Privacy Policy

1. Introduction

AdaSupply ("Company," "we," "our," or "us") operates the website www.adasupply.com and related services. We are a GSA Schedule Contract Holder providing ANSI-certified professional safety equipment for industrial, construction, and workplace safety needs.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website, place orders, create an account, or otherwise interact with our services. This policy is designed to comply with:

• California Consumer Privacy Act (CCPA/CPRA) — California Civil Code §1798.100 et seq.
• California Online Privacy Protection Act (CalOPPA) — California Business & Professions Code §22575-22579
• General Data Protection Regulation (GDPR) — EU Regulation 2016/679
• Virginia Consumer Data Protection Act (VCDPA)
• Colorado Privacy Act (CPA)
• CAN-SPAM Act — 15 U.S.C. §7701 et seq.
• Children's Online Privacy Protection Act (COPPA) — 15 U.S.C. §§6501-6506

By accessing or using our website and services, you acknowledge that you have read, understood, and agree to be bound by this Privacy Policy. If you do not agree with our practices, please discontinue use of our services immediately.

2. Information We Collect

2.1 Personal Information You Provide

We collect information you voluntarily provide when you register for an account, place an order, subscribe to our newsletter, request a quote, contact customer service, or otherwise interact with us:

• Identity Data: First name, last name, job title, company name
• Contact Data: Email address, phone number, billing address, shipping address
• Account Data: Username, password (stored in hashed form), account preferences
• Financial Data: Payment card details, billing information (processed and stored exclusively by our PCI DSS-compliant payment processors)
• Transaction Data: Order history, purchase amounts, product preferences, shipping details
• Communication Data: Messages, emails, feedback, reviews, and support inquiries you send to us
• Government/Business Data: For GSA and government orders — DUNS number, CAGE code, contract numbers, tax exemption certificates

2.2 Information Collected Automatically

When you access our website, we automatically collect certain technical and usage data:

• Device Data: IP address, browser type and version, operating system, device type, screen resolution, and unique device identifiers
• Usage Data: Pages visited, time spent on pages, click patterns, search queries, referring URLs, and navigation paths
• Location Data: Approximate geographic location derived from IP address
• Log Data: Server logs including access times, error logs, and HTTP request data

2.3 Information from Third Parties

We may receive information about you from third-party sources, including:

• Payment processors (transaction confirmations and fraud prevention data)
• Shipping carriers (delivery status and tracking information)
• Analytics providers (aggregated website usage data)
• Business verification services (for B2B and government accounts)
• Marketing partners (with appropriate consent and data processing agreements)

3. How We Use Your Information

We process your personal information for the following purposes, each supported by a lawful basis:

4. Information Sharing and Disclosure

We do not sell, rent, or trade your personal information to third parties for their own marketing purposes. We may share your information only in the following circumstances:

• Payment Processors: We share payment data with PCI DSS-compliant payment processors (e.g., Stripe, PayPal) solely to process your transactions. We never store your full credit card number on our servers.
• Shipping and Logistics Partners: We share shipping addresses and contact information with carriers (e.g., UPS, FedEx, USPS) to deliver your orders.
• Service Providers: We engage trusted third-party companies to perform services on our behalf, including cloud hosting, email delivery, analytics, and customer support tools. These providers are contractually obligated to protect your data and use it only for the services they provide to us.
• Government Agencies: For GSA Schedule orders, we may share necessary transaction data with relevant government agencies as required under federal procurement regulations.
• Legal Compliance: We may disclose information when required by law, subpoena, court order, or government regulation, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others.
• Business Transfers: If AdaSupply is involved in a merger, acquisition, or sale of assets, your personal information may be transferred as part of that transaction. We will notify you via email and/or a prominent notice on our website of any change in ownership.
• With Your Consent: We may share your information with third parties when you explicitly authorize us to do so.

5. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience and collect usage data. Below is a summary of the types of cookies we use:

Managing Cookies

You can manage your cookie preferences through your browser settings. Most browsers allow you to block or delete cookies. Please note that disabling strictly necessary cookies may prevent you from using certain features such as the shopping cart and checkout process.

For more information about our cookie practices, please visit our Cookie Policy.

6. Your Privacy Rights

6.1 Rights for All Users

Regardless of your location, you have the right to:

• Access the personal information we hold about you
• Correct inaccurate or incomplete personal information
• Opt out of marketing communications at any time
• Request deletion of your account and associated data

6.2 California Residents (CCPA/CPRA)

Under the California Consumer Privacy Act (as amended by the California Privacy Rights Act), California residents have the following additional rights:

• Right to Know: Request disclosure of the categories and specific pieces of personal information we have collected about you
• Right to Delete: Request deletion of your personal information, subject to certain exceptions
• Right to Correct: Request correction of inaccurate personal information
• Right to Opt-Out of Sale/Sharing: We do not sell or share your personal information for cross-context behavioral advertising
• Right to Limit Use of Sensitive Personal Information: Direct us to limit the use of your sensitive personal information
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your privacy rights

To exercise these rights, please contact us at privacy@adasupply.com or call 478-329-8896. We will verify your identity and respond within 45 days as required by law.

CCPA Annual Disclosure: In the preceding 12 months, we have collected the categories of personal information described in Section 2. We have not sold personal information to third parties. We have disclosed personal information to service providers for the business purposes described in Section 4.

6.3 Virginia Residents (VCDPA)

Virginia residents have the right to access, correct, delete, and obtain a portable copy of their personal data, as well as the right to opt out of targeted advertising, sale of personal data, and profiling. You may appeal a decision regarding your request by contacting us.

