Legal

Privacy Policy

Effective Date: September 26, 2026

Last Updated: September 26, 2026

1. Introduction and Scope

This Privacy Policy describes how Criemhild, Inc. ("Criemhild," "we," "us," or "our") collects, uses, discloses, and retains personal information in connection with the Aethel Criemhild website located at www.aethelcriemhild.com, including our contact form and Criemhild Order Portal (the "Website"), and related business communications with us (together, our "Services").

This Privacy Policy is intended to comply with the California Online Privacy Protection Act ("CalOPPA") and, to the extent applicable to us, the California Consumer Privacy Act, as amended by the California Privacy Rights Act, and its implementing regulations (together, the "CCPA"), as well as other applicable privacy laws. It does not apply to third-party websites, platforms, or services that are linked from the Website.

2. Personal Information We Collect

We aim to collect only the personal information that is reasonably necessary for the purposes described in this Privacy Policy.

A. Information You Provide to Us

• Contact & General Inquiries: When you submit an inquiry through our contact form, we collect your first name, last name, email address, subject line, the contents of your message, and your acknowledgment of our Terms of Use and this Privacy Policy.
• Wholesale & B2B Orders: When you use our Criemhild Order Portal, we collect your company name, account type (e.g., Franchise, Distributor, Independent Café), contact person's name, email address, phone number, shipping address, order categories and products of interest, notes you provide (such as estimated volumes, number of locations, delivery window, or voltage requirements), and your confirmation that the request is made on behalf of a registered business.
• Payment and Invoicing: We do not collect or store payment card information on the Website. When you pay a wholesale invoice, payment is processed by the third-party payment processor identified in the invoice, under its own privacy policy, and we receive information such as your company name, invoice and transaction details, and payment status. We may also collect billing details, tax or resale certificate information, and related business records needed to complete the transaction.
• Other Communications: If you contact us by email, telephone, or otherwise, we collect the information you choose to provide.

B. Information Collected Automatically

• Analytics Data (only with your consent): If you click "Accept" on our cookie consent banner, we use Google Analytics 4 ("GA4") to collect information about your interaction with the Website, such as cookie and device identifiers, browser type, device information, pages visited, referring pages, time spent, interactions, and approximate geographic location (for example, city or region). According to Google, GA4 uses your IP address to derive approximate location and does not log or store IP addresses. We do not use GA4 to collect precise geolocation.
• Server Logs and Technical Data: Our hosting provider, Vercel Inc., automatically records standard server log information needed for security, performance monitoring, and troubleshooting, such as IP addresses, timestamps, requested URLs, browser and device information, and request headers.

C. Information from Other Sources

We may receive business contact information about you from our authorized sales representatives, distributors, or business partners, or from publicly available business sources, in connection with wholesale inquiries and orders.

We do not knowingly collect "sensitive personal information" as defined by California law. Please do not submit sensitive personal information (such as government identification numbers or health information) through our forms.

3. Categories of Personal Information (California Disclosures)

In the preceding twelve (12) months, we have collected the following categories of personal information, as described in the CCPA. For each category, the sources are described in Section 2, the purposes are described in Section 4, and the categories of recipients are described in Section 5.

• Identifiers: name, email address, phone number, shipping address, IP address, and online identifiers (such as cookie identifiers). Disclosed for a business purpose to: service providers (form processing, hosting, email, analytics with consent, payment processing, shipping), and professional advisors.
• Personal information described in California Civil Code Section 1798.80(e): name, address, telephone number, and, for invoicing, billing information. Disclosed for a business purpose to: service providers (email, payment processing, shipping, accounting), and professional advisors.
• Commercial information: products and services requested, quotations, invoices, and purchase history. Disclosed for a business purpose to: service providers (payment processing, shipping, accounting), and professional advisors.
• Internet or other electronic network activity information: browsing and interaction data on the Website, and server log data. Disclosed for a business purpose to: service providers (hosting; analytics only with consent).
• Geolocation data: approximate location derived from IP address (not precise geolocation). Disclosed for a business purpose to: service providers (hosting; analytics only with consent).
• Professional or employment-related information: company name, account type, and your role as a contact person. Disclosed for a business purpose to: service providers (email, payment processing, shipping), and professional advisors.

We do not collect sensitive personal information, and we do not use personal information to draw inferences to create a profile about you.

