California Residents Data Privacy

Last Modified: July 10, 2026

Introduction

National Gypsum Services Company d/b/a National Gypsum Company and each of our Affiliates, as defined below (collectively, "we," "us," or "our") respects your privacy and is committed to protecting it through our compliance with this Privacy Policy ("Policy"). This Policy describes the types of information we may collect from you or that you may provide to us, and our practices for collecting, using, maintaining, protecting, and disclosing that information, including when you visit any of our and/or our Affiliates’ websites (including any successor URLs, sub-domains, and/or any syndications thereof, collectively, our "Websites"), including without limitation:

• https://www.nationalgypsum.com
• https://www.goldbondbuilding.com
• https://www.permabase.com
• https://www.proformfinishing.com
• https://www.askforpurple.com
• https://www.ngc4me.com
• https://unifix.ca

This Policy covers us and each of our affiliates, including without limitation, Gold Bond Building Products, LLC, ProForm Finishing Products, LLC, and PermaBASE Building Products, LLC (our "Affiliates").

In addition to any other applicable provisions of this Policy, if you are a resident of California, you may have additional rights pursuant to state law. Additional information regarding those rights can be found in the section titled “CALIFORNIA RESIDENTS”, which serves as our Notice at Collection for purposes of the California Consumer Privacy Act of 2018 (the “CCPA”). Further, if you are located in Canada, information regarding any additional rights you may have pursuant to Canadian laws can be found in the section titled “CANADA” below.

This Policy applies to any information we collect through our Websites, including any information in any e-mails, posts, texts, and other electronic messages between you and our Websites, and any information about you transferred to our Websites from other websites. This Policy also applies to any information we collect about you when you mail us or e-mail, text or exchange other electronic messages with us or when you interact with messages you receive from us, and any information we collect from you offline but that will be processed by automated means using our Websites.

Please read this Policy carefully to understand our policies and practices regarding your information and how we will treat it. If you do not agree with our policies and practices, you can choose not to use our Websites. By accessing or using our Websites, you agree to this Policy. This Policy may change from time to time. When we make changes to this Policy, we will post the updated Policy on our Websites and update the Policy's "Last Modified" date above. We will also provide notice of any material changes as explained in the section below titled "Changes to Our Privacy Policy." Your continued use of our Websites after we make changes is deemed to be acceptance of those changes.

Information Collected About You and How It Is Collected

Personal Information We Collect

We may collect several types of information from and about users of our Websites. This information may include information by which users may be personally identified or other information about a user to the extent maintained in personally identifiable form (collectively "Personal Information"). Specifically, we (or our third-party service providers acting on our behalf) may collect the following from you:

• Personal identifiers and contact information, such as your name, postal or billing address, e-mail address, telephone number, IP Address or Mobile Device ID, and account or user name ("Identifiers").

• Commercial information, including products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies ("Commercial Information").

• Information related to the Internet or other similar network activity, including browsing history, search history, information on your interaction with our Websites, or advertisements on our Websites ("Internet Activity").

With the exception of your IP address or mobile device ID (which we collect automatically as you navigate through or interact with our Websites, as described below in the section titled "Traffic, Usage and Computer/Device Information"), we collect this information directly from you when you provide it or submit it to us directly in connection with registering an account on the Websites, placing an order for products on the Websites, contacting us for customer service inquiries or reporting a problem with our Websites, or otherwise contacting us about our Websites or our products and services.

Traffic, Usage and Computer/Device Information

Additionally, as you navigate through and interact with our Websites, we may automatically collect certain traffic data, usage information, and information about your computer equipment or mobile device, such as your browser and operating system, your wireless carrier, configuration data, clickstream analytics and your actions and patterns when you use our Websites. The technologies we use for this automatic data collection may include cookies that are stored on the browser of your computer or mobile device, small embedded electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single- pixel gifs), and other types of embedded code. We collect this information: (i) to manage our content and improve users' use of our Websites; (ii) to count and review the number of users of our Websites and their usage patterns; (iii) to track key performance indicators such as pages accessed, frequency of access, and other statistical information related to our Websites (for example, recording the popularity of certain content and verifying system and server integrity); (iv) to identify the portion of users who accesses our Websites via different web browsers; (v) to recognize if a user is a returning user of our Websites; (vi) to store information about a user's visits; (vii) to remember a user's preferences; (viii) to create user profiles to assist with personalized advertisements and marketing campaigns; and (ix) for similar purposes in connection with monitoring, maintaining and improving our Websites.

