State Privacy Notice

State Privacy Notice Addendum

Last Updated: May 2026

This State Privacy Notice Addendum (“Notice”) supplements the information contained in the Stahls’ Fulfill Engine LLC’s or one of its related entities (e.g., affiliates and subsidiaries), (collectively,“Stahls’”) (“Privacy Policy”) and applies solely to all visitors, users, and others who reside in the State of Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia ("consumers" or "you").

We adopt this Notice to comply with the Colorado Privacy Act, the Connecticut Data Privacy Act, the Delaware Personal Data Privacy Act, the Indiana Consumer Data Protection Act, the Iowa Consumer Data Protection Act, the Kentucky Consumer Data Protection, the Maryland Online Data Privacy Act, the Minnesota Consumer Data Privacy Act, the Montana Consumer Data Privacy Act, Nebraska Data Privacy Act, New Hampshire Senate Bill 255, New Jersey Senate Bill 332, the Oregon Consumer Privacy Act, the Rhode Island Data Transparency and Privacy Protection the Tennessee Information Protection Act, the Texas Data Privacy and Security Act, the Utah Consumer Privacy Act, the Virginia Consumer Data Protection Act, and certain other privacy and data protection laws, as applicable (collectively, the "Statutes"). Any terms defined in the Statutes will have the same meaning when used in this Notice. Any terms used in this Notice but undefined herein shall have the meaning provided in the Privacy Policy.

As further set forth in our Privacy Policy, we may collect certain information that is (i) linked or reasonably linkable to an identified or identifiable individual or natural person, or (ii) as further defined in the Statutes as “Personal Data” or “Personal Information,” as further described in our Privacy Policy (collectively, “Personal Information”). Personal Information does not include publicly available information from government records and de-identified or aggregated consumer information.

Categories of Personal Information Processed

The following is a list of categories of Personal Information which may have been collected from consumers within the last twelve (12) months. The categories and examples provided in the chart below are those recognized by the Statutes. This does not mean that all examples of that category of Personal Information were in fact collected but reflects our good faith belief to the best of our knowledge that some of that information may have been collected about consumers. We will update this disclosure from time to time as appropriate

Category	Examples	Collected
A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, Social Security number, driver's license number, passport number, or other similar identifiers.	YES
B. Personal information categories listed in the state customer record statutes.	A name, signature, Social Security number, physical characteristics or description, address, telephone number, passport number, driver's license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. Some Personal Information included in this category may overlap with other categories.	YES
C. Protected classification characteristics under State or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information).	YES
D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	YES
E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	NO
F. Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	YES
G. Geolocation data.	Physical location or movements.	NO
H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	NO
I. Professional or employment-related information.	Current or past job history or performance evaluations.	YES
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	NO
K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	YES
L. Sensitive Personal Information.	(1) Personal Information that reveals: (A) A person’s social security, driver’s license, state identification card, or passport number; (B) A person’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account; (C) A person’s precise geolocation; (D) A person’s racial or ethnic origin, religious or philosophical beliefs, or union membership; (E) The contents of a person’s mail, email, and text messages unless the business is the intended recipient of the communication; (F) A person’s genetic data; (2) the processing of biometric information for the purpose of uniquely identifying a consumer; (3) Personal Information collected and analyzed concerning a consumer’s health, or a Personal Information collected and analyzed concerning a consumer’s sex life or sexual orientation.	NO

We obtain the categories of Personal Information listed above from the following sources:

Directly from you. For example, during account registration from forms you complete, subscriptions you purchase or comments you provide on our Site.
Indirectly from you. For example, from observing your actions on our Site.
From third parties. For example, third party social networking providers and advertising companies, our affiliates and service providers who provide services or information to us. If you do not want us to collect information from social networks, you should review and adjust your privacy settings on those networks as desired before linking or connecting them to our Site.
From publicly available sources. For example, online database searches.

Purpose of Processing Personal Information

We may use or disclose the Personal Information we collect for one or more of the following purposes:

To fulfill or meet the reason you provided the information. For example, if you provide your personal information to purchase a product or service, we will use that information to process your payment and facilitate delivery. We may also save your information to facilitate new product orders or process returns.
To provide, support, personalize, and develop our Site, products, and services.
To create, maintain, customize, and secure your account with us.
To process your requests, purchases, transactions, and payments and prevent transactional fraud.
To provide you with support and to respond to your inquiries, including to investigate and address your concerns and monitor and improve our responses.
To personalize your Site experience and to deliver content and product offerings relevant to your interests, including targeted offers and ads through our Site.
To provide you with promotions, newsletters, programs, education, and information you request.
To maintain, improve, customize, or administer the Site, perform business analyses, or other internal purposes to improve the quality of our business, the Site, resolve technical problems, or improve security or develop other products and services.
To perform analytics for business purposes and business intelligence, such as monitoring traffic to our Site, counting ad impressions, and auditing legal and regulatory compliance.
To identify and repair errors in our Site’s functionality.
To manage, improve and foster relationships with third-party service providers, including vendors, suppliers, and parents, affiliates, subsidiaries, and business partners.
For marketing and advertising purposes, including sending you promotional material or special offers on our behalf or on behalf of our marketing partners and/or their respective affiliates and other third parties, provided that you have not already opted-out of receiving such communications.
To help maintain the safety, security, and integrity of our Site, products, databases and other technology assets, and business.
To evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, in which personal information we hold is among the assets transferred.
For the purposes of obtaining or maintaining insurance coverage, managing risks, and obtaining professional advice.
To respond to law enforcement requests and as required by applicable law, court order, or governmental regulations.
To exercise or defend legal claims, whether in court proceedings or in an administrative or out-of-court procedure.
As described to you when collecting your Personal Information or as otherwise set forth in the Statutes.
For any other purposes disclosed to you at the time we collect your personal information and/or pursuant to your consent.

Categories of Personal Information shared with a Third-Party

In the preceding 12 months, we have disclosed for a business purpose to one or more third parties the following categories of Personal Information:

Category A – Identifiers
Category B - Customer records information
Category C - Protected classification characteristics under California or federal law
Category D - Commercial information
Category F - Internet or other electronic network activity information
Category I - Professional or employment-related information
Category K - Inferences drawn from other Personal Information

Your Rights Under Other State Privacy Laws

Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia also provide consumers who are residents of these states with certain rights regarding their Personal Information. This section describes the rights you may have under these state privacy laws, under certain circumstances and subject to certain exceptions. Please contact us if you have any questions about your rights under these state privacy laws.

Consumer Right	Explanation	Applies to Residents of:
The Right to Opt-Out	You may have the right to opt out of the processing of Personal Information concerning you for the purposes of: (a) Targeted Advertising; (b) The Sale of Personal Information; or (c) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.	Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Oregon, Tennessee, Texas, Utah, Virginia
The Right of Access	You may have the right to confirm whether we are processing Personal Information concerning you and to access your Personal Information. Please note, there may be restrictions on how often you may exercise this right.	Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia
The Right to Correction	You may have the right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of your Personal Information.	Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia
The Right to Deletion	You may have the right to delete Personal Information concerning you or to request that we delete Personal Information provided by, or obtained about, you.	Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia
The Right to Data Portability	You may have the right to obtain a copy of your Personal Information in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance. Please note, there may be restrictions on how often you may exercise this right.	Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia
The Right to Appeal	We hope that we can resolve any query or concern you raise about our use of your Personal Information. However, if we do not take action on your request to exercise any of your rights, we will inform you without undue delay after the receipt of the request for not taking action. You may appeal any decision we have made about your request by following the instructions in the communication you receive from us notifying you of our decision.	Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Virginia

Exercising Your Rights

To exercise the rights described above, please submit a verifiable consumer request to us via email at Privacy@stahls.com

Only you, or someone legally authorized to act on your behalf, may make a verifiable consumer request related to your Personal Information. The verifiable consumer request must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

In addition, if you ask us to provide you with specific pieces of Personal Information, we may require you to sign a declaration under penalty of perjury that you are the consumer whose Personal Information is the subject of the request.

You may use a representative, called an "authorized agent," to submit a request to us. In order to protect your privacy, Company requires you to confirm that you have provided the authorized agent permission to submit the request and you must provide the authorized agent with signed permission. "Signed" means that the written attestation, declaration, or permission has either been physically signed or provided electronically pursuant to the Uniform Electronic Transactions Act. Company may deny a request from an authorized agent that does not submit proof that they have been authorized to act on your behalf. Requests submitted by an authorized agent will still require verification of the person who is the subject of the request in accordance with the process described above.

We cannot respond to your request or provide you with Personal Information if we cannot reasonably verify your identity or authority to make the request and confirm the Personal Information relates to you.

Response Timing and Format

We endeavor to respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time, we will inform you of the reason and extension period in writing.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding the verifiable consumer request's receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable.

Changes to Our Privacy Notice

We may amend this Privacy Policy at our discretion and at any time. When we make changes to this Privacy Policy, we will post the updated notice on our Site. Your continued use of our Site and/or Services following the posting of changes constitutes your acceptance of such changes.

Contact Information

If you have any questions or comments about this Notice, our Privacy Policy, the ways in which we collect and use your Personal Information, your choices and rights regarding such use, or wish to exercise your rights under applicable law, please do not hesitate to contact us at:

Legal Department
GroupeSTAHL
25901 Jefferson Avenue
St. Clair Shores, MI 48081
Privacy@stahls.com