Privacy Policy of Sunhub, LLC

We take your privacy seriously, and this Privacy Policy explains how we collect, use, share, and protect information about you when you visit our website, use our services, or interact with us (collectively, the "Services"). Please read it carefully.

This Policy applies to all visitors, registered users, and business contacts who interact with our Services, whether as buyers, sellers, or browsers. It covers our online and offline data practices, including our use of cookies and third-party tracking technologies.

If you are a California resident, please pay particular attention to Section 10 (Your California Privacy Rights), which describes your rights under the California Consumer Privacy Act ("CCPA") and California Invasion of Privacy Act ("CIPA").

If you are located in the European Economic Area, the United Kingdom, or Switzerland, please also review Section 11 (Notice for EEA, UK, and Switzerland Residents).

By using our Services, you acknowledge this Policy. If you do not agree, please discontinue use of the Services.

1. WHAT DOES THIS POLICY COVER?

This Privacy Policy covers information we collect through our website, mobile applications, online portals, email communications, and any other digital or offline touchpoint that links to this Policy (collectively, the "Services"). It does not cover third-party websites, applications, or services that may link to or from our Services. Those third parties have their own privacy policies, and we encourage you to review them.

This Policy also applies to business-to-business contacts, including contacts with our customers, suppliers, and partners in accordance with applicable law.

Employment Information: This Policy does not cover personal information we collect from job applicants, employees, or contractors in an employment capacity.

2. INFORMATION WE COLLECT AND HOW WE COLLECT IT

The types of information we collect depend on how you interact with us. We collect information in three main ways: information you provide directly, information we collect automatically, and information we receive from third parties.

A. Information You Provide Directly

When you register for an account, place an order, submit an inquiry, or otherwise interact with our Services, you may provide us with:

• Identifiers: name, email address, mailing address, phone number, username, and account credentials.
• Commercial Information: products or services viewed, purchased, or inquired about; transaction history; order details.
• Financial Information: billing details processed through our payment provider. We do not store full payment card numbers.
• Professional or Employment Information: company name, job title, and industry, where you voluntarily provide them.
• Communications: messages, inquiries, support requests, and survey responses you send us.

B. Information Collected Automatically

When you visit or use our Services, we and our third-party partners automatically collect information about your device, browser, and activity. This includes:

• Internet or Network Activity: pages visited, links clicked, time spent on pages, search terms used within our Services, and interaction data.
• Device and Technical Information: IP address, device type, operating system, browser type and version, screen resolution, language settings, and device identifiers.
• Geolocation Data: approximate location inferred from your IP address.
• Inferences: profiles reflecting your preferences, interests, and behavior derived from your activity data.

We collect this information using cookies, pixels, tags, SDKs, web beacons, and similar tracking technologies, described further in Section 4 (Cookies and Tracking Technologies).

C. Information We Receive from Third Parties

We may receive information about you from our third-party service providers, analytics partners, advertising networks, and publicly available sources. For example, we may receive updated contact information or information about your interactions with our advertising on third-party platforms.

3. CATEGORIES OF PERSONAL INFORMATION WE COLLECT

The table below identifies the categories of personal information we collected in the preceding 12 months, mapped to the California Consumer Privacy Act's statutory categories, along with our expected retention period for each.

Sensitive Personal Information

The CCPA identifies a subset of personal information as "sensitive." We only collect or use sensitive personal information to the extent necessary to provide our Services or as otherwise permitted by law. The table below identifies which sensitive personal information categories we collect and how we use them.

We do not use or disclose sensitive personal information for purposes other than the CCPA's Permitted SPI Purposes (i.e., to provide and improve our Services, maintain security and integrity, fulfill transactions, and comply with law). Accordingly, we do not provide a "Limit the Use of My Sensitive Personal Information" link, as we do not use sensitive personal information beyond those permitted purposes.

4. COOKIES AND TRACKING TECHNOLOGIES

We use cookies, pixels, tags, SDKs, and similar technologies on our website to collect information automatically when you visit. Some of these are placed by us directly; others are placed by our third-party partners. Both types may transmit your IP address and device/browser identifiers to third parties as part of their normal operation.

