, Japan, and Australia), please refer to the applicable module in Section 4 for details on the mechanisms we use to protect your data in connection with such transfers.

IMPORTANT: YOUR PERSONAL INFORMATION MAY BE TRANSFERRED TO, PROCESSED, STORED, AND USED IN THE UNITED STATES AS DESCRIBED IN THIS PRIVACY NOTICE. DATA PROTECTION LAWS IN THE UNITED STATES MAY DIFFER FROM THOSE OF YOUR COUNTRY OF RESIDENCE. WHERE APPLICABLE LAW REQUIRES SPECIFIC SAFEGUARDS FOR SUCH TRANSFERS, WE WILL IMPLEMENT THEM AS DESCRIBED IN THE APPLICABLE JURISDICTION-SPECIFIC MODULE IN SECTION 4.

If you are a resident of a jurisdiction other than the United States, the laws of your jurisdiction may confer upon you rights with respect to your personal information that differ from or supplement those described above. Please refer to Section 4 (International Privacy Laws) below for jurisdiction-specific disclosures applicable to residents of Australia, Canada, the European Union/European Economic Area, and Japan.

3. U.S. Consumer Privacy Rights and Choices

This section describes the privacy rights available to residents of the United States under applicable state consumer privacy statutes and explains how to exercise those rights. Depending on where you reside within the United States, you may have some or all of the rights described below. These rights are available to residents of one or more of the following states: Alabama, California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Louisiana, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oklahoma, Oregon, Rhode Island, Tennessee, Texas, Utah, Vermont, and Virginia. If you reside outside the United States, please refer to Section 4 (International Privacy Laws) below for the rights applicable to your jurisdiction.

Right to Know and Data Portability

You may have the right to know what personal information Woodcraft has collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purposes for collecting, selling, or sharing personal information, the categories of third parties to whom the business discloses personal information, and the specific pieces of personal information the business has collected about you. Under certain state laws, you may have the right to obtain a list of specific third parties to whom we have disclosed or sold your personal information. You may also have the right to request a copy of the personal information we hold about you in a structured, commonly used, and machine-readable format (such as CSV, XML, or JSON), and to have that information transmitted to another organization where technically feasible (data portability).

Deletion Request Rights

You may have the right to request that we delete any of your personal information we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, we will delete (and direct our service providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if applicable data privacy or data protection laws provide legal grounds for us to do so. For example, we may deny your request to delete your personal information so that we may complete a transaction for which we collected the personal information, provide a product or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you.

Right to Correct

You may have the right to request that we update any information about you that is inaccurate or incomplete. Once we receive and confirm your verifiable consumer request, we will update (and direct our service providers to update) your personal information in our records. You may also have the right to require us to restrict processing of your personal information in certain circumstances, e.g., if you contest the accuracy of the personal information. Under certain state laws, this right includes the ability to correct inaccurate personal data, taking into account the nature and purposes of the processing.

Right to Opt-Out of the Sale or Sharing of Personal Information

You may have the right to opt-out of the sale or sharing of your personal information by us. Once we receive your consumer request, we will no longer sell or share your personal information. For the opt-out of sale or sharing your personal information via cookies and other tracking technologies, we have provided a “Your Privacy Choices” link in the footer of each page of our website, and we honor the Opt-Out Preference Signal. For more information, please see the Opt-Out Preference Signal section below.

Right to Limit the Use or Disclosure of Sensitive Personal Information

You may have the right to request that we limit our use of your sensitive personal information to that which is necessary to perform the services or provide the goods that you reasonably expect of us, with some narrowly tailored exceptions. To submit a request, use the ‘Limit the Use of My Sensitive Personal Information’ link in the footer of each page of our website, email custserv@woodcraft.com, or call 1-800-535-4482. We will honor your request with respect to any use or disclosure that is not among the purposes listed in Section 2(b).

