PRIVACY POLICY

2. How We Use Information

We use the information described above to: provide, operate, and improve the Site; identify and contact prospective and existing business customers, including outreach by our salesteam by phone and email; respond to inquiries and provide customer, dealer, andwarranty support; measure and improve the performance of our advertising and marketing campaigns; understand how visitors use the Site so we can improve navigation and content; supplement, verify, and maintain the accuracy of the information in our records; detect, investigate, and prevent fraudulent or unauthorized activity; and comply with our legal obligations.

3. Your Choices and Opt-Out Rights

·        Browser Controls. Most browsers let you block or delete cookies through their settings. Blocking cookies may affect thefunctionality of the Site.

·        Google Analytics Opt-Out. Available at https://tools.google.com/dlpage/gaoptout.

·        Advertising Opt-Outs. You may opt out of interest-based advertising from many of our partners through the Digital Advertising Alliance at https://optout.aboutads.info or the Network Advertising Initiative at https://optout.networkadvertising.org, and you may manage Meta ad preferences at the link in Section 1.2.

·        Do Not Track. Some browsers offer a “Do NotTrack” signal. Because there is no common industry standard for responding tosuch signals, the Site does not currently respond to them.

4. Disclosure of Information

We may disclose personal information we collect, or you provide, as described in this Policy:

·        To our subsidiaries, affiliates, or related brands.

·        To contractors, service providers, and other third parties we use to support our business and operations. These third parties are bound by contractual obligations to keep personal information confidentialand use it only for the purposes for which we disclose it to them.

·        To a buyer or other successor in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of M.H. Eby, Inc.’s assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding, in which personal information held by M.H. Eby is among the assets transferred.

·        To fulfill the purpose for which you provided it.

We may also disclose your personal information for any other purpose disclosed by us when you provide it, for which we have obtained your consent, or otherwise provided by law.

We may also disclose your personal information:

• To comply with any court order, law, or legal process, including to respond to any government or regulatory request.
• To enforce or apply our Terms of Use and other agreements, including for billing and collection purposes.
• If we believe disclosure is necessary or appropriate     to protect the rights, property, or safety of M.H. Eby, Inc., our customers, or others. This includes exchanging information with other     companies and organizations for the purposes of fraud protection and credit risk reduction.

4.1 Categories of personal information sharedor sold in the past 12 months

We may share your personal information by disclosing it to a third partyfor a business purpose.  In somecircumstances, we may “sell” your personal information as that term is definedunder certain state privacy laws, including the California Consumer Privacy Actand California Privacy Rights Act.  Inthe past 12 months, we have disclosed or sold the categories of personal information shown in the table below.

5. California Privacy Rights

If you are a California resident, the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”), may give you the following rights to:

The Right to Know and to Confirm, and the Right to Data Portability

You have the right to request that we disclose certain information to you about our collection and use ofyour personal Information over the past 12 months (the “right to know” and the “right to confirm”). Once we receive your request and confirm your identity, we will disclose to you:

• The categories of personal information that we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting or selling that personal information.
• The categories of third parties with whom we share that personal information.
• If we sold or disclosed your personal information for a business purpose, two separate lists disclosing:
  • Sales, identifying the personal information categories that each category of recipient purchased; and
     
  • Disclosures for a business purpose, identifying the personal information categories that each category of recipient obtained.
• The specific pieces of personal information we collected about you (also called a “data portability” request).
• If you submit a data portability request, we will provide you with a copy of your personal information in a common and portable format that you may transfer     to another organization of your choosing.

The Right to Delete

You have the right to request that we delete any of your personal information that we collected from you and retained, subject to certain exceptions (the "right to delete"). Once we receive your request and confirm your identity, we will review your requestto see if an exception allowing us to retain the information applies. We may deny your deletion request if retaining the information is necessary for us orour service provider(s) to:

• Complete the transaction for which we collected the personal information, provide a service that you requested, take actions reasonably anticipated within the     context of our ongoing relationship with you, or otherwise perform our contract with you.
• Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity, or prosecute those responsible for such activities.
• Debug products to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another individual to exercise their free speech rights, or exercise another right provided for by law.
• Comply with specific laws, such as the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et.     seq.).
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information's deletion may likely render impossible or seriously impair the research's achievement, if you previously provided informed consent.
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
• Comply with a legal obligation.
• Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

We will delete or deidentify personal information not subject to one of these exceptions from our recordsand will direct our service providers to take similar action.

The Right to Correct Inaccurate Personal Information

You have the right to correct any inaccurate personal information about you that we have in our possession (the “right to correct”).  Once we receive your request and confirm your identity, we will disclose to you the specific pieces of personal information that we have collected about you. You will then have the opportunity to direct us to correct the pieces of information which you believe are inaccurate.

We may deny your request to correct if we believe the updated personal information is incorrect or is being used for any fraudulent or deceptive purpose.

