Privacy Policy

SUPPLYONE, INC.

Privacy Policy

Last revised: April 30, 2026

This Privacy Policy (“Policy”) describes how SupplyOne, Inc. and the subsidiaries, affiliates, brands, operating businesses, and business units that operate under SupplyOne’s privacy and data-governance framework (“SupplyOne,” “we,” “our,” or “us”) collect, use, maintain, disclose, and otherwise process personal information.

This Policy applies when it is posted, linked, referenced, or otherwise provided in connection with: (1) our websites, webpages, mobile sites, digital properties, and other online properties (collectively, the “Websites”); and (2) our products, services, events, communications, sales activities, customer relationships, and other online or offline interactions (collectively, the “Services”).

SupplyOne operates through a family of companies and brands. Regardless of the outward-facing brand, trade name, Website, or Service through which you interact with us, SupplyOne establishes and administers the privacy and data-governance framework for the processing described in this Policy. Covered companies and brands process personal information within that framework and may use shared systems, personnel, vendors, policies, procedures, and operational practices designated, maintained, or approved by SupplyOne.

As our business grows, acquires, reorganizes, integrates, or rebrands companies, websites, products, services, or operations, this Policy will apply when it is posted, linked, referenced, or otherwise provided in connection with them. If a website, service, activity, entity, or business within or outside the SupplyOne family provides a different privacy notice, that notice will apply instead.

We use the term “personal information” to describe information that can reasonably be associated with you or used to identify you. Personal information does not include information that has been deidentified or aggregated.

If you are a resident of Canada, please review our Supplemental Addendum for Residents of Canada for details about privacy rights specific to your jurisdiction.

Our Websites may contain links to third-party websites or services. We are not responsible for the privacy practices or content of those third parties. You should review the privacy policy of each third-party website or service before providing personal information.

When We Collect Personal Information

We may collect personal information from the following sources:

• directly from you (for example, information you enter into our Websites, provide through contact forms, or share with our sales representatives);
• indirectly from your interactions with our technologies, Websites, or communications (for example, through cookies and similar tracking technologies);
• from our subsidiaries, affiliates, brands, operating businesses, and business units within the SupplyOne family, including through shared systems, centralized customer relationship management tools, marketing platforms, sales systems, analytics tools, security systems, and other business operations;
• from interactions you have with other SupplyOne websites, brands, operating businesses, or business units where those interactions are governed by this Policy or otherwise lawfully made available for the purposes described in this Policy;
• from data enrichment and business intelligence providers; and
• from advertising platforms and analytics providers.

Types of Personal Information We Collect and Possible Uses

The following is a summary of the types of personal information we collect, and the purposes for which that information may be used.

Website Visitors

When you use our Websites or submit an inquiry through a contact form, request a quote, or engage with our chat tools, we collect, use, store, and transfer different kinds of personal information about you, which we have grouped together as follows:

• “Communications Data” includes correspondence or messages (including emails, chat messages, or social media messages or comments) and other personal information which you provide to us through these sources, including through our live chat tools;
• “Contact Data” includes your postal address, email address, and telephone number(s);
• “Marketing Data” includes details of your marketing and communication preferences;
• “Identity Data” includes your first name, last name, title, and company name; and
• “Technical Data” includes technical information (through the use of cookies or similar technologies, including your IP address, device identifier, browsing patterns on our Websites, click-stream data, and HTTP protocol elements). Please see the Cookies and Tracking Technologies section below for further information.

In certain instances, we may use IP addresses to help identify you when we feel, in our sole discretion, that it is reasonably necessary to enforce compliance with this Policy, to protect our services, Websites, systems, information, employees, business partners, subsidiaries, affiliates, users, customers, or others, or when required by law or for law enforcement purposes.