Right to Opt Out of Automated Decision-Making

You may have the right to opt out of automated decision-making and profiling for certain decisions that produce a legal or similarly significant effect concerning you, such as decisions related to your financial or economic situation, access to credit, insurance, or other decisions producing a legal or similarly significant effect. Under certain state laws, you have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Woodcraft does not currently use automated decision-making technology, including profiling, in connection with any personal information collected about you to make decisions that produce legal or similarly significant effects. If our practices change in the future, we will update this Privacy Notice and provide you with a mechanism to exercise this right, as well as your rights to question the result of any such profiling, be informed of the reasoning, review personal data used in profiling, and correct inaccurate data and have the decision reevaluated, where applicable. We do process personal information for profiling in connection with advertising, as described in the Cookies and Other Tracking Technologies section. That profiling is not used to make decisions that produce legal or similarly significant effects concerning you. You may opt out of that processing at any time using the 'Your Privacy Choices’ link on our website or by enabling an opt-out preference signal in your browser.

Right to Opt Out of Targeted Advertising

Under certain state laws, you may have the right to opt out of the processing of your personal information for purposes of targeted advertising. Targeted advertising means displaying advertisements to you based on personal information obtained from your activities over time and across nonaffiliated websites or applications to predict your preferences or interests. To exercise this right, you may use the “Your Privacy Choices” link on our website, enable the Global Privacy Control (GPC) signal in your browser, or contact us at custserv@woodcraft.com.

Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights. Unless permitted by the applicable privacy laws, we will not:

• Deny you use of our services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us by:

• Email: custserv@woodcraft.com
• Phone: 1-800-535-4482
• Mail: Woodcraft Supply, LLC, Attn: Privacy Inquiries, P.O. Box 1686, Parkersburg, WV 26102-1686

Only you or a person you authorize to act on your behalf may make a verifiable consumer request related to your personal information. You may only make a verifiable consumer request for access or data portability twice within a twelve (12)-month period. The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may not be able to respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. Making a verifiable consumer request does not require you to create an account with us. To verify your identity, we may ask you to provide information that matches the personal information we already have on file, such as your name, email address, phone number, or details about your recent purchases or account activity. In some cases, we may request additional documentation. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

Authorized Agents: You may designate an authorized agent to submit a request on your behalf. To do so, you must provide the authorized agent with written permission to act on your behalf, and we may require you to verify your own identity directly with us and confirm that you provided the authorized agent permission to submit the request.

Response Timing and Format

We will acknowledge your request no later than ten (10) business days after receiving it and provide information about how we will process the request, including our verification process and when you should expect a response.

Before responding to your privacy rights request, we must verify your identity. We will do so by matching at least two reliable data points from your request to the information that we maintain about you. For certain more sensitive personal information, we may require further verification, to confirm that you are the person whose personal information is the subject of the request.

We endeavor to respond substantively to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days total), we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to the registered email associated with the account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option. For California residents, any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request’s receipt. For data portability requests, we will select a format to provide your personal information that is readily usable and should allow you to transmit the information from one entity to another entity without hindrance. If we deny your request, we will provide written notice to you setting out the reasons for refusal and recourse available to you.

No Fee

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

No Financial Incentive

We do not offer any financial incentives or price or service difference in an attempt to influence a consumer’s decision whether or not to exercise a right afforded to the consumer.

Appeals Process

If we decline to take action on your request, you may appeal that decision by contacting us at custserv@woodcraft.com or by calling 1-800-535-4482. Where the law of your state prescribes a period within which an appeal must be submitted, we will honor an appeal submitted within that period. We will respond to your appeal in writing within 45 days of receipt, or within any shorter period required by applicable law, and if we deny the appeal we will provide you with an online mechanism or other method to contact your state Attorney General to submit a complaint.

Grievances and Complaints

If you have any grievances or complaints regarding our privacy practices, you may contact us directly via email at custserv@woodcraft.com or at the Contact Information below. We will endeavor to investigate and respond to your complaint in a reasonable timeframe.

California Residents: Under California Civil Code § 1789.3, residents of California who use this website are entitled to know that they may file grievances and complaints with:

Department of Consumer Affairs

Consumer Information Center

1625 North Market Blvd., Suite N 112

Sacramento, CA 95834

Main: (800) 952-5210

California residents can also submit a complaint with the California Attorney General or the California Privacy Protection Agency (CPPA). For more information, see https://privacy.ca.gov/submit-a-complaint/ccpa-complaints/.

