Executive Summary Key Highlights

• Data we collect: contact information, billing and shipping details, payment information (processed by third-party payment processors), account credentials, and technical/usage data (IP address, device, browser, pages visited).
• Sensitive data: We do not intentionally collect sensitive personal information.
• Third parties: We share data with service providers for payments, hosting, shipping, analytics, and marketing; we do not sell personal information.
• Purpose: We process data to deliver orders, provide customer service, improve our website and packaging services, prevent fraud, and comply with legal obligations.
• Security: We implement reasonable administrative and technical safeguards to protect personal data.
• Rights: Depending on your jurisdiction, you may have rights to access, correct, delete, restrict, or port your personal information.

Information We Collect

Information You Provide

1. When you contact us, request a quote, create an account, or purchase packaging services, we may collect:

• Identifiers and contact details: full name, company name, email address, phone number, billing and shipping addresses
• Transaction data: order information, invoices, payment instrument details (processed by our payment partners)
• Account credentials and communication preferences
• Content you provide in messages, inquiries, or uploads (e.g., logo files or artwork)

Automatically Collected Information

We automatically collect technical and usage information including:

• IP address, device type, browser version, operating system
• Pages visited, referral source, time spent on pages, and interaction data

Sensitive Data

We do not intentionally collect special categories of personal data (such as racial, health, or biometric information). If you voluntarily submit such information, we will handle it in accordance with applicable law.

Payment Processing

Payments are processed through secure third-party payment processors. We do not retain full payment card numbers on our servers except as authorized by and secured through those processors.

1. Purposes for Processing Personal Data We use personal information to:

• Provide and fulfill orders for custom boxes, printed packaging, and related services
• Communicate about orders, samples, quotes, and customer support requests
• Send administrative notices and transactional communications
• Deliver marketing communications where you have consented or not opted out
• Improve our website, products, packaging design services, and digital printing capabilities
• Detect and prevent fraud, security incidents, and other prohibited activities
• Comply with legal obligations and exercise our legal rights

Legal Bases for Processing (EU/UK) For individuals in the European Economic Area or the UK, we process personal data on one or more of the following legal grounds:

• Performance of a contract: processing necessary to fulfill your order or provide requested services
• Legitimate interests: for fraud prevention, site operation, and business administration (balanced against your rights)
• Consent: where you have given explicit permission for specific processing activities (e.g., marketing)
• Legal obligations: to comply with applicable laws or regulatory requirements

Disclosure and Sharing of Personal Information We may share personal information with:

• Service providers and vendors who support our operations (payment processors, hosting providers, shipping partners, analytics and marketing platforms)
• Legal and governmental authorities when required to comply with law or protect rights
• Successors or third parties in connection with a corporate transaction such as a merger, acquisition, or sale
• Other parties with your consent or direction

We do not sell personal information for monetary consideration.

Links to Third-Party Sites

Our website may link to external websites or integrate third-party tools. We are not responsible for their privacy practices. Review third-party privacy policies before submitting personal data to them.

Cookies and Tracking Technologies

We use cookies, pixels, and similar technologies to collect information about your browsing behavior, remember preferences, and improve site functionality. You can manage cookie preferences via your browser settings. For details on cookies we use and how to opt out, refer to our Cookie Notice.

International Transfers

Our systems and service providers may transfer and process data in the United States and other jurisdictions. When data is transferred internationally, we implement appropriate safeguards to protect personal information in accordance with this Policy and applicable law.

Data Retention

We retain personal information only as long as necessary to fulfill the purposes outlined in this Policy, to comply with legal obligations, or to resolve disputes. Retention periods vary by data type; transactional records are typically retained for tax and accounting requirements, while support correspondence is retained for a limited operational period.

Security Practices

We maintain administrative, technical, and physical safeguards designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. Examples include access controls, encryption where appropriate, and periodic security assessments. No security system is impenetrable; we cannot guarantee absolute protection.

Children’s Privacy

Our Services are not directed to children under 18. We do not knowingly collect personal information from minors. If we become aware that we have collected personal information from someone under 18 without parental consent, we will take steps to delete that information.

Your Privacy Rights and Choices

Depending on your jurisdiction, you may have rights including:

• Access: request a copy of the personal information we hold about you
• Correction: request correction of inaccurate or incomplete personal data
• Deletion: request deletion of your personal data, subject to legal exceptions
• Restriction/Objection: request restriction of processing or object to certain uses
• Portability: request transfer of your personal data in a structured, machine-readable format
• Opt-out: unsubscribe from marketing communications

To exercise these rights, contact us at info@custompackagingmakers.com or call (512) 355-5666. We will verify your identity prior to fulfilling requests and will respond in accordance with applicable law.

Do-Not-Track Signals

We do not currently act on browser Do-Not-Track signals due to the absence of an accepted industry standard. If that changes, we will update this Policy.

Rights for Residents of Specific U.S. States

Residents of certain U.S. states (including California, Colorado, Connecticut, Utah, and Virginia) have additional statutory rights. These rights may include the ability to request disclosure, deletion, and opt out of sale or targeted advertising. To submit a request, contact info@custompackagingmakers.com. We will follow applicable verification procedures before responding.

California residents: You may request, once per 12-month period, information about the categories of personal data disclosed to third parties for direct marketing purposes.

Updates to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or legal requirements. Material changes will be indicated by an updated “Last updated” date and, when appropriate, additional notice. Continued use of our Services after posting changes constitutes acceptance of the updated Policy.

Contact Information

If you have questions about this Policy or wish to exercise your privacy rights, contact:

Custom Packaging Makers

Email: info@custompackagingmakers.com

Phone: (512) 355-5666

• 5900 Balcones Drive STE 10 Austin, TX 78731

Accessing, Correcting, or Deleting Your Data

To review, update, or request deletion of your personal information, submit a data subject request by emailing info@custompackagingmakers.com or calling (512) 355-5666. We will respond in accordance with applicable legal timelines and may request information to verify your identity before fulfilling the request.