Privacy Policy

Dated:  May 21, 2025

Floral Software Holdings, Inc. d.b.a. Koronet 

1. YOUR RIGHTS AS A CALIFORNIA CONSUMER
Floral Software Holdings, Inc. d.b.a. Koronet and our affiliates and subsidiaries (collectively, “Koronet,” “us,” “our,” or “we”) respects your privacy rights as a consumer (“Consumer”). Data and privacy policy for users domiciled in the European Economic Area is governed separately by the Data Processing Addendum to our Terms of Service. For other users, Koronet is voluntarily providing the same rights as those afforded to California Consumers under the California Consumer Privacy Act of 2018, as revised by the California Privacy Rights Act of 2020, and the associated regulations effective March 29, 2023, (the “CCPA/CPRA”) and other California laws; the terms used in this policy have the meanings used in the CCPA/CPRA. We are committed to protecting your CCPA/CPRA rights to: 

Delete Personal Information collected from or about you (“Right to Delete”).
Correct inaccurate Personal Information collected and maintained about you (“Right to Correct”).
Know what Personal Information is being collected about them, to access that Personal Information, and to know what Personal Information about you is being sold or shared and to whom (together called the “Right to Know”).
Opt-out of the Sale or Sharing of your Personal Information (“Right to Opt-out of Sale/Sharing”).
Limit use and disclosure of Sensitive Personal Information to what is necessary to perform the services or provide the goods reasonably expected by an average Consumer who requests such goods or services (“Right to Limit”).
Not be discriminated against for exercising your rights (“Right to No Discrimination”).

This document (“Privacy Policy”) provides you with a description of our business practices, both online and offline, regarding the collection use, disclosure, and sale of Personal Information and of the rights of Consumers regarding their own Personal Information. 

Consumers who utilize our Services (as defined herein) include flower growers, wholesalers, distributors, and others who use our Services (“Customers”).  Our services include, but are not limited to, our website, software and other digital services that allow our Customers to manage sales transactions, manage their inventory, integrate with other applications, facilitate the procurement process, and grow their e-commerce business (“Services”).  This Privacy Policy applies to all Customers who utilize our Services, as well as to visitors of our website. By using our Services or visiting our website, you agree to the practices described in this Privacy Policy.  If you do not agree with this Privacy Policy, please do not access the website or otherwise use any of our Services. 

2. PERSONAL INFORMATION WE COLLECT, SELL, SHARE, AND OTHERWISE DISCLOSE
The CCPA/CPRA defines Personal Information as “information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household.” 

See the chart below for the categories of Personal Information we have collected over the preceding 12 months, the retention period for each category, and the categories of sources of the information.

See the chart below for the categories of Personal Information we have collected over the preceding 12 months, the retention period for each category, and the categories of sources of the information.

Business or Commercial Purpose(s) for Collecting Personal Information. 
We collect the categories of Personal Information described above for the following business or commercial purposes: 

See the chart below for the categories of personal information we may have shared in the preceding 12 months, the business purposes for selling or sharing this personal information, and which categories of trusted business partners to whom we sold or shared that information:

We may also disclose personal information in the following situations:

a. Business transfers as part of a merger, acquisition, bankruptcy, or other transaction: Koronet may transfer to a third party Personal Information as an asset that is part of a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of Koronet.

b. Legal compliance and law enforcement: We may be required to disclose Personal Information in limited circumstances, for example, to respond to a subpoena or similar judicial process, to comply with state, federal or local laws, to exercise or defend legal claims or, to the extent required by law, to provide information to law enforcement agencies.

3. HOW TO EXERCISE YOUR RIGHTS TO DELETE, CORRECT, AND KNOW
a. Submitting Requests: Your Right to Delete, Right to Correct, and Right to Know can be exercised by submitting a request to us by sending an email to privacy@koronet.com.

Koronet uses a two-step process to complete any online Right to Delete request (but not for any other type of verifiable request). If you submit an online Right to Delete request, we will contact you to confirm that you would like your personal information deleted.

b. Requests to Know
You have the right to request, up to two times per year, that Koronet disclose the following information to you about our collection and use of your personal information:

- the specific pieces of Personal Information Koronet has collected about you. You may also request a copy of specific pieces of Personal Information that Koronet has collected about you. Please note that “specific pieces of information” do not include data generated to help ensure security and integrity or as prescribed by regulation. 

- two separate lists disclosing:
1. sales and sharing, identifying the Personal Information categories that each category of recipient purchased; and
2. disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.

c. Veryfing Requests to Delete, Correct or Know
Koronet may not grant your request if Koronet cannot verify your identity or authority to make the request and confirm that the Personal Information relates to you. Koronet will attempt to verify your request with the information you provide and the information that Koronet already has about you. For this reason, your request must both:

1. provide sufficient information that allows Koronet to reasonably verify you are the Consumer about whom Koronet collected Personal Information or an authorized representative; and
2. describe your request with sufficient detail to allow Koronet to properly understand, evaluate, and respond to it.

If you have a password-protected account with Koronet, Koronet may require you to verify your identity through our existing authentication practices for the account. As an additional security measure, Koronet shall also require you to re-authenticate yourself before deleting, correcting, or disclosing your personal information. 

Koronet will only use Personal Information provided in a verifiable request to verify the requestor’s identity or authority to make the request. Only you, or your properly authorized agent, may make a request related to your personal information. To be certain that anyone claiming to make a request on your behalf has been properly authorized by you, Koronet may require additional information, including:

- proof that you gave the agent the signed authorization to submit the request 
- require you to verify your own identity directly with Koronet.
- otherwise directly confirm with Koronet that you have provided your authorized agent permission to submit the request.

