Roadware Incorporated — ConcreteMender.com

Privacy Policy

Effective Date: August 20, 2026

Last Updated: August 20, 2026

Jurisdiction Notice: This Privacy Policy applies to all users of ConcreteMender.com worldwide. Users who are residents of the European Economic Area (EEA) or the United Kingdom (UK) should refer to Section 9.2 for their rights under the General Data Protection Regulation (GDPR) and UK GDPR. Users who are residents of California should refer to Section 9.3 for their rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA). Residents of other U.S. states with comprehensive privacy laws should refer to Section 9.4.

1. About Us / Identity of the Data Controller

2. Scope and Applicability

3. Personal Information We Collect

3.1 Information You Provide Directly

3.2 Information Collected Automatically

3.3 Information from Third Parties

3.4 Sensitive Personal Information (CPRA Category)

4. How We Use Your Personal Information

5. Cookies and Tracking Technologies

5.1 Types of Cookies Used

5.2 Third-Party Cookies

5.3 Do Not Track (DNT)

5.4 Managing Cookies

6. How We Share Your Personal Information

7. Data Retention

8. International Data Transfers

9. Your Rights and Choices

9.1 Rights of All Users (Global)

9.2 Rights of EEA and UK Residents (GDPR/UK GDPR)

9.3 Rights of California Residents (CCPA/CPRA)

9.4 Rights of Residents of Other U.S. States

10. Children’s Privacy

11. Security

12. Third-Party Links

13. Changes to This Privacy Policy

14. Contact Us

Appendix A: CCPA Personal Information Categories Collected

Appendix B: Legal Bases for Processing (GDPR Summary Table)

1. About Us / Identity of the Data Controller

ConcreteMender.com is a website owned and operated by Roadware Incorporated, a company organized under the laws of the State of Minnesota, United States. Roadware Incorporated is a manufacturer and distributor of professional-grade concrete repair products and related accessories, serving contractors, municipalities, and consumers throughout North America and internationally.

For the purposes of applicable data protection law, including the General Data Protection Regulation (GDPR) and UK GDPR, Roadware Incorporated acts as the data controller with respect to personal information collected through ConcreteMender.com.

Roadware Incorporated
Attn: Privacy Inquiries
381 Bridgepoint Way
St. Paul, Minnesota 55075, United States

Email: [email protected]
Phone: 1-651-457-6122
Website: ConcreteMender.com

EU/UK Representative: Roadware Incorporated serves as the data controller for EEA and UK users. Users located in the EEA or UK may direct privacy inquiries and data subject rights requests to the address above. We do not currently designate a separate EU or UK representative, as we are a small business that does not engage in large-scale or high-risk processing of personal data. All EEA and UK privacy inquiries are handled directly by Roadware Incorporated at the contact information above.

Data Protection Officer (DPO): We are not required to appoint a formal DPO under the GDPR (Article 37) given the nature and scale of our processing activities. All privacy-related inquiries, including those from EEA and UK residents, should be directed to the contact information listed above.

2. Scope and Applicability

This Privacy Policy applies to:

The ConcreteMender.com website and any subdomains operated by Roadware Incorporated;
All visitors, registered users, customers, prospective customers, and business contacts who interact with the website; and
All personal information collected by Roadware through any channel associated with the website, including contact forms, e-commerce checkout, account registration, and email communications.

This Privacy Policy does not apply to:

Third-party websites, platforms, or services linked from ConcreteMender.com. We are not responsible for the privacy practices of those sites, and we encourage you to review their respective privacy policies.
The offline business operations of Roadware Incorporated that are not connected to ConcreteMender.com.

3. Personal Information We Collect

We collect several categories of personal information depending on how you interact with ConcreteMender.com. The following describes those categories, organized to align with both the California Consumer Privacy Act (CCPA/CPRA) statutory categories and GDPR personal data categories.

3.1 Information You Provide Directly

When you make a purchase, create an account, submit a contact form, or otherwise interact with our website, you may provide us with the following categories of personal information:

Identifiers: Your full name, email address, billing address, shipping address, and phone number, collected at checkout via WooCommerce and through contact forms on the website.
Commercial Information: Products purchased or considered for purchase, order history, cart contents, and payment method type (e.g., credit card, debit card, PayPal). Important Note: Full payment card numbers, security codes (CVV), and similar sensitive financial data are processed directly by our third-party payment processor and are never stored by Roadware Incorporated on our servers.
Account Credentials: If you create a WooCommerce customer account, we collect and store your chosen username and a hashed (encrypted) version of your password.
Communications: Messages, questions, feedback, and other content submitted through contact forms on the website, as well as subsequent email communications with our customer service team.