Former, Current, and Prospective Customers

When we provide services to you or engage in a business relationship or potential business relationship, we collect, use, store, and transfer different kinds of personal information about you, which we have grouped together as follows:

• “Communications Data” includes calls you make to our teams, correspondence or messages (including emails, chat, or social media messages or comments) and other personal information which you provide to us within the scope of the relationship or potential relationship;
• “Contact Data” includes your postal address, email address, and telephone number(s);
• “Identity Data” includes your first name, last name, title, job title, and company name;
• “Commercial Data” includes information about orders, quotes, purchase history, returns, and shipping and delivery details;
• “Financial Data” includes payment, billing, invoicing, tax, bank account, payment card, transaction, and related financial information processed in connection with purchases, payments, vendor onboarding, supplier management, contractor management, billing, collections, accounting, or similar business activities.
• “Professional Data” includes information about your professional background and business role; and
• “Marketing Data” includes details of your marketing and communication preferences.
• “Sensitive Personal Information” includes information that applicable law treats as sensitive, which may include account log-in credentials, payment information in combination with required security or access credentials, contents of communications where we are not the intended recipient, or other sensitive information as defined by applicable law. We collect Sensitive Personal Information only as reasonably necessary for the purposes described in this Policy or as otherwise permitted by applicable law.

In the preceding 12 months, we have collected the categories of personal information described above consistent with this Policy.

Workforce Privacy Notice. This Policy applies to consumer-facing website and related business activities only and does not govern our collection, use, or disclosure of personal information relating to California job applicants, employees, contractors, or other personnel in the employment or engagement context. Where required, SupplyOne provides separate workforce privacy notices describing those practices and any applicable rights.

How and Why We Use Your Information

We use personal information for the business and commercial purposes described below. We may also use personal information for other disclosed purposes that are compatible with the context in which the information was collected and as otherwise permitted by applicable law. Our collection, use, retention, and disclosure of personal information is limited to what is reasonably necessary and proportionate for these purposes.

Cookies and Tracking Technologies

We and our service providers, advertising partners, analytics providers, and other third parties use cookies, pixels, tags, software development kits, embedded tools, and similar online tracking technologies on our Websites and online services. These technologies help us operate and secure our Websites, understand how visitors interact with our websites, provide customer support features, and support our marketing and advertising activities.

The categories of tracking technologies we use may include:

• Strictly Necessary Technologies. These technologies are necessary for our Websites to function properly and securely and to enable core site features, such as page navigation, site operation, security, network management, load balancing, and accessibility. These technologies may also include tools used to deploy and manage other Website technologies.
• Analytics and Performance Technologies. These technologies help us understand how visitors and customers use our Websites, measure traffic and engagement, identify errors, improve website performance, and enhance user experience. They may collect information about pages visited, links clicked, approximate location derived from IP address, browser type, device information, and interactions with our Websites.
• Functional and Communication Technologies. These technologies enable enhanced functionality and customer interaction features, such as live chat, customer support, lead capture, form handling, remembering preferences, and integration with customer relationship management or marketing automation tools.
• Advertising, Marketing, and Social Media Technologies. These technologies are used to measure the effectiveness of our advertising campaigns, attribute conversions, build audiences, support remarketing or retargeting, deliver more relevant advertising, and understand how users interact with our ads across websites, apps, devices, and platforms. These technologies may be provided by advertising networks, social media companies, and other marketing partners.
• Embedded Content and Third-Party Service Technologies. These technologies support embedded content and third-party features made available through our websites, such as maps, videos, social media features, or similar integrations. When you interact with those features, the third party may collect information about your interaction in accordance with its own privacy practices.

The information collected through these technologies may include identifiers and online activity information, such as IP address, cookie ID, device ID, advertising ID, browser and device characteristics, operating system, referring URLs, pages viewed, links clicked, search terms, approximate geolocation, and information about how you interact with our Websites and advertisements.

We use information collected through these technologies for the following purposes:

• operating, maintaining, debugging, and securing our websites and services;
• understanding website traffic, usage patterns, and campaign effectiveness;
• personalizing website content and user experience;
• communicating with users and responding to requests through interactive features;
• supporting marketing, advertising, audience creation, conversion measurement, and retargeting; and
• detecting and preventing fraud, misuse, and other unauthorized activity.

