VALLEY FORGE FABRICS, INC. PRIVACY POLICY

1. SCOPE OF THIS POLICY

This Policy applies to Personal Information we collect through the Services. It does not apply to information collected by third parties whose websites, products, or services we do not own or control, including sites reached through links on our Site (see Section 13).

We use Personal Information to operate and improve the Services, manage accounts and design library access, respond to inquiries, communicate with you, and analyze usage, as described in Section 4.

Children's Privacy. The Services are intended for business and professional users and are not directed to children. Consistent with the Children’s Online Privacy Protection Act (COPPA), we do not knowingly collect Personal Information from children under 13, and if we learn we have done so without verifiable parental consent, we will delete it promptly. Because several state privacy laws treat the data of consumers under 16 as sensitive and restrict its sale or sharing, we do not knowingly sell or share the Personal Information of any individual under 16.

2. CHANGES TO THIS POLICY

We may update this Policy from time to time. When we make material changes, we will post the revised Policy on the Site with a new “Last Updated” date and, where required by law, provide additional notice before the changes take effect. We encourage you to review this Policy periodically.

Where a change requires your consent under applicable law, we will obtain that consent before the change applies to you.

3. INFORMATION WE COLLECT

“Personal Information” means information that identifies, relates to, describes, or could reasonably be linked with a particular individual or household, excluding de-identified, aggregated, and publicly available information. “Sensitive Personal Information” means the subset that applicable law designates as sensitive, including, for example, account log-in credentials.

We collect the following categories of Personal Information:

We may also obtain business-contact information from your employer, business partners, distributors, project participants, and through purchase orders, quote requests, trade shows, and other commercial communications.

We use cookies and similar technologies as described in Section 11.

4. HOW AND WHY WE USE PERSONAL INFORMATION

We use Personal Information for the following purposes:

• Provide and operate the Services, including design library access. Legal basis for EEA/UK: performance of a contract with you, or our legitimate interests in managing the business relationship where our agreement is with your employer or another organization.
• Respond to inquiries and support requests. Legal basis: contract; legitimate interests.
• Personalize and improve the Services. Legal basis: legitimate interests.
• Analyze usage and trends. Legal basis: legitimate interests; consent where required for non-essential cookies.
• Send marketing communications where permitted. Legal basis: consent; for existing customers, legitimate interests, subject in each case to your right to opt out; for EEA and UK residents, consent or the existing-customer soft opt-in permitted by applicable e-privacy rules.
• Detect and prevent fraud and security risks. Legal basis: legitimate interests; legal obligation.
• Comply with legal obligations and establish or defend legal claims. Legal basis: legal obligation; legitimate interests.

We limit our collection, use, retention, and disclosure to what is reasonably necessary and proportionate to these disclosed purposes.

Automated Decision-Making. We do not use Personal Information for automated decision-making or profiling that produces legal or similarly significant effects. If this changes, we will update this Policy and provide any notices and choices required by law before doing so.

5. HOW WE DISCLOSE PERSONAL INFORMATION

We disclose Personal Information to the following categories of recipients:

1. Service providers and contractors that perform services on our behalf (IT, hosting, email delivery, analytics), each bound by a written contract that restricts them to the purposes we specify and prohibits selling the data or using it outside our relationship, as required by law;
2. Affiliates, in connection with joint services or offers, only as needed;
3. Parties to a corporate transaction (reorganization, merger, acquisition, financing, or asset sale), subject to this Policy;
4. Third parties at your direction or with your consent; and
5. Authorities or others for legal and safety purposes, including to comply with applicable law, respond to lawful requests, and protect the rights, property, or safety of Valley Forge, our users, or the public.

We may also create and disclose de-identified or aggregated information that cannot reasonably be used to identify you.

We do not sell your Personal Information, and we do not share your Personal Information for cross-context behavioral advertising.

6. DATA SECURITY

We maintain reasonable administrative, technical, and organizational measures designed to protect Personal Information against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit and, where applicable, at rest;
• Access controls and role-based permissions;
• Secure infrastructure, firewalls, logging, and monitoring;
• Contractual confidentiality obligations with vendors; and
• Periodic security assessments and staff training.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a data breach affects your Personal Information, we will notify you and the relevant authorities as required by applicable law.

Your role: You are responsible for maintaining the confidentiality of your account credentials, logging out of shared devices, and notifying us promptly at TechPM@valleyforge.com if you suspect unauthorized use.

7. YOUR PRIVACY RIGHTS AND CHOICES

Depending on your jurisdiction of residence, applicable law may grant you some or all of the following rights with respect to your Personal Information:

• Know and Access: request the categories and specific pieces of Personal Information we hold about you, our sources, purposes, and disclosure recipients.
• Correction: request that we correct inaccurate Personal Information.
• Deletion: request deletion of your Personal Information, subject to legal exceptions.
• Opt Out of Sale or Sharing: direct us not to sell or share your Personal Information for cross-context behavioral advertising.
• Limit Use of Sensitive Personal Information: restrict our use of Sensitive Personal Information to purposes authorized by law.
• Data Portability: receive a copy of your Personal Information in a portable, readily usable format.
• Restriction, Objection, and Complaint (EEA/UK): restrict or object to processing, and lodge a complaint with your supervisory authority.
• Consent Withdrawal: where processing is based on consent, withdraw that consent at any time without affecting the lawfulness of prior processing.

We will not discriminate against you for exercising any of these rights.

To exercise your rights, you may access and update account information directly through the Site, or submit a request via our Contact page or by email to TechPM@valleyforge.com (see Section 12 for verification and response procedures).

Marketing Choices. To stop receiving marketing messages, use the unsubscribe link included in any marketing email or contact us at TechPM@valleyforge.com. Opting out of marketing does not apply to service or transactional messages related to your account or orders.

8. DATA RETENTION

We retain each category of Personal Information only for as long as reasonably necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. The specific retention periods, as identified in the table in Section 3, are as follows:

• Account credentials: while your account is active plus twelve months thereafter.
• Identifiers and contact data: duration of the business relationship plus ten years, consistent with the retention period applicable to the CRM and ERP records in which those identifiers reside.
• Business relationship data (CRM and ERP records): duration of the business relationship plus ten years from the date of last transaction or meaningful interaction, to meet commercial, tax, and legal-recordkeeping obligations.
• Preferences and communications: three years from your last interaction.
• Technical and device data, and third-party data: twenty-four months.

Personal Information residing in backups is retained for up to twelve months in accordance with our disaster recovery procedures, after which it is overwritten or deleted. De-identified or aggregated data may be retained indefinitely.

9. INTERNATIONAL DATA TRANSFERS

We are based in the United States, and your Personal Information may be transferred to, stored in, and processed in the United States or other countries whose data protection laws may differ from those in your jurisdiction.

Where we transfer Personal Information out of the European Economic Area (EEA) or the United Kingdom (UK), we rely on appropriate safeguards required by law, such as the European Commission’s Standard Contractual Clauses and the UK International Data Transfer Addendum, together with any supplementary measures needed to protect your information.

You may request more information about these safeguards, or a copy of the relevant transfer mechanism, using the contact details in Section 14.

10. STATE-SPECIFIC AND INTERNATIONAL DISCLOSURES

(A) California. California residents have the rights described in Section 7. The categories of Personal Information we collect, our purposes, and our disclosure recipients are set forth in Sections 3 through 5. We do not sell or share Personal Information for cross-context behavioral advertising. We honor opt-out preference signals, including Global Privacy Control, as described in Section 11.

(B) Virginia, Colorado, Connecticut, Utah, and Other States. Residents of states with comprehensive privacy laws have rights of access, correction, deletion, and portability, and the right to opt out of targeted advertising, the sale of personal data, and certain profiling. If we deny a request, you may appeal by replying to our decision or by emailing TechPM@valleyforge.com with “Privacy Appeal” in the subject line. If we deny the appeal, you may contact your state Attorney General.

(C) EEA and UK. Valley Forge Fabrics, Inc. is the data controller for Personal Information collected through the Site. The legal bases on which we rely are identified in Section 4, and our safeguards for international transfers are described in Section 9.

If you are located in the European Economic Area or the United Kingdom, you have the rights of access, rectification, erasure, restriction of processing, objection, and data portability, together with the right to withdraw consent where we rely on consent, as described in Section 7. To exercise any of these rights, contact us using the details in Section 14 or follow the procedure in Section 12.

We have appointed representatives in the European Union and the United Kingdom under Article 27 of the GDPR and the UK GDPR. Our EU representative is Data Protection Representative Limited, trading as DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland, info@datarep.com. Our UK representative is DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. You may contact either representative on any matter relating to our processing of your Personal Information. Please identify Valley Forge Fabrics, Inc. in your correspondence so that your request reaches us without delay.

