YOUR PRIVACY RIGHTS

PRIVACY POLICY

Last Updated and Effective Date: October 22, 2026

This Privacy Policy describes how Lawson Products Inc. and our subsidiaries and affiliated companies, including Kent Automotive, which is a division of Lawson Products, Inc. (collectively, “Lawson Products,” “we,” or “us”), collect, use, and disclose personal information about you and your data privacy rights. Personal information is sometimes also referred to as personal data, personally identifiable information, or other like terms to mean any information that directly or indirectly identifies you or is reasonably capable of being associated with you or, depending on the applicable privacy law, your household. This Privacy Policy applies to personal information we collect online and offline, such as when you use our websites www.lawsonproducts.com, www.kent-automotive.com or any of our related mobile websites and applications (such as the Kent Mobile App); register for an account with us; order products from us; conduct business dealings with us; or otherwise interact with us, such as through our customer service channels (collectively, our “Services”). Please note that our Services are only intended for individuals in the United States or Canada that are interacting with us in the commercial and/or business-to-business (“b2b”) context. By using our Services or otherwise providing any information to Lawson Products, you acknowledge that you are engaging in our Services in the commercial or b2b context.

We may provide different or additional notices of our privacy practices with respect to other personal information collection practices not within the scope of this Privacy Policy, in which case this Privacy Policy will not apply. For example, our personal information handling practices with respect to job applicants are addressed in our job applicant privacy notices. Job applicants from California may view the notice here and job applicants from Canada may view the notice here. If you are an employee or contractor of Lawson, please contact us at 1-800-241-1381 or legal_dept@lawsonproducts.com to get a copy of our human resources privacy notice.

We may change this Privacy Policy from time to time. If we make changes, we will notify you by revising the date at the top of this Privacy Policy. We may also provide you with an additional notice (such as by adding a statement to the Services or sending you a notification), in connection with making material changes to this Privacy Policy. We encourage you to review this Privacy Policy regularly to stay informed about our information practices and the choices available to you.

If you have trouble accessing this Privacy Policy because of a disability, please contact us at our email address legal_dept@lawsonproducts.com or our toll-free customer service telephone number 1-866-837-9908 to receive it in an alternative format.

I. NOTICE AT COLLECTION

A. Collection of Personal Information

1. Personal Information You Provide to Us

We collect personal information you provide directly to us. For example, we collect information directly from you when you visit our website; register for an account with us; sign up to receive communications from us; contact us for customer support or other inquiries; during the check-out process when purchasing products on our websites; or when we conduct business dealings with you. The types of personal information that we may collect directly from you include the following:

• Contact and Account Information: We collect certain contact and account information from you, such as name, account number, account login information, phone number, business name, email address, postal address, and other similar identifiers.
• Financial and Transactional Information: We collect payment and other financial information, and information regarding the products you purchased and your purchasing or consuming histories or tendencies.
• Professional or Employment-Related Information: We collect information regarding the company you work for, such as company name.
• Sensitive Personal Information: We also collect certain personal information that is considered sensitive personal information, such as account login, account number, and financial and other payment information (e.g., credit card information).

2. Personal Information We Collect Automatically

We automatically collect certain personal information about your interactions with us or our Services, including:

• Device and Usage Information: We collect internet or other electronic network activity information about how you access our Services, including identifiers, data about the device and network you use, such as your hardware model, the identity of your Internet service provider, operating system version, mobile network, IP address, language, unique device identifiers, browser type, and app version. We also collect information about your activity on our Services, such as access times, pages viewed, links clicked, and the page you visited before navigating to our Services.
• Information Collected by Cookies and Similar Tracking Technologies: We and others that control collection of personal information use tracking technologies, such as cookies, pixels and web beacons, to collect information about you. Cookies are small data files stored on your hard drive or in device memory that help us improve our Services and your experience, see which areas and features of our Services are popular, and count visits. Web beacons (also known as “pixel tags” or “clear GIFs”) are electronic images that we use on our Services and in our emails to help deliver cookies, count visits, and understand usage and campaign effectiveness. For more information about cookies and how to disable them, see “Your Choices” below in Section III.
• CCTV recordings: If you visit one of our locations, we or our property management providers may collect your image through CCTV cameras. These cameras are typically installed at entrances and exits and other prominent locations. CCTV recordings are used for safety and security purposes; to monitor and control access to our facilities; to protect company property, inventory, and equipment; to document workplace incidents or accidents for insurance and liability purposes; to ensure the physical safety of employees, visitors, and contractors; to investigate violations of law or company policy; to comply with applicable health, safety, or security regulations; and to otherwise defend our legal interests.
• Call or Video Call Recording: We may record phone calls for quality assurance, training and record-keeping purposes. If you join a video conference call with a member of our personnel (e.g., Teams, Zoom) we may record the call for quality assurance and record-keeping purposes. We will provide you with advanced notice of this recording, where required by law.

3. Personal Information We Derive

We may derive personal information or draw inferences about you based on the information we collect. For example, we may make inferences about your approximate location based on your IP address or infer that you are looking to purchase certain products based on past purchases.

B. Purpose and Use of Personal Information

We may use the categories of personal information identified in “Collection of Personal Information” in Section I.A above for the following purposes:

• Provide, maintain, and improve our products and Services;
• Conduct business dealings with our partners, service providers, or contractors;
• Process transactions and send you related information, including confirmations, receipts, invoices, customer experience surveys, and recall notices;
• Personalize and improve your experience on our Services;
• Send you technical notices, security alerts, and support and administrative messages;
• Respond to your comments and questions and provide customer service;
• Communicate with you about products and special offers provided by Lawson Products and others and provide news and information that we think will interest you (see “Your Choices” in Section III below for information about how to opt out of these communications at any time);
• Improve our marketing and promotional efforts;
• Monitor and analyze trends, usage, and activities in connection with our Services and engage in targeted advertising;
• Detect, investigate, and prevent security incidents and other malicious, deceptive, fraudulent, or illegal activity and protect the rights and property of Lawson Products and others;
• Debug to identify and repair errors in our Services;
• Comply with our legal and financial obligations; and
• Carry out any other purpose described to you at the time the information was collected.
• We may also use aggregated or de-identified information that cannot reasonably be used to identify you. When doing so, we publicly commit to maintain and use the information in an aggregated or de-identified form and not attempt to re-identify the information, unless permitted or required by law.

C. Disclosure of Personal Information

We may disclose personal information in the following circumstances or as otherwise described in this Privacy Policy:

• Our Service Providers, and Contractors: We may disclose your personal information to service providers, contractors, and processors who provide services to us. We may share the following categories of personal information with the following service providers, contractors, and processors:
• We may share your contact and account information, financial and transactional information (including payment card details) and commercial information with our e-commerce and payment processing providers so they may help us carry out transactions on our website and provide related financial and fraud detection services.
• We may share your contact and account information, commercial information, and financial and transactional information with our order fulfillment providers so they may help us process, ship, and deliver your orders.
• We may share website visitor device and usage data and analytics data with our website hosting provider who uses it to host, protect and improve our website.
• Your personal information may be accessible to our cloud software and storage providers, who provide, maintain and troubleshoot our cloud software, such as our customer relationship management platform or workflow automation platform. Similarly, your personal information may be accessible to our data management providers who help us store, organize, and maintain our data systems and records.
• We may share your contact and account information with our survey providers so they may help us administer customer experience and satisfaction surveys on our behalf.
• We may share your contact and account information, commercial information, device and usage information, and inferences we have drawn about you with our marketing and promotions providers so they may help us develop, deliver, and measure the effectiveness of our marketing campaigns and promotional offers. Marketing providers may also process data about you collected from other sources to provide better advertising.
• We may also share your contact and account information and device and usage information with our communications and other technical services providers so they may help us deliver notifications, technical support, and other communications to you.
• We may share CCTV recordings to protect company property and personnel, investigate security incidents, and maintain the safety and security of our locations. We may share these recordings as required by law, including to local law enforcement and fire authorities.
• We may share call and video call recordings with our video conference platform and telecommunications providers so they may help us facilitate, record, and store calls for quality assurance, training, and record-keeping purposes.
• Sold or Shared: We may “sell” or “share” your personal information, as those terms are defined under applicable privacy law, with third-party advertising, marketing, cookie, pixel and tracker providers for analytics, marketing, and cross-context behavioral and targeted advertising. See “Selling or Sharing of Personal Information” in Section V.B below for more information. You can opt-out of “selling” and “sharing” by clicking on our “Do Not Sell or Share My Personal Information” link, which can be found on the footer of our website or here.
• Legal Disclosures: We may disclose personal information if we believe that disclosure is in accordance with, or required by, any applicable law or legal process, including lawful requests by public authorities to meet national security or law enforcement requirements. We may also share personal information if we believe that your actions are inconsistent with our user agreements or policies, if we believe that you have violated the law, or if we believe it is necessary to protect the rights, property, and safety of Lawson Products, our users, the public, or others.
• Disclosed to Advisors and Lawyers: We may disclose personal information with our lawyers and other professional advisors where necessary to obtain advice or otherwise protect and manage our business interests.
• Disclosed During Change of Ownership: We may disclose personal information in connection with, or during negotiations concerning, any merger, sale of company assets, financing, or acquisition of all or a portion of our business by another company.
• Among Our Family of Companies: Personal information may be disclosed between and among our company and current and future parents, affiliates, and subsidiaries and other companies under common control and ownership.
• With Your Consent: We may disclose personal information with your consent or at your direction.
• Disclosure of Non-Personal Information: We may also disclose aggregated or de-identified information that cannot reasonably be used to identify you. When doing so, we publicly commit to maintain and use the information in an aggregated or de-identified form and not attempt to re-identify the information, unless permitted or required by law.

D. Retention of Personal Information

We store personal information for as long as necessary to carry out the purposes for which we originally collected it and for other legitimate business purposes, including to meet our legal, regulatory, or other compliance obligations. Specifically, we will retain your personal information while we have an ongoing relationship with you and during the length of time you maintain an account with us. We may also need to retain your personal information after your relationship with us ends or you close your account if we are subject to a legal obligation to keep the information or if we need to maintain the information for business, tax, or accounting purposes.

II. ANALYTICS AND ADVERTISING

We allow others to provide analytics services and serve advertisements on our behalf across the web and in mobile apps. These entities may use cookies, pixels, web beacons, device identifiers, and other technologies to collect information about your use of our Services and other websites and applications, including your identifiers, internet or other electronic network activity information, approximate location, IP address, web browser, mobile network information, pages viewed, time spent on pages or in mobile apps, links clicked, and conversion information. This information may be used by us and others to, among other things, analyze and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Services and other websites, and better understand your online activity. It may also be used by our advertising partners for retargeted advertising purposes, including to share relevant advertising with you on other websites that you visit.

We also work with third parties to serve ads to you as part of customized campaigns on third-party platforms. As part of these ad campaigns, we or the third-party platforms may convert information about you into a unique value that can be matched with a user account on these platforms to allow us to learn about your interests and serve you advertising that is customized to your interests. Note that the third-party platforms may offer you choices about whether you see these types of customized ads.

III. YOUR CHOICES

A. Account Information

You may update and correct certain account information at any time by emailing us at legal_dept@lawsonproducts.com or calling us toll-free at 1-866-837-9908. If you wish to delete your account, please login and fill out the account deletion form. Please note that after you submit an account deletion request, we may need to retain certain information as required by law or for our legitimate business purposes.