We use Advertising, Marketing, and Social Media Technologies for targeted advertising, retargeting, audience creation, customer list matching, conversion measurement, campaign measurement, analytics, lead generation, and cross-brand marketing. These technologies may allow advertising networks, social media platforms, analytics providers, audience measurement providers, and other third-party marketing partners to collect or receive identifiers, device information, internet or other electronic network activity information, commercial information, approximate geolocation information, and related inferences or audience segments from your browser, device, or interactions with us.

Depending on the activity and applicable law, these practices may constitute a “sale,” “sharing,” or processing for targeted advertising. You may opt out as described in the Your Privacy Rights and Choices section and through the Do Not Sell or Share My Personal Information link available on our Websites.

Cookie controls may help you manage certain tracking technologies on the browser or device you are using. However, where required by law, we also provide a method to opt out of the sale or sharing of personal information and targeted advertising, which may apply beyond cookie placement. You may exercise those rights through the Do Not Sell or Share My Personal Information link, by enabling a legally recognized opt-out preference signal such as Global Privacy Control, or by contacting us as described in this Policy.

Disclosure of Personal Information to Third Parties

We may disclose the categories of personal information described in this Policy to the categories of recipients listed below for the business and commercial purposes described in this Policy. The categories of personal information disclosed depend on the nature of the relationship, the purpose of the disclosure, the services provided, the systems involved, and applicable legal requirements. We do not disclose every category of personal information to every recipient.

When we disclose personal information to service providers, contractors, or other vendors that process personal information on our behalf, we require appropriate contractual protections, including limitations on use, retention, and disclosure of the information, safeguards for the information, and compliance with applicable legal requirements.

We may disclose personal information to the following categories of recipients:

• Affiliates, subsidiaries, brands, operating businesses, and business units within the SupplyOne family, including for centralized administration, shared systems, account management, customer support, security, compliance, analytics, sales operations, business intelligence, marketing, advertising, lead management, customer relationship management, cross-brand communications, and other shared operational functions conducted within SupplyOne’s privacy and data-governance framework.
• Advertising networks, social media platforms, and audience measurement providers, including to support advertising, campaign measurement, conversion tracking, audience creation, customer list matching, retargeting, and similar marketing activities.
• Analytics providers, to help us understand how our Websites, Services, and communications are used and to improve them.
• Cloud hosting, storage, infrastructure, security, and website service providers, to host, maintain, secure, back up, troubleshoot, and support our systems, Websites, and online services.
• Communications, forms, chat, and customer engagement providers, to support email, phone, text, chat, forms, customer service, and other business communications.
• Customer relationship management, sales enablement, and marketing automation providers, to manage contacts, customer accounts, leads, communications, campaigns, and sales activities.
• Data verification, data enhancement, and business intelligence providers, to validate, append, update, or enhance business contact or customer information and support business intelligence activities.
• Payment processors and financial transaction providers, to process payments, billing, invoicing, and related transactions.
• Order fulfillment, shipping, and logistics providers, to process, coordinate, and deliver orders and related services.
• Professional advisors and business support providers, such as auditors, consultants, insurers, accounting and tax advisors, and legal advisors.
• Government entities, regulators, law enforcement, courts, and other parties, where required or permitted by law.
• Parties involved in corporate transactions, such as an actual or prospective merger, acquisition, financing, reorganization, bankruptcy, integration, due diligence review, or sale of assets.

We may disclose Sensitive Personal Information, if collected, only as reasonably necessary for the purposes described in this Policy, to provide requested goods or services, for security and fraud prevention, to comply with law, or as otherwise permitted by applicable law.

In the preceding 12 months, we have disclosed personal information to the categories of recipients described above for business and commercial purposes consistent with this Policy.

Sale and Sharing of Personal Information

Under certain U.S. state privacy laws, including the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”), disclosing personal information to third parties for cross-context behavioral advertising, targeted advertising, or for monetary or other valuable consideration may constitute a “sale” or “sharing” of personal information.