3.2 Information Collected Automatically

When you visit ConcreteMender.com, certain information is collected automatically by our website infrastructure, analytics tools, and cookies:

Internet and Electronic Network Activity: Your IP address, browser type and version, operating system, referring URL (the page you came from), pages visited on our site, links clicked, time and date of your visit, and clickstream data (the sequence of pages you viewed).
Device Identifiers: Information about the device you use to access the site, including device type, screen resolution, and unique browser identifiers collected through cookies and similar tracking technologies.
Geolocation Data: Approximate geographic location (typically at the country, region, or city level) derived from your IP address. We do not collect precise GPS-level geolocation data.
Inferences: Data derived from your browsing behavior on the site, such as product interests and general usage patterns, which may be used to create aggregated analytics profiles to understand how visitors use the site. We do not use this information to make automated decisions that have legal or similarly significant effects on individuals.

3.3 Information from Third Parties

We may receive personal information about you from third parties in the following circumstances:

Distributor Referral Data: If you are referred to ConcreteMender.com by a Roadware-authorized distributor, that distributor may share your name, email address, phone number, or other contact information with us for the purpose of fulfilling your order or providing product support.
Analytics Providers: We receive aggregated and pseudonymized behavioral data from analytics tools (such as Jetpack Stats operated by Automattic) that help us understand how visitors use the site. This data is used in aggregate and is not typically linked back to specific individuals.
Payment Processors: Our payment processor may share transaction status information and fraud signals with us (for example, whether a transaction was flagged as potentially fraudulent) to assist with order verification. We do not receive full payment card data from the payment processor.

3.4 Sensitive Personal Information (CPRA Category)

Sensitive Personal Information Policy

Roadware Incorporated does not intentionally collect, use, or disclose sensitive personal information as defined under the California Privacy Rights Act (CPRA) or similar applicable law. This includes, without limitation: Social Security numbers or government-issued identification numbers; driver’s license numbers; financial account numbers or full payment card numbers; precise geolocation data; racial or ethnic origin; religious or philosophical beliefs; health or medical information; sexual orientation or gender identity; biometric data; or the contents of private communications not directed to us.

If a customer voluntarily includes any sensitive information in a free-text message or contact form submission (for example, describing a health-related situation in an inquiry), we will use that information only to respond to the specific inquiry and will not process it for any other purpose. We will handle any such incidentally received sensitive information with particular care and will limit access to it on a strict need-to-know basis.

4. How We Use Your Personal Information

We use the personal information we collect for the specific, documented purposes set out in the table below. For EEA and UK residents, we identify the applicable legal basis under Article 6 of the GDPR for each purpose. For California residents, we identify the applicable CCPA/CPRA business purpose category.

Purpose	Data Categories Used	GDPR Legal Basis	GDPR Article	CCPA Business Purpose
Processing and fulfilling orders placed through WooCommerce	Identifiers, commercial information, financial transaction data	Performance of a contract	Art. 6(1)(b)	Performing services / fulfilling transactions
Customer account creation and management	Identifiers, account credentials	Performance of a contract	Art. 6(1)(b)	Performing services
Responding to contact form inquiries and customer service requests	Identifiers, communications	Legitimate interests; performance of a contract where applicable	Art. 6(1)(f); Art. 6(1)(b)	Performing services
Sending transactional emails (order confirmations, shipping updates, account notifications)	Identifiers, commercial information	Performance of a contract	Art. 6(1)(b)	Performing services
Sending marketing and promotional communications (only where consent has been given)	Identifiers, email address	Consent	Art. 6(1)(a)	Business purpose; opt-out right applies
Website analytics, performance monitoring, and service improvement	Internet/electronic activity, device identifiers, approximate geolocation	Legitimate interests	Art. 6(1)(f)	Analytics / improving services
Security, fraud prevention, and detection of malicious activity	Internet/electronic activity, identifiers, device identifiers	Legitimate interests; legal obligation	Art. 6(1)(f); Art. 6(1)(c)	Security / detecting incidents
Legal compliance, tax and accounting record-keeping, and responding to legal process	All categories, as applicable and required by law	Legal obligation	Art. 6(1)(c)	Legal obligation / compliance
Sharing with authorized distributors for sales support and order fulfillment assistance	Identifiers, commercial information	Legitimate interests	Art. 6(1)(f)	Business purpose / sharing disclosure

Legitimate Interests Balancing Test: Where we rely on legitimate interests as a legal basis under GDPR Article 6(1)(f), we have carried out an assessment and determined that our interests are not overridden by your fundamental rights and freedoms. You have the right to object to processing based on legitimate interests; see Section 9.2 for details.

Consent and Withdrawal: Where we rely on your consent to process personal information (such as for marketing emails), you may withdraw that consent at any time without affecting the lawfulness of processing that occurred prior to withdrawal. Withdrawal of consent may be exercised through the mechanisms described in Section 9.

5. Cookies and Tracking Technologies

ConcreteMender.com uses cookies and similar tracking technologies to enable essential website functionality, remember your preferences, analyze how the site is used, and support the e-commerce experience. This section explains the types of cookies we use, who sets them, and how you can manage your cookie preferences.

5.1 Types of Cookies Used

Strictly Necessary Cookies: These cookies are essential for the website to function correctly and cannot be disabled without impairing core site features. They include:

WooCommerce session cookies: Store your shopping cart contents and maintain your login session so that items remain in your cart as you browse.
WordPress authentication and security cookies: Used to authenticate logged-in users and to prevent cross-site request forgery (CSRF) attacks.

