Supplemental California Privacy Disclosures

Last updated: October 17, 2025

Scope

This Supplemental California Privacy Disclosures (this “Supplement”) describes how HBD Industries, Inc. and its subsidiaries, affiliates, and related entities (collectively, “Company,” “we,” “our,’ or “us”) collect and process Personal Information (as defined below) about our consumers who reside in the State of California, either online or offline, within the scope of the California Consumer Privacy Act of 2018 (“CCPA”). This Supplement supplements the information contained in our Privacy Notice and applies solely to individuals that reside in the State of California (“consumers” or “you”).

For a detailed description of how we collect, use, disclose, and otherwise process personal information, please see our Privacy Notice.

Unless otherwise expressly stated, all terms in this Supplement have the same meaning as defined in our Privacy Notice or as otherwise defined in the CCPA.

Personal Information Disclosures

Personal Information

“Personal Information” in this Supplement means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include publicly available information, lawfully obtained, truthful information that is a matter of public concern, aggregated or anonymized information that is maintained in a form that is not reasonably capable of being associated with or linked to you, or information that is otherwise excluded from the CCPA’s scope.

Personal Information Collected

As set forth in more detail in our Privacy Notice “The Personal Information That We Collect or Process”, we collect the following categories of Personal Information:

Identifiers: Such as first and last name, phone number, email address and IP address.
California Customer Records (Cal. Civ. Code § 1798.80(e)): Such as mailing address, email address, phone number, and state and country of residence.
Commercial Information: Such as Services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
Internet/Network Information: Such as log file data (including operating system and browser type) and clickstream data (including your usage and activity on our Services).
Geolocation Data: Such as your general geographic location based on your IP address.
Sensory Information: Such as the sound of your voice from calls with us or your image when you visit our facilities (where permitted by law).
Professional/Employment Information: Such as your title, company name, professional background, the nature of your relationship with us.
Sensitive Personal Information: Solely in connection with your job application where voluntarily provided or otherwise collected in accordance with law, such as account credentials for our careers page, social security number, driver’s license number, state identification card number, passport number, racial or ethnic origin, union membership, and personal information concerning health (such as accommodation requests).
Other Personal Information: Such as inquiries, requests or comments you choose to send us.
Inferences: Such as predictions about which Services may be of interest to you and your employer.

Sources of Personal Information

We collect the categories of Personal Information listed above from the following categories of sources:

directly from you, such as from the from the forms or other information you provide to the Company;
indirectly from you, such as from your browser or device when you interact with our Services,
from our affiliates;
your employer;
service providers;
information providers;
inferences generated the Company’s or our service providers’ computer systems; and
other publicly available sources.

For more information about the Personal Information we collect and how we collect it, please refer to our Privacy Policy: “The Personal Information That We Collect or Process.”

Sensitive Personal Information

We only use sensitive personal information for the purposes set forth in our Privacy Notice: “How We Use of Personal Information” to the extent necessary to process your job application at your request, to enter into and perform a contract with you, to comply with legal and regulatory requirements, to protect the life or physical safety of anyone or as otherwise permissible for our own internal purposes consistent with laws.

Deidentified Information

We may at times receive, or process Personal Information to create, deidentified information that can no longer reasonably be used to infer information about, or otherwise be linked to, a particular individual or household. Where we maintain deidentified information, we will maintain and use the information in deidentified form and not attempt to reidentify the information except as required or permitted by law.

Use of Personal Information

We collect Personal Information from and about you for a variety of purposes. For example, we use Personal Information to communicate with customers about our Services, to provide customers with our Services, to otherwise operate our business, and comply with legal obligations and rights. For more information about our use of personal information, please refer to our Privacy Notice: “How We Use Personal Information.”

Disclosing, Selling, or Sharing of Personal Information

We may disclose the Personal Information we collect to third parties for the business purposes described in our Privacy Notice: “Our Disclosure of Personal Information”, such as to engage third parties to support our business functions. We only make these business purpose disclosures under written contracts that describe the purposes, require the recipient to keep the Personal Information confidential, prohibit using the disclosed information for any purpose except performing the contract, and meet the CCPA’s other contract requirements for engaging service providers or contractors.

We also allow certain third-party providers to use cookies and related technologies to collect Identifiers (such as IP address), Commercial Information (such as Services sold or considered), Internet/Network Information (such as analytics data), and Inferences (generated from your interactions with us) directly through our Services for purposes of analyzing and optimizing our Services and to help us communicate with you about our Services.

We do not sell your Personal Information to third parties and have not sold it in the preceding 12 months. We do not share your Personal Information with third parties for cross-context behavioral advertising purposes and have not shared your Personal Information in the preceding 12 months.

Retention of Personal Information

We retain Personal Information only for as long as is reasonably necessary to fulfil the purpose for which it was collected. However, if necessary, we may retain personal information for longer periods of time, until such retention periods and deadlines expire, for instance where we are required to do so in accordance with legal, tax, or accounting requirements set by a legislature, regulator, or other government authority.

To determine the appropriate duration of the retention of Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of Personal Information, and whether we can attain our objectives by other means, as well as our legal, regulatory, tax, accounting, and other applicable obligations.

Your California Privacy Rights

If you are a California resident, the CCPA grants you the following rights regarding your personal information:

The Right to Know

You have the right to confirm whether we are processing Personal Information about you and to obtain certain personalized details about the Personal Information we have collected about you, including the:

categories of Personal Information collected;
categories of sources of the Personal Information;
purposes for which the Personal Information was collected;
categories of Personal Information disclosed to third parties (if any) and the categories of recipients to whom this Personal Information was disclosed;
categories of Personal Information shared for cross-context behavioral advertising purposes (or, “targeted advertising”) (if any), and the categories of recipients to whom the Personal Information was disclosed for those purposes; and
the categories of Personal Information sold (if any), and the categories of third parties to whom the Personal Information was sold.

The Right to Access & Portability

You have the right to obtain access to the Personal Information we have collected about you and, where required by law, the right to obtain a copy of the Personal Information in a portable and, to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.

The Right to Correction

You have the right to correct inaccuracies in your Personal Information, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information.

Right to Limit Sensitive Personal Information Use and Disclosure to Permitted SPI Purposes

You have a right to ask businesses that use or disclose your sensitive Personal Information to limit those actions to just the CCPA’s Permitted SPI Purposes. As we do not use or disclose sensitive Personal Information beyond the CCPA’s Permitted SPI Purposes, we do not currently provide this consumer right.

The Right to Opt-Out of Sales or Sharing of Personal

You have the right to request that businesses stop selling or sharing your Personal Information at any time, including through a user-enabled opt-out preference signal. Similarly, the CCPA prohibits businesses from selling or sharing the Personal Information of consumers it actually knows are under 16 years old without first obtaining consent from consumers who are between 13 and 15 years old or the consumer’s parent or guardian for consumers under age 13.

As we do not sell or share consumers’ Personal Information, we do not currently provide these consumer rights.

The Right to Request Deletion

You have the right to request the deletion of Personal Information that we have collected from you.

Right to Non-Discrimination

You have the right not to be discriminated or retaliated against for exercising any of your privacy rights under the CCPA.

How to Exercise Your California Privacy Rights

To Exercise Your Right to Know, Access, Portability, Correction, or Deletion

To submit a request to exercise the Right to Know, Access, Portability, Correction and/or Deletion, please submit a request by:

Emailing us at [sales@winsmith.com] with the subject line “California Rights Request;” or
Sending a request to:
HBD Industries, Inc.
565 Metro Place South, Suite 250
Dublin, OH 43017
Attn: [Privacy Policy]

Please describe your request with sufficient detail so we can properly understand, evaluate, and respond to your request. Before processing your request, we will need to verify your identity and confirm you are a resident of California. In order to verify your identity, we will generally either require the successful login to your account or the matching of sufficient information you provide us to the information we maintain about you in our systems. Although we try to limit the Personal Information collected in connection with a request, certain requests may require us to obtain additional Personal Information from you. In certain circumstances, we may decline or limit a request, particularly where we are unable to verify your identity.

Verification Process and Authorized Agents

Only you, or someone legally authorized to act on your behalf, may make a request to know, access, portability, delete, or correct related to your Personal Information. We may request specific information from you or your authorized representative to confirm your or their identity before we can process your right to know, access, portability, delete, or correct your Personal Information.

We cannot respond to your request to know, access, portability, delete, or correct if we cannot verify your identity or authority to make the request and confirm the Personal Information relating to you. We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make the request.

Responding to Your Requests to Know, Access, Portability, Correction or Deletion

We will confirm receipt of your request within ten (10) business days. If you do not receive confirmation within the ten-day timeframe, please contact [sales@winsmith.com].

We endeavor to substantively respond to a verifiable request within 45 days of its receipt. If we require more time (up to another 45 days), we will inform you of the reason and extension period in writing. We will deliver our written response to your verified email address. Our substantive response will tell you whether or not we have complied with your request. If we cannot comply with your request in whole or in part, we will explain the reason, subject to any legal or regulatory restrictions. Applicable law may allow or require us to refuse to provide you with access to some or all of the personal information that we hold about you, or we may have destroyed, deleted, or made your personal information anonymous in compliance with our record retention policies and obligations.

Any disclosures we provide will cover information for the 12-month period preceding the request’s receipt date. We will consider requests to provide a longer disclosure period that do not extend past January 1, 2022, unless providing the longer timeframe would be impossible or involves disproportionate effort.

For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.