This Privacy Policy is provided to describe our privacy practices and the rights and choices available to you. Except where expressly incorporated into a separate written agreement, it is not intended to create contractual rights or obligations beyond those imposed by applicable law and does not create a warranty or guarantee. Nothing in this Policy limits any rights or remedies that cannot lawfully be limited.

If any provision of this Policy conflicts with a separate written agreement between you and OfficeNation, Inc. (including a Terms of Service, purchase agreement, credit application, or supplemental notice), the more specific agreement will govern to the extent permitted by applicable law.

This Privacy Policy applies to personal information we collect through the Site and, where noted, through related offline interactions such as phone orders. It describes our practices with respect to residents of all U.S. states. The specific rights available to you depend on your state of residence; where your state has not enacted a comprehensive consumer privacy law, we may honor requests as a matter of practice rather than legal obligation. Where a state's law provides additional or different rights, those provisions are described in the California Privacy Disclosures and Other U.S. State Privacy Rights sections and control to the extent required by law.

Depending on how you interact with us, we may collect the categories of personal information listed below. The table below is consistent with the categories defined at Cal. Civ. Code § 1798.140(v) and § 1798.80(e); the examples are illustrative rather than exhaustive. This table reflects our practices as of the Last Updated date above. We review it periodically and update it to reflect changes in the categories we collect.

De-identified information. When we de-identify personal information in accordance with California Civil Code § 1798.140(m), we maintain and use that information only in de-identified form and will not attempt to reidentify it. We contractually require any third party that receives de-identified data from us to do the same. De-identified information is not personal information and is not subject to the rights described below.

Payment and billing details are collected to process your transactions and are not used for advertising or marketing purposes. See Sensitive Personal Information.

• Directly from you — when you register, place an order, request a quote, contact us, enter a contest, or submit a review.
• Automatically — through cookies, web beacons, log files, and similar technologies as you use the Site.
• From service providers and partners — such as payment processors, shippers, analytics providers, and advertising partners.
• From other sources — such as commercial data providers, publicly available sources, and business contact intelligence services that enrich company and role information based on an email domain.

• Create and manage your account and make the Site easier to use.
• Process, fulfill, and deliver your orders, and communicate with you about orders and deliveries.
• Provide customer service and respond to your requests.
• Send service-related announcements and, where permitted, marketing communications about products, services, and special offers.
• Personalize content and, subject to your choices, deliver and measure advertising.
• Conduct automated or AI-assisted analysis of your interactions, orders, and purchase history to identify products, offers, or account services that may be relevant to you.
• Improve the Site's content, layout, and our products and services.
• Detect, prevent, and respond to fraud, security incidents, and illegal activity, and to protect our legal rights.
• Comply with legal obligations.

Because we must communicate with you about orders you place, you cannot opt out of transactional emails related to your orders. You can opt out of marketing emails at any time.

Like most websites, we use cookies, web beacons, pixels, and similar technologies. Cookies are small text files stored by your browser. We use the following categories:

• Strictly necessary — required to operate the Site, including selecting products, using your shopping cart, and checking out. These cannot be disabled.
• Functional — remember your preferences and settings.
• Analytics/performance — help us understand how the Site is used so we can improve it.
• Advertising — set by us and by third-party advertising partners to deliver and measure relevant advertising, including cross-context behavioral (targeted) advertising.

Web beacons and pixels help us and our partners determine whether a page or email has been viewed and how our advertising performs. You can manage cookies through your browser settings and through our cookie preference tool; if you disable certain cookies, parts of the Site may not function. To opt out of advertising cookies and targeted advertising, use the controls described in Targeted Advertising and Your Privacy Rights, or send us a Global Privacy Control signal.

Do Not Track (DNT). As required by California Business and Professions Code § 22575(b)(5), we disclose the following regarding Do Not Track browser signals: because there is no industry-standard interpretation of the DNT signal, we do not currently respond to DNT signals from web browsers. We do honor the Global Privacy Control (GPC) signal as described in the Global Privacy Control section below.

We work with third-party analytics and advertising service providers to understand how visitors use our Site and to reach potential customers. These providers include, but are not limited to, services such as Google Analytics, Google Tag Manager, Google Ads and the Google Display Network, Google Maps Places, and site performance monitoring services. We may add, replace, or remove providers from time to time; the current list of cookies and tracking technologies in use on the Site is maintained through our cookie preference tool.