Please see the section below titled “Cookies” for additional information.

How We Use Your Information

Generally

We may use the information we collect about you or that you provide to us, including Personal Information, to:

• Provide our Websites, services, and products and their contents to you.

• Fulfill your orders for our products.

• Provide you with information, products, or services you request from us.

• Process your requests, purchases, and transactions via the Websites or otherwise.

• Create, maintain, customize, and secure your account with us.

• Authenticate or otherwise verify your identity in connection with your requests, purchases, transactions, and payments via the Websites or otherwise.

• Provide you with support and respond to your inquiries and customer service and support requests, including investigating and addressing your concerns and to monitor and improve our responses.

• Provide you with informational and promotional content and materials regarding the Websites and our products and services offered through the Websites.

• Provide you with informational and transactional text message alerts and e-mail communications.

• Advertise to third parties with similar interests, hobbies, or demographic information as you.

• Help maintain the safety, security, and integrity of our Websites, databases, and other technology assets and our business.

• Perform research and development activities, which may include, for example, conducting data analyses in order to develop new products and services or to improve existing products and services, and performing quality-control activities.

• Update and maintain customer, subscription, or e-mail lists.

• Create a profile about you reflecting your personal preferences and, if applicable, purchasing behavior.

• Learn more about your personal preferences and suggest products, services and other information that may be of interest to you and generally improve your use of the Websites, including through the use of artificial intelligence tools and models

• Notify you about changes to our Websites, products, and services.

• With respect to automatically collected traffic, usage, and device information, fulfill the purposes described in the section above titled "Traffic, Usage and Computer/Device Information".

• Respond to lawful requests for information through court orders, subpoenas, warrants, and other legal processes or obligations.

• Enforce any contracts between you and us, including for billing and collection, or for the establishment, exercise, or defense of legal claims.

• Evaluate or conduct a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of our assets, whether as a going concern or as part of a bankruptcy, liquidation, or similar proceeding, in which information (including Personal Information) held by us is among the assets transferred.

• Fulfill any other purpose for which you provide the information.

• Serve any other purpose that we describe when you provide the information and for any other purpose with your consent.

Aggregated or De-Identified Data

We may convert or combine Personal Information of users into de-identified or aggregated data. We may use and disclose to third-parties any such de-identified or aggregated data (including traffic and usage data that does not identify you personally) for any lawful purpose.

Disclosure of Your Information

We only permit collection and use of your information (including Personal Information) internally by our own personnel, except in the following circumstances:

• We may disclose your information to any contractors, service providers and other third-parties who need to know such information to provide services to us, including those that support our hosting, maintenance, operation, and promotion of our Websites and our permitted uses of Personal Information under this Policy. For example, we may use a third-party cloud-hosting infrastructure service provider (e.g., Amazon Web Services, Google Cloud, or Microsoft Azure) to store certain of your information, a provider of customer relationship management software to organize and track our communications with you, certain third-party advertising service providers, and third-party website analytics providers.

• We may disclose your information to a buyer or other successor to our business in the event of a sale of equity or assets, reorganization, merger, bankruptcy or a similar corporate transaction, and any due diligence review with respect to any such proposed transaction. We may disclose all forms of information described above under these circumstances.

• We may disclose your information to comply with any court order, law, or legal process, including to meet national security and law enforcement requirements and to respond to any government or regulatory request or audit.

• We may disclose your information to enforce or apply any legal agreements between us and you, including our Terms and Conditions of Sale, or if we believe disclosure is necessary or appropriate to protect the rights, property, or safety of our customers or others.