You may lodge a complaint with your supervisory authority at any time, including the Information Commissioner's Office in the United Kingdom or the data protection authority in your EEA member state. We would welcome the opportunity to address your concern first.

11. COOKIES AND TRACKING TECHNOLOGIES

We use cookies and similar technologies (web beacons, pixels, and device identifiers) to operate the Site, measure performance, analyze usage, and assess email campaign effectiveness. We classify these technologies into three categories, which correspond to the three categories presented in our cookie banner:

1. Strictly necessary cookies: required for the Site to function properly. These do not require your consent.
2. Analytics and performance cookies: used to understand how visitors interact with the Site and to improve its performance, including Google Analytics and Google Tag Manager.
3. Marketing cookies: used to measure the effectiveness of our communications and campaigns and to support our advertising, including the Meta (Facebook) Pixel.

We set non-essential cookies and third-party tags, for all visitors, only after you affirmatively consent through our cookie banner. Analytics and marketing cookies are each off by default, and you may accept or decline each category. You may review and change your preferences at any time through the “Manage Cookies” link available on the Site. If you withdraw consent, we stop setting the affected cookies and tags and delete those already placed on your device, including first-party cookies set by our analytics and marketing tools. A description of each cookie, including its provider, its purpose, and its duration is available in our cookie preference center through the “Manage Cookies” link.

Opt-out preference signals. We recognize and honor the Global Privacy Control (GPC) signal as a valid request to opt out of the sale or sharing of Personal Information. We do not currently respond to legacy “Do Not Track” signals, which lack a uniform standard across browsers.

12. HOW TO SUBMIT AND VERIFY REQUESTS

Submit privacy requests through our Contact page or by email to TechPM@valleyforge.com. To protect your information, we may request information sufficient to verify your identity; we use such information only for verification purposes.

We will respond within the timeframe required by applicable law: generally within 45 days under U.S. state privacy laws (extendable once when reasonably necessary) or within one month under the GDPR (extendable by two months for complex requests). If we deny a request, we will explain the reasons and, where an appeal right applies, describe how to appeal.

Authorized agents. An authorized agent may submit a request on your behalf with proof of authorization, such as signed written permission or a valid power of attorney. We may require you to verify your identity directly even when an agent acts on your behalf.

Fees. Requests are generally free. For manifestly unfounded, excessive, or repetitive requests, we may charge a reasonable fee or decline to act, as permitted by law.

Confirmation of opt-out. Where you opt out of sale or sharing, we will confirm that your request has been processed.

13. ADDITIONAL PROVISIONS

Links to Third Parties. The Site may contain links to websites, products, or services operated by third parties that we do not own or control. This Policy does not apply to those third-party resources, and we are not responsible for their privacy practices. We encourage you to review the privacy policies of any third-party site you visit.

Automated Decision-Making. As stated in Section 4, we do not use Personal Information for automated decision-making or profiling that produces legal or similarly significant effects.

Accessibility and Language. We aim to make this Policy accessible and to follow generally recognized accessibility standards, including WCAG 2.1. If you need this Policy in an alternate format or language, contact us using the details in Section 14.

Data Minimization and Privacy by Design. We collect only the Personal Information reasonably necessary for the purposes described in this Policy, limit internal access on a need-to-know basis, and assess new features and vendor relationships for privacy impact before deployment.

14. CONTACT US

Valley Forge Fabrics, Inc. is the controller responsible for Personal Information collected through the Site. To exercise your rights or ask questions about this Policy, contact us at:

Valley Forge Fabrics, Inc.

Attn: Technology PM Office

1650 W. McNab Road

Fort Lauderdale, Florida 33309, USA

Email: TechPM@valleyforge.com

Telephone: (954) 971-1776

EU Representative appointed under Article 27 of the GDPR: Data Protection Representative Limited, trading as DataRep, 77 Camden Street Lower, Dublin, D02 XE80, Ireland. Email: info@datarep.com. UK Representative appointed under Article 27 of the UK GDPR: DataRep, 107-111 Fleet Street, London, EC4A 2AB, United Kingdom. Please identify Valley Forge Fabrics, Inc. in any correspondence addressed to either representative.

If you are in the EEA or UK and believe your rights have been violated, you may lodge a complaint with your local supervisory authority at any time. You may also contact our EU or UK representative using the details above. We would welcome the opportunity to resolve your concern first.