4. How We Use Personal Information

We use personal information for the following purposes:

• To receive, review, and respond to your inquiries.
• To process wholesale requests, prepare quotations and invoices, fulfill and ship orders, provide customer support, and manage our business-to-business relationships.
• To analyze Website traffic and user behavior to improve our content and user experience (only if you consent to analytics cookies).
• To maintain the security, stability, and proper functioning of the Website, and to detect and prevent fraud, spam, and misuse.
• To comply with legal, accounting, and tax obligations, and to establish, exercise, or defend legal claims.
• For any other purpose disclosed to you at the time we collect the information, or with your consent.

We will not use personal information for materially different, unrelated, or incompatible purposes without providing you notice.

5. How We Disclose Personal Information

We do not sell, rent, or trade your personal information. We disclose personal information only as follows:

A. Service Providers

We use the following service providers to operate the Website and our business. They are permitted to use personal information only to provide services to us, subject to their contractual commitments and privacy policies:

• Web3Forms: processes submissions from our contact and wholesale order forms and delivers them to our designated email address. Web3Forms Privacy Policy.
• Google LLC (Google Analytics 4): provides website analytics (only with your consent). Google Privacy Policy. To learn how Google uses information from sites that use its services, visit: How Google uses information from sites or apps that use our services.
• Vercel Inc.: hosts the Website and processes server log data for security and performance. Vercel Privacy Policy.
• Microsoft 365 (provided through GoDaddy): hosts our business email, where form submissions and correspondence are stored.
• Payment Processor: the third-party payment processor identified in your invoice processes invoice payments.
• Shipping carriers, logistics providers, and accounting and tax professionals, as needed to fulfill orders and maintain business records.

B. Other Disclosures

• Sales Representatives and Distributors: If your inquiry concerns a territory or channel covered by one of our authorized sales representatives or distributors, we may share your business contact information and inquiry with that representative or distributor, under written confidentiality obligations, so that it can respond to you.
• Legal Requirements: We may disclose personal information if required to do so by law, subpoena, or court order, or when we believe in good faith that disclosure is necessary to protect our rights, property, or safety, or the rights, property, or safety of others.
• Business Transfers: If we are involved in a merger, acquisition, financing, reorganization, or sale of all or part of our assets, personal information may be transferred as part of that transaction, subject to this Privacy Policy.
• With Your Consent: We may disclose personal information for other purposes with your consent.

6. No Sale or Sharing of Personal Information

We do not "sell" personal information or "share" personal information for cross-context behavioral advertising, as those terms are defined in the CCPA, and we have not done so in the preceding twelve (12) months. We do not knowingly sell or share the personal information of consumers under 16 years of age. We have configured our GA4 account so that data is not used for Google advertising purposes.

7. Cookies, Local Storage, and Tracking Choices

The Website operates on an "opt-in" basis for non-essential tracking.

• Analytics Cookies: GA4 scripts and associated cookies are loaded only if you click "Accept" on our cookie consent banner. If you click "Decline" or do not respond to the banner, GA4 cookies are not set and no data is sent to Google Analytics.
• Changing Your Choice: You may change or withdraw your consent at any time by clicking "Cookie Settings" in the Website footer. Withdrawing consent stops future analytics collection but does not affect data collected before withdrawal. You may also block or delete cookies through your browser settings.
• Local Storage: We use your browser's localStorage only to record your cookie consent choice so that you are not asked again on each visit. This entry does not contain your name, email address, or other directly identifying information.
• No Advertising Cookies: We do not use advertising or marketing cookies, and we do not permit third parties to use our Website to track you across other websites for advertising purposes.
• Do Not Track and Global Privacy Control: Some browsers offer a "Do Not Track" ("DNT") setting. Because we do not load analytics unless you affirmatively consent, and we do not track you across third-party websites over time, the Website operates the same way whether or not your browser sends a DNT signal. If your browser sends a Global Privacy Control ("GPC") signal, we treat it as a decision to decline analytics cookies.

8. Data Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this Privacy Policy, including to meet legal, accounting, and tax requirements. We use the following criteria:

• Contact form inquiries: retained for up to two (2) years after our last communication with you, unless the inquiry becomes part of a business relationship, in which case the retention period for B2B records applies.
• B2B wholesale requests, quotations, invoices, and related communications: retained for the duration of our business relationship and for up to seven (7) years thereafter, as needed for accounting, tax, warranty, and record-keeping purposes.
• Server logs: retained by Vercel for a limited period in accordance with its standard log retention practices.
• Analytics data: retained by Google in accordance with the data retention setting we have configured in GA4, which is fourteen (14) months.
• Cookie consent preference: stored in your browser until you change it or clear your browser storage.

