Supplemental Privacy Policy and Notice at Collection for California and Nevada Residents

Last updated on: July 14, 2026

This Supplemental U.S. State-Specific Privacy Policy and Notice at Collection (hereinafter referred to as the “State-Specific Privacy Notice”) supplements the information in our Privacy Policy, available at https://usa.h-f.group/state-specific-privacy-notice (the “Privacy Policy”), and contains disclosures that the California Consumer Privacy Act of 2018 (“CCPA”) as amended by the California Privacy Rights Act of 2020 (“CPRA”) and such other data protections laws in California (collectively, the “California Law”), and/or Chapter 603A of the Nevada Revised Statutes (“Nevada Law”) may require from us, Herbstreith & Fox, Inc. (“H&F”, “We” or “Us”) with respect to Personal Information collected from residents of the State of California, the Commonwealth of Virginia, and the State of Nevada.

For general information on our privacy practices, please refer to the Privacy Policy. Unless otherwise specified, Section 1 of this State-Specific Privacy Notice applies to California residents only, and Section 2 of this State-Specific Privacy Notice applies to Nevada residents only. This State-Specific Privacy Notice is incorporated in the Privacy Policy hereby by reference. Capitalized terms not defined in this State-Specific Privacy Notice shall have the meaning assigned to them in the Privacy Policy.

1. California

This Section 1 reflects California Law as amended through the date set forth above, including regulations adopted by the California Privacy Protection Agency (“CPPA”) effective January 1, 2026, as well as those governing automated decision-making technology (compliance required by January 1, 2027 for certain uses) and the California Opt Me Out Act, effective January 1, 2027.

1.1. Collected Personal Information

Below is a chart containing categories of Personal Information under the California Law that we have collected within the last twelve (12) months and may continue to collect. Opposite each category of Personal Information, you will also see (i) the purpose of the collection of such Personal Information, (ii) the category of third parties to whom we disclosed/may disclose such Personal Information for a business purpose, and (iii) the length of the retention period.

Category	Examples	Use/Purpose of Collection	Category of Third Party	Retention Period
Identifiers	Name, email address	All the purposes mentioned in the Section “For which purposes do we collect your Personal Information?” of the Privacy Policy (https://usa.h-f.group/privacy-policy/)	Please see Section “To whom do we disclose your Personal Information” under Section 1 of the Privacy Policy	Please see Section “How long does H&F store/retain your Personal Information?” of the Privacy Policy (https://usa.h-f.group/privacy-policy/)
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	Name	All the purposes mentioned in the Section “For which purposes do we collect your Personal Information?” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy/)	Please see Section “To whom do we disclose your Personal Information” under Section 1 of the Privacy Policy	Please see Section “How long does H&F store/retain your Personal Information?” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy/)

Note, however, that the companies in the H&F group may disclose Personal Information to each other and process such disclosed Personal Information for all the purposes mentioned in Section “For which purposes do we collect your Personal Information” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy/).

Please refer to the Section “How do we collect your Personal Information?” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy/) for information on the sources from which we collect your Personal information.

California Law deems IP addresses as Personal Information. Note, however, that, as mentioned under (ii) of the Section “How do we Collect your Personal Information?” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy/), the IP addresses we collect are anonymized and de-identified.

1.2. Collected sensitive Personal Information

We have not collected any Sensitive Personal Information as defined in the California Law (“Sensitive Personal Information”) in the preceding twelve (12) months and we do not intend to collect such information on and after the date of this State-Specific Privacy Notice.

1.3. Sale and Sharing of Personal Information

We do not “sell” or “share” Personal Information (nor Sensitive Personal Information) as such activities are defined in the California Law.  Accordingly, we do not engage in cross-context behavioral advertising or targeted advertising using your Personal Information.

However, please note that we are using analytical cookies, which only collect de-identified data with your consent. For more information, please see Section 3 of the Privacy Policy (

Automated Decision-Making Technology. Effective January 1, 2026, California Law provides consumers with the right to opt out of, and in certain circumstances to access information about, a business’s use of Automated Decision-Making Technology (“ADMT”).  ADMT is identified as any technology that processes Personal Information and uses computation to execute a decision, make a recommendation, or facilitate human decision-making that produces legal or similarly significant effects. We do not currently use ADMT to process your Personal Information in ways that produce legal or similarly significant effects, including for profiling purposes. If this practice changes, we will update this State-Specific Privacy Notice and provide the required disclosures at or before the point of collection.

Data Broker / DELETE Act. We are not registered as a data broker with the California Privacy Protection Agency.

1.4. Your Rights and Choices

California Law provides the specific rights listed below to California residents regarding their Personal Information. This Section 1.4 describes your rights under California Law and explains how to exercise these rights.