B. Approximate Non-Precise Geolocation Information

When you first launch our mobile apps that collect approximate non-precise geolocation information based on your IP address, you will be asked to consent to the app’s collection of this information. If you initially consent to our collection of such approximate location information, you can subsequently stop the collection of this information at any time by changing the preferences on your mobile device. You may also stop our collection of this information by following the standard uninstall process to remove all of our mobile apps from your device. If you stop our collection of this approximate location information, some features of our Services may no longer function properly. This information may be used, with your consent if required by law, for sending custom events related to our mobile app usage if a user triggers one of the following events: product views, add to cart, checkout completion, customer support submission, order submission, and page view.

C. Cookies

Most web browsers are set to accept cookies by default. If you prefer, you can usually adjust your browser settings to remove or reject browser cookies. You may also accept or reject cookies via the consent banner on our website. Please note that removing or rejecting cookies could affect the availability and functionality of our Services.

D. Communications Preferences

You may opt out of receiving text messages or promotional emails from Lawson Products by following the instructions in those communications or by updating your preferences in your account settings on our website, emailing us at legal_dept@lawsonproducts.com, or calling us toll-free at 1-866-837-9908. If you opt out, we may still send you non-promotional emails, such as those about your account or our ongoing business relations.

E. Mobile Push Notifications

With your consent, we may send push notifications to your mobile device. You can deactivate these messages at any time by changing the notification settings on your mobile device.

IV. CHILDREN

This website is not intended for or directed at children under the age of 18. In addition, we do not knowingly collect personal information from children under the age of 18. We also do not knowingly sell, share, use for cross-context behavioral or targeted advertising, or disclose the personal information of children under the age of 18.

V. YOUR CALIFORNIA RIGHTS

The California Consumer Privacy Act or “CCPA” (Cal. Civ. Code § 1798.100 et seq.) and the Shine the Light law (Cal. Civ. Code § 1798.83) afford consumers residing in California certain rights with respect to their personal information. If you are a California resident, this section applies to you.

A. Summary of Categories of Personal Information Collected and Disclosed

In the preceding 12 months, we have collected the categories of personal information set forth in the table below. For details about the precise data points we collect and the categories of sources of such collection, please see “Collection of Personal Information” in Section I.A above. We collect personal information for the business and commercial purposes described in “Purpose and Use of Personal Information” in Section I.B above. In the preceding 12 months, we have disclosed the following categories of personal information for business purposes to the following categories of recipients, which we also describe in greater detail in “Disclosure of Personal Information” in Section I.C above.

B. Selling or Sharing of Personal Information

Below, we describe the categories of personal information we may “sell” or “share” for cross-context behavioral advertising currently and in the preceding 12 months. We also describe the third parties who received or may receive the personal information and the business or commercial purpose for the sale or sharing. We do not knowingly sell or share the personal information of children under the age of 16, and have not done so in the prior 12 months.

C. Opt-Out Preference Signals and “Do Not Track” Requests

We honor opt-out preference signals. An opt-out preference signal is a signal that is sent by a platform, technology or mechanism on your behalf that communicates your choice to opt-out of the sharing for cross-context behavioral advertising or sale of your personal information.  You can learn more about implementing opt-out preference signals by visiting https://globalprivacycontrol.org/ or by exploring other developing technologies and services that offer this tool.  

We treat opt-out preference signals as valid requests to opt-out of the sale or sharing of your personal information under privacy laws. Ordinarily, your opt-out preference signal is sufficient for us to honor your request, but in some instances we may request additional information to help facilitate your request for offline sales or sharing.  We will not use, disclose or retain this additional information for any purpose other than to facilitate the request. If you communicate an opt-out preference signal, we will also display on our website whether we have processed your request by stating “Opt-Out Request Honored.” Please note that you can also opt-out of the sale or sharing of your personal information through our other methods described in “Instructions on How to Exercise Your Privacy Rights” in Section V.F below.

Some browsers have incorporated “Do Not Track” features. Most of these features, when turned on, send a signal or preference to the websites you visit indicating that you do not wish to be tracked. Because there is not yet a common understanding of how to interpret the do not track signal, we currently do not respond to the browser do not track signals. However, as noted above, we do honor opt-out preference signals.

D. Sensitive Personal Information

Under the CCPA, certain types of personal information are considered “sensitive” personal information and require additional data privacy rights and obligations. We collect account login, account number, and financial and other payment information (e.g., credit card information), which may be considered sensitive personal information under the CCPA. We only collect this sensitive personal information for limited purposes, such as to perform the Services requested; to prevent, detect, and investigate security incidents; to resist malicious, deceptive, fraudulent, or illegal actions and prosecute those responsible; and for other permitted purposes (“Permitted Uses”). Because Lawson Products uses this sensitive personal information for Permitted Uses, there is no need for it to provide a Limit Use and Disclosure of Sensitive Personal Information right under the CCPA.

E. Your Privacy Rights

The CCPA affords consumers residing in California the following rights with respect to their personal information, subject to certain exceptions:

• (1) Right to Delete. You have the right to request us to delete the personal information we have collected about you.
• (2) Right to Correct. You have the right to request us to correct inaccurate personal information we maintain about you.
• (3) Right to Know and Access. You have the right to know and access the personal information we have collected about you, including the categories of personal information, the categories of sources from which the personal information is collected, the business or commercial purpose for collecting, selling, or sharing personal information, the categories of personal information and service providers, contractors and third parties to whom we disclosed personal information, and the specific pieces of personal information we have collected about you.
• (4) Right to Data Portability. You have the right to receive the information under right (3) in a format, to the extent technically feasible, that is portable, usable, and allows you to transmit the personal information to a person without impediment.
• (5) Rights Related to Sharing for Cross-Context Behavioral Advertising or Sale. You have the right to opt out of the sharing of your personal information for cross-context behavioral advertising or the sale of your personal information.
• (6) Rights Related to Sensitive Personal Information. The CCPA provides additional protection for sensitive personal information. Please see “Sensitive Personal Information” in Section V.D above for more information.
• (7) Rights Related to Automated Decisionmaking Technology (“ADMT”). We do not use ADMT to make decisions that result in the provision or denial of financial or lending services, housing, education enrollment or opportunities, employment or independent contracting opportunities or compensation, or healthcare services. As such, there is no need to exercise opt-out and other rights related to ADMT.
• (8) Right to No Discrimination. You have the right not to be discriminated against for exercising any of your privacy rights. This includes us not: (a) denying you goods or services; (b) charging you different prices or rates for goods or services, including through the use of discounts or other benefits or imposing penalties; (c) providing you a different level or quality of goods or services; (d) suggesting to you that you will receive a different price or rate for goods or services or a different level or quality of goods or services; and (e) retaliating against you for exercising your privacy rights.

F. Instructions on How to Exercise Your Privacy Rights

You may exercise your privacy rights by calling our toll-free phone number at 1-866-837-9908 or emailing our Legal Department at legal_dept@lawsonproducts.com. Except for opt-out of sale or sharing requests, we will need to verify your identity before honoring your privacy right request. We will verify your identity by asking you to provide personal information related to your recent interactions with us. We will honor your privacy rights request within 45 calendar days of receipt, unless we request an extension under the CCPA. However, we will honor opt-out of sale and sharing requests within 15 business days.

We will not verify your identity for opt-out of sale or sharing of personal information requests. However, we may ask for information necessary to complete the request, such as information necessary to identify the consumer whose information we will cease to sell or share. You can exercise this right by clicking on the “Do Not Sell or Share My Personal Information” link here and at the footer of our website. You may also enable opt-out preference signals, as described in Section V.C above. If you have any questions, you may also call us at 1-866-837-9908 or email us at legal_dept@lawsonproducts.com.

G. Authorized Agents

If permitted by law, you may exercise your privacy rights through an authorized agent. If we receive your request from an authorized agent, we may ask for evidence that you have provided such agent with a power of attorney or that the agent otherwise has valid written authority to submit requests to exercise rights on your behalf. If you are an authorized agent seeking to make a request, you can call us at 1-866-837-9908 or email us at legal_dept@lawsonproducts.com.

H. Additional Disclosure for California Residents

California law permits residents of California to request certain details about how their information is shared with third parties for direct marketing purposes. Under the law, a business must either provide this information or permit California residents to opt in to, or opt out of, this type of sharing. If you would like to opt out of having information about you shared with third parties for direct marketing purposes, please email us at legal_dept@lawsonproducts.com. You may also exercise the right to opt out of “sale” or “sharing” under the CCPA.

VI. ADDITIONAL NOTICES FOR CANADA

If you are located in Canada, this section is applicable to you.

A. Cross Border Transfers

Your personal information may be collected, used, disclosed, or stored in countries outside of Canada, including the United States. If you are located in Quebec, please note your personal information may be communicated outside of Quebec. Accordingly, your personal information may be accessible to foreign courts, law enforcement, and national security entities. If you have any questions, or wish to receive further written information about our policies and practices with respect to the collection, use, disclosure, or storage of personal information by affiliates or service providers, please contact our Legal Team at legal_dept@lawsonproducts.com.

B. Data Security

We will protect your personal information with safeguards commensurate with the sensitivity of the information. These include physical, organizational, and technical safeguards. Unfortunately, the transmission or storage of personal information via the internet or other electronic means is not completely secure. Therefore, we cannot guarantee the security of your personal information that is transmitted or stored electronically.

C. Roles and Responsibilities

The personal information that we collect is accessible to employees within our organization that need access to perform their duties. These include customer service, marketing and communications, distribution/fulfillment, logistics, finance, IT, legal, and management personnel.

Our Legal Department has overall responsibility for our compliance with applicable privacy laws, including responsibility for the day-to-day administration and implementation of our privacy program, such as by developing and delivering privacy training to relevant personnel, establishing relevant policies and procedures, investigating and responding to complaints and potential violations of our privacy policies or relevant laws, responding to requests from individuals to exercise their rights under applicable privacy laws, and regularly reviewing and identifying opportunities to improve our privacy program.

Our Chief Information Officer is responsible for: preparing and managing our information security program; assisting with breach prevention, response, and containment; and evaluating and implementing information security controls.

All other personnel are responsible for: protecting the confidentiality and security of any personal information they handle in connection with their employment; following our security measures and policies and procedures for handling personal information; refraining from any unauthorized access, use, or disclosure of personal information; and reporting security or confidentiality incidents.

D. Privacy Rights

Depending on your location, you may have certain rights under applicable privacy laws, including the right to access, correct, or delete your personal information. You may also have the right to complain or object to certain uses of your personal information, or receive or transmit a copy of your personal information in a portable format. You may also have the right to withdraw consent where our processing of your personal information is based on consent (as outlined in “Your Choices” in Section III above).

You may exercise your privacy rights by emailing our Legal Department at legal_dept@lawsonproducts.com. In some instances, we will need to verify your identity before honoring your privacy right request. We will typically verify your identity by asking you to provide personal information related to your recent interactions with us, but may also ask to view your identification depending on the nature of your request.

E. Language

Please note that both the English and French versions of this Privacy Policy have equal legal value. The French version of this Privacy Policy is accessible here.

Veuillez noter que les versions anglaise et française de cette politique de confidentialité ont la même valeur juridique. La version française de cette politique de confidentialité est accessible ici.

VII. CONTACT US

If you have any questions about this Privacy Policy or have trouble accessing it because of a disability, please contact us at our email address legal_dept@lawsonproducts.com or our toll-free customer service telephone number 1-866-837-9908.

Please note, our Legal Team has overall responsibility for our privacy compliance program. They can be contacted at legal_dept@lawsonproducts.com.