Privacy Policy

SourceGrid LLC (“SourceGrid”, “we”, “us” or “our”) is a Florida limited liability company organized and existing under the laws of the State of Florida, United States, with its principal place of business at 7971 NW 21 ST, Doral, Florida 33198, USA. SourceGrid is the data controller responsible for the processing of personal information collected through the website sourcegrid.co, the subdomains www.sourcegrid.co, app.sourcegrid.co, shop.sourcegrid.co and any other digital, telephonic, in-person, electronic-messaging or postal channel operated by SourceGrid in connection with its B2B wholesale activities (collectively, the “Services”).

For all matters relating to this Policy or to the exercise of your rights, you may contact our Privacy Office in writing at sales@sourcegrid.co or by certified mail at the address above, marked “Attn: Privacy Office”.

Depending on the User's interaction with us, we may collect the following categories of personal information:

• Identifiers & contact data: first and last name, business or trade name, business address, residential address (only when used as a business address), email, telephone, country, state, city, IP address, device identifier, online identifier, account credentials.
• Commercial & business data: Employer Identification Number (EIN) or equivalent tax ID, Resale Tax Certificate or equivalent reseller credential, type of business (salon, beauty supply store, e-commerce seller, distributor), estimated monthly purchase volume, sales channels, brands carried, professional license numbers, website URL.
• Transactional data: orders placed, invoices, payment status, payment method (last four digits of the card and brand only — full card data is processed by PCI-DSS Level 1 payment processors and never stored by SourceGrid), shipping addresses, returns, claims and credits.
• Technical & usage data: IP address, browser type and version, operating system, language, time-zone, referrer URL, pages visited, click-stream, session duration, events, error logs, cookie identifiers and similar technologies.
• Marketing & preference data: newsletter subscriptions, marketing consents, communication preferences, product interests, event attendance.
• Communications & UGC: emails, support tickets, chat logs, voicemail, recorded calls (where lawful and disclosed at the start of the call), form submissions, reviews and any content you voluntarily share with us.
• Sensitive identifiers (limited): photographs of physical Resale Tax Certificates and government-issued business documents that may contain identifiers. We do not knowingly request or process Social Security Numbers, government-issued IDs of natural persons, biometric data, precise geolocation, or special categories of data within the meaning of the GDPR (race, ethnicity, religion, health, sexual orientation, etc.).

We do not sell or share personal information of consumers under 16 years of age and our Services are not directed to them.

We process personal information for the following purposes, each of which is necessary for the legal basis identified in Section 6:

• Evaluating, opening, maintaining and closing wholesale accounts (including KYC, sanctions screening and credit assessment).
• Processing orders, invoicing, fulfillment, shipping, returns and customer support.
• Complying with U.S. federal, Florida state and local tax, customs, anti-money-laundering, anti-terrorism, sanctions, consumer-protection and product-safety obligations.
• Preventing, detecting and investigating fraud, abuse, chargebacks, channel diversion, counterfeiting and other unlawful conduct.
• Operating, securing, monitoring, improving and developing the Services.
• Sending transactional communications (order confirmations, shipping updates, invoices, recalls, legal notices) and, with consent where required, marketing communications.
• Performing analytics, product research, demand planning and personalization.
• Defending, exercising or establishing legal claims and enforcing our Terms.

We do not sell personal information for monetary consideration and do not share it for cross-context behavioral advertising as defined under the CCPA/CPRA. We disclose personal information only to:

• Service providers and processors bound by written contracts containing GDPR/CCPA-compliant data-protection terms — including cloud hosting, database, e-mail, CRM, analytics, customer-support, payment, fraud-prevention, fulfillment and shipping providers.
• Brand owners and manufacturers for the limited purpose of validating authorized resale, warranty, recall and product-stewardship matters.
• Professional advisors (legal, tax, audit, insurance) under duty of confidentiality.
• Government authorities, regulators and law enforcement when required by law, subpoena, court order or to protect our rights, property or safety, or those of others.
• Successors in interest in connection with any merger, acquisition, financing, reorganization, bankruptcy or sale of all or part of our assets, in which case the recipient will be bound by terms substantially similar to this Policy.

Depending on your jurisdiction, you may have the right to:

• Access: request confirmation of whether we process your personal information and obtain a copy.
• Rectification: request correction of inaccurate or incomplete data.
• Deletion / Erasure: request deletion subject to lawful retention obligations.
• Restriction: request restriction of processing in defined circumstances.
• Portability: receive your data in a structured, commonly used and machine-readable format.
• Objection: object to processing based on our legitimate interests or for direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of prior processing.
• Non-discrimination for exercising your rights, as required by the CCPA/CPRA and similar laws.
• Lodge a complaint with a competent supervisory authority (in the EU/UK) or attorney general (in the U.S.).

To exercise any right, send a written request to sales@sourcegrid.co from the email associated with your account, including the right being exercised and reasonable identifying information. We will respond within 30 days (extendable by 60 additional days where permitted by law). We may decline requests that are manifestly unfounded, repetitive or excessive, or impose a reasonable fee in such cases.

California (CCPA/CPRA): in the past twelve (12) months SourceGrid has collected the categories described in Section 3 for the purposes described in Section 5 and disclosed them only to the recipients described in Section 7. SourceGrid has not sold or shared personal information for cross-context behavioral advertising. California residents may exercise the rights to know, delete, correct, opt-out of sale/sharing and limit use of sensitive personal information by contacting us as described in Section 12. We will not discriminate against residents who exercise these rights.

Other U.S. states (Virginia, Colorado, Connecticut, Utah, Texas, Florida and others with comprehensive privacy statutes): residents may exercise rights of access, correction, deletion, portability and opt-out under their respective state laws by following the procedures in Section 12.