• We may also disclose your information for any purpose disclosed when the information is provided, and for any other purpose with your consent.

• We may disclose all forms of information for the purposes described above, including Identifiers, Commercial Information, Internet Activity, except for your payment information (which is collected directly from you and processed by our third-party payment processor only and such information is not shared with us or any other party).

Cookies

Our Websites use "cookies" and similar mechanisms to collect certain data from the computer or mobile device you use to access our Websites.

• "Cookies" are data files that are placed on your device or computer and often include an anonymous unique identifier. For more information about cookies, and how to disable cookies, visit: http://www.allaboutcookies.org.

• "Web beacons," "tags," and "pixels" are electronic files used to record information about how you browse our Websites.

Why Do We Use Cookies?

Cookies allow us to serve you better. They allow us to know if your computer or device has visited our site before. Cookies can be used to help understand how our site is being used, help you navigate between pages efficiently, help remember your preferences, allow us to improve our Websites, and generally Improve your browsing experience.

How Long Will Cookies Stay On Your Device?

The length of time a cookie will stay on your computer depends on whether it is a "persistent" or "session" cookie. Session cookies will only stay on your device until you stop browsing. Persistent cookies stay on your device until they expire or are deleted.

First Party and Third-Party Cookies

First-party cookies are cookies that belong to us; third-party cookies are cookies that third-parties place on your device through our Websites. Third-party cookies may be placed on your device by someone providing a service for us, for example to help us understand how our Websites are being used. For example:

• Google Analytics. We use Google Analytics to collect and process statistical data about the number of people using our Websites and to better understand how they find and use our Websites. The data collected includes data related to your device/browser, your IP address, and your activities on our Websites to measure and report statistics about user interactions. Any data that is collected is used in accordance with this Policy and Google’s Privacy Policy, which can be found here. To opt-out of Google Analytics, click here and install the opt-out browser ad-on feature. For more information, visit the Google Analytics Opt-Out Browser Add-On page, located here.

• Google Tag Manager. We use Google Tag Manager, which allows website tags to be managed using an interface. The tool itself (which implements the tags) does not use cookies and does not register identifiable data. However, the tool causes other tags to be activated which may, for their part, register personal data under certain circumstances. Google Tag Manager does not access this information. Google Tag Manager is subject to Google’s Privacy Policy, located here.

• Microsoft Advertising. We use Microsoft Advertising to serve advertisements in response to keywords entered into search engines, such as Bing. To opt out of the Microsoft Advertising optimization program, please click here. To opt out of personalized ads, please click here. The Microsoft Bing Ads Privacy Policy is available here.

• LinkedIn. We use LinkedIn’s technologies for analytics and to add tags to our Websites to allow for conversion tracking of LinkedIn ad campaigns. These tools allow us to learn about user activity and LinkedIn audiences, find trends in user engagement, and analyze trends within these groups. For more information on LinkedIn’s marketing technologies and to view LinkedIn’s Privacy Policy, please click here. You can opt-out of LinkedIn Ads by clicking here.

• Facebook (Meta) Pixel. We use Meta Pixel to customize and display advertisements only to Facebook users who have shown an interest in our Websites or who have specific characteristics (e.g., certain demographics or interests in certain topics or products determined by websites visited) that we submit to Facebook. The use of Meta Pixel helps ensure that our advertisements are in line with the potential interests of users and do not have a nuisance effect. Meta Pixel also allows us to track the effectiveness of Facebook advertisements for statistical and market research purposes by seeing whether users have been redirected to our Websites after clicking on a Facebook advertisement. The Meta Pixel is directly integrated into our Websites by Meta and can store a cookie on your device. The information collected about you is anonymous to us. However, information collected via Meta Pixel, on our Websites as well as other websites on which Meta Pixel is also installed, is also stored and processed by Meta. Meta may link this information to your Facebook account and also use it for its own promotional purposes in accordance with Facebook’s Data Usage Policy. You can learn more about Facebook’s policies, and find instructions for opting out of receiving advertisements, by clicking here.

• HubSpot. We use HubSpot to collect, monitor, and analyze navigational information from your web browser, your IP address, and the actions you take on our Websites, such as the web pages viewed and the links clicked, to increase the functionality of our Websites and our services. To opt out of HubSpot’s processing of your information for analytics purposes, please click here. For more information on the privacy practices of HubSpot, please visit the HubSpot Privacy Policy available here.

• YouTube. We may use tracking technologies provided by YouTube as part of our services and/or embed YouTube videos on our Websites. These technologies enable us to understand and improve our marketing efforts, track the performance of video content we have, and provide you with a more personalized experience. With respect to YouTube videos embedded on our Websites, no data about you will be transferred to YouTube if you do not play the videos. YouTube may collect information relating to your visit to our Websites, including the referring IP address, device, and pages you accessed on our Websites. Additional information on the purpose and scope of data collection and processing by YouTube can be found by viewing YouTube/Google’s Privacy Policy here. By viewing any videos embedded on our Websites or as part of our services, you consent to the disclosure of your information to YouTube through its tracking technologies.

What Are Your Choices Regarding Cookies?

Your browser may allow you to delete cookies or refuse to accept them. Please note, however, that if you delete cookies or refuse to accept them, you might not be able to use all the features we offer, you may not be able to store your preferences, and some pages might not display properly.

Do Not Track

Our Websites do not respond to any "do not track" signals sent by your computer, browser, or mobile device, and if your computer, browser, or mobile device sends a "do not track" signal to our Websites, our Websites will not treat you differently from users who do not send such signals.

Your Rights and Choices

If you do not wish to have your Personal Information used by us to contact you for marketing or promotional purposes, you can opt-out by clicking on the "Unsubscribe" or similar link in the most recent e-mail you received from us and by following the prompts that appear. This opt-out does not apply to information provided as a result of a product purchase, product service experience, or other transactions (e.g., an order confirmation).

Users Outside of the United States

Our Websites are hosted in the United States and are provided from the United States. It is possible that certain information will be stored on servers in multiple other countries on the "cloud" or other similar distributed hosting platforms. If you are a resident of any country other than the United States, please note that by providing your Personal Information to us, you are consenting to the transfer of your Personal Information to the United States and other jurisdictions and to our use and disclosure of your Personal Information in accordance with this Policy.

Third-Party Websites

Our Websites may include links to blogs, social media, and third-party Websites. These third-party sites have their own privacy policies and terms of use and are not controlled by this Policy. You should carefully review any terms, conditions, and policies of such third-party sites before visiting them or supplying them with any Personal Information. If you follow a link on our Websites to any third-party site, any information you provide to that site will be governed by its own terms of use and privacy policy and not this Policy. You may be able to use social media widgets (e.g., the Facebook "Like" button) while using our Websites. These widgets will collect your IP Address and identify which page you are visiting on our Websites and make your preference information available to third parties. The information collected by such widgets is controlled by third-party privacy policies.

We are not responsible for the privacy or security of any information you provide to third-party Websites, or the information practices used by any third-party site, including links to any third-party site from our Websites. We make no representations, express or implied, concerning the accuracy, privacy, safety, security, or the information practices of any third-party site. The inclusion of a link to a third-party site on our Websites does not constitute any type of endorsement of the linked site by us. We are not responsible for any loss or damage you may sustain resulting from your use of any third-party Websites or any information you share with third-party Websites.

Children Under the Age of 16

Our Websites are not intended for children under 16 years of age, and we prohibit anyone under the age of 16 from providing any information to us or others on or using our Websites.

We do not knowingly collect, sell or share Personal Information from children under the age of 16. If you are under 16 years of age, do not use our Websites or provide any information about yourself to us, including your name, address, telephone number, email address, IP address or mobile device ID, or any screen name or username you may use. If we learn we have collected Personal Information from a child under 16 years of age without verification of parental consent, we will delete that information. If you believe we might have collected any information from or about a child under the age of 16, please contact us at privacy@nationalgypsum.com.

