Privacy Policy

Purpose

This Privacy Policy describes how Kenna, LLC, doing business as (DBA) Kenna Group, collects, uses, discloses and otherwise processes personal information or personal data (“personal information”) about you. This Privacy Policy applies to information we collect when you access or use our websites or other services or receive communications from Kenna LLC that link to this Privacy Policy (collectively, our “Services”), or when you otherwise interact with us, such as through email or other communication with Kenna Associates. We may provide different or additional notices of our privacy practices with respect to certain products, services or activities, in which case those notices will state whether they supplement or replace the disclosures in this Privacy Policy.

Definitions

• “Kenna Associate” means a person employed by Kenna LLC.
• “Client” means a company with which Kenna LLC does business.
• “Customer” means a person who has had at least one interaction with a client-branded program store operated by Kenna LLC.

Changes

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this policy. If we make material changes, we will provide you with additional notice (such as by adding a statement to the Services). We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

Exclusions

This Privacy Policy does not apply to websites or services that Kenna LLC operates or performs as a service provider for its Clients, including but not limited to e-commerce platforms managed on behalf of Clients. Specifically, Kenna LLC utilizes the Shopify platform to build, maintain, and manage online stores for Clients. As part of this service, we may process personal information of end-users (referred to as “Customers”) on behalf of our Clients in accordance with their instructions.

When acting as a service provider on behalf of its Clients, including in the operation of Shopify-powered stores, Kenna LLC strives to respect and protect the privacy of Customers. We do not control the personal information collected by our Clients through their Shopify stores; rather, we process this information strictly in accordance with our Clients’ directives and their applicable privacy policies.

If you are a Customer of one of Kenna LLC’s Clients and have provided personal information—or believe your personal information has been provided—to a Shopify store managed by Kenna LLC, and you have questions about how your personal information is collected, used, processed, or disclosed, please review that Client’s privacy policy directly. If you need further assistance, you may also contact the Client or Shopify’s privacy team for additional information on how your data is handled within the Shopify platform.

Collection of Information

The information we collect about you depends on how you interact with us or use our Services. In this section, we describe the categories of information we collect and the sources of this information.

Information You Provide to Us

We collect information that you provide directly to us. For example, you share information with us when you fill in a form, request information, place an order, request customer support, search on our website, complete a survey or otherwise communicate with us.

The types of personal information we may collect include your name, email address, phone number, shipping address, billing, credit card, or other payment information, or any other information you choose to provide.

If you make a purchase from us through a Shopify-powered store, your payment information is collected and processed by Shopify’s payment processing system or another third-party payment processor integrated with Shopify. Kenna LLC does not store or have direct access to your full payment details. All payment transactions are securely handled in accordance with Shopify’s security and compliance standards, as well as the policies of the designated payment processor.

Information We Collect

We collect certain information about your interactions with us, our Clients, and our Services, including data related to both business-to-business (B2B) transactions for Clients ordering merchandise and business-to-consumer (B2C) transactions where Customers purchase merchandise from Shopify stores we operate on behalf of our Clients.

• Transactional Information
  • For Clients (B2B): We collect information about merchandise orders placed through Kenna LLC, whether made online via our platforms or directly with a Kenna LLC Sales Associate. This includes details about requested quotes, order history, billing and shipping details, and any related communications.
  • For Customers (B2C): When purchasing merchandise through a Shopify store managed by Kenna LLC on behalf of a Client, we collect information about products viewed, added to the cart, and purchased. Transaction details such as order confirmations, shipping status, and returns may also be collected.
• Web Activity Information
  • We track interactions with our websites and Shopify-powered stores, including when you request information, log in, or place an order.
  • Information is collected through cookies and site tracking tools, including session details such as pages viewed, links clicked, time spent on the site, and referral sources.
• Device and Usage Information
  • We gather data on how you access our Services, whether through our corporate platforms or Shopify-powered stores.
  • This includes information about your device (hardware type, operating system, browser type) and network (IP address, connection type).
• Information Collected by Cookies and Similar Tracking Technologies
  • We use cookies and tracking technologies on both Kenna LLC-operated sites and Shopify-powered stores to enhance user experience, improve services, and analyze site engagement.
  • These technologies help track site usage, store preferences, and measure marketing effectiveness. For details, refer to our Analytics section and Cookie Policy.