Based on our current advertising and marketing practices, which may include advertising pixels, cookies, tags, customer list uploads, hashed email matching, audience-building tools, retargeting, conversion tracking, campaign measurement, social media advertising tools, analytics tools, and similar technologies provided by third-party advertising platforms, SupplyOne may “sell” or “share” the following categories of personal information for targeted advertising, cross-context behavioral advertising, campaign measurement, audience creation, lead generation, and cross-brand marketing: identifiers; Contact Data; Technical Data; internet or other electronic network activity information; Commercial Data; Marketing Data; approximate geolocation information derived from IP address or device information; and inferences or audience segments derived from these categories.

We may use personal information collected through one SupplyOne Websites, brand, operating business, or customer relationship to support marketing, advertising, analytics, audience creation, customer list matching, retargeting, campaign measurement, lead generation, and cross-brand communications for SupplyOne and other businesses within the SupplyOne family. These activities may involve disclosures to affiliates, subsidiaries, advertising networks, social media platforms, analytics providers, audience measurement providers, customer relationship management providers, marketing automation providers, and similar partners. Depending on the activity and applicable law, these practices may constitute a “sale,” “sharing,” or processing for targeted advertising.

We do not knowingly sell or share personal information of consumers under 16 years of age.

You have the right to opt out of the sale or sharing of your personal information and, where applicable, targeted advertising. Please see the Your Privacy Rights and Choices section below for information about how to exercise this right.

Your Privacy Rights and Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. However, these rights are not absolute, may apply only in certain circumstances and, in certain cases, we may decline your request as permitted by law.

• Right to Access / Know. You may have a right to request access to personal information that we hold about you, including information about the personal information we have collected about you, including, in some cases, the categories and specific pieces of personal information, the categories of sources, the purposes for which we collect, use, disclose, sell, or share it, and the categories of third parties to whom we disclose it.
• Right to Delete. You may have a right to request that we delete personal information we maintain about you.
• Right to Correct. You may have a right to request that we correct inaccurate personal information we maintain about you.
• Right of Portability. You may have a right to receive a copy of certain personal information in a portable and, to the extent technically feasible, readily usable format, subject to applicable exceptions.
• Right to Opt Out of Sale/Sharing and Targeted Advertising. You may have the right to opt out of the “sale” or “sharing” of your personal information, as well as targeted advertising, as those terms are defined under applicable state law. You may exercise this right by clicking the Do Not Sell or Share My Personal Information link available on our Websites, by enabling a legally recognized opt-out preference signal such as Global Privacy Control in your browser or browser extension, or by contacting us using the methods described in the Contact Us section below. We do not require you to create an account to submit an opt-out request, and we will not require additional information beyond what is reasonably necessary to process the request.
• Right to Limit Use of Sensitive Personal Information.  Where applicable, you may have the right to direct us to limit certain uses or disclosures of sensitive personal information to purposes permitted by law.

Exercising Your Rights. You may submit a request to exercise your rights using the contact details provided in the Contact Us section below and/or through the methods described elsewhere in this Policy.

We may need to verify your identity before processing your request. If we cannot verify your identity from the information we already maintain, we may request additional information from you, which we will use only to verify your identity and for security or fraud-prevention purposes.

Where permitted by law, you may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of valid authorization, and we may also require you to verify your identity directly with us or confirm that you authorized the agent to act on your behalf, as permitted by law.

We will respond to your request in accordance with applicable law. Where permitted, we may extend the time to respond and will notify you if an extension applies.

If we decline to take action on your request, we will notify you as required by applicable law. Depending on where you live, you may have the right to appeal our decision, and we will provide information about how to do so where required by law.

Right to Non-Discrimination. You have the right not to receive discriminatory treatment by us for the exercise of your privacy rights as set forth in this Policy.

Marketing Communications. If you would prefer not to receive marketing emails from us, simply click on the unsubscribe link included at the bottom of any of those emails. If you opt out of receiving marketing emails, we may still send you other types of messages, such as purchase receipts, information about shipments, or communications related to your account or business relationship.

Global Privacy Control. We honor Global Privacy Control (“GPC”) signals and other legally recognized opt-out preference signals where required by applicable law. When we detect a valid GPC signal from your browser, we will treat it as a request to opt out of the sale and sharing of personal information associated with that browser or device. If you would like your opt-out to apply to personal information associated with your account, email address, customer record, or other information not linked to the browser or device sending the signal, please also submit an opt-out request through the Do Not Sell or Share My Personal Information link or by contacting us as described in this Policy in the Contact Us section. We will use the information you provide to process and maintain your request.

International Transfers

Our Websites and services are operated from the United States and Canada. We and our service providers may process personal information in the United States, Canada, and other jurisdictions where we or they operate. These jurisdictions may have privacy and data protection laws that differ from the laws in your province, state, or country of residence, and personal information processed in those jurisdictions may be subject to lawful access by courts, law enforcement, regulators, or government authorities. We protect personal information as described in this Policy and as required by applicable law.

Retention of Your Personal Information

We retain personal information for no longer than is reasonably necessary and proportionate for the purposes described in this Policy, including to provide products and services, manage customer, vendor, supplier, contractor, and business relationships, communicate with individuals, operate and secure our business, administer privacy choices, comply with legal and regulatory obligations, establish or defend legal claims, and enforce our agreements.

The criteria we use to determine retention periods include the nature and sensitivity of the information, the purposes for which it was collected and used, the length of any relationship with the relevant individual or organization, applicable legal, tax, accounting, safety, and regulatory requirements, and whether the information is needed for recordkeeping, dispute resolution, fraud prevention, or subject to a legal hold.

In general, we retain the following categories of personal information according to the following respective criteria:

• Identity Data — retained based on the length of the applicable customer, vendor, supplier, contractor, prospect, or other business relationship; identification and verification needs; recordkeeping requirements; legal, regulatory, and compliance obligations; and the need to administer privacy requests and preferences.
• Contact Data — retained based on the need to communicate with individuals and organizations, manage the relationship, maintain business records, and comply with legal and operational requirements.
• Communications Data — retained based on the need to respond to inquiries, document interactions, provide customer or business support, maintain records of communications, and establish, exercise, or defend legal claims.
• Marketing Data — retained based on marketing preferences, consent records, suppression lists, opt-out requests, communication history, campaign administration, and legal compliance needs.
• Technical Data — retained based on website and system operation, security, diagnostics, analytics, fraud prevention, legal compliance, and the duration necessary to honor cookie, advertising, and opt-out preferences.
• Commercial Data — retained based on order fulfillment, warranty, returns, accounting, tax, recordkeeping, and legal compliance requirements.
• Professional Data — retained based on business relationship management, diligence, compliance review, and legal or operational needs.
• Financial Data — retained based on payment processing, accounting, tax, audit, recordkeeping, and legal compliance requirements.
• Sensitive Personal Information — retained based on the limited purposes for which it was collected, such as identity verification, screening, payment, safety, legal, regulatory, and compliance obligations, and related recordkeeping needs.

We may retain personal information longer where required or permitted by law, where it is subject to a legal hold, investigation, or audit, or where necessary to establish, exercise, or defend legal claims.

Information Security

We employ reasonable security measures designed to protect the security of all information submitted through our services or Websites. However, the security of information transmitted through the internet can never be guaranteed. We are not responsible for any interception or interruption of any communications through the internet or for changes to or losses of data. Users of the services are responsible for maintaining the security of any password, user ID, or other form of authentication involved in obtaining access to password-protected or secure areas of any of our digital services.

In order to protect you and your data, we may suspend your use of any of the services, without notice, pending an investigation, if any breach of security is suspected. Access to and use of password-protected and/or secure areas of any of the services are restricted to authorized users only. Unauthorized access to such areas is prohibited and may lead to criminal prosecution.