4. RIGHT TO OPT-OUT OF SALE OR SHARING OF PERSONAL INFORMATION 
Koronet shares your Personal Information to third parties. While Koronet doesn’t currently recognize opt-out preference signals, in the future, you may be able to exercise your right to opt out of the sale or sharing of your Personal Information by using an opt-out preference signal sent by a platform, technology, or mechanism such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the Consumer’s choice to opt-out of the sale of their Personal Information. If and when Koronet implements the recognition of opt-out preference signals, Koronet will process them in a frictionless manner. 

You have the right at any time to direct Koronet not to sell or share your personal information to third parties (this right is referred to as the “Right to Opt‐out”). In addition to using the “Do Not Sell My Personal Information,” link on the Koronet website or here in our Privacy Policy, you may submit a request to exercise your Right to Opt-out as follows:

- Koronet respond to and abide by global privacy controls such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the Consumer’s choice to opt-out of the sale of their Personal Information. 
- sending an email to privacy@koronet.com. 

Only you, or your properly authorized agent, may make a Right to Opt-out request using the method(s) provided above. If you change your mind after making an opt-out, you may contact Koronet at any time by the method(s) listed above or by our contact information below to request to allow Koronet to sell and share your Personal Information (this is known as requesting to “opt-in”). Koronet is required by the CCPA/CPRA to use a two-step opt-in process, so that if you submit a request to opt-in, Koronet will contact you separately to request additional confirmation of your request.

5. RIGHT TO LIMIT USE AND DISCLOSURE OF SENSITIVE PERSONAL INFORMATION
Koronet may use or disclose your Sensitive Personal Information for purposes other than:
1. To perform the Services or provide the goods reasonably expected by an average Consumer who requests those goods or Services.
2. To prevent, detect, and investigate security incidents that compromise the availability, authenticity, integrity, or confidentiality of stored or transmitted Personal Information.
3. To resist malicious, deceptive, fraudulent, or illegal actions directed at your business and to prosecute those responsible for those actions.
4. To ensure the physical safety of individuals.
5. For short-term, transient use (including, but not limited to, non-personalized advertising shown as part of a Consumer’s current interaction with the business, provided that the Personal Information is not disclosed to another third party and is not used to build a profile about the Consumer or otherwise alter the Consumer’s experience outside the current interaction with the business).
6. To perform services on behalf of the business.
7. To verify or maintain the quality or safety of a product, Service, or device that is owned, manufactured, manufactured for, or controlled by the business
8. To improve, upgrade, or enhance the Service or device that is owned, manufactured by, manufactured for, or controlled by the business.
9. To collect or process Sensitive Personal Information where the collection or processing is not for the purpose of inferring characteristics about a Consumer.

You have the right, at any time, to direct Koronet to limit our use or disclosure of your sensitive personal information to that set forth in (1)-(9), above (this right is referred to as the “Right to Limit”). 

Until such time that you may exercise your right to opt out or limit use and disclosure of Sensitive Personal Information by using an opt-out preference signal sent by a platform, technology, or mechanism such as a browser plug-in or privacy setting, device setting, or other mechanism, that communicate or signal the Consumer’s choice to limit the use of their Sensitive Personal Information, you may exercise your right to opt out or limit the use and disclosure of Sensitive Personal Information by sending an email to privacy@koronet.com. 

Only you, or your properly authorized agent, may make a Right to Limit request using the method(s) provided above. If you change your mind after making a Right to Limit request, you may contact us at any time to opt-in to the use or disclosure of your sensitive personal information as described above.

6. ADDITIONAL INFORMATION REGARDING CHILDREN UNDER 16 YEARS OF AGE
Exercising Consumer Rights: A parent or guardian may make a Consumer Rights request on behalf of their child under the age of 16. In the case of a request to exercise the Right to Delete or the Right to Know on behalf of a child under the age of 13, we provide additional safeguards to confirm that you are the parent or guardian of that child. If you are making a request for a child under 13, please indicate this in the submission of your request or contact Koronet using Koronet’s contact information provided below so that we can provide you with further instructions on how to comply with CCPA/CPRA requirements.

Sale or sharing of the children’s Personal Information: Koronet does not knowingly sell or share the Personal Information of children under 16 years of age. 

7. NON-DISCRIMINATION
We will not discriminate against you for exercising any of your CCPA/CPRA rights. We will not unlawfully:
- Deny you goods or Services.
- Charge you different prices or rates for goods or Services, including through granting discounts or other benefits, or imposing penalties.
- Provide you a different level or quality of goods or Services.
- Suggest that you may receive a different price or rate for goods or Services or a different level or quality of goods or Services.
- Retaliate against an employee, applicant for employment, or independent contractor for exercising their rights under this title.

8. CALIFORNIA “SHINE THE LIGHT” LAW
California’s “Shine the Light” law (Civil Code Section § 1798.83) permits users of our website that are California residents to request certain information regarding our disclosure of Personal Information to third parties for their direct marketing purposes. To make such a request, please email privacy@koronet.com. 

9. CHANGES TO OUR PRIVACY POLICY
Koronet reserves the right to amend this Privacy Policy at Koronet’s discretion and at any time. When Koronet makes changes to this Privacy Policy, Koronet will post the updated Privacy Policy on our website and update the Privacy Policy’s effective date. Your continued use of Koronet’s website or Koronet’s Services following the posting of changes constitutes your acceptance of such changes.

10. CONTACT INFORMATION
If you have any questions or concerns about Koronet’s privacy policies and practices, please do not hesitate to contact Koronet as follows: sending an email to privacy@koronet.com