Because these cookies are strictly necessary for the operation of the website, we do not require your consent to place them under the ePrivacy Directive or equivalent national law. However, you retain the right to disable them via browser settings, understanding that doing so will impair checkout and account login functionality.

Functional Cookies: These cookies enhance your experience by remembering your choices and preferences, such as:

Language or regional display preferences;
Items saved to a wish list or persistent cart; and
Whether you have previously dismissed a notice or banner.

Analytics Cookies: These cookies help us understand how visitors interact with ConcreteMender.com, which pages are most popular, and where visitors come from. We use these insights to improve the website and our product offerings. Specifically:

Jetpack Stats (Automattic): Jetpack, operated by Automattic, Inc., embeds a tracking pixel (served via pixel.wp.com, historically using filenames such as g.gif or v.gif) on our pages. This pixel collects your IP address, browser user agent string, referring URL, timestamp, country code, browser language preference, and (where applicable) a WordPress.com user identifier if you are logged into a WordPress.com account. This data is used to generate aggregated site statistics and is processed by Automattic as a data processor on our behalf under a data processing agreement. See Automattic’s privacy policy at automattic.com/privacy for further details.

Marketing and Targeting Cookies: Roadware Incorporated does not currently operate paid advertising retargeting or behavioral advertising campaigns through third-party advertising networks on ConcreteMender.com. Accordingly, we do not currently deploy third-party marketing or targeting cookies. If we introduce such technologies in the future, we will update this Privacy Policy with at least 30 days’ advance notice and, where required by law, obtain your prior consent before placing such cookies.

5.2 Third-Party Cookies

The following third parties may set cookies or similar technologies on your device when you visit ConcreteMender.com:

Automattic / Jetpack: As described above, Jetpack embeds tracking scripts and a statistics pixel for site analytics. Automattic’s privacy practices govern their independent processing as our data processor. See automattic.com/privacy.
WooCommerce: Sets first-party functional cookies for shopping cart session management, as described in Section 5.1.
Payment Processors: At the checkout stage, our payment processor(s) (such as Stripe, PayPal, or other applicable processors) may set their own cookies to facilitate payment processing, detect fraud, and maintain session state during checkout. These cookies are governed by the payment processor’s own privacy policy and terms of service, and are not within Roadware’s control.

5.3 Do Not Track (DNT)

Some browsers transmit “Do Not Track” (DNT) signals to websites. At this time, no universally accepted technical standard exists for how websites should respond to DNT signals, and most analytics tools do not alter their behavior in response to DNT signals. To the extent technically feasible, we endeavor to respect the intent of DNT signals. If you wish to opt out of analytics tracking, please use the opt-out mechanisms described in Section 9 or adjust your cookie settings as described in Section 5.4. We will honor opt-out requests submitted through our contact form or the Global Privacy Control (GPC) mechanism.

5.4 Managing Cookies

You have several options for managing your cookie preferences:

Browser Settings: Most web browsers allow you to refuse new cookies, delete existing cookies, and configure your cookie preferences through the browser’s settings menu. Please refer to your browser’s help documentation for instructions. Note that disabling strictly necessary cookies will impair checkout, login, and cart functionality.
Cookie Consent Banner: For users visiting from the EEA and UK, we display a cookie consent banner on your first visit to the site. You may use this banner to accept or decline non-essential cookies (analytics and functional cookies) before they are placed. Your preferences are recorded and can be changed at any time.
Opt-Out of Jetpack/WordPress Stats: You may opt out of data collection by Automattic’s Jetpack Stats by visiting jetpack.com/support/privacy or by contacting us as described in Section 14.
Global Privacy Control (GPC): We honor browser-level Global Privacy Control signals as an opt-out from the “sharing” of personal information as defined under the CPRA. See Section 9.3 for further details.

6. How We Share Your Personal Information

Roadware Incorporated does not sell personal information. We share personal information only as described below, and only as necessary to operate our business, fulfill orders, comply with legal obligations, or as otherwise authorized by you.

6.1 Authorized Distributors

Roadware maintains a network of authorized regional distributors. If you inquire about a product or place an order and an authorized distributor in your region is better positioned to serve you, we may share your name, email address, phone number, and general geographic location with that distributor for the purpose of fulfilling your order, providing product support, or following up on your inquiry. Distributors are contractually required to use this information exclusively for sales and support purposes related to Roadware products, and are prohibited from using it for independent marketing purposes or sharing it with additional third parties without authorization.