Children

Our Websites and services are intended for business users and are not directed to individuals under 16 years of age. We do not knowingly collect personal information from individuals under 16 through our Websites or services. We do not knowingly sell or share personal information of consumers under 16 years of age. If you believe that we have collected personal information from a child or individual under 16, please contact us via the options listed in the Contact Us section at the end of this document.

Modifications to Privacy Policy

We reserve the right to change this Privacy Policy at any time. Updated versions of this Policy will appear on the Websites and are effective immediately. You are responsible for regularly reviewing the Policy. Continued use of the Websites after any such changes constitutes your acknowledgment of such changes.

Contact Us

If you have any questions about this Privacy Policy, please contact us by email at privacy@supplyone.com or by phone at (866) 824-8003.

Supplemental Addendum for Residents of Canada

If you are a resident of Canada, this section supplements the rest of this Privacy Policy. We handle personal information relating to individuals in Canada in accordance with applicable Canadian privacy laws, including the Personal Information Protection and Electronic Documents Act (“PIPEDA”) and, where applicable, substantially similar provincial private-sector privacy laws in Quebec, Alberta, and British Columbia.

Depending on your province of residence and the nature of your relationship with us, you may have the following rights, subject to applicable legal exceptions:

• Right to Access – You may request access to the personal information we maintain about you and information about how we use and disclose it.
• Right to Correction – You may request that inaccurate, incomplete, or outdated personal information be corrected.
• Right to Withdraw Consent – Where we rely on consent to process your personal information, you may withdraw that consent, subject to legal or contractual restrictions and reasonable notice. If you withdraw consent, we may not be able to provide certain products, services, communications, or features.
• Right to Information – You may request information about why we collect your personal information, how we use it, and to whom it has been disclosed, subject to applicable legal limitations.
• Right to Complain – You may raise privacy-related concerns with us at any time. You may also have the right to file a complaint with the Office of the Privacy Commissioner of Canada or the applicable provincial privacy commissioner if you believe your rights have not been respected.

As set forth in the International Transfers section of the Policy we may process personal information in Canada, the United States, and other jurisdictions where we or our service providers operate. Personal information processed outside your province or country may be subject to lawful access by courts, law enforcement, regulators, or government authorities in those jurisdictions.

We may use cookies, pixels, analytics tools, advertising technologies, and similar technologies as described in the Cookies and Tracking Technologies section of the Privacy Policy. These technologies may be used to identify your browser or device, understand how you interact with our Websites and Services, measure advertising campaigns, support retargeting, create audiences, and deliver more relevant advertising.

Quebec Residents

If you are a resident of Quebec, additional rights may apply to you under Quebec’s Act respecting the protection of personal information in the private sector, CQLR c. P-39.1, as amended by Law 25. These may include:

• Right to De-indexation / Re-indexation – You may request that we stop disseminating personal information about you or de-index or re-index hyperlinks attached to your name, in cases permitted by law.
• Right to Data Portability – You may request that computerized personal information collected from you be provided to you, or to another organization where technically feasible, in a structured, commonly used technological format, subject to applicable legal limitations.
• Rights Regarding Automated Decision-Making – If we use personal information to make a decision based exclusively on automated processing, you may have the right to be informed of that processing and to request information about the personal information used, the reasons and principal factors leading to the decision, and the right to submit observations to a member of our team for review.
• Right to Anonymization – Once the purposes for which personal information was collected or used are fulfilled, we may delete or anonymize the information in accordance with applicable law.

For Quebec residents, this Privacy Policy also serves as our confidentiality policy for personal information collected through technological means where this Policy is posted, linked, referenced, or otherwise provided. As described above and in the Cookies and Tracking Technologies section, we may use technologies that identify, locate, or profile users, including cookies, pixels, analytics tools, advertising technologies, and similar technologies.

Contact Information

We are responsible for personal information under our control and have appointed a Privacy Officer to oversee compliance with applicable Canadian privacy laws. To exercise your rights, withdraw consent, submit a complaint, or ask questions about our privacy practices, please contact us using the information provided in the Contact Us section of the Policy.