Data Security

We have implemented measures designed to secure your Personal Information from loss and from unauthorized access, use, alteration, and disclosure.

The safety and security of your information also depends on you. When we have given you (or when you have chosen) a password for access to certain parts of our Websites, you are responsible for keeping that password confidential. We ask you not to share your password with anyone. Unfortunately, the transmission of information over the Internet is not completely secure. Although we have implemented security measures that we think are adequate, we cannot guarantee the security of your Personal Information transmitted to or using our Websites. Any transmission of Personal Information is at your own risk. We are not responsible for the circumvention of any privacy settings or security measures contained on our Websites.

Retaining and Disposing of Information

Your Personal Information is maintained on our networks or on the networks of our service providers. Your information may also be stored in a secure off-site storage facility. We retain Personal Information only as long as it is needed to fulfill the identified purposes, or as may be required to comply with applicable laws or our information retention policies. Thereafter, such information is destroyed, erased or made anonymous using commercially reasonable methods. To determine the appropriate retention period for Personal Information, we consider the amount, nature, and sensitivity of the Personal Information, the potential risk of harm from unauthorized use or disclosure of your Personal Information, the purposes for which we process your Personal Information and whether we can achieve those purposes through other means, and the applicable legal requirements. If we convert or combine Personal Information into de-identified or aggregated data, we may retain it indefinitely, as permitted under applicable law.

CALIFORNIA RESIDENTS

If you are a California resident, we are required to tell you certain things about your Personal Information and your rights regarding your Personal Information. This notice serves as our Notice at Collection for purposes of the CCPA.

In addition to the information set forth in the sections of the Policy titled “Information Collected About You and How It Is Collected” and “How We Use Your Information”, the table below sets forth: (i) the categories of personal information we have collected within the preceding twelve (12) months, (ii) the categories of sources from which such personal information was collected within the preceding twelve (12) months, and (iii) the business or commercial purpose for such collection:

The table below sets forth: (i) the categories of personal information that we have sold to or shared with third parties within the preceding twelve (12) months, (ii) the categories of third parties to whom such information was sold or shared within the preceding twelve (12) months, and (iii) the business or commercial purpose for selling or sharing such personal information:

In addition to the information set forth in the section of the Policy titled “Disclosure of Your Information”, the table below sets forth: (i) the categories of personal information that we have disclosed to a service provider or contractor for a business purpose within the preceding twelve (12) months, and (ii) the business or commercial purpose for such disclosure:

Sensitive Information

We do not use or disclose sensitive Personal Information, except as permitted under the CCPA.

Rights Regarding Your Personal Information

You have several rights regarding your Personal Information. We will explain these rights to you and how you may exercise them:

1. Right to Opt-Out of the Selling or Sharing of Your Personal Information: You have the right to opt-out of us selling or sharing your Personal Information. By clicking here or clicking the “Do Not Sell Or Share My Personal Information” link at the bottom of the home page of our Websites you will learn more about this option and will have the opportunity to opt-out. You can also opt-out by calling us at 1-800-833-8158 or emailing us at privacy@nationalgypsum.com.
2. Right to Know: This means you have the right to know what Personal Information we have collected about you, the categories of this Personal Information, the categories of sources from which the Personal Information was collected, the business or commercial purpose for collecting, selling, or sharing your Personal Information, the categories of third-parties to whom we disclose Personal Information, and the specific pieces of Personal Information we have collected about you.
3. Right to Delete: You have the right to request that we delete Personal Information we have collected from you. However, keep in mind that this right is subject to certain exceptions.
4. Right to Correct: You can request that we correct inaccurate Personal Information we maintain about you.
5. Right Not to Receive Discriminatory Treatment: You have the right not to be retaliated against for the exercise of your rights under California law.

Exercising Your Rights

You may exercise any of the rights listed above by calling us at 1-800-833-8158 or emailing us atprivacy@nationalgypsum.com. If you exercise any of these rights, we may need to verify your identity. If we need to do so, we may ask you to provide certain information such as your driver's license, or other form of identification. If we cannot verify your identity, we may deny your request. If that happens, we will let you know. You can also have an authorized agent exercise your rights on your behalf using the same methods as described above. If you do so, we may also ask your authorized agent to provide proof that they are authorized to act on your behalf.