6.2 Service Providers and Data Processors

We engage trusted third-party service providers who process personal information on our behalf under written data processing agreements that restrict their use of the data to the services they provide to us. These service providers include:

Automattic, Inc. (WordPress.com, Jetpack, WooCommerce, Akismet): Provides website hosting, e-commerce platform functionality, site statistics, comment and form spam filtering, and related services. Automattic is headquartered in San Francisco, California, and may process data on servers located in the United States and other countries. Automattic processes data as our data processor under a Data Processing Agreement (DPA) that incorporates Standard Contractual Clauses for EEA/UK data transfers. See automattic.com/privacy and wordpress.com/support/data-processing-agreements/.
Payment Processor (e.g., Stripe, PayPal, or other applicable payment service): Processes payment card transactions on our behalf during checkout. Full payment card data is processed directly by the payment processor and is not stored by Roadware Incorporated. The payment processor acts as an independent data controller for cardholder data, subject to PCI-DSS compliance requirements and its own privacy policy.
Email Service Provider: We use an email service provider to deliver transactional emails (such as order confirmations and shipping notifications) and, where applicable, marketing emails to opted-in subscribers. This provider processes your email address and message content solely to deliver communications on our behalf.
Web Hosting and CDN Providers: Infrastructure and content delivery network providers who host and serve the ConcreteMender.com website may have incidental technical access to data transmitted through the site as part of providing hosting services. Such access is governed by data processing agreements.

6.3 Analytics Providers

Jetpack / WordPress.com Stats: Site usage analytics data is processed by Automattic as described in Sections 5.1 and 6.2.
Google Analytics (if applicable): We may use Google Analytics, a web analytics service provided by Google LLC, to analyze traffic and usage patterns on the site. If in use, data collected by Google Analytics is subject to Google’s Privacy Policy and Google’s Data Processing Terms. Google may process and store data on servers in the United States and other countries. You may opt out of Google Analytics data collection by installing the Google Analytics Opt-Out Browser Add-on, available at tools.google.com/dlpage/gaoptout.

6.4 Legal Requirements

We may disclose personal information to governmental authorities, law enforcement agencies, courts, or regulatory bodies when required by applicable law, court order, subpoena, or other legal process, or when we believe in good faith that disclosure is reasonably necessary to: (a) comply with a legal obligation; (b) protect and defend the rights or property of Roadware Incorporated; (c) prevent or investigate possible wrongdoing in connection with the website; or (d) protect the personal safety of users of the website or the public.

6.5 Business Transfers

In the event of a merger, acquisition, reorganization, sale of all or substantially all of our business assets, or other corporate transaction, personal information held by Roadware Incorporated may be transferred to the acquiring entity as part of the transaction. In such circumstances, we will notify affected users via email and/or by posting a prominent notice on ConcreteMender.com prior to the transfer taking effect, and the acquiring entity will be required to honor the terms of this Privacy Policy or notify users of any material changes.

6.6 With Your Consent

We may share your personal information with additional third parties for other purposes not described in this policy where we have obtained your explicit prior consent to do so. You may withdraw such consent at any time by contacting us as described in Section 14.

6.7 We Do Not Sell or Share Personal Information for Behavioral Advertising

No Sale of Personal Information

Roadware Incorporated does not sell personal information to third parties in exchange for monetary or other valuable consideration.

Roadware Incorporated does not share personal information with third parties for the purpose of cross-context behavioral advertising as that term is defined under the California Privacy Rights Act (CPRA).

However, please note that the use of Jetpack Stats, WordPress analytics tools, and potentially Google Analytics may constitute “sharing” of personal information under the CPRA’s broad definition of that term, even absent monetary exchange. We provide opt-out mechanisms for such sharing, as described in Section 9.3.

7. Data Retention

We retain personal information only for as long as necessary to fulfill the purposes for which it was collected, to comply with legal, tax, and accounting obligations, to resolve disputes, and to enforce our agreements. The following table describes our standard retention periods by data category:

Data Category	Retention Period	Basis / Notes
Order and transaction records (identifiers, commercial information, financial transaction data)	7 years from the date of transaction	Tax, accounting, and legal compliance obligations. After this period, data is deleted or irreversibly anonymized.
Customer account information	For the duration the account is active; deleted within 30 days of an account deletion request	Records required for legal or tax compliance are retained for the applicable statutory period notwithstanding account deletion.
Contact form submissions and email correspondence	2 years from the date of submission	Retained longer if necessary to resolve an ongoing dispute or comply with a legal hold or regulatory inquiry.
Website analytics and server log data (IP addresses, clickstream data)	13 months	Consistent with standard analytics industry practice. Data is deleted or aggregated/anonymized after this period.
Marketing email subscriber lists (consented contacts)	Until unsubscribe or consent withdrawal	Removed from active marketing lists within 10 business days of receiving an unsubscribe request or consent withdrawal.
Cookie and session data	Session cookies: expire upon browser close. Persistent cookies: 30 days to 2 years depending on cookie type.	Specific expiration periods are set per cookie as disclosed in our cookie consent manager.
Distributor-shared customer data	Duration of business relationship with the relevant distributor, plus any applicable statutory retention period	Reviewed periodically for necessity and relevance.
Data subject to legal hold or litigation	Suspended until matter is resolved	Normal retention schedules are paused for any data subject to a legal hold, litigation, regulatory investigation, or audit.

Upon expiration of the applicable retention period, personal information is securely deleted, destroyed, or irreversibly anonymized using industry-standard methods. Anonymized data (from which no individual can be identified) may be retained indefinitely for statistical analysis and business improvement purposes.