Information We Derive

We may derive information or draw inferences about you based on the information we collect. For example, we may infer that you are looking to purchase certain products based on your browsing behavior and past purchases.

We Do Not Knowingly Collect Children’s Data

Kenna LLC does not knowingly collect or solicit any information from anyone under the age of 16, or knowingly allow such persons to register an account with us or on our websites or become a Client. In the event that we learn that we have collected personal information from a child under age 16 without appropriate permission from their parents or legal guardian, we will delete that information as quickly as possible. If you believe that Kenna LLC might have information from a minor under the age of 16, please contact us at the email or postal address provided below. Requests will not be accepted by phone.

Use of Information

We use the categories of information we collect to provide Services and to improve our website and Services. We also use the information we collect to:

• Provide, maintain, improve services, including to debug and repair errors in our Services;
• Send you support messages and other transactional or relationship messages;
• Communicate with you about products and services offered by Kenna LLC (see the Your Choices section below for information about how to opt out of these communications at any time);
• Monitor and analyze trends, usage, and activities in connection with our products and services;
• Detect, investigate, and help prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity and help protect the rights and property of Kenna LLC and others;
• Comply with our legal and financial obligations;
• Carry out internal operations that are reasonable in the context of your relationship with us;
• Create de-identified, anonymized, or aggregated information; and
• Carry out any other purpose described to you at the time the information was collected.

Disclosures of Information

In certain circumstances, we disclose (or permit others to directly collect) information about you. The list below describes when and to whom we disclose the categories of personal information described in the Collection of Information section above.

• Vendors, Service Providers, and Contractors: We disclose personal information to third-party vendors, service providers, and contractors that assist in providing services such as Shopify for e-commerce store operations, hosting, software used for service delivery, payment processing, customer service, invoicing, and product fulfillment (including customization and shipping).
• Shopify and Integrated E-commerce Services: When you place an order on a Shopify store operated by Kenna LLC on behalf of a Client, Shopify and its associated payment processors, shipping providers, and fraud prevention services may collect and process your personal information as necessary to complete the transaction. Shopify’s use of your data is subject to its own Privacy Policy and Terms of Service.
• Clients (Your Employer or Business Partner): If you are ordering on behalf of your employer through a Kenna LLC-managed store, we may disclose your personal information to your employer, who is our Client. For example, your employer may request ordering history by person. Similarly, if your employer is engaged in a business relationship with another Client, we may share order-related details relevant to that relationship.
• Legal and Compliance Obligations: We disclose personal information if we believe that your actions are inconsistent with our user agreements or policies, if you have violated the law, or if it is necessary to protect the rights, property, and safety of Kenna LLC, our Clients, Customers, users, or the public.
• Corporate Transactions: We may disclose personal information in connection with, or during negotiations of, certain corporate transactions, including a merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• Affiliates and Subsidiaries: Personal information is disclosed between and among Kenna LLC and our parents, affiliates, subsidiaries, and other companies under common control and ownership.
• Your Consent: We disclose personal information when we have your consent or when you direct us to do so.
• Aggregated or De-identified Information: We also disclose aggregated or de-identified information that cannot reasonably be used to identify you. For example, we may report an aggregate customer satisfaction score based on Shopify store feedback.
• Internal Business Operations: We use third-party vendor platforms to manage operational processes such as payroll, PTO tracking, benefits enrollment for Associates, and recruitment/hiring processes for job seekers.

Analytics

We utilize Shopify’s built-in analytics tools to collect data about your interactions with Shopify-powered stores operated by Kenna LLC on behalf of our Clients. These analytics may include information such as pages viewed, time spent on product pages, items added to cart, purchase activity, and other engagement metrics. This data helps us and our Clients understand shopping behavior, optimize store performance, and improve the overall customer experience. Shopify may use cookies, tags, and similar tracking technologies to collect and process this information, subject to Shopify’s Privacy Policy and Cookie Policy.

Transfer of Information to the United States and Other Countries

Kenna LLC is headquartered in the United States, and we have operations and vendors in the United States and other countries. Therefore, we and those that perform work for us may transfer your personal information to, or store or access it in, jurisdictions that may not provide levels of data protection that are equivalent to those of your home jurisdiction. Where required by law, we provide adequate protection for the transfer of personal information in accordance with applicable law, such as by obtaining your consent, relying on the European Commission’s adequacy decisions, or executing Standard Contractual Clauses. Where relevant, you may request a copy of these Standard Contractual Clauses by contacting us at dpo@kennagroup.com.