The Right to Restrict Sensitive Personal Information Processing

You have the right to restrict our processing of your sensitive personal information (the “right to restrict”).  Once we receive your requestand verify your identity, we will cease the processing of your sensitive personal information for the purpose of inferring characteristics about you.  Please note that we may continue to process your sensitive personal information for other purposes consistent with thisPolicy.

The Right to Opt Out of the Processing and Sale of Personal Information

You have the right to direct us not to process your personal information for targeted advertising and not tosell your personal information at any time (the "right to opt-out").Once we receive your request, we will no longer use or process your personal information for the purpose of providing targeted advertising to you based on your activity and interests.  We will also no longer sell (as that term is defined by relevant and applicable state law) your personal information to third parties for targeted advertising purposes.

The Right to Opt Out of the Sharing of Personal Information for Cross-Contextual Behavioral Advertising

You have the right to opt out of the sharing of your personal information with third parties for cross-contextual behavioral advertising. Once we receive your request, we will no longer use or process your personal information for the purpose of advertising to you based on your individual activity.

The Right to Opt Out of Profiling

You have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects to you.  Once we receive your request, we will no longer use or process your personal informationfor making decisions that produce a legal or similarly significant effect toyou.

The Right to Be Free from Discrimination

We will not discriminate against you for exercising any of your rights under applicable state privacy law.  Unless permitted by state law, we will not:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you with a different level or quality of goods or services.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer youcertain financial incentives permitted by state privacy law that can result in different prices, rates, or quality levels. This may include loyalty and rewards programs. Any legally permitted financial incentive we offer will reasonably relate to your personal information’s value and will contain written terms that describe the program's material aspects. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

To submit a request, please reviewthe information included in Section 6.

To the extent any of the advertising or analytics technologies described in Section 1.2 constitute a“sale” or “sharing” of personal information under the CCPA, you may opt outusing the methods described in Section 3 above or by contacting us directly.

6. European Economic Area / GDPR

If you are located in the European Economic Area, you may have additional rights regarding your personal data under the General Data Protection Regulation, including the rights to access, correct, delete, restrict, or object to certain processing of your personal data, and the right to data portability. To exercise these rights, contact us using the information in Section 12.

You have the right to submit a complaint to a Data Protection Authority about our collection and use of your Personal Information.For more information, please contact your local data protection authority inthe European Economic Area (EEA).

7. Exercising Your Privacy Rights

As described above, you may have certain privacy rights depending on your residency or location. To exercise your privacy rights, please use the contact information provided in Section 12.

Only you or someone legally authorized to act on your behalf may make a request related to your personal information. You may only submit arequest twice within a 12-month period.

Your request must:

· Provide sufficient information that allows us to reasonably verify you are the personabout whom we collected personal information or an authorized representative, which may include:

o   Providing at least three (3) pieces of information that match the information we have about you.

o   Providing a signed declaration, under penalty of perjury, that you are the individual about whom you have submitted the request, or that you are legally authorized to submit the requeston the individual’s behalf.

·        Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm that the personal information relates to you.

We will only use the personal information provided in therequest to verify the requester's identity or authority to make it.

You may appeal a decision concerning your privacy rights by contacting us at https://www.mheby.com/contact or writing to us at M.H. Eby, Inc., ATTN:Legal Department, 145 Center Street, Blue Ball, PA 17506.

7.1 Response Timing and Format

We will confirm receipt of yourrequest within ten (10) business days. If you do not receive confirmationwithin the 10-day timeframe, please call 1-800-292-4752 or email [email protected].

We endeavor to substantively respond to a verifiable consumer request within forty-five (45) days of its receipt. If we require more time (up to another 45 days), we will inform you ofthe reason and extension period in writing.

Any disclosures we provide willonly cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a formatto provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

8. “Do Not Track” signals

We do not respond to Do NotTrack (“DNT”) signals at this time. We will respond to such signals in thefuture, if and when we are required to do so.

9. Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information. However, no method of transmission over the internet or method of electronic storage is completely secure, and we cannot guarantee absolute security.

10. Children’s Privacy

The Site is intended for ageneral business audience and is not directed to children under 18. We do no tknowingly collect personal information from children under 18. If you believe a child has provided us with personal information, please contact us so we can delete it.

11. Links to Third-Party Websites

The Site may contain links to third-party websites. We are not responsible for the privacy practices or content of those sites, and we encourage you to review their privacy policies before providing any information.

12. Contact Information

If you have questions about this Privacy Policy or wish to exercise any privacy rights described above, please contact us at:

Mail: M.H. Eby, Inc. ATTN: LegalDepartment, 145 Center Street, Blue Ball, PA 17506  

Phone: 1-800-292-4752

Website: https://www.mheby.com/contact

13. Changes to This Privacy Policy

This Policy is effective as of 10/6/2026. We may update this Policy from time to time; any changes will be posted on thispage with a revised effective date. Your continued use of the Site after changes are posted constitutes your acceptance of the revised Policy.

‍