8. International Data Transfers

Roadware Incorporated is based in St. Paul, Minnesota, in the United States. Personal information we collect is processed and stored in the United States. If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, please be aware that the United States is not considered by the European Commission to provide an adequate level of data protection equivalent to that provided under European law for general data transfers.

Transfer Mechanisms for EEA and UK Users:

Standard Contractual Clauses (SCCs): For transfers of personal data from the EEA to the United States, we rely on the European Commission’s Standard Contractual Clauses (2021 SCCs, implementing Commission Implementing Decision (EU) 2021/914) as our primary transfer mechanism. This applies to data transferred to our data processors, including Automattic, Inc.
UK International Data Transfer Agreements (IDTAs): For personal data originating from the United Kingdom, we rely on the UK International Data Transfer Agreement (IDTA) approved by the UK Information Commissioner’s Office as the applicable transfer mechanism.
Swiss Transfers: For personal data originating from Switzerland, we rely on the Swiss Federal Data Protection Act (revFADP) and applicable transfer mechanisms recognized by the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Automattic / WordPress Transfer Coverage: Automattic has executed Standard Contractual Clauses as part of its Data Processing Agreement covering transfers of EEA and UK user data. Details are available at wordpress.com/support/data-processing-agreements/.

You may request a copy of the applicable Standard Contractual Clauses or UK IDTA that govern our data transfers by contacting us at the address provided in Section 1. We will provide these documents within a reasonable time of your request.

9. Your Rights and Choices

Depending on your location and the applicable law, you may have certain rights with respect to your personal information. This section describes those rights and how to exercise them. We are committed to responding to all rights requests promptly and in accordance with applicable law.

9.1 Rights of All Users (Global)

Regardless of your location, the following rights and choices are available to all users of ConcreteMender.com:

Right to Be Informed: This Privacy Policy fulfills our obligation to inform you about how we collect, use, and share your personal information.
Opt Out of Marketing Emails: If you receive marketing or promotional emails from us, you may opt out at any time by clicking the “Unsubscribe” link in any marketing email, or by contacting us at [email protected]. You will continue to receive transactional emails related to any active orders or your account.
Cookie Management: You may manage cookie preferences by adjusting your browser settings or by using the cookie consent banner displayed on your first visit to the site (EEA/UK users). See Section 5.4 for details.
Accuracy of Information: If you believe any personal information we hold about you is inaccurate, you may update it by logging into your WooCommerce account or by contacting us directly.

9.2 Rights of EEA and UK Residents (GDPR / UK GDPR)

If you are located in the European Economic Area or the United Kingdom, you have the following rights under the General Data Protection Regulation (GDPR) and/or UK GDPR with respect to your personal data that we process:

Right of Access (Article 15 GDPR): You have the right to request confirmation of whether we process personal data about you, and if so, to receive a copy of that personal data along with supplementary information about how it is used.
Right to Rectification (Article 16 GDPR): You have the right to request that we correct any inaccurate personal data we hold about you, and to complete any incomplete personal data.
Right to Erasure / “Right to Be Forgotten” (Article 17 GDPR): You have the right to request that we delete your personal data in certain circumstances, including where it is no longer necessary for the purpose it was collected, where you have withdrawn consent, or where you object to processing. This right is subject to exceptions, including where we are required to retain data to comply with a legal obligation.
Right to Restriction of Processing (Article 18 GDPR): You have the right to request that we restrict our processing of your personal data in certain circumstances, such as where you contest the accuracy of the data or object to processing, while we verify or review your request.
Right to Data Portability (Article 20 GDPR): Where processing is carried out by automated means on the basis of your consent or performance of a contract, you have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
Right to Object (Article 21 GDPR): You have the right to object at any time to processing of your personal data where that processing is based on legitimate interests (Article 6(1)(f)), including where such processing is used for profiling. We will cease processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or the processing is necessary for the establishment, exercise, or defense of legal claims. Where personal data is processed for direct marketing purposes, you have an absolute right to object at any time.
Rights Related to Automated Decision-Making and Profiling (Article 22 GDPR): We do not make solely automated decisions (decisions made without any meaningful human involvement) that produce legal effects or similarly significantly affect you. If we were to implement such processing in the future, we would notify you and provide the rights set out in Article 22.
Right to Withdraw Consent: Where we process your personal data on the basis of consent (such as for marketing emails), you have the right to withdraw that consent at any time by contacting us or using the unsubscribe mechanism. Withdrawal of consent does not affect the lawfulness of processing that occurred prior to withdrawal.
Right to Lodge a Complaint: You have the right to lodge a complaint with the data protection supervisory authority in your country of residence or habitual place of work if you believe our processing of your personal data infringes applicable data protection law. In the United Kingdom, the relevant authority is the Information Commissioner’s Office (ICO) at ico.org.uk. A full list of EU data protection authorities (DPAs) is available at edpb.europa.eu. We encourage you to contact us first so that we have an opportunity to resolve your concern.