Connecticut Residents: Residents of Connecticut may contact the Connecticut Attorney General to submit a complaint:

Office of the Attorney General

165 Capitol Avenue

Hartford, CT 06106

(860) 808-5318

https://portal.ct.gov/AG/Common/Complaint-Form-Landing-page

Texas Residents: Under Tex. Bus. & Com. Code §§ 541.053 and 541.152, you may contact the Attorney General to file a complaint or if you have concerns about the result of the Appeal Process described above:

Office of the Texas Attorney General

PO Box 12548

Austin, TX 78711

1 (800) 621-0508

https://consumerprotection.texasattorneygeneral.gov

For more information, see https://www.texasattorneygeneral.gov/consumer-protection/file-consumer-complaint.

Nebraska Residents: Under Nebraska Revised Statutes § 87-1109, you may contact the Attorney General and submit a complaint if you are not satisfied with the results of the Appeal Process described above:

Consumer Affairs Response Team

Nebraska Attorney General’s Office

2115 State Capitol

Lincoln, NE 68509

(402) 471-2682 | (800) 727-6432 Toll-Free

https://www.nebraska.gov/apps-ago-complaints/

Other State Residents: If you reside in Virginia, Colorado, Utah, Oregon, Montana, Minnesota, Iowa, Indiana, Kentucky, Tennessee, Delaware, New Hampshire, Rhode Island, New Jersey, Maryland, Alabama, or Oklahoma, and you are not satisfied with our response to your appeal, you may have the right to lodge a complaint with your state’s Attorney General or other applicable regulatory authority. Please consult your state’s Attorney General website for information on how to file a privacy-related complaint.

California’s “Shine the Light” Law

California’s “Shine the Light” law (California Civil Code § 1798.83) permits California residents who use our website to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. California residents may request, once per calendar year, a list of the categories of personal information we disclosed to third parties for those third parties’ own direct marketing purposes during the preceding calendar year, together with the names and addresses of those third parties. To make a request, please contact us at custserv@woodcraft.com with ‘Shine the Light Request’ in the subject line.

4. International Privacy Laws

This section sets out the privacy rights and disclosures that apply to residents of specific jurisdictions outside the United States, in addition to the general provisions of this Privacy Notice. In the event of a conflict between a jurisdiction-specific module below and the general provisions of this Privacy Notice, the jurisdiction-specific module controls for residents of that jurisdiction. These modules are intended to ensure compliance with the privacy laws of Australia, Canada, the European Union/European Economic Area, and Japan, and to provide you with the specific disclosures and rights required under those laws.

a. Australia

This module applies to individuals in Australia. The Privacy Act 1988 (Cth), as amended by the Privacy and Other Legislation Amendment Act 2024, (“the Privacy Act”) and the Australian Privacy Principles (APPs) regulate our handling of personal information. The Privacy Act is enforced by the Office of the Australian Information Commissioner (OAIC). Woodcraft Supply, LLC is an overseas entity for purposes of Australian privacy law; where we collect personal information from individuals in Australia, we are bound by the APPs as they apply to our handling of that information.

Notice of Collection. When we collect your personal information we take reasonable steps to ensure you are aware of the following, either through this Privacy Notice or through a notice given at the point of collection. We are Woodcraft Supply, LLC, 5300 Briscoe Rd Parkersburg, West Virginia 26105, and you may contact us using the Contact Information below. We collect personal information directly from you when you place an order, create an account, subscribe to our communications, or contact us, and automatically through our website as described in Section 2(a). We are not aware of any Australian law or court order that requires or authorizes us to collect your personal information. We collect and use your personal information for the purposes described in Section 2(d), and we disclose it to the categories of recipients described in Sections 2(e) and 2(f). If you do not provide the information we request, we may be unable to provide you with the products or services you have requested. This Privacy Notice explains how you may access and seek correction of your personal information and how you may complain about a breach of the Australian Privacy Principles. We are likely to disclose your personal information to recipients located in the countries identified under Cross-Border Disclosure below.

Collection, Use, and Disclosure. We collect only personal information reasonably necessary for our functions, by lawful and fair means, and where practicable, directly from you. We use or disclose your personal information only for the primary purposes of collection described in this Privacy Notice, unless a permitted secondary purpose applies (for example, where you consent, the secondary use is within your reasonable expectations, or disclosure is required by law). If we receive unsolicited personal information that we could not have collected under the APPs had we solicited it, we will, as soon as practicable and if lawful and reasonable to do so, destroy the information or ensure that it is de-identified. We will not adopt your government-related identifiers as our own identifiers of you unless required or authorized by law, or unless reasonably necessary for us to verify your identity.