Depending on the service, these providers may collect information including your IP address, device and browser characteristics, pages viewed, click and scroll events, session data, search queries submitted on the Site, and referring URL. Data collected by these services is transmitted to the applicable provider and is processed by that provider under its own privacy terms. We use the information for purposes such as measurement, Site analytics, personalization, advertising, and fraud prevention.

We use a consent management platform to manage non-essential cookies, pixels, tags, scripts, and similar technologies. Except for technologies that are strictly necessary to operate or secure the Site or provide a feature you request, we configure technologies in the Analytics/Performance and Advertising categories so that they do not activate or transmit information about your Site interactions to the applicable third-party provider until you affirmatively accept the applicable category through our consent banner.

Strictly necessary technologies may be activated without consent as needed to operate and secure the Site, remember your privacy choices, and provide features you request.

We recognize and honor Global Privacy Control (GPC) signals as described in the Global Privacy Control section. You may review or change your choices at any time through our Your Privacy Choices link, including by opting out of the sale or sharing of personal information and targeted advertising.

If you believe a technology is operating inconsistently with your stated preferences, please contact us at privacy@pcnation.com so that we can investigate. Contacting us does not limit any privacy rights or remedies available to you under applicable law.

We work with third-party advertising companies (for example, ad networks and social media platforms) that use cookies, pixels, and similar technologies to deliver advertising tailored to your interests across other websites and services, and to measure its effectiveness. This activity involves disclosing certain identifiers and internet activity to these partners.

Under some U.S. state privacy laws, this type of disclosure for targeted advertising may be considered a "sale" of personal information or the "sharing" of personal information for cross-context behavioral advertising, even when no money is exchanged. You have the right to opt out. See Your Privacy Rights to opt out, or send a Global Privacy Control signal, which we honor.

We do not use your payment card information for advertising. We do not process personal information for targeted advertising, and do not "sell" or "share" personal information, where we know or have reason to know that the consumer is under 18 years of age.

In our regular course of business we do not sell your personal information in exchange for money. We may disclose personal information to categories of recipients including, but not limited to, those described below, in each case subject to applicable law and to the opt-out and other choices described in Your Privacy Rights:

• Service providers that perform functions on our behalf — for example, shipping and logistics carriers, payment processors and card issuers, hosting and IT providers, analytics providers, and customer-service tools. Carriers receive information such as your name, shipping address, email, and phone number; payment processors receive your card details to process transactions using encryption.
• Google Places (address autocomplete). During checkout, our address entry fields use the Google Places API to suggest and validate addresses. Information you enter into the address field is transmitted to Google and processed under Google's applicable terms and privacy disclosures. See Google's privacy policy for details on Google's data practices.
• Payment processing (Braintree). Payment card details entered during checkout are collected by Braintree, a PayPal service, through its hosted payment fields. Braintree represents that it maintains PCI-DSS compliance. In the ordinary course, we receive only a tokenized reference to your payment method rather than the full card number. Braintree acts as our service provider under the CCPA. See Braintree's and PayPal's privacy policies for details.
• Advertising partners, as described in Targeted Advertising (subject to your opt-out).
• Affiliates under OfficeNation, Inc.'s control, to help provide and improve our services.
• Business partners — we work with a number of manufacturers and third-party business partners to make products and services available through our Site. We may share personal information with these partners to facilitate your purchase of their products or to support limited co-marketing activities in which they participate with us.
• Suppliers and distributors — we disclose personal information to suppliers and distributors for purposes of fulfilling and shipping your orders, processing returns and manufacturer support, and administering manufacturer and warranty programs, as well as to improve our performance, products, and services. Our suppliers and distributors also use personal information for their own internal purposes (including administrative purposes) and under their own privacy practices.
• Legal and safety recipients — in response to law-enforcement requests, subpoenas, court orders, or as otherwise required by law, and where disclosure is necessary to protect our legal rights, enforce our agreements, prevent fraud, or protect the safety of others.
• A successor entity in connection with a merger, acquisition, financing, or sale of assets, as described in Business Transfers.