Your Choices

Cookies

Most browsers let you remove and/or stop accepting cookies from the websites you visit. To do this, follow the instructions in your browser’s settings. Many browsers accept cookies by default until you change your settings. If you do not accept cookies, however, you may not be able to use all functionality of the Services and our website may not work properly. For more information about cookies, including how to see what cookies have been set on your browser and how to manage and delete them, visit www.allaboutcookies.org.

Advertising Choices

If you wish to minimize the amount of interest-based advertising you receive, you may block third-party cookies in your browser settings, use browser plug-ins/extensions, and use your mobile device settings to limit the use of the advertising ID associated with your mobile device. You can also opt out of interest-based ads from companies participating in the following industry opt-out programs by visiting the linked websites: the Network Advertising Initiative (networkadvertising.org) and the Digital Advertising Alliance (optout.aboutads.info). Users in the EEA or UK can visit the European Interactive Digital Advertising Alliance (youronlinechoices.eu). Some of the companies we work with may offer their own opt-out mechanisms. For example, you can learn more about how Google uses cookies for advertising purposes and opt out of ad personalization by Google.

Many of the opt-out preferences described in this section must be set on each device or browser for which you want them to apply. Please note that some of the advertising companies we work with may not participate in the opt-out mechanisms described above, so even after opting-out, you may still receive interest-based advertisements from other companies. If you opt-out of interest-based advertisements, you will still see advertisements online but they may be less relevant to you.

Access/Know, Deletion, Correction, and Other Rights

Subject to certain limitations and applicable law, you may have the right to:

1. Request to know more about the categories and specific pieces of personal information we collect, use, and disclose.
2. Request deletion of your personal information.
3. Opt out of any “sales” or “sharing” of your personal information that may be occurring.
4. Request transmission of your personal information to another entity (portability).
5. Correct inaccurate personal information.
6. Limit the use and disclosure of your sensitive personal information.
7. Request to know more about automated decision-making.
8. Opt out of automated decision-making technology.
9. Not be discriminated against for exercising these rights.

Kenna LLC adheres to Shopify’s data protection and privacy standards when managing personal information collected through Shopify-powered stores. Shopify provides built-in privacy tools that allow Customers to request access to, modify, or delete their personal data, in accordance with privacy laws such as the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR). Any data access or deletion requests submitted to us related to a Shopify store we manage will be processed in compliance with Shopify’s privacy framework and in coordination with our Clients where applicable.

You may make these requests, where applicable, by emailing dpo@kennagroup.com.

We will verify your request by asking you to provide information related to your recent interactions with us, such as the date you requested information or the order number or date of your last purchase. We will not discriminate against you for exercising your rights under applicable data protection laws.

If we receive your request from an authorized agent and they do not provide a valid power of attorney, we may ask the agent to provide proof that you gave them signed permission to submit the request on your behalf. If no valid power of attorney is provided, we may require you to verify your own identity directly with us or confirm that you authorized the agent to act on your behalf.

If you are an authorized agent seeking to make a request, please email dpo@kennagroup.com.

For Customers who made purchases through a Shopify-powered store managed by Kenna LLC, additional privacy rights and tools may be available directly through Shopify’s Privacy Policy and Shopify’s privacy request tools, accessible via the Shopify platform.

Additional Disclosures for Individuals in California

The California Consumer Privacy Act or “CCPA” (Cal. Civ. Code § 1798.100 et seq.), as modified by the California Consumer Privacy Rights Act or “CPRA”, affords consumers residing in California certain rights with respect to their personal information. If you reside in California, this section applies to you.

