Your privacy choices

The short version

We do not sell your personal information. We do not share it for cross-context behavioural advertising. We do not use it for targeted advertising or for profiling that produces legal effects. There is therefore no opt-out for you to exercise — the setting is already where an opt-out would put it. The rights below are the ones that still apply, and they are real.

Who this applies to

Residents of states with a comprehensive consumer privacy law — California (CCPA as amended by the CPRA), Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and the other states whose acts are now in force. The rights differ slightly between them; we apply the most generous version to everyone rather than run ten different processes.

What we collect and why

The categories are set out in full in our privacy policy: identifiers (name, email, address), commercial information (what you ordered), and internet activity limited to server and CDN request logs. We collect it to take payment, ship your order, support you afterwards and meet our tax obligations. We do not collect sensitive personal information, biometric data, precise geolocation or data about your health.

Your rights

Whatever state you are in, we will honour all of the following:

• Know and access. What we hold about you, where it came from, why we have it and who we disclosed it to, plus a copy in a portable format.
• Delete. Removal of what we hold, except records we are legally required to keep, such as invoices.
• Correct. Fixing anything inaccurate.
• Opt out of sale, sharing and targeted advertising. We do none of these, so there is nothing to switch off — but if that ever changes, the control will be on this page before the practice starts.
• Limit the use of sensitive personal information. We do not collect any.
• Non-discrimination. Using any of these rights will never get you a worse price, a slower service or a refused order.

How to make a request

Email privacy@cofactorsupply.com with the word “privacy request” and tell us what you want. There is no form to fill in and no account to create.

We will verify you before we act, because handing your order history to someone impersonating you would be the worse failure. Usually that means replying from the email address on the order; for a deletion request we may ask for one more detail that only you would know. We do not ask for ID documents.

We respond within 45 days. If a request is genuinely complex we may take one 45-day extension, and we will tell you before we do, not afterwards.

Authorised agents

You may use an authorised agent. Send written permission signed by you, and we will still verify you directly unless the agent holds a valid power of attorney.

Appeals

If we refuse a request, we will say why in writing. You may appeal by replying to that decision within 30 days, and a different person will review it. If we turn down your appeal you may contact your state Attorney General, and we will tell you how in the same message.

Financial incentives

We run no loyalty programme and offer no discount in exchange for personal information, so there is no financial incentive to disclose.

Global Privacy Control

We honour the Global Privacy Control signal. In practice it changes nothing here, because there is no sale or sharing for it to switch off — but the signal is respected rather than ignored, and it will keep being respected if our practices ever change.

Contact

Privacy requests and appeals: privacy@cofactorsupply.com. Post: [LEGAL ENTITY NAME], [REGISTERED ADDRESS].