Types of Cookies We Use

• Operational / Strictly Necessary Cookies: Essential to the functioning of our website. They enable core features such as page navigation, secure login, and shopping cart functionality. These cannot be disabled without impairing the Services.
• Functional Cookies: Enable enhanced features and personalization, such as remembering your preferences and settings between sessions.
• Performance / Analytics Cookies: Help us understand how visitors use our website so we can improve it. These may be set by us or by third-party analytics providers.
• Targeting / Advertising Cookies: Track your browsing activity across our site and other websites to deliver relevant advertisements, measure ad effectiveness, and build audience profiles. These are placed by our advertising partners and constitute the transmission of personal information to third parties.

Categories of Third-Party Services Active on Our Website

We integrate third-party services into our website that may automatically receive your IP address, device identifiers, and browsing activity when you visit. The table below describes the categories of those services. A current list of specific providers is available upon request by contacting us at data.privacy@sunhub.com.

Each of these third-party service providers operates under its own privacy policy. We encourage you to review the privacy policies of any third-party services you interact with through our website. Upon request, we will provide you with a current list of specific third-party providers we use. Contact us at data.privacy@sunhub.com to make this request.

Your Cookie Choices

You can manage cookies through your browser settings or through our cookie preference center (if available on your site). You may also use browser-based tools such as the Global Privacy Control ("GPC") signal, which we honor as a valid opt-out of personal information sales and sharing for cross-context behavioral advertising (see Section 10).

Please note that disabling certain cookies may affect the functionality of our Services. Blocking operational cookies may prevent you from using core features such as account login and checkout.

5. HOW WE USE YOUR INFORMATION

We use the information we collect for the following business and commercial purposes:

• Providing and Operating the Services: To process transactions, fulfill orders, manage your account, authenticate users, and deliver the products and services you request.
• Communications: To send you transactional messages, order confirmations, account updates, and service-related notifications.
• Customer Support: To respond to your inquiries, resolve disputes, and provide technical assistance.
• Analytics and Service Improvement: To understand how our Services are used, measure performance, and improve features, content, and user experience.
• Marketing and Advertising: To send you promotional communications (where permitted), deliver interest-based advertising, and measure the effectiveness of our marketing campaigns. You may opt out of marketing communications at any time.
• Personalization: To tailor your experience based on your preferences, browsing history, and interactions with us.
• Security and Fraud Prevention: To detect and prevent fraudulent activity, unauthorized access, and other harmful or illegal conduct.
• Legal Compliance: To comply with applicable laws, respond to legal process, fulfill regulatory obligations, and exercise or defend our legal rights.
• Business Transactions: In connection with a merger, acquisition, sale of assets, or similar corporate transaction, your information may be transferred as a business asset.

We will not use your personal information for materially different or incompatible purposes without providing you with advance notice and, where required by law, obtaining your consent.

6. HOW WE SHARE YOUR INFORMATION

We may share your information in the following circumstances:

A. Service Providers and Contractors

We disclose personal information to third-party service providers who perform services on our behalf, such as web hosting, analytics, payment processing, customer support, marketing, and email delivery. These disclosures are made under written contracts that limit the service provider's use of your information to the specific business purpose for which it was shared and prohibit further sale or sharing of the information.

B. Third-Party Advertising and Analytics Partners

We share (and, in some cases, sell) personal information, including identifiers, device data, and internet activity with the third-party advertising networks, analytics providers, and marketing platforms listed in Section 4 (Cookies and Tracking Technologies). This sharing enables cross-context behavioral advertising and audience profiling. You have the right to opt out of this sharing. See Section 10 for details.

C. Business Transfers

If we are involved in a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your personal information may be transferred to the acquiring entity. We will notify you as required by applicable law.

D. Legal Requirements and Protection of Rights

We may disclose your personal information when we believe in good faith that disclosure is necessary to: comply with applicable law or legal process; respond to a court order, subpoena, or government request; enforce our Terms of Service or other agreements; protect the safety, rights, or property of us, our users, or others; or prevent fraud or other illegal activity.

E. With Your Consent

We may share your information with your consent or at your direction for purposes not described in this Policy.

What We Do Not Do

• Mobile phone numbers: We do not share mobile phone numbers provided to us for messaging or security purposes with third parties or affiliates for marketing or promotional purposes.
• Sale to data brokers for direct marketing: We do not sell your personal information to data brokers for their own direct marketing use (California Shine the Light Law, Cal. Civ. Code § 1798.83).

7. SOURCES OF PERSONAL INFORMATION

We collect personal information from the following categories of sources:

Directly from you, through registration forms, account creation, purchases, inquiries, and communications.