Disclosures

We collect and, in the preceding 12 months, we have collected the following categories of personal information: personal identifiers such as real name, postal or electronic address, unique personal identifier or account name assigned by a Kenna LLC system, internet protocol addresses; commercial information; Internet or other electronic network activity information; audio, electronic, and professional or employment-related information for Associates and people who apply for jobs at Kenna LLC or other similar identifiers as defined under Cal. Civ. Code § 1798.140(o). For details about the precise data points we collect and the categories of sources of such collection, please see the Collection of Information section above. We collect this personal information from the following sources: directly from you (when you provide us with personal information); our Clients; automatically through the use of cookies and similar technologies on the Services; and from other third parties, such as social media platforms, publicly-available sources, business partners, and others. We collect personal information for the business and commercial purposes described in the Use of Information section above. In the preceding 12 months, we have disclosed personal information for the following business or commercial purposes described in the Use of Information section above. We have made the disclosures to the following categories of recipients:

To the extent that we may collect sensitive personal information (as defined under the CCPA), we only use or disclose it for purposes permitted under the CCPA (e.g., to provide the Services, detect security incidents and prevent fraud, and to verify and maintain the quality of the Services). We do not collect or use sensitive personal information for the purpose of inferring characteristics about California residents.

Kenna LLC does not sell or share your personal information with third parties, as those terms are defined under the CPRA. We also do not allow our third-party service providers to sell or share your personal information.

Your California Privacy Rights

As a California resident, you have the rights listed below. Please note, these rights are not absolute, and, in some cases, we may not be able to respond to your request, such as when a legal exemption applies or if we are not able to verify your identity.

• Right to Know/Access: You can request the following information about how we have collected and used your personal information:
  • the categories of personal information we collected;
  • the categories of sources from which we collected personal information;
  • the business or commercial purpose for collecting, selling, or sharing (as applicable) that personal information;
  • the categories of third parties with whom we disclose personal information; and
  • a copy of the personal information that we collected about you.
• Right to Delete: You can request that we delete the personal information we collected from you.
• Right to Correct: You can request that we correct inaccurate personal information that we maintain about you.
• Right to Opt-Out of Sales/Sharing: If we “sell” or “share” your personal information, you can opt-out.
• Right to Nondiscrimination: You are entitled to exercise the rights described above without receiving discriminatory treatment.

You may exercise the rights described above as follows:

• Know/Access, Delete, or Correct: You may exercise these California privacy rights by visiting our Privacy Portal or by emailing us at dpo@kennagroup.com.
• Opt-Out of Sales/Sharing: You can request to opt-out of the “sale” or “sharing” of your personal information through Your Privacy Choices or by broadcasting the Global Privacy Control (GPC) signal. Note that due to technological limitations, if you visit our Services from a different computer or device, or clear cookies on your browser that store your preferences, you will need to return to this screen to select your preferences and/or rebroadcast the GPC signal.

If you direct us not to sell/share your personal information, we will consider it a request pursuant to California’s “Shine the Light” law to stop sharing your personal information covered by that law with third parties for their direct marketing purposes.

Additional Disclosures for Individuals in Europe

If you are located in the European Economic Area (“EEA”), the United Kingdom, or Switzerland, you have rights and protections under the law regarding the processing of your personal information, and this section applies to you.

Legal Basis for Processing

When we process your personal information, we will do so in reliance on the following lawful bases:

• To perform our responsibilities under our contract with you or our Clients (e.g., processing payments for and providing the products and services you requested).
• When we have a legitimate interest in processing your personal data to operate our business or protect our interests (e.g., to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you).
• To comply with our legal obligations (e.g., to maintain a record of your consents and track those who have opted out of marketing communications).
• When we have your consent to do so (e.g., when you opt in to receive marketing communications from us). When consent is the legal basis for our processing of your personal data, you may withdraw such consent at any time.

Data Retention

We store personal data associated with your account for as long as your account remains active. We will delete your account data after two years of inactivity. We store other personal data for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations. If you consent to our use of cookies, we may collect and store data analyzing use of our website for up to two months. See our Cookie Policy for additional information.

Additional Rights

In addition to the Privacy Rights described above and subject to certain limitations, you have the right to object to certain processing, withdraw your consent where we process your information on that basis, and the right to request we restrict certain processing. To exercise any of these rights, please email us at dpo@kennagroup.com.

If you have a concern about our processing of personal data that we are not able to resolve, you have the right to lodge a complaint with the Data Protection Authority where you reside. Contact details for your Data Protection Authority can be found using the links below:

• For individuals in the EEA: edpb.europa.eu
• For individuals in the UK: ico.org.uk
• For individuals in Switzerland: edoeb.admin.ch

Contact Us

If you have any questions about this Privacy Policy, please contact us at dpo@kennagroup.com.

You can also contact our Data Protection Officer directly at dpo@kennagroup.com, or in writing at: