Privacy Policy of Good Roots, Inc.

Introduction

This privacy notice (“Privacy Notice”) is intended to provide you with specific details about how Good Roots, Inc., which owns and operates growgoodroots.com (“Good Roots,” “we,” and “us”), collects and processes your personal and personally identifiable information through your use of our website and our associated services including but not limited to a transaction or inquiry concerning our services (collectively, the “Services”).

You understand and agree that we may store and process your personal information on computers located outside of your jurisdiction, including, but not limited to, in the United States or the European Union. By using the Services, you agree to the collection and processing of your personal or personally identifiable information outside of your jurisdiction.

Before using the Services or providing information to us, please carefully review this Privacy Notice. By using or accessing the Services, you agree that we may collect and use your personal and personally identifiable information in accordance with this Privacy Notice, as revised from time to time. We may modify, amend, replace, or suspend this Privacy Notice at any time. If you have any questions or suggestions regarding our Privacy Notice, or if your personal information is not accurate or complete, please contact us at:

Or email us at our contact page.

By providing Good Roots with your personal or personally identifiable data and using the Services, you warrant that you are over the age of eighteen (18) or otherwise above the age of majority within your jurisdiction. If you are younger than eighteen (18) or the age of majority within your jurisdiction, please do not use the Good Roots Services and please do not provide personal information to us.

Our Services may include links to websites or may include the use of analytics tools that are owned, operated, and maintained by third parties. Good Roots does not exercise control over the privacy practices of such third-party websites or analytics tools, and you are encouraged to review the privacy practices of all such third-party websites or analytics tools disclosed within this Privacy Notice.

What Data We Collect, How And Why

When you use the Services, we may collect personal or personally identifiable information from you (“PII”). PII may include any information that identifies, relates to, describes, references, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual. It does not include anonymized data.

We may collect and process the following categories of PII about you:

• Communication Data. Any communication that you may send to us through the Services, email, telephone, SMS or other text, livechat, or social media. We process this data to communicate with you, to provide customer support, to record logs of our communication, and to store information to respond to legal claims. Our lawful ground is to respond to communications sent by you to us, to keep records, and to pursue or defend against legal claims.
• User Data. Data about how you use the Services and any data that you post to or authorize through the Services, such as your name, address, country, phone number, and email address. This includes data stored in persistent cookies and analytics data collected when you use the Services. Our lawful ground is our legitimate business interests in administering and offering the Services and fulfilling your orders.
• Technical Data. Your IP address, login data, phone number, mobile device model, operating system, geolocation, and time zone. We may collect this from your use of the Services and from advertising IDs. Our lawful ground is our legitimate interests in administering and securing the Services and growing our business.
• Marketing Data. Your preferences in receiving and interacting with our advertisements or content, on the Services or on third party websites. We collect this from your use of the Services and from third party advertising IDs. Good Roots does not connect advertising identifiers to persistent device identifiers such as MAC addresses or mobile device IDs.

Good Roots will only use your PII for the purpose for which it was collected. If we need to use your PII for an unrelated, new purpose, we will provide you with notice of this new use and will explain the lawful ground for such processing. We may process your PII without your knowledge or consent where required or permitted by law. Where consent is required by applicable law, we will request and rely on your affirmative consent before collecting or using your data for marketing or tracking purposes.

How do we collect this information?

• Direct collection. When you sign up for our consulting services, contact us through our website or another website, via live chat, social media, SMS, telephone or email, respond to a survey, participate in a contest, submit a review or feedback, or opt in to receive marketing emails or mailings from us.
• Third party tracking tools. We use pixels, web beacons, and cookies to automatically collect PII from you when you open, view, or click pages, links, emails, or advertisements. These tools are disclosed below.
• Business partners and service providers. We may obtain PII from our business partners or service providers. When we do, we ensure that all such partners and providers have obtained consent from you to transfer that PII to us for its intended uses.
• Sales and prospecting data providers. We use business contact data providers, including Apollo, to identify and reach professional contacts at farm and food businesses. This data concerns you in a business capacity and may be obtained from sources other than you directly.
• Social media networks and other platforms. When you interact with our social media accounts or content posted on third-party platforms such as Facebook, X, LinkedIn, Instagram, or YouTube.
• Analytics providers. Through our use of third-party analytics providers, listed below. We may create user profiles based on PII obtained through these providers to better understand your needs as a customer.

Third Parties We Use

Good Roots may collect data about you through cookies and other technologies. This helps us understand how you use the Services and any patterns associated with that use, which aids us in developing or improving our Services and marketing communications.

We may use the following analytics and marketing platforms, and you are directed to review their privacy and cookie policies:

• HubSpot legal.hubspot.com/privacy-policy
• Google google.com/policies/privacy
• Meta (Facebook) facebook.com/privacy/policy
• Salesforce (Pardot) salesforce.com/company/legal/privacy

You may opt out of Google Analytics at tools.google.com/dlpage/gaoptout. Good Roots may also receive data from third parties including analytics providers or advertising networks such as Google, Meta, TikTok, or Apple. These third parties may be based outside of your jurisdiction.

Business contact data and prospecting

We use business contact data platforms, including Apollo, to identify and contact professionals at farm and food businesses for sales and marketing purposes. Data obtained through these platforms is business contact information and may have been collected from sources other than you directly. You may ask us to remove your details from our prospecting lists at any time by contacting our Privacy Officer, and we will do so.

• Apollo apollo.io/privacy-policy

Platforms used to deliver our services

We also use some or all of the following third party platforms when responding to inquiries or providing our services to a client in a paid engagement. This list is not exclusive:

• HubSpot legal.hubspot.com/privacy-policy
• Zoom zoom.com/trust/privacy
• QuickBooks and Intuit quickbooks.intuit.com/privacy
• SurveyMonkey surveymonkey.com/legal/privacy
• Kantata kantata.com/privacy-policy

Do We Use Your Information For Training Large Language Models?

We may use data collected on this Website, including text input, interaction logs, and usage statistics, to improve the accuracy, reliability, and quality of our services, which we may use to help improve our customer service interactions and to assist us in answering common questions we receive from our users. We may use enterprise-grade AI-assisted tools such as Claude, ChatGPT, Gemini, and similar technologies to do so, to deliver Services, or to support related business operations. These AI tools are configured under provider terms that prohibit the use of customer data for model training. We do not upload personally identifiable or sensitive client information into consumer-grade AI platforms. All AI-assisted outputs are reviewed and approved by Good Roots team members before being shared with clients or being used in subsequent work.

Cookies And Pixels

Yes, we use persistent and session cookies. Cookies are small files that a site or its service provider transfers to your computer through your web browser, if you allow, which enable the site or service provider to recognize your browser and capture and remember certain information.

Session cookies are only stored during your use of the Services and are automatically deleted when you close your web browser. They may be used to direct internet traffic to a server closer to you, or to identify you as you move between pages. Persistent cookies remain on your device after you close your browser and can be read by the service that created them when you return.

Following our migration to HubSpot, the Services use HubSpot’s tracking technologies. These include the identifiers hubspotutk, __hstc, __hssc, and __hssrc, which are used to recognize returning visitors, attribute form submissions, and measure sessions. The same technology supports our forms, meeting scheduler, and live chat where those features are present.

We may use cookies to help us compile aggregate data about site traffic and site interaction so that we can offer better site experiences and tools in the future. We never use cookies to store sensitive customer information such as names, addresses, passwords, or credit card information.

Our website also loads web fonts from Google Fonts, which means Google receives your IP address when a page is rendered.

How we use pixels on our site

Like many other websites, we use tracking technologies which include the Meta Pixel (formerly Facebook Pixel). These technologies help us understand how visitors interact with our site and how to improve our marketing efforts. We may also use other tracking technologies, including other pixels, in the future. If we do, we will notify users by updating this Privacy Notice.

A pixel is a small piece of code added to our site. When you visit, this code helps us track actions you take, such as clicking a link, viewing a page, or making a purchase. The pixels send this information back to Meta, which helps us show you more relevant ads, measure the effectiveness of our ads, and improve your experience by understanding which content is most useful. These pixels do not collect personal details like your name, email, or phone number; they track actions and behaviors using cookies and other identifiers.

By using our website, you consent to the use of these pixels as described above. If you do not want them to track your activity, you can adjust your privacy settings on Meta to limit ad tracking, use browser settings or extensions that block tracking technologies, or opt out through the Digital Advertising Alliance or your device’s privacy settings.

Marketing, Disclosure, Security And Retention

Marketing communications

Our lawful ground for sending you marketing communications is either consent or our legitimate business interests. We may send you marketing communications if you have asked for information concerning our goods or services, or if you have agreed to and have not opted out from receiving them. You may ask us to stop at any time by following the opt-out link in any marketing message. If you opt out, that does not extend to PII provided for other purposes.

When do we disclose your information?

• Service providers that provide us with information technology, software as a service, cloud storage, or other administrative services;
• Our accountants, auditors, insurers, or attorneys;
• Law enforcement agencies upon receipt of a subpoena or court order, or where necessary to protect our personnel or property; and
• Government bodies that require us to report our processing activities.

We may also transfer PII to third parties when we sell, transfer, or merge any part of our business or assets.

How do we protect your information?

We implement a variety of security measures to maintain the safety of your personal information. However, no security measures are impenetrable and there are always security risks. We will notify you and any regulatory body of any breach of your PII or our security measures if we are legally required to do so. We allow access to your PII only by employees and service providers who have a need to know or access it on our instructions.

For how long do we retain your data?

We will only retain your PII for so long as necessary to fulfill the purposes for which it is collected under this Privacy Notice, or for the purposes of satisfying any legal, accounting, or reporting requirements. With respect to location data, technical data, usage and interaction data, and marketing data, we may retain this for so long as it is relevant to the uses disclosed here. If you are a client who has paid for our services, we may retain account data, public data, and communications data for so long as you continue to work with our services, and for longer where there is a need to comply with our legal obligations, such as the preservation of electronic evidence or compliance with a preservation order.

Your Privacy Choices

Access, rectification, correction, erasure, transfer and withdrawal

Under the law, you may have a right to request access to your PII for rectification, correction, erasure, transfer, or restriction, or to object to its processing or withdraw your consent. If you wish to exercise any of these rights, please contact our Privacy Officer as disclosed in this Privacy Notice.

You do not need to pay a fee to access your PII or to exercise your rights. However, we may charge a reasonable fee if your request is unreasonable or excessive. To confirm your request, we may need to request specific information from you as a security measure to ensure that PII is not disclosed to an unauthorized third party. We will attempt to respond to all legitimate requests within thirty (30) days.

Rights of European citizens

Good Roots adheres to the EU-U.S. Data Privacy Framework (“DPF”) Principles, including the DPF’s Supplemental Principles, and while we are not compliance certified under the DPF, we follow the Principles in handling all data from EU citizens. We are subject to the enforcement powers of the United States Federal Trade Commission in relation to our handling of user data.

If you are a European citizen, you are entitled to certain rights regarding the protection of your Personally Identifiable Information and Personal Data, subject to limitations set forth in the EU GDPR and its applicable case law. These rights are:

• The right to access and correct the information that we process about you;
• The right to transfer all or part of the information collected about you to another data controller, where technically feasible;
• The right to erasure of data concerning you, subject to our rights of retention under the law;
• The right to object to processing where you dispute the accuracy of the data, the processing is not lawful, we no longer need the information, or you have raised an objection for personal reasons;
• The right to revoke your consent to data processing;
• The right to object to processing for marketing purposes;
• The right to object to processing for direct marketing or for personal reasons arising from your particular situation; and
• The right to file a complaint with a data protection authority.

To exercise these rights you may unsubscribe from our emails or contact our Privacy Officer. For further information regarding your privacy rights as a citizen of the EU, please visit the U.S. Department of Commerce at commerce.gov and the DPF overview at dataprivacyframework.gov. As a citizen of the EU you may, under certain conditions, invoke binding arbitration against Good Roots, and we may be held liable in cases of onward data transfers to third parties as described in the DPF overview. We may be required to disclose personal information in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

California Privacy Rights

The following rules apply solely to visitors, users, and others who are residents of the State of California. California residents have the right to be notified which categories of PII are being collected and the purposes for which the PII is being used. We collected the following categories of PII as defined in the California Consumer Privacy Act within the last twelve months.

We obtain the categories marked Yes directly from California residents when they complete forms through our Services or provide it to us as part of a transaction or inquiry. We also obtain these categories indirectly while observing their actions on our Services, and from third parties or service providers that they have authorized to receive and share PII.

California residents have a right to request that we disclose what PII we collect and whether, and how, we disclose or sell that PII. California residents may also request that we delete any personal information collected or maintained by us.

California residents may also have the right to opt out of the sale of their personal information by contacting us or, where available, by clicking a link or icon associated with an advertisement, which may state “Do Not Sell My Personal Information.” Even if you opt out, you may still see interest-based advertisements. To learn more about interest-based advertising across websites and additional opt-out choices, visit optout.aboutads.info.

To submit a request for a list of the categories of personal information collected from you, or to request deletion, write to our Privacy Officer at the address above or use our contact page. To verify your request we may ask for information to confirm that you are a Good Roots user, such as your phone number, email address, city, state, or geographic location. You may also designate an authorized agent to make a request on your behalf, in which case you must provide proof of that appointment, such as a signed power of attorney. California residents have a right not to receive discriminatory treatment for exercising these rights.

Other State Privacy Laws

If Good Roots becomes subject to one or more of the above states’ privacy laws other than California’s, we will update this Privacy Notice to reflect your rights under those laws.

Tracking Choices And Signals

Third party links

Our Services may include links to third-party websites and applications. By clicking on third party links, you may allow third parties to collect or share data about you. We do not control these third-party links and you are advised to review their respective privacy policies.

Responding to Do Not Track signals

You can generally opt out of receiving personalized ads from third party advertisers and ad networks who are members of the Network Advertising Initiative, or who follow the Digital Advertising Alliance’s Self-Regulatory Principles, by visiting the opt-out pages at thenai.org and digitaladvertisingalliance.org. We respect Do Not Track signals from browsers. If you enable DNT, we will not track your activity for targeted advertising or analytics.

You can opt out of targeted advertising using the links below:

• Call Tracking Metrics: opt-out page
• Meta: facebook.com/adpreferences
• Google: google.com/settings/ads

Additionally, you can opt out of some of these services at optout.aboutads.info.

Global Privacy Control

We recognize and honor Global Privacy Control signals, which are browser-based settings that communicate your privacy preferences to websites. When GPC is enabled in your browser, we will interpret this as a valid opt-out request under applicable U.S. state privacy laws, such as the California Consumer Privacy Act, for purposes of data sharing and targeted advertising.

Opting out via GPC does not affect our ability to process your personal information to fulfill your orders or otherwise perform a contract with you, to comply with legal obligations, for internal business purposes such as fraud prevention, security or analytics, or where data is processed solely by our service providers acting on our behalf and not sold or shared for their own use. To enable GPC, visit globalprivacycontrol.org and follow the instructions for your browser.

Children’s Privacy, Changes And Contact

Children’s Online Privacy Protection Act compliance

We comply with the requirements of COPPA. We do not knowingly collect any information from anyone under 13 years of age, and our products and services are aimed at individuals 13 years of age or older. If you believe that we have collected PII from someone under the age of 13, please notify us immediately.

Changes to our Privacy Notice

Whenever we change our Privacy Notice, we will post those changes to this Privacy Notice on the Services and other places that we deem appropriate. Your use of our Services following these changes indicates your consent to the practices described in the revised Privacy Notice.

Contacting us

If you have any questions about this Privacy Notice or the manner in which we collect or use personal information about you, contact our Privacy Officer at the address above, call 267.606.0391, or use our contact page.