Sensitive Information. We do not collect sensitive information (e.g., racial or ethnic origin, health, biometric data) unless you consent and the collection is reasonably necessary for our functions, or collection is authorized by law. Woodcraft does not typically collect sensitive information from retail customers.

Direct Marketing. We will not use or disclose your personal information for the purpose of direct marketing, unless it would be reasonably expected that we use or disclose the personal information collected from you for direct marketing purposes (or you consent), we provide you with a simple means to request not to receive direct marketing communications, and you have not made such a request.

Cross-Border Disclosure. Your data may be transferred to the United States and other countries where our service providers operate. Most of our processing takes place in the United States, which we do not treat as subject to laws substantially similar to the Privacy Act. Before disclosing your personal information to a recipient in the United States or another overseas location, we take reasonable steps to ensure that the recipient does not breach the Australian Privacy Principles, including by entering into contractual commitments requiring the recipient to handle your personal information consistently with those principles. Where we reasonably believe that a recipient in a particular country is subject to a law or binding scheme that has the effect of protecting your personal information in a way that is at least substantially similar to the Australian Privacy Principles, and mechanisms are available to you to enforce that protection, we may disclose to that recipient without taking those additional steps. We are likely to disclose your personal information to recipients located in the following countries: United States and Canada. Before disclosing personal information to an overseas recipient we take reasonable steps to ensure the recipient does not breach the Australian Privacy Principles, or we obtain your informed consent, or the disclosure is otherwise permitted by law.

Automated Decision-Making. From 10 December 2026, Australian Privacy Principle 1.7 requires us to disclose information about certain automated decision-making. Woodcraft does not use a computer program to make, or to do anything substantially and directly related to making, a decision that could reasonably be expected to significantly affect your rights or interests. If that changes, we will update this Privacy Notice to identify the kinds of personal information used and the kinds of decisions made.

Integrity, Security, Retention, and Breach Notification. We take reasonable steps to ensure that the personal information we collect, use, or disclose is accurate, up-to-date, and complete. We take reasonable steps, including technical and organizational measures, to protect personal information from misuse, interference, loss, and unauthorized access, modification, or disclosure, and to destroy or de-identify information no longer needed. If an eligible data breach is likely to result in serious harm, we will notify you and the OAIC as required by the Privacy Act.

Your Rights. Under the Privacy Act, you have the right to:

• Pseudonymization / Anonymization: Deal with us anonymously or by pseudonym where practicable.
• Access: Request access to your personal information, to which we will respond within 30 days and may charge a reasonable access fee to cover our costs.
• Correction: Request correction of inaccurate, out-of-date, incomplete, irrelevant, or misleading information, and ask us to notify third parties of corrections.
• Complaints: Complain about a breach of the APPs.
• To exercise your rights, please contact us using the Contact Information below. We will respond within a reasonable period of time. If we refuse your request for a reason permitted by law, we will notify you in writing of the reasons for the refusal, the mechanisms available to complain about the refusal, and any other matter prescribed by the regulations.

Complaints and Grievances. If you are dissatisfied with our handling of a request or wish to complain about a breach of the APPs, you may lodge a complaint with the OAIC (www.oaic.gov.au | 1300 363 992). To make a complaint with us, please contact us using the Contact Information below. We will respond to all requests or complaints within a reasonable period of time.

b. Canada

This module applies to individuals in Canada whose personal information Woodcraft collects, uses, or discloses in the course of commercial activities.

The Personal Information Protection and Electronic Documents Act (PIPEDA) is Canada’s federal private-sector privacy law, administered by the Office of the Privacy Commissioner of Canada (OPC). PIPEDA governs interprovincial and international commercial data flows across Canada.

Quebec (Act respecting the protection of personal information in the private sector, as amended by Law 25) (“Law 25”), Alberta (Personal Information Protection Act) (“AB PIPA”), and British Columbia (Personal Information Protection Act) (“BC PIPA”) have enacted private-sector privacy legislation deemed “substantially similar” to PIPEDA. Quebec Law 25, AB PIPA, and BC PIPA govern the collection, use, and disclosure of personal information that occurs wholly within the respective province, while PIPEDA continues to apply to any interprovincial or international data flows.

Accountability. Woodcraft is responsible for personal information under its control. We have designated a Privacy Officer as the person in charge of the protection of personal information, who is accountable for our compliance with Canadian privacy laws, including Quebec’s Law 25. You may contact our Privacy Officer at PrivacyOfficer@woodcraft.com or at the mailing address in the Contact Information section below.

Collection, Use, and Disclosure. We collect personal information by fair and lawful means, and with your consent where required by applicable law. If we use your personal information for a purpose not previously identified to you, we will notify you of the new purpose and obtain your consent prior to such use, unless the new purpose is required by law or a limited exception by law applies. We will not condition the supply of our products or services on your consent to the collection, use, or disclosure of information, beyond that required to fulfill the explicitly specified and legitimate purposes described in this Privacy Notice. We will only use and disclose your personal information with your express or implied consent where applicable, the consent of your authorized representative, or as reasonably expected by you. We limit the amount and type of information collected to that which is necessary to fulfill the purposes described in this Privacy Notice.

Cross-Border Transfers. Your personal information may be transferred to and processed in the United States and other countries where our service providers operate. Under PIPEDA, we remain accountable for its protection regardless of where it is processed, and we use contractual measures and other safeguards to provide a comparable level of protection. Under Quebec’s Law 25, before communicating personal information outside Quebec we assess whether the information would receive adequate protection in light of generally accepted data protection principles, taking into account the sensitivity of the information, the purposes for which it is to be used, the protection measures the recipient will apply, and the legal framework of the destination jurisdiction. Where we proceed, the communication is governed by a written agreement that takes the results of that assessment into account.

Integrity, Security, and Retention. We take reasonable steps to ensure that the personal information we collect, use, or disclose is accurate, up-to-date, and complete. We maintain security safeguards, including physical, organizational, and technological measures, to protect personal information against loss or theft, as well as unauthorized access, disclosure, copying, use, or modification. We retain your personal information only as long as necessary to fulfill the purposes described in this Privacy Notice. We will destroy, erase, or anonymize personal information that is no longer required to fulfill our purposes.

Breach Notification. If a breach of security safeguards creates a real risk of significant harm to you, we will report it to the OPC (and, for Quebec residents, to the Commission d’accès à l’information) and notify you as required, including the circumstances, date or period of the breach, information involved, and steps you can take to mitigate harm.

Your Rights. Under PIPEDA and applicable provincial law, you may have the following rights (subject to verification of your identity, where applicable):

• Access: Request access to your personal information, including information about how it has been used and to whom it has been disclosed over the preceding year. We will respond within 30 days (or such other period as required by applicable provincial law), in a generally understandable form, at minimal or no cost.
• Correction / Rectification: Challenge the accuracy or completeness of your personal information and have it corrected, which may involve the correction, deletion, or addition of information. Where we have disclosed information to third parties, we will transmit corrections to those third parties where appropriate. We will respond within 30 days in writing (or such other period as required by applicable law).
• Withdrawal of Consent: Withdraw consent at any time, subject to legal or contractual restrictions and reasonable notice. You will be informed of the implications of withdrawal.
• Erasure / De-indexing: Under Quebec’s Law 25, you may request de-indexing or cessation of dissemination where continued dissemination causes serious injury to your reputation or privacy, or where collection was unlawful. Under PIPEDA, personal information no longer required for identified purposes will be destroyed, erased, or de-identified.
• Data Portability: Under PIPEDA’s data mobility framework (subject to regulations) and Quebec Law 25, you may request a copy of your personal information in a structured, commonly used format.
• To exercise your rights, please contact us at the Contact Information below. If we refuse your request, we will notify you of the basis for refusal, the remedies available to you, and the time limit for exercising them. If you request our assistance in understanding the refusal, we will provide it to you.

Complaints and Grievances. If you have concerns about how we handle your personal information, please contact our privacy officer using the Contact Information below. We will investigate and respond to your complaint within 30 days. If you are unsatisfied with our response, you may file a complaint with the Office of the Privacy Commissioner of Canada (www.priv.gc.ca | 1-800-282-1376). Quebec residents may contact the Commission d’accès à l’information du Québec (www.cai.gouv.qc.ca | 1 888 528-7741) in writing within 30 days from the date of refusal to grant a request. Alberta residents may contact the Office of the Information and Privacy Commissioner of Alberta (www.oipc.ab.ca | 1 888 878-4044). British Columbia residents may contact the Office of the Information and Privacy Commissioner for British Columbia (www.oipc.bc.ca | 250-387-5629).

Quebec-Specific Disclosures (Law 25). If you are a resident of Quebec, you have the following rights and protections under Law 25: (a) the right to receive information about the collection of your personal information, including the purposes for collection, the categories of persons who will have access to it, and your rights of access and rectification; (b) the right to access your personal information and obtain information about how it has been used and communicated to third parties over the preceding year; (c) the right to request rectification of inaccurate or incomplete information; (d) the right to object to the collection, use, or disclosure of your personal information for commercial or philanthropic prospecting purposes; (e) the right to receive information about any automated decision-making technology used to make decisions affecting you, including how it functions and its parameters, and to request that the decision be reviewed by a person competent to do so; (f) the right to receive prior notice and, where required, provide consent before any cross-border transfer of your personal information to a jurisdiction that does not provide equivalent protection; (g) the right to have our website and services provide, by default, the highest level of confidentiality without any intervention on your part, meaning that non-essential tracking, profiling, and advertising technologies are not activated unless you consent to them; and (h) the right to be informed when we use technology that includes functions allowing you to be identified, located, or profiled, and to be informed of the means available to deactivate those functions. If Woodcraft uses automated decision-making or profiling technologies that affect you, we will inform you of their use, the personal information used in the decision, the reasons supporting the decision, and your right to have the decision reviewed. We use cookies and similar technologies that allow us to identify, locate, and profile website visitors for the purposes described in Section 2(g). If you are a resident of Quebec, these technologies are deactivated by default and are activated only where you consent through our cookie consent banner. You may deactivate them at any time by withdrawing your consent through that banner, by adjusting your browser settings, or by contacting the person in charge of the protection of personal information identified above.

c. European Union / European Economic Area

This module applies to individuals in the European Union (EU) or European Economic Area (EEA) whose personal data Woodcraft processes in connection with offering goods or services to them or monitoring their behavior within the EU/EEA. The General Data Protection Regulation (EU) 2016/679 (“GDPR”) governs such processing. Woodcraft Supply, LLC, located at 5300 Briscoe Rd Parkersburg, West Virginia 26105, acts as the data controller for purposes of the GDPR. We process your personal data only where a valid legal basis exists. For privacy inquiries, please contact us using the Contact Information below.

Legal Bases for Processing. The purposes for which we process personal data are described in Section 2(d). For individuals in the European Union and European Economic Area, the section below identifies the legal basis under Article 6 of the GDPR on which we rely for each purpose. Where more than one basis is identified, we rely on the basis applicable to the specific processing activity.

• Performance of a contract (Article 6(1)(b)). Processing your order, including shipping, delivery, and Buy Online Pick Up In Store services; creating and managing your customer account; processing payments; responding to your inquiries and handling returns, exchanges, and warranty claims; sending order confirmations, shipping updates, and other transactional communications; and meeting our contractual obligations to you.
• Legitimate interests (Article 6(1)(f)). Preventing and detecting fraud; maintaining the security and integrity of our network, systems, and premises; protecting our employees, customers, and the public from theft, legal liability, fraud, or abuse; business continuity and disaster recovery; internal administration, data analysis, auditing, and billing; improving our products, services, and website; seeking your feedback on your experience with us; direct marketing to you as an existing customer; evaluating or carrying out a merger, reorganization, sale, or other business change; and protecting and enforcing our legal rights. Where we rely on this basis we have assessed that our interests are not overridden by your interests or fundamental rights, and you may object at any time as described below.
• Consent (Article 6(1)(a)). Deploying non-essential cookies and similar tracking technologies; delivering personalized interest-based advertising across websites and platforms; measuring the effectiveness of our advertising and promotional campaigns; analyzing how visitors interact with our website and with third-party websites; conducting research and analysis regarding customer behavior and preferences; understanding how customers in different geographic areas use our website; abandoned cart recovery communications; email and text message marketing to prospective customers; administering loyalty programs, promotions, contests, and surveys; and processing any special category data within the meaning of Article 9. You may withdraw your consent at any time through our cookie consent banner or by contacting us, without affecting the lawfulness of processing carried out before withdrawal.
• Compliance with a legal obligation (Article 6(1)(c)). Meeting tax, accounting, and recordkeeping requirements; responding to law enforcement, regulatory, and court requests; verifying our compliance with data protection law; notifying you and regulators of a personal data breach; and responding to requests you make to exercise your rights.

Electronic marketing communications are also subject to the national rules implementing the ePrivacy Directive in the country in which you reside, and where those rules require consent we will obtain it.

International Transfers. Your personal data is transferred to and processed in the United States, which has not received an adequacy decision from the European Commission. For those transfers we rely on the European Commission’s Standard Contractual Clauses (‘SCCs’), which we have entered into with the recipients of your personal data, supplemented by a transfer impact assessment and, where the assessment identifies a need, additional technical and organizational measures. You may request a copy of the safeguards we use, with commercially sensitive terms redacted, by contacting us using the Contact Information below.

Retention. We retain personal data only as long as necessary for the purposes of collection and to meet legal, accounting, or reporting obligations, considering sensitivity, risk of harm, and applicable legal requirements.

Data Protection Officer. Woodcraft has not appointed a GDPR Data Protection Officer because we do not engage in processing that requires one under Article 37 of the GDPR. For privacy inquiries, please contact us using the Contact Information below.

We will respond to your request without undue delay and in any event within one month of receipt. Where your request is complex or you have made a number of requests, we may extend that period by up to two further months, and we will inform you of the extension and the reasons for it within one month of receipt. We do not charge a fee unless your request is manifestly unfounded or excessive.

You may exercise the following rights by contacting us at the Contact Information below:

• Access (Art. 15): Obtain confirmation of whether we process your data, and if so, access the data and information about purposes, categories, recipients, and retention periods.
• Rectification (Art. 16): Correct inaccurate personal data or complete incomplete data.
• Erasure (Art. 17): Request deletion without undue delay where data is no longer necessary, you withdraw consent where there is no other legal basis for processing, you object with no overriding grounds for processing, processing is unlawful, or deletion is required by law. Exceptions apply (e.g., freedom of expression, legal obligations, legal claims).
• Restriction (Art. 18): Restrict processing while accuracy is contested, where processing is unlawful but you oppose erasure and request restriction instead, where we no longer need the data but you need it for legal claims, or pending verification of legitimate grounds when you have objected to processing.
• Portability (Art. 20): Receive data you provided in a structured, commonly used, machine-readable format and transmit it to another controller, where processing is based on consent or contract and carried out by automated means.
• Objection (Art. 21): Object to processing based on legitimate interests (including profiling). We will cease processing unless we demonstrate compelling legitimate grounds. If we process personal data for direct marketing purposes, you may object at any time and we will stop.
• Automated Decision-Making (Art. 22): You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects concerning you. Woodcraft does not currently engage in such automated decision-making for EU/EEA residents. If our practices change, we will notify you and provide safeguards, including the right to obtain human intervention, express your point of view, and contest the decision.

Complaints. You may lodge a complaint with a supervisory authority in the EU/EEA Member State of your habitual residence, place of work, or place of the alleged infringement. A list of authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

d. Japan

This module applies to individuals in Japan whose personal information Woodcraft handles in connection with the provision of goods or services to persons in Japan, in accordance with the Act on the Protection of Personal Information (‘APPI’), as amended, and enforced by the Personal Information Protection Commission (‘PPC’). The APPI was further amended by legislation promulgated in July 2026, with provisions taking effect in stages; we will update this module as those provisions commence. Woodcraft Supply, LLC, located at 5300 Briscoe Rd Parkersburg, West Virginia 26105, is the business operator responsible for your personal information.

Collection, Use, and Disclosure. Per the APPI, we specify the purpose of use to the extent possible, do not use personal information beyond that purpose without your prior consent, and notify you of the purpose at or before the time of acquisition. We only use personal information to the extent such use is necessary to achieve the purposes described in this Privacy Notice. If we change the purpose of use, we will notify you of the new purpose. We do not acquire personal information by deception or other wrongful means. We do not provide personal data to third parties without your prior consent, except as permitted under the APPI, including entrustment to service providers that handle personal data on our behalf within the scope of the purposes described in this Privacy Notice, or business succession by merger, acquisition, or similar transaction.

Sensitive Information. We do not collect sensitive personal information without first obtaining your consent, except as permitted by the APPI (cases based on laws and regulations; protection of life, wellbeing, or property, where it is difficult to obtain consent; special need to improve public wellbeing or promote healthy child development, where it is difficult to obtain consent; or for cooperation with governments).

Minors. Where we handle the personal information of an individual under 16 years of age in Japan, any consent required under the APPI must be obtained from, and any notice required under the APPI must be given to, that individual’s parent or other legal representative. An individual under 16, or that individual’s legal representative, may request that we suspend the use of, erase, or cease providing to third parties that individual’s retained personal data, without being required to establish the grounds that otherwise apply to such requests. In handling the personal information of individuals under 16 we give primary consideration to the best interests of the child.

Cross-Border Transfers. Where we provide personal data to a third party located outside Japan, including in the United States, we obtain your prior consent and, before doing so, provide you with information about the name of the destination country, the personal information protection system of that country, and the measures the recipient takes to protect personal information. Where we transfer data to a recipient that has established a system conforming to the standards prescribed under the Act on the Protection of Personal Information (‘APPI’), or to a country recognized by the Personal Information Protection Commission (‘PPC’) as having an equivalent level of protection, your consent may not be required, and we will instead take necessary measures to ensure the continued protection of your data and provide information about those measures on request. Upon request, we will provide you with information about our transfer practices.

Integrity and Security. We endeavor to keep personal data accurate and up-to-date, within the scope necessary for achieving the purpose of use. We take necessary and appropriate measures to prevent leakage, loss, or damage of personal data, including implementing organizational, technical, and physical safeguards. We supervise our employees and service providers regarding the handling of personal data.

Retention. We retain personal data only as long as necessary to achieve the purposes for which it was collected, after which we will delete or anonymize it in accordance with our internal retention policies. We will inform you of our retention periods upon request.

Breach Notification. If a breach is likely to harm your rights (including breaches involving sensitive data, risk of property damage, unauthorized access, or affecting more than 1,000 individuals), we will report it to the PPC and notify you without delay as required under the APPI.

We will respond to your request without delay. If we are unable to comply with your request in whole or in part, we will notify you of our decision and explain our reasons.

Under the APPI, with respect to “retained personal data” as defined therein, you may exercise the following rights by contacting us:

• Disclosure (Access): Request disclosure of your retained personal data, its purpose of use, and records of third-party transfers, in the format you request where feasible.
• Correction: Request correction, addition, or deletion of inaccurate retained personal data; we will investigate and correct without delay where justified.
• Cessation of Use / Erasure: Request that we cease using, erase, or stop providing your data to third parties where use exceeds the specified purpose, data was unlawfully acquired, there is no longer a valid reason for use, a breach has occurred, or continued handling may harm your rights or interests.
• Third-Party Transfer Records: Request disclosure of records regarding provision of your data to third parties.
• If we refuse your request, we will notify you of our decision and explain our reasons. We may ask you to present sufficient information to identify the personal data at issue, and we will help you do so.

Complaints. Contact us using the Contact Information below, or contact the PPC directly (www.ppc.go.jp | +81-3-6457-9680). We will endeavor to process complaints about the handling of personal information appropriately and promptly.

5. Changes to this Notice

We may update this Privacy Notice at our discretion from time to time. When we make material changes to this Privacy Notice, we will notify you by email (to the email address associated with your account) or through a prominent notice on our website’s homepage. The date this Privacy Notice was last updated is identified at the top of this page. We encourage you to review this Privacy Notice periodically to stay informed about how we are protecting your information. For residents of jurisdictions requiring advance notice before changes take effect (such as Quebec), we will provide such notice as required by applicable law.

6. Contact Information

If you have any questions about this Privacy Notice, our privacy practices, or wish to exercise your privacy rights, please contact us at:

Woodcraft Supply, LLC

Attn: Data Privacy Officer

PrivacyOfficer@woodcraft.com

Customer_Change_Requests@woodcraft.com

P.O. Box 1686

Parkersburg, WV 26102-1686

Email: custserv@woodcraft.com

Customer Service: 1-800-535-4482 (M-F 8:30 a.m. – 6:00 p.m. Eastern Time )

Website: www.woodcraft.com