Individuals With Disabilities

Individuals with a disability may access an alternative format of this notice by calling us at 1-800-833-8158 or emailing us at privacy@nationalgypsum.com.

Other California Privacy Rights

Under California law we are required to let you know you may request information regarding the disclosure of your Personal Information to third-parties for their direct marketing purposes. To make such a request, please send an email to: privacy@nationalgypsum.com.

CANADA

In addition to the other information in our Policy, this section describes the privacy rights specific to residents of Canada.

Withdrawing Your Consent

Your knowledge and consent are required for the collection, use or disclosure of Personal Information except where required or permitted by law.

You may withdraw all or part of your consent for us to collect, use or disclose your Personal Information in accordance with this Policy at any time upon reasonable notice to us in writing, subject to legal or contractual restrictions. The withdrawal of your consent may affect our ability to continue to provide you with the services and products that you have or would like to receive.

Transfer Outside Canada

At times we may transfer your Personal Information outside of Canada, including to service providers who may perform services for us involving some of your Personal Information. This information is subject to both the laws of Canada and the laws of those other jurisdictions, including laws with respect to disclosure of such information, and may be accessible by regulatory authorities in other jurisdictions. When we transfer Personal Information to service providers, we ensure by contractual means that the transferred personal information is protected to the same degree as if it were in our possession.

Ensuring Accuracy, Accessibility and Portability of Your Information

We will do our best to ensure that your Personal Information is correct and kept current. If you wish to access the Personal Information we have about you, or to correct factual errors in our records, or exercise the right to portability of your information, please email privacy@nationalgypsum.com or contact our National Gypsum Privacy Officer at the address listed below. You are requested to notify us as soon as possible of any changes, deletions or corrections to your Personal Information so that we may keep such information up to date.

Please note that we may be unable to provide you with full access to your Personal Information if we are prohibited by law or regulatory reasons to do so, or if the information has been securely destroyed. Subject to legal or contractual restrictions, we will provide you with an explanation if we are unable to fulfill your access request.

Automated Decision-Making

We do not use your personal information to render a decision based exclusively on automated processing that produces legal effects or otherwise significantly affects you.

Responding to Inquiries and Complaints

If you believe the privacy laws relating to the protection of your Personal Information or this Policy have not been respected, or if you have any questions or requests in connection with this Policy or other privacy-related matters, please send an email to our Privacy Officer at: privacy@nationalgypsum.com.

If, after an investigation, your complaint is deemed justified, we will take appropriate steps to correct the situation, including, if necessary, amending our policies and practices. If you are not satisfied with the results of the investigation or the corrective measures taken by us, you may exercise the remedies available under law by contacting the appropriate privacy regulator. The Office of the Privacy Commissioner of Canada may be contacted at:

Office of the Privacy Commissioner of Canada

30 Victoria Street

Gatineau, Québec

K1A 1H3

Our Privacy Officer

For Canada, the person in charge of the protection of Personal Information is our Privacy Officer, who may be contacted at:

2001 Rexford Road

Charlotte, NC 28211

privacy@nationalgypsum.com

704-365-7300

Changes To This Privacy Policy

We may change this Policy from time to time to make sure it is up to date and in compliance with privacy practices. If we make material changes, we will post a notice on the home page of our Websites. We may also provide notice via e-mail so please make sure we have an up-to-date, active, e-mail address for you. The date this Policy was last revised is stated at the top of the Policy. We recommend that you periodically check our Policy for any changes.

Contact Details

We welcome questions, comments, or concerns about this Policy and our privacy practices. You can provide feedback by contacting us:

• By E-mail: privacy@nationalgypsum.com
• Online at: https://www.nationalgypsum.com/contact-us
• By Phone: 704-365-7300
• By Mail: 2001 Rexford Road, Charlotte, NC 28211