9. Data Security

We use reasonable administrative, technical, and physical safeguards designed to protect personal information, including encrypted (HTTPS) transmission of data on the Website. However, no method of transmission over the Internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. Your Privacy Rights and California Disclosures

If you are a California resident, and to the extent the CCPA applies to us, you have the following rights regarding your personal information, subject to certain exceptions. These rights apply to business contacts as well as individual consumers. Residents of certain other U.S. states may have similar rights under their state laws, and we will respond to such requests as required by applicable law.

• Right to Know and Access: You may request that we disclose the categories of personal information we have collected about you, the categories of sources, the business or commercial purposes for collecting it, the categories of third parties to whom we disclosed it, and the specific pieces of personal information we have collected about you (including in a portable format).
• Right to Delete: You may request that we delete personal information we have collected from you, subject to legal exceptions (for example, records we must keep for tax purposes).
• Right to Correct: You may request that we correct inaccurate personal information we maintain about you.
• Right to Opt Out of Sale or Sharing: We do not sell or share personal information, so there is no sale or sharing to opt out of.
• Right to Limit Use of Sensitive Personal Information: We do not collect or use sensitive personal information for purposes that would trigger this right.
• Right to Non-Discrimination: We will not discriminate or retaliate against you for exercising any of your privacy rights.

How to Submit a Request: You may submit a request by (1) emailing us at contact@criemhild.com with the subject line "Privacy Request," or (2) writing to us at Criemhild, Inc., Attn: Privacy Requests, 6131 Orangethorpe Ave., Ste 141, Buena Park, CA 90620, USA. Please describe your request and the relationship you have with us (for example, contact form user or wholesale customer).

Verification: To protect your information, we will verify your identity before fulfilling a request to know, delete, or correct, generally by matching information you provide with information we already maintain (for example, your name, email address, and details of your inquiry or order). We will use personal information provided in a request only to verify your identity and to respond.

Authorized Agents: You may designate an authorized agent to submit a request on your behalf. We may require the agent to provide your signed written permission and may require you to verify your identity directly with us, unless the agent holds a valid power of attorney under California Probate Code Sections 4121 to 4130.

Response Timing: We will confirm receipt of a request within ten (10) business days and respond within forty-five (45) calendar days. If we need more time (up to an additional forty-five (45) days), we will notify you of the reason and extension period. If we cannot fulfill your request, we will explain why.

11. California "Shine the Light" Law

Under California Civil Code Section 1798.83, California residents may request information about our disclosure of personal information to third parties for their own direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

12. Children's Privacy

The Website is intended for adults and businesses and is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13 (or, where applicable law requires, under 16). If you believe a child has provided us with personal information, please contact us at contact@criemhild.com, and we will delete it.

13. Third-Party Links and Social Media

The Website contains links to our official brand accounts on third-party social media platforms, including Instagram, X (formerly Twitter), YouTube, and TikTok. When you click on these icons or links, you leave our Website. We do not control these platforms and are not responsible for their data collection, privacy practices, tracking technologies, or content. Your interactions with these platforms are governed by their own privacy policies, which we encourage you to review.

14. Data Location

We are based in the United States, and personal information we collect is processed and stored in the United States by us and our service providers. If you access the Website from outside the United States, you understand that your information will be transferred to, processed, and stored in the United States, where data protection laws may differ from those in your jurisdiction.

15. Accessibility of This Policy

If you have a disability and need this Privacy Policy in an alternative format, please contact us at contact@criemhild.com. See also our Accessibility Statement.

16. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will post the updated Privacy Policy on the Website and update the "Last Updated" date above. If we make material changes, we will provide additional notice (for example, a prominent notice on the Website) before the changes take effect. We will not use previously collected personal information in a materially different manner than described at the time of collection without your consent where required by law.

17. Contact Us

If you have any questions, requests, or concerns regarding this Privacy Policy or our privacy practices, please contact us at:

Criemhild, Inc.

6131 Orangethorpe Ave., Ste 141, Buena Park, CA 90620, USA

Email: contact@criemhild.com