Pre-chat consent for live chat. Live chat on our Site is powered by LiveChat, Inc., a third-party service provider. When you click to open a chat, we display a consent notice describing the categories of information that may be collected during the chat, including message content, contact information you enter in the pre-chat form, and technical context such as IP address, browser, and the pages you viewed before starting the chat. You must affirmatively acknowledge that notice before the chat widget opens. Chat transcripts may be retained by LiveChat and by us for customer-service quality and recordkeeping.

We are a U.S.-based business. Some of the service providers we work with — for example, hosting, analytics, payment processing, and mapping providers — operate globally and may process personal information outside the United States. Where they do, they process it under contractual terms that require them to protect the information consistent with U.S. law and their own privacy commitments.

If you access our Site from outside the United States, you understand that your personal information may be transferred to, stored in, and processed in the United States, where laws about personal information may differ from those in your country.

Subject to your state of residence and applicable law, you have the following rights regarding your personal information:

• Right to know / access the personal information we have collected about you, including categories, sources, purposes, and the categories of third parties to which it is disclosed.
• Right to correct inaccurate personal information.
• Right to delete personal information we have collected from you, subject to legal exceptions.
• Right to data portability — to obtain a copy of your personal information in a portable format.
• Right to opt out of targeted advertising and of the "sale" or "sharing" of your personal information.
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Right to limit the use of sensitive personal information, where applicable.
• Right to non-discrimination. We will not deny you goods or services, charge different prices, provide a different level of quality, or retaliate against you for exercising your privacy rights. Please note, however, that if the exercise of your rights limits our ability to process personal information that is necessary to provide our products or services (for example, deletion of your account), we may no longer be able to provide those products or services to you in the same manner.

Some information we cannot return to you. Where applicable state law prohibits us from disclosing certain higher-risk information in response to an access request — such as Social Security or other government-issued identification numbers, financial account numbers, account credentials, health insurance or medical identification numbers, or biometric data — we will inform you with sufficient particularity that we collected that information rather than providing the information itself. Where state law requires it, our response will also include the inferences we have drawn about you.

Submit a request using any of the following: our online privacy request form, by email at privacy@pcnation.com, or by phone at 1-800-235-4050. You do not need an account with us to submit a request. You may exercise an opt-out anonymously — for the "sale"/"sharing" of your information or targeted advertising, use the Do Not Sell or Share My Personal Information link, adjust your cookie preferences, or send a Global Privacy Control signal; we do not require you to provide an email address, create an account, or verify your identity to submit an opt-out. If you provide an email address so that we can apply your opt-out to your account across devices, we will send a verification link to that address to confirm the request came from you — this prevents someone else from submitting a request in your name and does not affect anonymous browser-level opt-outs.

Verification. For rights other than opt-outs, we will take steps to verify your identity before fulfilling a request, typically by confirming information associated with your account or order. Please do not email your credit-card number or other sensitive information.

Authorized agents. You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide proof of authorization and may require you to verify your identity directly with us.

Requests we may decline. We may decline to act on your request where we cannot verify your identity, where the request is manifestly unfounded, excessive, or repetitive, where responding would be technically infeasible or would require disproportionate effort in relation to the risks presented, where responding would adversely affect the rights of others, or where an authorized agent has not demonstrated authority to act on your behalf. Where we decline, we will explain why and, where your state provides a right of appeal, how to appeal.

Response timeline. We will confirm receipt of your request within ten business days and will respond within the period required by the law applicable to you — generally 45 days, and up to 90 days in some states. Where permitted by applicable law, we may extend the response period and will notify you of the extension and the reason for it.

Appeals. If we decline your request, you may appeal by submitting the privacy appeal form or by contacting privacy@pcnation.com with the subject line "Privacy Appeal." We will respond to your appeal within the period required by your state's law (generally 45–60 days). If your appeal is denied, you may contact your state Attorney General.

We recognize and honor the Global Privacy Control (GPC) signal. When we detect a GPC signal from your browser or device, we treat it as a valid request to opt out of the "sale" or "sharing" of personal information and of targeted advertising for that browser or device, and — where you are logged in — for your account. Because GPC is browser- and device-specific, you should enable it on each browser and device you use.

When we detect and process a Global Privacy Control signal, we display confirmation on the Site that your opt-out preference signal has been received and applied. If you are logged in, we also apply the opt-out to your account.

When GPC conflicts with a prior consent. Where a Global Privacy Control signal conflicts with a consent you previously gave for a specific purpose, we treat the opt-out signal as controlling. If you have opted out of the "sale" or "sharing" of your personal information, we will not ask you to consent to that processing again for at least twelve months, though you may opt back in at any time using the methods in How to Exercise Your Rights.

Certain information — such as precise geolocation, government identifiers, financial account login credentials, or similar categories — is treated as "sensitive" under some state laws.

Notice and consent at the point of collection. When we collect sensitive personal information — for example, when you upload a tax-exemption certificate that may include an Employer Identification Number (EIN) or, for sole proprietors, a Social Security Number — we provide a notice at the point of collection describing the categories of information involved and the purposes for which it will be used. Where state law requires affirmative consent before we process sensitive personal information, we capture that consent at the point of collection and retain a record of it. Where state law instead gives you a right to limit our use and disclosure of sensitive personal information, you may exercise that right using the methods in How to Exercise Your Rights.

We collect payment and billing information to process your transactions and do not use it to infer characteristics about you or for advertising or marketing purposes.

We use automated processing, including automated or AI-assisted analysis, to help us operate our business — for example, to assess fraud and to evaluate creditworthiness and credit risk in connection with business accounts and credit applications, to understand product preferences, and to personalize content and features on the Site. Where such processing is used to make a decision that produces a legal or similarly significant effect about you, we treat it in accordance with the automated decision-making and profiling provisions below and applicable state law.

Where applicable state law grants you rights in connection with automated decision-making technology used to make significant decisions about you — including rights to notice, to opt out, and to information about the logic used — we will honor those rights as and when they take effect under that law. California's automated decision-making technology requirements apply beginning January 1, 2027. Where state law gives you the right to opt out of profiling, including profiling that informs but does not solely determine a decision, you may exercise that right using the methods in How to Exercise Your Rights.

Training of large language models. We do not use your personal information to train large language models or other generative artificial intelligence models, and we do not sell or otherwise make your personal information available to others for that purpose. We may use tools that incorporate such models to process information at the time of a request — for example, to assist customer service or improve category and product information on the Site — under contractual terms that prohibit the provider from using your information to train its models.

We maintain personal information, including sensitive personal information, in accordance with our internal record-retention policy. The criteria that we use to determine the length of time we maintain personal information include:

• Service delivery — as reasonably required to provide you with our products and services and to serve your account.
• Legal and regulatory obligations — including federal, state, and local tax, accounting, and recordkeeping requirements applicable to order and transaction records.
• Legal purposes — the establishment, exercise, or defense of legal claims.
• Reasonable operational uses — such as fraud prevention, security, dispute resolution, and internal analytics performed on de-identified data.

We do not retain personal information longer than reasonably necessary for the purposes for which it was collected. When personal information is no longer necessary, we delete it, de-identify it (as described in the De-identified information paragraph above), or aggregate it.

Transaction records retained for tax and legal purposes may include order details even after your customer account has been deleted. We retain this information only for those purposes and do not use it for marketing or advertising.

The Site incorporates physical, electronic, and administrative safeguards to protect your personal information, including industry-standard encryption of information in transit. We restrict access to personal information based on business need and maintain role-based access controls. We use third-party providers for the physical security of certain infrastructure. While we use industry-standard precautions, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

The Site is directed to a business and general adult audience and is not directed to individuals under 18. We do not knowingly permit individuals under 18 to create customer accounts or place orders without appropriate authorization. Where we know or have reason to know that an individual is under 18, we do not use that individual's personal information for targeted advertising and do not "sell" or "share" it for cross-context behavioral advertising. To provide a consistent level of protection, we apply this standard to individuals under 18 throughout the United States. If you believe a minor has provided us personal information, please contact us and we will take appropriate steps to delete or otherwise address the information, subject to applicable law and legitimate retention requirements.

Product reviews. If you submit a product review, we will ask for your email address (kept private). Your general geographic location may be displayed with your review, and any personal information you choose to include in the review text may be visible to others. Please do not include personal information you want to keep private.

