Effective Date: April 4, 2026

1. Introduction

Grace Carlton Consulting LLC ("GCC," "we," "us," or "our") is a premier strategic advisory firm headquartered in Avon, Indiana. We specialize in manufacturer market entry and expansion, go-to-market strategy, distribution program development, sales strategy, procurement optimization, and cross-cultural business advisory services. Our firm serves clients across a broad range of industries, including industrial manufacturing, energy, safety, sustainability and environmental, healthcare, home building, defense, pharmaceuticals, government, food processing, automotive and HVAC manufacturing, commercial construction, and retail and consumer goods.

Our clients include manufacturers—from startups to industry leaders, both domestic and international—distributors, Group Purchasing Organizations (GPOs), end users such as healthcare facilities, amusement parks, food processing plants, heavy manufacturers, and cruise ships, as well as private equity firms and startups. GCC's team brings deep expertise in strategic growth consulting, fractional sales effectiveness, business development, distributor and GPO program development, private label and OEM sourcing, on-shoring initiatives, supplier development, international quality assurance, regulatory compliance playbooks, sustainability program development, and compressed air optimization, among other capabilities. Our team is fluent in Cantonese, Mandarin, English, and French, enabling us to serve an international clientele.

This Privacy Policy describes how GCC collects, uses, and protects information obtained through our website at www.gracecarltonconsulting.com (the "Site"). By accessing or using our Site, you agree to the practices described in this Privacy Policy. If you do not agree, please discontinue use of the Site.

2. Information We Collect

2.1 Personal Information You Provide

When you submit an inquiry through our contact form (powered by Gravity Forms), we may collect the following information:

• First Name (required)
• Last Name (required)
• Email Address (required)
• Phone Number (optional)
• Subject — selected from the following categories: Manufacturer Market Entry & Expansion; Healthcare System Direct Sourcing; Distributor & Buying Group Programs; End-User Procurement Advisory; Private Label & OEM Sourcing; Other / General Inquiry
• Message — free-text content of your inquiry

2.2 Information Collected Automatically

When you visit our Site, certain information is collected automatically through cookies and similar technologies:

• Analytics Data: We use Google Analytics 4 (GA4) to collect standard usage data, including pages visited, session duration, referral sources, device type, browser type, approximate geographic location, and interaction events.
• Cookies: Our Site uses cookies set by WordPress and the Divi theme framework to facilitate basic site functionality, session management, and user preferences.
• Font and CDN Requests: Our Site loads Google Fonts (Open Sans, Hind Siliguri, and Work Sans) and Cloudflare-hosted resources (Font Awesome icons). When your browser requests these resources, standard connection data such as your IP address may be transmitted to Google and Cloudflare servers.

3. How We Use Your Information

We use the information we collect for the following purposes:

• To respond to your inquiries about our strategic advisory, consulting, and business development services
• To communicate with you regarding our service offerings, capabilities, and engagement opportunities
• To analyze website traffic and usage patterns using Google Analytics 4, enabling us to improve our Site's performance, content, and user experience
• To maintain and optimize the technical operation of our Site
• To comply with applicable legal obligations and enforce our terms of use

4. Cookies and Tracking Technologies

Our Site uses the following cookies and tracking technologies:

• Google Analytics 4 (GA4): GA4 uses first-party cookies (e.g., _ga, _ga_<container-id>) to distinguish unique users and sessions. These cookies collect anonymized, aggregated usage data. Our GA4 Tracking ID is G-3BSWCZ2D0H.
• WordPress/Divi Cookies: Standard cookies used for site functionality, session management, and content display preferences.
• Google Fonts: Our Site loads Open Sans, Hind Siliguri, and Work Sans from Google's font servers. Google may collect connection metadata when these fonts are requested.
• Cloudflare CDN: Font Awesome icon assets are served via Cloudflare's content delivery network. Cloudflare may set performance-related cookies and process connection data.

We do not use Facebook Pixel, LinkedIn Insight Tag, chat widgets, newsletter signup forms, scheduling tools (such as Calendly), or any e-commerce or payment processing technologies on our Site.

Most web browsers allow you to manage or disable cookies through your browser settings. Please note that disabling cookies may affect your ability to use certain features of our Site.

5. Third-Party Services

We use the following third-party services in connection with the operation of our Site:

• Google Analytics 4 (Google LLC): Web analytics service that processes usage data to generate aggregated reports. Google's privacy policy is available at https://policies.google.com/privacy.
• Google Fonts (Google LLC): Web font hosting service. Google's privacy policy applies to data collected during font delivery.
• Cloudflare, Inc.: Content delivery network used to serve Font Awesome icons. Cloudflare's privacy policy is available at https://www.cloudflare.com/privacypolicy/.
• Gravity Forms (Rocketgenius, Inc.): Form plugin used to collect contact form submissions. Form data is stored within our WordPress database on our hosting server.
• Yoast SEO (Newfold Digital): WordPress plugin used for search engine optimization, including schema markup and meta tag generation. Yoast does not collect personal information from visitors.

Each third-party service operates under its own privacy policy. We encourage you to review those policies to understand how your data may be processed by these services.

6. How We Share Your Information

GCC does not sell, rent, or trade your personal information to third parties. We may share your information only in the following circumstances:

• Service Providers: We may share information with trusted third-party service providers (such as our hosting provider and analytics platform) who assist us in operating our Site, subject to confidentiality obligations.
• Legal Obligations: We may disclose your information if required to do so by law, regulation, legal process, or enforceable governmental request, or to protect the rights, property, or safety of GCC, our clients, or others.
• Business Transfers: In the event of a merger, acquisition, or sale of all or a portion of our assets, personal information may be transferred as part of that transaction. We will provide notice before your personal information is transferred and becomes subject to a different privacy policy.

7. Data Retention

We retain information in accordance with the following practices:

• Contact Form Submissions: Personal information submitted through our contact form is retained in our WordPress database for as long as necessary to respond to your inquiry, maintain a record of our communications, and fulfill any applicable legal or business obligations. You may request deletion of your submission at any time by contacting us.
• Analytics Data: Google Analytics data is retained in accordance with our GA4 data retention settings and Google's data retention policies. Analytics data is aggregated and does not directly identify individual users.
• Cookies: Cookies are retained for their default durations as set by each respective service (Google Analytics, WordPress). You may clear cookies at any time through your browser settings.

8. Your Rights and Choices

You have the following rights regarding your personal information:

• Opt-Out of Analytics: You may opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-On.
• Cookie Management: You can control and delete cookies through your browser settings. Instructions are typically available in the "Help" or "Settings" section of your browser.
• Access and Deletion: You may request access to, correction of, or deletion of the personal information you have provided to us by contacting us at the email address listed in Section 14 below.
• Communication Preferences: If we contact you in response to a form submission, you may request at any time that we cease future communications.

We will respond to all valid requests within thirty (30) days or as required by applicable law.

9. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA) provide you with additional rights regarding your personal information:

• Right to Know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which information was collected, the business purpose for collection, and the categories of third parties with whom information is shared.
• Right to Delete: You have the right to request deletion of the personal information we have collected from you, subject to certain legal exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information that we maintain about you.
• Right to Non-Discrimination: We will not discriminate against you for exercising any of your CCPA/CPRA rights.
• No Sale or Sharing: GCC does not sell or share personal information as those terms are defined under the CCPA/CPRA. We do not use personal information for cross-context behavioral advertising.

To exercise any of these rights, please contact us at support@gracecarltonconsulting.com or call us at (855) 361-0422. We will verify your identity before processing your request and respond within 45 days as required by law.

10. International Visitors

GCC actively works with international clients, including manufacturers and business partners in Asia and Europe seeking to enter or expand within the North American market. If you are visiting our Site from outside the United States, please be aware that your information will be transferred to, stored, and processed in the United States, where our servers and operations are located.

For Visitors from the European Economic Area (EEA), United Kingdom, and Switzerland: If you are located in the EEA, UK, or Switzerland, the General Data Protection Regulation (GDPR) and related legislation provide you with the following additional rights:

• The right to access your personal data
• The right to rectification of inaccurate personal data
• The right to erasure ("right to be forgotten")
• The right to restrict processing of your personal data
• The right to data portability
• The right to object to processing based on legitimate interests

Our legal basis for processing personal data under the GDPR includes: (a) your consent, where you have voluntarily submitted information through our contact form; (b) our legitimate interests in responding to business inquiries and improving our Site; and (c) compliance with legal obligations.

To exercise any of these rights, please contact us at support@gracecarltonconsulting.com. If you believe we have not adequately addressed your data protection concerns, you have the right to lodge a complaint with your local data protection authority.

11. Data Security

We take the security of your personal information seriously and implement reasonable administrative, technical, and physical safeguards to protect against unauthorized access, alteration, disclosure, or destruction of your data. These measures include:

• Encryption in Transit: Our Site uses SSL/TLS encryption (HTTPS) to protect data transmitted between your browser and our servers.
• Secure Hosting: Our website is hosted on a secure WordPress hosting platform with regular security updates and monitoring.
• Access Controls: Access to personal information is restricted to authorized GCC personnel on a need-to-know basis.

While we strive to protect your personal information, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security but are committed to maintaining industry-standard protections.

12. Children's Privacy

Our Site and services are not directed at children under the age of 13, and we do not knowingly collect personal information from children under 13. If we become aware that we have inadvertently collected personal information from a child under 13, we will take steps to delete such information promptly. If you believe we may have collected information from a child under 13, please contact us immediately at the address provided in Section 14 below.

13. Changes to This Privacy Policy

GCC reserves the right to update or modify this Privacy Policy at any time. When we make changes, we will revise the "Effective Date" at the top of this page. If we make material changes to how we handle personal information, we will provide notice through our Site. We encourage you to review this Privacy Policy periodically to stay informed about how we protect your information. Your continued use of the Site after any changes to this Privacy Policy constitutes your acceptance of the revised terms.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Grace Carlton Consulting LLC

Avon, Indiana 46123

Email: support@gracecarltonconsulting.com

Phone: (855) 361-0422

Website: www.gracecarltonconsulting.com