Automatically from your device and browser when you use our Services, via cookies and similar technologies described in Section 4.

From our service providers, including analytics platforms, advertising networks, and customer relationship management systems.

From third-party platforms and data partners, including social media platforms when you interact with our advertising, and business data providers.

From publicly available sources, including business directories and public records.

8. HOW WE RETAIN YOUR INFORMATION

We retain personal information for as long as reasonably necessary to fulfill the purposes described in this Policy, unless a longer retention period is required or permitted by law. The retention periods outlined in Section 3 apply to each category of personal information.

In determining retention periods, we consider: the nature and sensitivity of the information; our legal obligations; the purposes for which we collected it; whether we can achieve those purposes by other means; and the potential risk of harm from unauthorized use or disclosure.

At the end of the applicable retention period, personal information will be securely deleted, destroyed, or de-identified. We maintain a confidential record of deletion requests in accordance with the CCPA.

9. HOW WE PROTECT YOUR INFORMATION

We implement and maintain reasonable administrative, technical, and physical safeguards designed to protect your personal information from unauthorized access, use, disclosure, alteration, or destruction. These measures include encryption of data in transit and at rest, access controls, regular security assessments, and vendor security requirements.

No method of electronic transmission or storage is completely secure. While we work diligently to protect your information, we cannot guarantee absolute security. If we become aware of a data breach that triggers notification obligations under applicable law, we will notify you as required.

You are also responsible for protecting the security of your account credentials. Do not share your password with others, and notify us immediately if you believe your account has been compromised.

10. YOUR CALIFORNIA PRIVACY RIGHTS

This section applies to California residents and provides disclosures required by the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), and the California Invasion of Privacy Act ("CIPA"). Terms used in this section have the meanings defined under those laws.

A. Your CCPA Rights

As a California resident, you have the following rights regarding your personal information:

• Right to Know (Access): You may request disclosure of the categories and specific pieces of personal information we have collected about you, the categories of sources, our business or commercial purposes for collecting it, and the categories of third parties we shared it with. You may make up to two requests in any 12-month period.
• Right to Data Portability: As part of your right to know, you may request a copy of the specific pieces of personal information we collected about you in a readily usable, portable format.
• Right to Deletion: You may request that we delete personal information we collected from you, subject to certain exceptions (e.g., where retention is necessary to complete a transaction, comply with law, or ensure security).
• Right to Correction: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: You may direct us to stop selling or sharing your personal information with third parties for cross-context behavioral advertising. See "How to Opt Out" below.
• Right to Limit Sensitive Personal Information: As described in Section 3, we do not use sensitive personal information beyond the CCPA's Permitted SPI Purposes, so this right is not currently applicable.
• Right to Non-Discrimination: We will not discriminate against you for exercising your CCPA rights. We will not deny you goods or services, charge different prices, or provide a different level of quality because you exercised your rights.

B. Personal Information Sales and Sharing Disclosure

In the preceding 12 months, we have shared (and may have sold) the following categories of personal information with third-party advertising and analytics partners for cross-context behavioral advertising purposes: Identifiers (Category A), Internet or Network Activity (Category F), and Geolocation Data (Category G).

The third parties who received this information include the advertising networks, analytics providers, and marketing platforms identified in Section 4. This sharing occurred automatically upon page load, prior to any user interaction, through the third-party tracking technologies described in Section 4.

We do not knowingly sell or share the personal information of consumers we know are under 16 years of age.

C. How to Opt Out of Sale or Sharing

To opt out of the sale or sharing of your personal information, you may:

Click "Do Not Sell or Share My Personal Information" in the footer of our website.

Use a Global Privacy Control (GPC) signal. We honor browser-based GPC signals as a valid opt-out request. When we detect a GPC signal from your browser, we will process it as a request to opt out of the sale and sharing of your personal information.

Submit a request by email to data.privacy@sunhub.com.

We will process your opt-out request within 15 business days. We will notify our service providers, contractors, and downstream third parties of your request. We will not ask you to reauthorize the sale or sharing of your personal information for at least 12 months after you opt out.

D. How to Exercise Your Other Rights

To exercise your rights to know, delete, or correct, please submit a verifiable request by:

• Emailing us at: data.privacy@sunhub.com
• Calling us at: (800) 409-9172
• Visiting: Contact Us

We will confirm receipt of your request within 10 business days and provide a substantive response within 45 calendar days. If we need additional time (up to another 45 calendar days), we will notify you of the extension and the reason. We will verify your identity before processing your request. You may designate an authorized agent to submit requests on your behalf; we may require written authorization from you confirming the agent's authority.

E. CIPA Notice

The California Invasion of Privacy Act (Cal. Penal Code § 638.51) restricts the installation or use of pen register processes, technologies that capture addressing or signaling information from electronic communications without a court order or the user's informed, specific consent. The third-party tracking technologies described in Section 4 may, depending on their technical operation, function as pen register processes under CIPA by capturing IP addresses and device/browser identifiers transmitted as part of HTTP requests when you visit our website.

We are committed to obtaining your informed consent before deploying non-essential tracking technologies. Through our consent management platform (where deployed), you can accept or reject non-essential tracking technologies before they execute. Essential/operational technologies required to render the website may still operate, as they are necessary to provide the service you requested.

F. Shine the Light

California Civil Code § 1798.83 ("Shine the Light") permits California residents to request information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes without your consent. For questions about this, contact us at data.privacy@sunhub.com.

11. NOTICE FOR EEA, UK, AND SWITZERLAND RESIDENTS

This section applies to individuals located in the European Economic Area (EEA), the United Kingdom, and Switzerland and provides information required by the General Data Protection Regulation (GDPR) and equivalent laws.

A. Data Controller

SUNHUB, LLC, located at 1925 St Clair Ave NE, Cleveland, OH, 44114, is the data controller responsible for your personal information.

B. Legal Bases for Processing

We process your personal information on the following legal grounds:

• Contractual Necessity: To perform our contract with you or to take steps at your request before entering into a contract.
• Legitimate Interests: For analytics, fraud prevention, security, marketing (where balanced against your rights), and improving our Services.
• Legal Obligation: To comply with applicable laws and regulatory requirements.
• Consent: Where you have given your explicit consent, such as for non-essential cookies and marketing communications. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

C. Your GDPR Rights

You have the right to: access your personal information; correct inaccurate data; request erasure; restrict processing; object to processing based on legitimate interests or for direct marketing; data portability; and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority (for EEA residents: your national data protection authority; for UK residents: the ICO at ico.org.uk; for Switzerland: the FDPIC at edoeb.admin.ch).

D. International Data Transfers

We are based in the United States. When we transfer your personal information outside the EEA, UK, or Switzerland, we rely on appropriate transfer mechanisms, such as the European Commission's Standard Contractual Clauses, to ensure your information receives adequate protection.

E. How to Exercise Your Rights

To exercise any of your rights, contact us using the information in Section 15. We will respond within one month. We may extend this period by two additional months for complex or multiple requests, with notice.

12. ADDITIONAL US STATE PRIVACY RIGHTS

Residents of Colorado, Connecticut, Virginia, Texas, Oregon, Montana, and other states with comprehensive privacy laws may have rights similar to those described in Section 10, including rights to access, correct, delete, and opt out of targeted advertising and profiling. To exercise these rights, contact us using the information in Section 15. We will not discriminate against you for exercising your rights. Appeals may be submitted through the same contact channels.

We do not sell personal data or process it for targeted advertising in ways that require opt-in consent under these state laws without first providing the required notice and, where applicable, obtaining consent.

13. CHILDREN'S PRIVACY

Our Services are not directed to children under the age of 13, and we do not knowingly collect personal information from children under 13. If you are under 13, please do not use our Services or provide any information to us.

If we learn that we have inadvertently collected personal information from a child under 13 without verified parental consent, we will promptly delete that information. If you believe we may have collected information from a child under 13, please contact us at data.privacy@sunhub.com.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last Updated" date at the top of this Policy and, where required by law, provide notice to you through the Services or by other means. We encourage you to review this Policy periodically.

Your continued use of our Services after the effective date of any updated Policy constitutes your acknowledgment of the changes.

15. HOW TO CONTACT US

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Email

data.privacy@sunhub.com

Phone

(800) 409-9172

Online

Contact Us

Mail

SUNHUB, LLC Attn: Legal / Privacy, 1925 St Clair Ave NE, Cleveland, OH, 44114

If you need this Privacy Policy in an alternative format due to a disability, please contact us at the email or phone number above.