How to Exercise Your GDPR Rights: Submit a written request by email to [email protected], or by post to the address in Section 1. Please describe your request with sufficient detail to allow us to identify your personal data and respond effectively. We will respond within 30 days of receipt of a valid request. For complex or numerous requests, we may extend this period by up to two additional months, in which case we will notify you within the initial 30-day period and explain the reason for the extension. We will not charge a fee for handling a rights request unless the request is manifestly unfounded or excessive, in which case we may charge a reasonable administrative fee or decline to respond, with written explanation.

9.3 Rights of California Residents (CCPA / CPRA)

If you are a resident of California, you have the following rights under the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (effective January 1, 2023) (collectively, “CCPA/CPRA”):

Right to Know (Cal. Civ. Code § 1798.110): You have the right to request that we disclose the categories of personal information we have collected about you, the specific pieces of personal information collected, the categories of sources from which it was collected, the business or commercial purposes for which it was collected, and the categories of third parties with whom we shared it during the preceding 12 months.
Right to Delete (Cal. Civ. Code § 1798.105): You have the right to request that we delete personal information we have collected from you, subject to certain exceptions. Exceptions include, without limitation: completing a transaction you requested; providing goods or services requested; complying with a legal obligation; detecting security incidents or protecting against malicious activity; exercising free speech or another legal right; and conducting research in the public interest.
Right to Correct (Cal. Civ. Code § 1798.106): You have the right to request that we correct inaccurate personal information we maintain about you, taking into account the nature of the information and the purposes of the processing.
Right to Opt Out of Sale or Sharing (Cal. Civ. Code § 1798.120): You have the right to opt out of the sale of your personal information or the sharing of your personal information for cross-context behavioral advertising. Roadware Incorporated does not sell personal information for monetary consideration. To the extent that our use of analytics tools or other third-party services constitutes “sharing” of personal information under the CPRA’s broad definition, you may exercise your opt-out right as described in the notice box below.
Right to Limit Use of Sensitive Personal Information (Cal. Civ. Code § 1798.121): To the extent we collect sensitive personal information (as defined under the CPRA), you have the right to direct us to limit its use and disclosure to those uses that are necessary to perform the services or provide the goods requested by you. As noted in Section 3.4, we do not intentionally collect sensitive personal information through ConcreteMender.com. To submit a “Limit Sensitive PI” request, contact us using the information in Section 1.
Right to Non-Discrimination (Cal. Civ. Code § 1798.125): Roadware Incorporated will not discriminate against you for exercising any of your CCPA/CPRA privacy rights. We will not deny you goods or services, charge you a different price, provide you a different quality of goods or services, or retaliate against you based on your exercise of privacy rights under the CCPA/CPRA.
Shine the Light Law (Cal. Civ. Code § 1798.83): California residents may request information once per calendar year about the categories of personal information, if any, that Roadware disclosed to third parties for those third parties’ direct marketing purposes during the preceding calendar year. To make such a request, contact us at the information provided in Section 14.

How to Submit a California Rights Request: You may submit a verifiable consumer request through any of the following methods:

(a) Email: [email protected]
(b) Phone: 1-651-457-6122
(c) Online Web Form: [Contact Roadware]

We will confirm receipt of your request within 10 business days and will respond substantively within 45 days of receipt. We may extend this response period by an additional 45 days, for a total of 90 days, where reasonably necessary, and will provide you with written notice of the extension and the reason within the initial 45-day period. We will verify your identity prior to processing your request using reasonable verification methods that are proportionate to the sensitivity of the information requested. For requests to access or delete specific pieces of personal information, additional verification steps may be required. We will not charge a fee for processing a rights request unless the request is manifestly unfounded or excessive.

⚑ Do Not Sell or Share My Personal Information

Roadware Incorporated does not sell your personal information to third parties for monetary consideration. To the extent that our use of Jetpack Stats, WordPress.com analytics, or other analytics or technology partners constitutes “sharing” of personal information for cross-context behavioral advertising under the California Privacy Rights Act (CPRA), you may opt out of such sharing at any time through the following mechanisms:

Click the “Do Not Sell or Share My Personal Information” link located in the footer of ConcreteMender.com;
Submit an opt-out request by email to Admin or
Use a browser-based Global Privacy Control (GPC) signal, which we will recognize and honor as a valid opt-out request consistent with CPRA requirements.

We will process your opt-out within 15 business days of receipt and will direct our service providers to cease the relevant sharing activities promptly thereafter.

Authorized Agents: California residents may designate an authorized agent to submit rights requests on their behalf. To use an authorized agent, the resident must provide the agent with written, signed authorization to act on the resident’s behalf, and a copy of that authorization must accompany the request. Roadware may require direct verification of the resident’s identity and confirmation of the authorization before processing the request, except where the agent presents a valid power of attorney executed under California Probate Code sections 4000–4465.

9.4 Rights of Residents of Other U.S. States

Residents of the following states with comprehensive state privacy laws may have rights similar to those described in Section 9.3, including the right to access, delete, correct, and opt out of targeted advertising and, in some cases, profiling:

Virginia — Virginia Consumer Data Protection Act (VCDPA)
Colorado — Colorado Privacy Act (CPA)
Connecticut — Connecticut Data Privacy Act (CTDPA)
Texas — Texas Data Privacy and Security Act (TDPSA)
Other states that have enacted or may in the future enact comprehensive consumer privacy legislation

If you are a resident of one of these states and wish to exercise applicable privacy rights, please contact us using the information in Section 14. We will evaluate and respond to your request in a manner consistent with the privacy law applicable to your state of residence. Response time frames vary by state law but we aim to respond within 45 days for all state privacy law requests.

10. Children’s Privacy

ConcreteMender.com is intended for adult professional users, contractors, and consumer purchasers of concrete repair products. The website is not directed to children, and we do not knowingly market to or solicit personal information from children.

Users in the United States: We do not knowingly collect personal information from children under the age of 13, consistent with the requirements of the Children’s Online Privacy Protection Act (COPPA), 15 U.S.C. §§ 6501–6506.
Users in the EEA and UK: We do not knowingly collect personal information from children under the age of 16 without verifiable parental or guardian consent, consistent with Article 8 of the GDPR and applicable national age thresholds for digital consent.
If we discover that we have inadvertently collected personal information from a child below the applicable age threshold, we will promptly delete that information from our records and notify the parent or guardian where feasible.
Parents or legal guardians who believe that we may have inadvertently collected personal information from a child should contact us immediately at [email protected] so that we can take appropriate remedial action.
Consistent with CPRA Section 1798.120(c), Roadware Incorporated does not sell or share the personal information of consumers under 16 years of age without affirmative, opt-in authorization from either the consumer (if between 13 and 16 years of age) or the consumer’s parent or guardian (if under 13 years of age).

11. Security

Roadware Incorporated takes the security of your personal information seriously and implements reasonable and appropriate administrative, technical, and physical safeguards to protect personal information from unauthorized access, disclosure, alteration, loss, or destruction. Our security measures include, but are not limited to:

Encryption in Transit: ConcreteMender.com uses SSL/TLS (HTTPS) encryption to protect personal information transmitted between your browser and our web server.
Access Controls: Access to personal information on internal systems is restricted to authorized personnel on a need-to-know basis, and is protected by strong authentication requirements.
Software Security: We maintain our WordPress installation, WooCommerce platform, and Jetpack plugins with regular software updates and security patches to reduce vulnerability exposure.
Spam and Malicious Content Filtering: We use Akismet, operated by Automattic, to detect and filter spam and malicious content submitted through contact forms and comment fields.
Payment Card Data Security: Full payment card numbers and sensitive cardholder data are processed through PCI-DSS compliant third-party payment processors. We do not store, transmit, or have access to full card numbers, expiration dates, or security codes on our own servers.
Vendor Security: We require our data processors and service providers to maintain appropriate security measures consistent with industry standards and applicable law.

Security Limitation Notice

While we implement industry-standard security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee the absolute security of personal information transmitted to or stored on our systems. In the event of a data security incident that triggers notification obligations under applicable law (including, without limitation, U.S. state data breach notification laws and GDPR Article 33/34), we will notify affected individuals and relevant regulatory authorities as required by law and within the required timeframes. You are encouraged to use strong, unique passwords for your account and to contact us immediately if you suspect unauthorized access.

12. Third-Party Links

ConcreteMender.com may contain hyperlinks to third-party websites, including the websites of authorized Roadware distributors, industry partners, product resource libraries, and other external resources. These links are provided for your convenience and informational purposes only.

This Privacy Policy applies solely to ConcreteMender.com and does not govern the privacy practices of any third-party website. Roadware Incorporated has no control over, and accepts no responsibility for, the content, privacy policies, or practices of any third-party website. We encourage you to review the privacy policy of every website you visit before providing any personal information. The inclusion of a link on ConcreteMender.com does not constitute an endorsement or recommendation by Roadware Incorporated of the linked website or its operator.

13. Changes to This Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect changes in our data processing practices, the services we offer, applicable law, or regulatory guidance. When we make changes, we will:

Post the revised Privacy Policy on this page with an updated “Last Updated” date at the top of the document;
For material changes—meaning changes that materially affect your rights or how we use your personal information—provide prominent notice on the ConcreteMender.com homepage and/or notify registered account holders by email at least 30 days before the changes take effect;
For minor or clarifying changes, post the updated policy without additional advance notice.

Your continued use of ConcreteMender.com after the effective date of a revised Privacy Policy constitutes your acknowledgment of the revised policy, to the extent permitted by applicable law. If you do not agree with the revised policy, you should discontinue use of the website and may exercise any applicable rights to delete your account and personal information as described in Section 9.

We will maintain a version history or archive of prior versions of this Privacy Policy, which will be available to you upon request submitted to the contact information in Section 14.

14. Contact Us

For any privacy-related inquiries, data subject rights requests, complaints, questions about this Privacy Policy, or to request a copy of applicable Standard Contractual Clauses or prior policy versions, please contact us by any of the following means:

Roadware Incorporated
Attn: Privacy Inquiries
381 Bridgepoint Way
South St. Paul, Minnesota 55075
United States

Email: [email protected]
Phone: 1-651-457-6122
Website: ConcreteMender.com

We aim to acknowledge all privacy inquiries within 5 business days of receipt and to resolve or substantively respond within the timeframes required by applicable law.

EEA and UK Users: In addition to contacting us directly, you also have the right to lodge a complaint with the data protection supervisory authority in your country of residence. In the United Kingdom, this is the Information Commissioner’s Office (ICO) at ico.org.uk. A directory of EU national data protection authorities is maintained by the European Data Protection Board at edpb.europa.eu. We encourage you to contact us first so that we may have the opportunity to address your concern before you escalate to a supervisory authority.

APPENDIX A: CCPA Personal Information Categories Collected

The following table summarizes the categories of personal information we collect and disclose, as defined under the California Consumer Privacy Act (Cal. Civ. Code § 1798.140), for the 12-month period preceding the effective date of this policy.

CCPA Category	Examples Collected by Roadware	Disclosed to Third Parties?	Sold?	Shared for Cross-Context Behavioral Advertising?
A. Identifiers	Full name, email address, billing address, shipping address, phone number, IP address, browser identifiers	Yes — service providers (Automattic, payment processors), authorized distributors	No	No
B. Customer Records (Cal. Civ. Code § 1798.80)	Name, postal address, phone number, payment method type (card brand/last four digits only)	Yes — payment processors, service providers	No	No
C. Commercial Information	Products purchased, order history, cart contents, products browsed	Yes — service providers, authorized distributors	No	No
D. Internet / Electronic Network Activity	Pages visited on site, referring URLs, clickstream data, search queries on site, browser/device interaction data	Yes — analytics service providers (Automattic/Jetpack, Google Analytics if applicable)	No	Limited — analytics use only; no behavioral advertising
E. Geolocation Data	Approximate location derived from IP address (country, region, city level)	Yes — analytics service providers	No	No
F. Inferences	Aggregated profiles reflecting site usage patterns and product interests, derived from browsing data	Yes — analytics service providers (in aggregate)	No	No
G. Sensitive Personal Information	Not intentionally collected through ConcreteMender.com	N/A	No	No

Note: “Disclosed to Third Parties” in this table refers to disclosures to service providers, contractors, and authorized distributors for business purposes as described in this Privacy Policy. Such disclosures are not considered “sales” under the CCPA/CPRA. “Sold” means disclosed in exchange for monetary or other valuable consideration as defined by Cal. Civ. Code § 1798.140(ad).

APPENDIX B: Legal Bases for Processing (GDPR Summary Table)

The following table summarizes the legal bases under Article 6 of the General Data Protection Regulation (Regulation (EU) 2016/679) upon which Roadware Incorporated relies for each category of processing activity involving personal data of EEA and UK residents. This table is provided for transparency consistent with GDPR Articles 13 and 14.

Processing Activity	Personal Data Categories	GDPR Legal Basis	Article Reference
Order fulfillment — processing, shipping, and delivering products purchased through WooCommerce	Identifiers, commercial information, financial transaction data	Performance of a contract to which the data subject is a party	Art. 6(1)(b)
Customer account creation and management	Identifiers, account credentials (username, hashed password)	Performance of a contract to which the data subject is a party	Art. 6(1)(b)
Customer service and contact form response	Identifiers, communications content	Legitimate interests of the controller (responding to customer inquiries); performance of a contract where the inquiry relates to an existing order	Art. 6(1)(f); Art. 6(1)(b)
Sending marketing and promotional emails (opted-in subscribers only)	Identifiers, email address	Consent of the data subject (freely given, specific, informed, and unambiguous; withdrawable at any time)	Art. 6(1)(a)
Website analytics, traffic analysis, and service improvement	Internet/electronic activity, device identifiers, approximate geolocation	Legitimate interests of the controller (understanding and improving website performance and user experience)	Art. 6(1)(f)
Security monitoring, fraud prevention, and malicious activity detection	Internet/electronic activity, IP addresses, identifiers	Legitimate interests of the controller (securing the website and protecting users and the business); legal obligation where notification is required by law	Art. 6(1)(f); Art. 6(1)(c)
Legal compliance, tax record-keeping, and responding to legal process	All data categories, as applicable and required by law	Compliance with a legal obligation to which the controller is subject (including tax, accounting, and record-keeping obligations)	Art. 6(1)(c)
Sharing data with authorized Roadware distributors for sales support	Identifiers, commercial information	Legitimate interests of the controller (supporting authorized distribution channels and providing customers with regional service options); balanced against data subject interests	Art. 6(1)(f)

For processing based on legitimate interests (Article 6(1)(f)), Roadware Incorporated has conducted a balancing test and determined that in each case, our legitimate interests are not overridden by the fundamental rights and freedoms of the data subjects concerned, given the context and nature of the processing, the reasonable expectations of data subjects, and the safeguards implemented. Data subjects have the right to object to processing based on legitimate interests at any time by contacting us as described in Section 9.2.

This document was prepared for publication on ConcreteMender.com.

Roadware Incorporated

Privacy Policy

Privacy Policy

Table of Contents

1. About Us / Identity of the Data Controller

2. Scope and Applicability