1.4.1. Right to Know and Right to Access

You have the right to request that we disclose certain information to you about our collection and use of your Personal Information. Once we receive your request and confirm your identity (see Section 1.5 of this State-Specific Privacy Notice), we will disclose to you:

• The categories of Personal Information we collected about you;
• The categories of sources from which we collected Personal Information about you;
• Our business or commercial purpose for collecting, disclosing, “selling” or “sharing” of such Personal Information;
• The categories of Personal Information we disclosed about you for a business purpose and the categories of third parties to whom such Personal Information was disclosed for a business purpose; and
• The categories of Personal Information that we “sold” or “shared” about you and the categories of third parties to whom your Personal Information was “sold” or “shared”, by category or categories of Personal Information for each category of third parties to whom the Personal Information was “sold” or “shared”; and/or
• The specific pieces of Personal Information we collected about you.

1.4.2. Right to Delete

You have the right to request that we delete any of your Personal Information that we have collected from you and retained, subject to certain exceptions. Once we receive your request and confirm your identity (see Section 1.5 of this State-Specific Privacy Notice), we will review your request to see if an exception allowing us to retain the Personal Information applies.

We may deny your deletion request if retaining the Personal Information is necessary for us or our service provider(s) to:

• Complete the transaction for which we collected the Personal Information, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service that you requested or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
• Help to ensure security and integrity to the extent the use of your Personal Information is reasonably necessary and proportionate for those purposes;
• Debug to identify and repair errors that impair existing intended functionality;
• Exercise free speech, ensure the right of another consumer to exercise their right of free speech, or exercise another right provided for by law;
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 of Title 12 of Part 2 of the Penal Code (Cal. Penal Code § 1546 et. seq.);
• Engage in public or peer-reviewed scientific, historical, or statistical research that adheres to all other applicable ethics and privacy laws, when our deletion of the Personal Information is likely to render impossible or seriously impair the ability to complete such research, if you previously provided informed consent;
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us and compatible with the context in which you provided the information; and/or
• Comply with a legal obligation.

We will then delete or de-identify Personal Information not subject to one of these exceptions from our records and will direct our service providers, contractors and third parties to whom we have sold or shared your Personal Information to take similar action, unless this proves impossible or involves disproportionate effort. However, we may maintain a confidential record of your deletion request solely for the purpose of preventing your Personal Information from being sold, for compliance with laws for other purposes permissible under California Law.

1.4.3. Right to Correct

You have the right to request that we correct your Personal Information if you think they are inaccurate, taking into account the nature of the Personal Information and the purposes of the processing of the Personal Information. Once we receive your request and confirm your identity (see Section 1.5 of this State-Specific Privacy Notice), we will use commercially reasonable efforts to correct your inaccurate Personal Information and will direct our service providers to do the same.

1.4.4. Right to Opt-Out of Sale or Sharing

California Law provides its residents with a right to out-out of sale of sharing of Personal Information. However, we do not currently sell or share Personal Information triggering California Law’s opt-out requirements.

1.4.5. Right to limit Use and Disclosure of sensitive Personal Information

California Law provides its residents with a right to limit the use and disclosure of Sensitive Personal Information. However, we do not currently collect, use or disclose Sensitive Personal Information triggering California Law’s opt-out requirements.

1.4.6.  Right to Opt-Out of Automated Decision-Making Technology (ADMT)

Effective January 1, 2026, California Law grants consumers the right to opt out of a business’s use of ADMT when such technology is used to process their Personal Information in furtherance of decisions that produce legal or similarly significant effects. We do not currently use ADMT in a manner that triggers this right. If we begin using ADMT for covered purposes, we will provide the required notice and opt-out mechanism before or at the point of collection.

1.4.7. Right to Opt-Out via Universal Opt-Out Mechanismus

Effective January 1, 2026, California Law requires businesses that sell or share Personal Information to recognize universal opt-out preference signals, including the Global Privacy Control (“GPC”). Because we do not currently sell or share Personal Information as defined by California Law, we do not process GPC signals at this time. If our data practices change, we will implement GPC recognition and update this Section accordingly. We encourage users who wish to send a GPC signal to continue doing so, as it signals your preferences to other businesses that may sell or share your Personal Information.

1.4.8. Other California Privacy Rights

California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our Website that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please send an email to usa@herbstreith-fox.com or write to us at: Herbstreith & Fox, Inc., 570 Taxter Road, Elmsford, NY 10523. Our policy is not to disclose any Personal Information to a third party for their direct marketing purposes without your approval.

Data Breach Notification. In the event of a qualifying data breach affecting California residents, we will notify affected individuals within thirty (30) days of discovering the breach, and will notify the California Attorney General within fifteen (15) days when more than five hundred (500) California residents are affected.

1.5. Exercising your Rights under California Law

You may exercise your rights mentioned above as follows:

• To exercise your rights to know, access, delete or correct described above, please submit a request by either:
  • Calling us at 914-345-9501 (toll-free);
  • Emailing us at usa@herbstreith-fox.com; or
  • Via our contact form: https://usa.h-f.group/contact.
• To exercise your rights pursuant to California’s “Shine the Light” law, please submit a request by either
  • Emailing us at usa@herbstreith-fox.com; or
  • Writing us at Herbstreith & Fox, Inc., 570 Taxter Road, Elmsford, NY 10523.

Only you, or someone legally authorized to act on your behalf, may make a request related to your Personal Information. You may also make a request on behalf of your minor child. In such case, you must provide sufficient information to allow us to reasonably verify your child is the person about whom we may have inadvertently collected Personal Information and you are authorized to submit the request on your child’s behalf (i.e., you are the child’s legal guardian or authorized representative).

You may only submit a request to know twice within a 12-month period and a request pursuant to California’s “Shine the Light” law once during the course of a calendar year.

Your request related to Personal Information must:

• Provide sufficient information or documentation that allows us to reasonably verify whether you are the person about whom we collected Personal Information or an authorized representative. Such information or documentation may include:
  • Certain Personal Information about you that we have on file (e.g., postal address) or information related to the purchases you made on the Website; or
  • Certain information or certification showing your authority or relationship to the person on whose behalf you are submitting the request.
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request related to Personal Information or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you or the person on whose behalf you are submitting the request.

We will only use Personal Information provided in the request to verify the requestor’s identity or authority to make it.

1.6. Response Timing and Format

We will respond to verifiable consumer requests within forty-five (45) days of receipt. If we require more time (up to an additional forty-five (45) days), we will inform you of the reason and extension period in writing within the first forty-five (45) day period. Any disclosures we provide will cover only the twelve (12)-month period preceding receipt of your request, unless you request a specific period. We will deliver our response electronically, unless you request otherwise. We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded.

For requests under California’s Shine the Light Law, we will respond within thirty (30) days of receipt of your request.

1.7. Appealing Privacy Rights Decisions

You may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted via email to usa@herbstreith-fox.com. We will respond to your appeal within forty-five (45) days of receipt.  You may appeal a decision we have made in connection with your privacy rights request by submitting an appeal via email to usa@herbstreith-fox.com or via our contact form at https://usa.h-f.group/contact. If we deny your appeal, we will provide you with an explanation of the reasons for our decision and information on how to contact submit a complaint to the CPPA. You may contact the CPPA at: https://cppa.ca.gov/consumers/ or file a claim with the Attorney General via this link: https://oag.ca.gov/contact/consumer-complaint-against-business-or-company.

2. Nevada

Please refer to the “Which Personal Information do we collect from you?” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy) and Section 1.1 of this State-Specific Privacy Notice for the categories of Personal Information that we collect and Section “To whom do we disclose your Personal Information?” under Section 1 of the Privacy Policy (https://usa.h-f.group/privacy-policy) for the categories of third parties with whom we may share such Personal Information.

If you wish to review or request changes to any of your Personal Information we collect, please contact us via any of the methods mentioned in Section 5 of this State-Specific Privacy Notice.

We do not conduct targeted advertising, cross-context behavioral advertising and profiling.

Nevada Law provides its residents with a limited right to opt-out of certain personal information sales. However, we do not currently sell Personal Information triggering Nevada Law’s opt-out requirements.

You may be able to appeal a decision we have made in connection with your privacy rights request. All appeal requests should be submitted via email to usa@herbstreith-fox.com.

3. Changes to our Privacy Policy

We reserve the right to amend this State-Specific Privacy Notice at our discretion and at any time. When we make changes to this State-Specific Privacy Notice, we will post the updated notice on the Website and update the notice’s effective date. Your continued use of our Website following the posting of changes constitutes your acceptance of such changes.

4. Contact Information

If you need to access this State-Specific Privacy Notice in an alternative format due to a disability, if you have any questions or comments about this notice, the ways in which H&F collects and uses your information described here and in the Privacy Policy (https://usa.h-f.group/privacy-policy), or your choices and rights regarding such use, or if wish to exercise your rights under the state laws set forth in this State-Specific Privacy Notice, please contact us at:

Email:                                 usa@herbstreith-fox.com;

Online contact form:      https://usa.h-f.group/contact;

Phone:                                914-345-9501 (toll-free); or

Postal Address:                Herbstreith & Fox, Inc., 570 Taxter Road, Elmsford, NY 10523.