This Privacy Policy applies to all who interact with Kings Distro Inc. — wholesale B2B customers, retail consumers (B2C), visitors to our physical locations, and users of our website and online marketplaces. It is written to comply with the most stringent applicable US state privacy laws so that one policy covers you regardless of which state you live in.

1. Who We Are and Scope of This Policy

Kings Distro Inc. (“Kings Distro,” “we,” “us,” or “our”) is a wholesale and retail distribution company based in Richmond, Virginia. We operate physical warehouse and retail locations, an online store at kingsdistro.com, and sell through online marketplaces. We serve a network of over 300 business customers across the United States.

This Policy explains what personal information we collect, how we use and protect it, when and with whom we share it, and what rights you have over it. By using our website, placing an order, visiting our locations, or doing business with us in any way, you agree to the practices described here.

This Policy covers all of the following:

• Our website at kingsdistro.com and any related subdomains or pages
• Our physical retail and warehouse locations in Richmond, Virginia
• Interactions via email, phone, and online marketplaces
• Our B2B wholesale accounts, partner portal, and wholesale ordering
• Any future products, services, or platforms we launch under the Kings Distro brand

This Policy does not cover third-party websites, marketplaces, or platforms linked from our site. Those services have their own privacy policies and we are not responsible for their practices.

2. What Personal Information We Collect

We follow a data minimization principle — we collect only what is reasonably necessary to operate our business and serve you. We never collect sensitive personal data (race, health, religion, sexual orientation, immigration status, or precise GPS location) and we do not sell personal data.

2.1  Information You Give Us Directly

When you create an account, place an order, apply for wholesale terms, contact us, or otherwise interact with us, you may provide:

• Identity: Full name, job title, company name (B2B customers)
• Contact: Email address, billing address, shipping address
• Account: Username, password, and account preferences
• Payment: Credit/debit card details and billing information — we do not store full card numbers; all payment data is handled exclusively by PCI-DSS compliant third-party processors
• Orders: Products purchased, order history, amounts, and delivery details
• B2B Business Info: Business license number, resale certificate, EIN/tax ID, business type, and trade references
• Communications: Content of emails or messages when you contact us
• Voluntary Feedback: Product reviews or survey responses you choose to submit

2.2  Information Collected Automatically

When you visit our website, we and our service providers may automatically collect:

• Device & Technical: IP address, browser type, operating system, device type, and screen resolution
• Usage: Pages visited, links clicked, time on page, on-site search queries, referring URL, and exit pages
• General Location: Approximate geographic region derived from IP address only — not precise GPS
• Cookie Data: Information from cookies and similar technologies (see Section 9 for full details)

2.3  Information from Our Physical Locations

When you visit our physical retail or warehouse locations, we may collect:

• Security Camera Footage: Video surveillance for security and loss prevention at our premises
• Visitor Log Records: Sign-in information for warehouse or office visitors
• In-Person Transaction Data: Payment and order information collected during in-person purchases

2.4  Information from Third Parties

We may receive limited information from:

• Online Marketplaces: When you order through a marketplace (such as Amazon), that platform shares transaction and shipping details with us only to fulfill your order — we use it for no other purpose
• Payment Processors: Transaction status and fraud-screening signals only
• Business Credit Sources: For wholesale applicants, we may request business credit or trade reference data

3. How We Use Your Information

We use personal information only for the purposes listed below and only to the minimum extent necessary. We do not use your information for any purpose incompatible with why it was collected. We never use personal information to make automated decisions that significantly affect you without human review.

We do not sell, rent, or trade your personal information to any third party. We do not use it for cross-context behavioral advertising. We do not engage in profiling or automated decision-making that produces legal or significant effects without human review.

4. How We Share Your Information

We share personal information only in the limited circumstances described below. We never sell it.

4.1  Service Providers (Vendors)

We work with carefully selected third-party vendors who perform services on our behalf — including payment processing, shipping and logistics, website hosting, email marketing, and analytics. Every vendor is contractually required to: (a) use your information only to provide services to us; (b) protect it to a standard at least as strong as this Policy; and (c) delete or return it when their work is complete. They cannot use it for their own purposes. Examples of service provider categories include:

• Payment processors (e.g., Stripe, PayPal, or similar — handles card data on our behalf)
• Shipping carriers (e.g., UPS, FedEx, USPS — receives name and address for delivery only)
• Email and CRM platforms (e.g., receives email address for marketing or service messages)
• Website hosting and cloud infrastructure providers
• Analytics platforms (receive anonymized/aggregated usage data)
• Accounting and tax software (receives transaction and billing data)

4.2  Online Marketplace Platforms

When an order originates through a third-party marketplace, we receive the customer’s information from that marketplace solely to fulfill the order. We use marketplace-sourced data only for fulfillment and do not use it for marketing, retargeting, or any other secondary purpose.

4.3  Legal Requirements and Safety

We may disclose your information when: (a) required by law, court order, or government authority; (b) we reasonably believe it is necessary to protect the safety, rights, or property of Kings Distro, our customers, or others; or (c) we need to detect, prevent, or address fraud, security threats, or technical problems. In all cases we will disclose only the minimum information necessary to comply.

4.4  Business Transfers

If Kings Distro undergoes a merger, acquisition, restructuring, or sale of all or part of its assets, your information may transfer to the successor entity. We will provide reasonable advance notice of any such change and any modification to this Policy that results from it.

4.5  With Your Explicit Consent

We may share your information with other parties only when you have specifically consented to or directed the disclosure.

5. Your Privacy Rights

We honor privacy rights for all customers regardless of location, calibrated to the most protective applicable state law. No state privacy law currently provides a private right of action — enforcement is by state attorneys general only. Below are your rights by jurisdiction.

5.1  All Customers — Universal Rights

Regardless of where you live, you may at any time:

• Opt out of all marketing emails by clicking Unsubscribe in any email, or by emailing privacy@kingsdistro.com
• Request access to or a copy of personal information we hold about you
• Request correction of inaccurate personal information
• Request deletion of personal information you provided to us (subject to legal retention obligations)
• Withdraw consent for any processing based on consent, at any time

To exercise any right, email privacy@kingsdistro.com. We respond within 45 days. We will verify your identity before fulfilling data requests.

5.2  Virginia Residents — CDPA (Va. Code § 59.1-571 et seq.)

Virginia residents may confirm processing, access data, request correction, request deletion, request a portable copy, opt out of targeted advertising, and appeal any denial. We respond within 45 days (extendable by 45 days with notice). Denied appeals may be escalated to the Virginia Attorney General at oag.state.va.us.

5.3  California Residents — CCPA/CPRA (Cal. Civ. Code § 1798.100 et seq.)

California residents have the right to know what categories of personal information we collect and why, to request deletion, to request correction, and to opt out of sale or sharing. We do not sell or share personal information for cross-context behavioral advertising. We do not discriminate against you for exercising these rights. If we offer financial incentives (such as a discount for newsletter sign-up), we will disclose the value and terms before you opt in. Authorized agents may submit requests with proper written authorization. To submit a California request, email privacy@kingsdistro.com.

5.4  Colorado, Connecticut, and Other State Residents

Residents of Colorado, Connecticut, Texas, Montana, Iowa, Delaware, New Hampshire, New Jersey, Indiana, Kentucky, Rhode Island, Nebraska, Maryland, Minnesota, and other states with active privacy laws have equivalent rights to access, correct, delete, port, and opt out of processing where applicable. We process all such requests equally regardless of your state. Email privacy@kingsdistro.com to submit a request.

Note on Nebraska: The Nebraska Data Privacy Act imposes obligations with no minimum consumer count or revenue threshold. Any business that processes personal data of Nebraska residents and is not a federally-defined small business must comply. Kings Distro honors Nebraska residents’ rights on the same terms as all other customers.

There is no private right of action under any current US state privacy law. Enforcement is exclusively by state attorneys general. Your rights request goes to privacy@kingsdistro.com — we process all requests promptly and professionally.

6. Data We Do Not Collect or Sell

Kings Distro does not:

• Sell personal information to any third party for any purpose
• Share personal information for cross-context behavioral advertising
• Collect sensitive personal data including: racial or ethnic origin, religious beliefs, health or medical information, sexual orientation or gender identity, immigration or citizenship status, precise GPS geolocation, biometric identifiers, or Social Security numbers
• Collect personal information from children under 13
• Use personal information to make automated decisions with significant legal effects without human review
• Use personal information for purposes beyond those disclosed in this Policy

7. Data Retention

We retain personal information only as long as necessary for the purpose collected, or as required by law — whichever is longer. Upon expiry, we securely delete or irreversibly anonymize the data.

8. Data Security

We implement technical, administrative, and physical safeguards proportionate to the nature of the data and the risks involved. Our measures include:

• SSL/TLS encryption for all data transmitted to and from our website
• PCI-DSS compliant payment processing — full payment card numbers are never stored on our own servers
• Role-based access controls limiting employee access to personal data on a strict need-to-know basis
• Physical security measures at our Richmond warehouse and retail locations
• Regular internal review and updating of our security practices and procedures
• Employee training on data privacy obligations and secure data handling
• Contractual data security obligations imposed on all third-party vendors

No security system is 100% guaranteed. In the event of a data breach that materially affects your rights or poses a risk of harm, we will notify affected individuals and applicable regulatory authorities within the timeframes required by Virginia Code § 18.2-186.6 and other applicable state breach notification laws.

9. Cookies and Tracking Technologies

Our website uses cookies and similar technologies. You can control non-essential cookies through your browser settings. Disabling certain cookies may affect some site features.

We do not engage in cross-site behavioral tracking without consent. We do not share individual-level tracking data with third parties for their own advertising purposes. Our analytics use is limited to improving our own website and services.

We recognize and honor browser-based opt-out signals including Global Privacy Control (GPC) where required by law (California, Colorado, Connecticut, and other applicable states). To enable GPC, use a compatible browser extension or privacy browser.

10. Children’s Privacy

Our website and services are not directed to children under 13. We do not knowingly collect personal information from any child under 13. If a parent or legal guardian believes a child under 13 has provided personal information to us, contact us immediately at privacy@kingsdistro.com and we will delete it promptly upon verification.

Individuals under 18 should not use our website or submit personal information without the supervision and consent of a parent or legal guardian. If we have actual knowledge that a user is between ages 13 and 17, we will not sell their personal data or use it for targeted advertising, in accordance with applicable state laws.

11. Third-Party Links and Services

Our website may link to third-party websites including online marketplaces, shipping carriers, and payment processors. This Privacy Policy does not apply once you leave kingsdistro.com. We are not responsible for the privacy practices of any third-party site or service, and we encourage you to review their policies before providing any personal information.

When you purchase through a third-party marketplace, your transaction is also governed by that marketplace’s terms and privacy policy. Kings Distro receives marketplace-sourced customer data only to fulfill your order and uses it for no other purpose.

12. Marketing Communications and CAN-SPAM Compliance

We may send you promotional emails about products, offers, and company news, but only if you have provided your email address in connection with a transaction or have opted in to receive marketing communications. Every marketing email we send will:

• Clearly identify Kings Distro Inc. as the sender
• Include our valid physical mailing address as required by the CAN-SPAM Act
• Include a clear, functional one-click Unsubscribe link
• Honor opt-out requests within 10 business days of receipt

Order confirmations, shipping notifications, and account-related messages are transactional communications and are exempt from CAN-SPAM opt-out requirements. However, you may request to limit transactional communications by contacting privacy@kingsdistro.com.

If you offer to sign up for marketing in exchange for a discount or incentive, we will disclose the value and terms of that offer before you opt in, as required by California law.

13. Changes to This Privacy Policy

We may update this Policy when our data practices change, new laws take effect, or we expand our business. When we make changes, we will update the Last Updated date above and post the revised Policy at kingsdistro.com/privacy. For material changes that affect your rights, we will make reasonable efforts to notify you directly by email. Your continued use of our services after we post changes constitutes your acceptance of the updated Policy.

14. Contact Us — Privacy Requests

For any privacy questions, data access or deletion requests, marketing opt-outs, or other concerns, contact our Privacy Officer:

We will acknowledge your request within 5 business days. Full response timeframes by applicable law:

• Virginia CDPA: 45 days, extendable by 45 days with written notice
• California CCPA/CPRA: 45 days, extendable by 45 days with notice
• Colorado, Connecticut, Indiana, Kentucky, Rhode Island, Nebraska, and other states: 45 days with similar extension rights
• All others: We aim to respond within 45 days regardless

If we deny a request, we will explain the reason in writing. You have the right to appeal any denial by responding to our written decision. If our appeal response also denies your request, you may escalate to your state Attorney General.

15. Additional Legal Disclosures

No Sale or Sharing of Personal Information

Kings Distro Inc. does not sell personal information as defined under California Civil Code § 1798.140, or under any other applicable state privacy law. We do not share personal information for cross-context behavioral advertising. We do not exchange customer data for money or any other consideration with any third party for that party’s own marketing, advertising, or commercial purposes.

Virginia CDPA — Data Controller

Kings Distro Inc. is a controller of personal data under the Virginia Consumer Data Protection Act (Va. Code § 59.1-571). We process personal data only for the purposes stated in this Policy. We do not process sensitive data categories without prior consent.

California — Notice at Collection

At the point of data collection on our website (e.g., checkout, account signup, contact form), we collect the categories of personal information listed in Section 2. This data is used for the purposes in Section 3. We do not sell or share this data. Retention periods are in Section 7. California residents may exercise CCPA rights as described in Section 5.3.

Global Privacy Control (GPC)

We recognize GPC opt-out preference signals where required by California, Colorado, Connecticut, and other applicable laws. If your browser sends a GPC signal, we treat it as an opt-out of sale and sharing for that browser session. Note: GPC affects online tracking only, not email communications — to opt out of marketing emails, use the Unsubscribe link in any email.

Payment Card Security — PCI-DSS

All payment card transactions are processed by PCI-DSS compliant third-party payment processors. Kings Distro does not store, process, or transmit full payment card numbers, CVV codes, or full magnetic stripe data on our own servers.

Data Breach Notification

In the event of a security breach that reasonably may have caused or threatens misuse of personal information, we will notify affected Virginia residents within 60 days of discovery as required by Va. Code § 18.2-186.6, and will notify residents of other states within the timeframes required by their applicable state breach notification laws.

Limitation of Liability

To the fullest extent permitted by applicable law, Kings Distro Inc.’s liability for privacy-related claims is limited to direct damages and shall not include indirect, incidental, consequential, or punitive damages arising from: (a) unauthorized third-party access to our systems resulting from causes beyond our reasonable control; (b) cyberattacks, force majeure events, or actions of third-party service providers. Our liability, if any, shall not exceed the amount you paid us in the 12 months preceding the claim.

Governing Law and Venue

This Privacy Policy is governed by the laws of the Commonwealth of Virginia, without regard to conflict of law principles. Any dispute arising from or relating to this Policy or our data practices shall be resolved exclusively in the state or federal courts located in Richmond, Virginia. By using our services, you consent to personal jurisdiction and venue in those courts.

Severability

If any provision of this Policy is found invalid, unlawful, or unenforceable by a court of competent jurisdiction, that provision shall be severed and the remainder of this Policy shall continue in full force and effect.

Entire Agreement

This Privacy Policy, together with our Terms and Conditions (when published), constitutes the entire agreement between you and Kings Distro Inc. with respect to the subject matter herein and supersedes all prior communications, representations, or agreements on the same subject.

Adopted and Effective — June 26, 2026

This Privacy Policy has been formally adopted by Kings Distro Inc. and is effective as of the date stated above. By using our website, placing an order, visiting our physical locations, or doing business with us in any capacity, you confirm that you have read this Privacy Policy and agree to its terms.