6.4 Colorado Residents (CPA)

Colorado residents have similar rights to access, correct, delete, and port their personal data, and to opt out of targeted advertising, sale of personal data, and certain profiling activities.

6.5 EU/EEA Residents (GDPR)

If you are located in the European Union or European Economic Area, you have additional rights under the GDPR:

• Right to Access: Obtain confirmation of whether we process your data and receive a copy
• Right to Rectification: Correct any inaccurate or incomplete personal data
• Right to Erasure: Request deletion of your personal data ("right to be forgotten")
• Right to Restrict Processing: Limit how we use your data in certain circumstances
• Right to Data Portability: Receive your data in a structured, commonly used format
• Right to Object: Object to processing based on legitimate interest or for direct marketing
• Right to Withdraw Consent: Withdraw consent at any time, without affecting prior processing
• Right to Lodge a Complaint: File a complaint with your local data protection supervisory authority

6.6 Marketing Communications

You can opt out of marketing emails at any time by clicking the "unsubscribe" link in any promotional email, updating your communication preferences in your account settings, or contacting us directly. Please note that even after opting out of marketing emails, you will still receive transactional communications related to your orders and account.

7. Data Security

We take the security of your personal information seriously and implement industry-standard technical and organizational measures to protect it:

• Encryption in Transit: All data transmitted between your browser and our servers is encrypted using TLS 1.2+ (HTTPS)
• Encryption at Rest: Sensitive data stored in our databases is encrypted using AES-256 encryption
• PCI DSS Compliance: All payment processing is handled by PCI DSS Level 1 certified payment processors. We never store full credit card numbers on our systems.
• Access Controls: Strict role-based access controls and multi-factor authentication for all administrative access
• Regular Audits: Periodic security assessments, vulnerability scans, and penetration testing
• Incident Response: Documented incident response procedures to quickly identify, contain, and remediate security incidents
• Employee Training: All employees with access to personal data receive regular privacy and security training

While we strive to protect your personal information using commercially reasonable measures, no electronic storage or transmission method is 100% secure. If you have reason to believe your interaction with us is no longer secure, please contact us immediately.

8. Data Retention

We retain your personal information only for as long as necessary to fulfill the purposes for which it was collected, or as required by applicable law:

• Account Data: Retained for the duration of your account and up to 30 days after account deletion
• Transaction Records: Retained for 7 years as required by IRS and state tax regulations
• Government Contract Records: Retained as required by Federal Acquisition Regulation (FAR) record retention requirements
• Marketing Data: Retained until you unsubscribe or request deletion
• Analytics Data: Retained in anonymized/aggregated form for up to 26 months
• Communication Records: Customer support interactions retained for up to 3 years

When personal data is no longer needed, we securely delete or anonymize it in accordance with our data retention schedule.

9. Third-Party Services

Our website may contain links to third-party websites and services. We are not responsible for the privacy practices of these third parties. We encourage you to review the privacy policies of any third-party sites you visit.

We use the following categories of third-party services:

• Payment Processing: Secure payment gateways for credit card and electronic payment processing
• Shipping & Logistics: Major carriers for order fulfillment and delivery tracking
• Analytics: Website analytics tools to understand user behavior and improve our services
• Cloud Infrastructure: Secure cloud hosting providers for data storage and processing
• Email Services: Transactional and marketing email delivery platforms

All third-party service providers are contractually obligated to protect your data and are prohibited from using it for any purpose other than providing the contracted services.

10. Children's Privacy

Our website and services are intended for use by individuals who are at least 18 years of age, or the legal age of majority in their jurisdiction. We do not knowingly collect, use, or disclose personal information from children under 13 years of age in compliance with the Children's Online Privacy Protection Act (COPPA).

If we learn that we have inadvertently collected personal information from a child under 13, we will take steps to delete that information as promptly as possible. If you believe a child under 13 has provided us with personal information, please contact us immediately at privacy@adasupply.com.

11. International Data Transfers

AdaSupply is based in the United States, and your personal information is processed and stored on servers located within the United States. If you access our services from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where data protection laws may differ from those in your country.

For transfers of personal data from the EU/EEA, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission, or other lawful transfer mechanisms, to ensure adequate protection of your data.

12. Do Not Track Signals

Some web browsers transmit "Do Not Track" (DNT) signals. As there is currently no industry standard for recognizing or honoring DNT signals, our website does not currently respond to DNT signals. However, you can manage your tracking preferences through your browser's cookie settings and through the opt-out mechanisms described in this policy.

13. SMS/Text Message Policy

If you opt in to receive SMS or text message notifications from us (e.g., order updates, shipping alerts), the following terms apply:

• Message frequency varies based on your order activity
• Message and data rates may apply depending on your mobile carrier
• You can opt out at any time by replying "STOP" to any message
• Reply "HELP" for assistance
• We will not share your mobile number with third parties for marketing purposes

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, legal requirements, or other factors. When we make material changes:

• We will update the "Last Updated" date at the top of this page
• For significant changes, we will provide a prominent notice on our website
• For changes that materially affect how we process your data, we will notify you by email (if you have an account with us)

We encourage you to review this Privacy Policy periodically. Your continued use of our services after the posting of changes constitutes your acceptance of those changes.

15. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us through any of the following methods:

We will acknowledge your request within 5 business days and provide a substantive response within 30–45 days, depending on the nature and complexity of your request, as required by applicable law.