Shopper Approved. Shopper Approved is an independent company that lets shoppers rate their experience. After placing an order, we may share basic order information — such as your name, email address, country/state, and order ID — with Shopper Approved so it can invite you to provide optional feedback. Participating is optional and does not affect your order or the service you receive. Shopper Approved collects any feedback you provide and processes it under its own privacy policy; we receive the resulting ratings and review content and may display them on our Site.

From time to time we may offer programs such as contests, sweepstakes, or special offers in connection with signing up with your email address. Where a program constitutes a "financial incentive" under applicable law, we will provide the required notice at the point of sign-up, including the material terms of the program, a good-faith estimate of the value of the personal information involved, and the method we used to calculate it. Participation is optional, and you may withdraw at any time without penalty to any purchase you have already made.

Most of the information we collect is obtained through the Site, but we may also collect information offline — for example, when you call us to place an order or ask a question. When you call, we ask only for the personal information needed to complete your request. We apply the protections in this Policy to that information where applicable.

This section provides additional disclosures for California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA").

• Categories collected, sources, purposes, and third parties — see Personal Information We Collect, Sources, How We Use Your Information, and How We Disclose Information.
• "Sale"/"Sharing." In the preceding 12 months, we have disclosed identifiers and internet activity to advertising partners in a manner that may constitute "sharing" for cross-context behavioral advertising (and a "sale" under some laws). You may opt out via Your Privacy Rights and we honor GPC.
• Retention — see Data Retention.
• Sensitive personal information — see Sensitive Personal Information.
• Your rights — to know, access, correct, delete, portability, opt out of sale/sharing, limit use of sensitive information, and non-discrimination, as described in Your Privacy Rights.
• Automated decision-making technology — see Automated Decision-Making & Profiling.

B2B contact information (California). Unlike most other state privacy laws, California's law applies to personal information collected in a business-to-business context. This Privacy Policy applies to business-contact information you provide in connection with a customer, supplier, manufacturer, distributor, or other business relationship — including your work email address, direct phone number, job title, employer name, and other identifiers tied to your role.

California "Shine the Light" law. Under California Civil Code § 1798.83, California residents may request information about the sharing of their personal information with third parties for those third parties' own direct marketing purposes. In the ordinary course we do not share personal information with third parties for those third parties' own direct marketing purposes. To request the information described in § 1798.83, contact privacy@pcnation.com with the subject line "Shine the Light Request."

The table below summarizes the privacy rights available to residents of U.S. states with comprehensive consumer privacy laws in effect. To exercise these rights, use the methods in How to Exercise Your Rights. Where your state provides a right to appeal a denial, you may appeal as described below, and you may contact your state Attorney General.

"✓" = right exists in this state under its comprehensive privacy law as of the effective date of this Policy. "Opt-in" = affirmative consent is required before processing sensitive personal information (SPI). "Opt-out" = you may request that we stop processing SPI. "Eff. [date]" = the right becomes operational on the stated date. "—" = right not established under this state's law as of the effective date of this Policy. * California's automated decision-making technology (ADMT) requirements have a compliance date of January 1, 2027; the related consumer rights become operational on that date.

Right to appeal. If you are a resident of Colorado, Connecticut, Delaware, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, or Virginia, and we decline to act on your privacy request, you may appeal our decision at our privacy appeal form or by emailing privacy@pcnation.com with the subject line "Privacy Appeal."

We do not sell, rent, trade, or license your personal information in our regular course of business other than as described in this Policy. However, if we are involved in a merger, acquisition, financing, reorganization, or sale of some or all of our assets, your personal information may be transferred as part of that transaction. In that event, we will provide notice as required by applicable law. We will seek to have your personal information continue to be treated in a manner consistent with this Policy, and the acquiring or successor entity may provide notice of any material changes to its privacy practices.

If we change or update this Privacy Policy, we will post the revised Policy on the Site and update the "Last updated" date at the top of this page. We encourage you to review it periodically. Material changes will be highlighted as appropriate.

If we make material changes that we intend to apply to personal information we collected before the change, we will notify you and, where required by applicable law, give you an opportunity to withdraw your consent before those changes take effect as to that information.

If you have questions about this Privacy Policy or wish to exercise your rights, please contact our Privacy Team: