Z Natural Foods · Privacy, choice & support
Privacy Policy
Understand your information. Make your choices. Reach us when you need help.
How we collect, use, share, and protect personal information—including cookies, website chat, and optional accessibility preferences—and how to exercise your rights.
Reading & navigation tools
Use your browser’s zoom and reading features, or ask for accessibility help or an alternative format.
On this pageShow or hide the section guide
24 sections available. Search filters this guide only.
Privacy at a glance
We use information to provide shopping and support, operate and secure our Services, meet legal responsibilities, and carry out permitted marketing. You can manage cookies and advertising, unsubscribe from marketing, and request applicable access, correction, deletion, or other privacy rights. A cookie choice does not automatically change email or text preferences.
Notice at Collection
We collect contact and account details; transaction and shipping records; device and browsing activity; communications and content; preferences; relevant inferences; and limited sensitive or health-related information. Section 5 explains the categories, Section 7 the purposes, Section 9 recipients, and Section 11 retention. Advertising disclosures can be treated as sale or sharing. Use Your Privacy Choices / Do Not Sell or Share and review California disclosures.
Read the full Policy below for details.
Scope and how our policies work together
This Policy explains how Z Natural Foods LLC (ZNF, we, us, or our) processes personal information through our website, commerce, communications, and related Services. It covers visitors, customers, business contacts, and inquiries; separate employment notices may apply.
Visiting, shopping, or reading this Policy does not itself constitute consent to optional tracking, marketing, recording, sensitive-data processing, or arbitration. Separate legally required permission remains necessary.
This Policy supplies baseline disclosures. The Cookie Policy, Your Privacy Choices, U.S. State Privacy Addendum, International Addendum, EEA/UK/Switzerland Notice, and specific collection notices supplement their subjects. Mandatory law and binding, more protective privacy commitments prevail over conflicting general terms, including the Terms of Use.
Independent marketplaces, payment providers, and other services control some processing under their own notices. ZNF remains responsible for its processing and providers acting for us.
Section guide ↑Who is responsible for your information
Z Natural Foods LLC is responsible for the processing described here and acts as controller where applicable. We operate from West Palm Beach, Palm Beach County, Florida.
Z Natural Foods LLC5407 N Haverhill Rd, Unit 336
West Palm Beach, FL 33407, United States
Privacy: privacy@znaturalfoods.com
EEA/UK/Switzerland: GDPR@znaturalfoods.com
Telephone: 1-888-963-6637
No legal citation or representative is needed to ask for help. See Sections 17 and 22.
Section guide ↑Services, cookie banner, and live chat
We cover browsing, purchases, accounts, subscriptions, quotes, wholesale inquiries, pickup, shipping, returns, reviews, support, and programs you join. This includes in-person sales and, where offered, manufacturing, private-label, government, institutional, and drop-shipping transactions. Marketplace data is covered to the extent ZNF receives and uses it.
Cookie banner and preference center
Our iubenda-supported banner and privacy controls explain cookie and similar-technology choices. They process selections, consent or withdrawal status, timestamps, preference identifiers, and relevant device or regional information to present, remember, and document choices. Consent records may be stored by our consent provider as well as on your device. Section 10 explains acceptance, rejection, customization, withdrawal, and opt-outs.
Necessary technologies deliver pages, secure sessions, support a requested checkout, or remember privacy choices. Optional analytics, advertising, personalization, and embedded services follow applicable permission or opt-out rules. A “functional” label, server-side operation, or absence of conventional cookies does not itself create an exemption.
Website live chat and Richpanel
We use Richpanel for customer conversations. ZNF and Richpanel process messages and responses, contact details and attachments you provide, timestamps, and technical/session information needed for chat. Relevant account, order, delivery, or support history may be linked to your inquiry.
Conversations are saved as support transcripts to answer questions, manage orders or complaints, follow up, maintain service history, review service quality, and address safety, security, or legal matters. Authorized personnel and supporting providers may access them. See Sections 9, 11, and 15 for recipients, retention, and transfers. See Richpanel’s privacy information; send ZNF privacy requests to us.
Required notice and consent precede covered chat collection or recording. Opening this Policy or browsing is not permission for interception or unrelated uses. Saved chat text is distinct from call recording, microphone/camera activation, or session replay. Those features require their own accurate notice and any necessary permission.
If automated assistance is offered, we identify it before the interaction. Tools may use messages and relevant support context to suggest answers, summaries, or routing. Contact Customer Care for human assistance. Chat is not marketing enrollment, and a general chat notice does not authorize unrelated general-purpose AI training on private conversations.
Share only what is needed. Do not send passwords, authentication codes, full card details, identity documents, diagnoses, or medical records through chat. For sensitive safety details, ask for an appropriate channel. Use email or telephone support if preferred or chat is inaccessible. Those communications also follow this Policy.
Where privacy laws apply
Rights depend on the person, processing, territorial scope, thresholds, and exemptions. Florida operations do not exclude duties elsewhere; global website availability alone does not trigger every foreign law.
Florida: the Digital Bill of Rights has a narrow full-controller definition. Section 501.715 separately restricts sensitive-data sales by a broader group; its scope is not limited by the billion-dollar revenue threshold. Required prior consent and statutory notices apply before covered sales. Florida security, breach, recording, and consumer-protection rules may apply independently.
United States: federal consumer-protection, children’s privacy, communications, and relevant security rules supplement state laws. Sensitive-data and consumer-health rules can apply without the usual volume or revenue thresholds. Wellness commerce does not automatically make ZNF a HIPAA covered entity or make shopping records HIPAA-protected.
International: offering goods to or monitoring people in the EEA/UK may trigger local data-protection rules. Swiss, Canadian, and other laws have their own scope. Sections 8, 15, and 17 and our supplemental notices address applicable bases, transfers, and rights. Mandatory protections prevail.
Section guide ↑Information we collect
Categories depend on your interaction. Sections 6–11 explain sources, purposes, bases, recipients, and retention; Section 16 supplies California disclosures.
- Identifiers and contacts
- Name, billing/delivery addresses, email, phone, business name, account identifier, and order or quote references.
- Accounts, purchases, and programs
- Products viewed, searched, saved, ordered, subscribed to, reviewed, or returned; quantities, prices, payment status, discounts, history, and program participation.
- Payment and fraud information
- Billing details, authorizations, references/tokens, status, fraud indicators, and proportionate identity or authority verification. Payment providers handle credentials through their interfaces; do not send full card details to support.
- Shipping, pickup, and business records
- Recipient and representative details, signatures, delivery instructions, tracking, claims, freight/customs records, purchasing authority, business role, and necessary tax/resale documents.
- Device and online activity
- IP address, device/browser information, online identifiers, approximate network-derived location, referrals, searches, page/product interactions, timestamps, diagnostics, and security events. Permitted cookies, local storage, pixels, and server integrations contribute data.
- Communications and content
- Chats, emails, tickets, texts, voicemail, complaints, attachments, surveys, reviews, ratings, and submitted media. Recording or transcription requires the notice and permission applicable to the activity.
- Preferences and permissions
- Cookie/advertising choices, marketing consent or withdrawal, language, campaign engagement, and optional accessibility preferences in Section 18.
- Inferences and automated outputs
- Product interests, audiences, recommendations, risk indicators, and support outputs derived from relevant data, subject to purpose and sensitive-data limits. These may be inaccurate.
- Safety, security, and legal records
- Adverse-event reports, recalls, incidents, disputes, lawful verification, and necessary tax, customs, or compliance records. Facility/pickup images or surveillance, where used, require appropriate notice and safeguards.
Sensitive information
Ordinary shopping does not require a diagnosis, genetic/biometric identifier, religious/political belief, or unrelated family information. Credentials, payment-security data, necessary government identifiers, health communications, and some inferences receive special protection. Processing requires a specific lawful purpose and the required consent or authorization. A request from us does not remove a legal restriction.
Provide precise device location, identity documents, or sensitive information only through an explained feature or secure request. Sensitive-data consent, limit rights, and withdrawal are separate from advertising choices. Consent cannot authorize a prohibited activity. Where Maryland’s law applies, sensitive-data collection, processing, and sharing must be strictly necessary to provide or maintain the specific product or service you requested; sensitive-data sales are prohibited. Where Oregon’s law applies, precise-geolocation sales are prohibited.
Consumer health data
Health-concern searches, dietary preferences, purchases, messages, safety reports, and inferences may be consumer health data. Our separate Consumer Health Data Privacy Notice explains covered categories, purposes, sources, disclosures, consent, and rights. Contact privacy@znaturalfoods.com for access, withdrawal, deletion, or required recipient information.
Covered collection or sharing requires its own consent unless a specific exception applies. A sale requires separate valid authorization where allowed; we do not sell sensitive data where prohibited, including covered Maryland data. We do not use prohibited healthcare-facility geofences to identify or track people seeking care.
Where information comes from
- You: orders, accounts, messages, chat, reviews, uploads, surveys, and enrollments.
- Devices: page requests, technical signals, interactions, and permitted tracking technologies.
- Providers: commerce, payment, shipping, communications, review, marketplace, advertising, analytics, and security services.
- Authorized people: gift purchasers, business contacts, pickup representatives, recipients, and agents.
- Lawful public and business sources: relevant verification, sanctions, carrier, customs, and legal records.
- Derived information: support summaries, preferences, audience signals, or risk indicators from the data described above.
Provide another person’s information only with appropriate authority and required permission. ZNF retains its own duties. Public browsing needs no account, but technical data may still be processed. Orders require payment and delivery information.
Section guide ↑Why we use information
- Requested services: commerce, payments, accounts, subscriptions, quotes, delivery, pickup, customs, returns, and programs you choose.
- Support: answer inquiries; maintain service history; handle complaints; send order, safety, security, and account messages.
- Reliability: prevent fraud, secure systems, diagnose errors, and investigate incidents.
- Optional features: publish submitted reviews and administer feedback, loyalty, referrals, and saved products.
- Permitted marketing: analytics, campaign measurement, personalization, advertising, and direct marketing, subject to consent, opt-outs, and sensitive-data restrictions.
- Legal and business needs: tax, accounting, lawful records, safety, recalls, professional support, claims, and genuine corporate transactions.
Collection and use must meet the applicable necessity and purpose limits. New incompatible uses require the applicable notice and lawful basis before they begin. We may create aggregated or deidentified information for analysis and improvement, applying required safeguards and reidentification restrictions. Hashed or persistent identifiers are not automatically anonymous.
Section guide ↑Legal bases, consent, and automated decisions
Where EEA/UK law requires a lawful basis, the following explains the basis associated with the relevant purpose. Other countries may use different permission rules.
- Contract or requested pre-contract steps
- Information objectively necessary to take, pay for, fulfill, or support your requested order or quote and administer the service you request. Optional advertising is not necessary merely because our terms mention it.
- Legal obligation
- Processing required by a law applicable to us, such as tax, accounting, product-safety, valid legal-process, or privacy-rights obligations.
- Legitimate interests
- Proportionate security, fraud prevention, business-contact management, service support and improvement, and establishment or defense of claims, after considering your interests and rights. This basis does not replace a required cookie or marketing consent.
- Consent
- Optional tracking or marketing, certain sensitive-data activities, and other processing requiring permission. Consent must be informed, specific, freely given, and affirmative where required. You can withdraw through the relevant control or by contacting us; withdrawal does not invalidate earlier lawful processing.
- Vital interests
- Exceptional processing necessary to protect a person’s vital interests where the relevant law permits it; routine commercial convenience is not a vital interest.
Special-category health or other sensitive information also requires an applicable additional condition, such as explicit consent, a specific legal-claims condition, or another narrowly applicable legal exception. Where consent is the only available basis and you withdraw it, we stop the covered processing, subject to lawful retention obligations.
Automation and AI
Automated processing may support fraud screening, recommendations, search, advertising, and support. The particular feature and its data use determine which rights apply. This Policy is not permission to deploy every possible AI use or to reuse private chats for unrelated model training.
If a covered decision produces legal or similarly significant effects, you may have rights to information, an explanation, correction, objection or opt-out, human review, and a way to contest the result. Minnesota residents may also have applicable rights to question profiling results, understand the reason and possible alternative outcome, and seek reevaluation after correcting data. Contact us about the specific decision. Where required, we provide a pre-use notice and conduct the relevant assessment before processing. Provider-made financing decisions follow the provider’s notice and applicable rights.
Section guide ↑Who receives information
Relevant disclosures follow the purposes and choices in this Policy. A provider’s role depends on its actual processing and contracts; a “service provider” label alone does not exclude sale or sharing.
- Commerce, payments, and delivery
- Shopify supports commerce/accounts; services such as PayPal handle payments. ShipStation and logistics providers receive delivery, freight, pickup, or claim details. Selected financing and marketplace services may act independently.
- Infrastructure and diagnostics
- Cloudflare supports hosting, content delivery, and security. Monitoring providers receive relevant device, error, or event data. Sensitive forms and conversations should be excluded from general diagnostics.
- Support and communications
- Richpanel supports chat and service history. Messaging providers, including Klaviyo for relevant functions, receive contact, permission, communication, and associated customer data. Support does not authorize unrelated advertising use of private conversations.
- Reviews and programs
- Services such as Judge.me and providers for programs you use receive submitted content and relevant publication, verification, or participation details. Public submissions can be indexed or copied by others.
- Advertising and analytics
- Google and Meta audience/advertising services may receive online identifiers, page/product events, approximate location, conversion information, and lawful matching identifiers. Hashed contact identifiers remain personal information when linkable. Klaviyo audience integrations may support these transfers. Section 10 explains choices.
- Safety, professional, and legal recipients
- Relevant advisers, insurers, safety counterparties, regulators, courts, or authorities receive information when necessary and lawfully justified. Section 19 explains limits.
- Business transfers and your directions
- Genuine proposed or completed corporate transactions require appropriate protections and notices. We also disclose to recipients you lawfully direct us to use.
Advertising recipients / Rhode Island: the named businesses relevant to these advertising and audience integrations are Google LLC, Meta Platforms, Inc., and Klaviyo, Inc. Their roles vary by service. Where a disclosure is a statutory sale, these are businesses to whom information may be sold. You can request required actual-recipient information under Section 17. This does not authorize unrestricted onward use.
Private chats, identity/payment records, and privacy/accessibility requests are not public submissions and are excluded from public-content licenses. Required notices precede material changes to disclosed processing.
Section guide ↑Cookies, advertising, and your choices
What tracking can involve
Cookies and similar technologies can recognize a browser, remember a preference, measure activity, and support advertising. Pixels, tags, local storage, device identifiers, and server-to-server events may perform similar functions. Advertising and audience matching can constitute a sale, sharing, or targeted advertising under privacy law even when no money changes hands. We do not sell personal information for money; this does not exclude the advertising disclosures described here from broader legal definitions.
Accept, reject, customize, or withdraw
Use Your Privacy Choices / Cookie Preferences to reopen available controls. Where prior consent is required, optional technologies must remain off until that consent is given. You can reject optional uses, choose available purposes, and change or withdraw consent. Rejection must be as straightforward as acceptance where required, and withdrawal must be as easy as giving consent. Continued browsing, scrolling, a preselected box, or dismissing a banner is not affirmative consent.
Choosing to allow one purpose does not automatically authorize every other purpose. Necessary processing may continue to deliver a service you requested, protect it, and remember your choice. A requested chat may need limited session storage; that does not make advertising, unrelated analytics, or session replay necessary. We apply any specific statutory exception only when its conditions are met.
The consent interface may use different purpose labels by region. A saved choice does not make an otherwise prohibited use lawful. Cookie choices do not request deletion or unsubscribe you from direct marketing. Browser and server-side disclosures remain subject to applicable consent and opt-outs. If a control does not work or is inaccessible, email privacy@znaturalfoods.com or call 1-888-963-6637.
Do Not Sell or Share; targeted-advertising opt-out
You can opt out of covered sale, sharing, or targeted advertising through Your Privacy Choices. We honor legally recognized opt-out preference signals, including Global Privacy Control (GPC), as required. No account or identity verification is required for a covered browser-level opt-out. If we know the signal relates to an identifiable consumer or account, we apply it as the applicable law requires; technical inconvenience does not cancel that duty.
A signal normally communicates a choice from the browser or device sending it. Other browsers or devices may need their own signal unless the choice is linked more broadly. Clearing storage can remove a saved preference, but an active recognized signal continues to communicate the applicable opt-out. We do not treat a general “Accept all” action as permission to disregard an existing legally effective opt-out without the separately required choice. Legacy Do Not Track signals are not handled as GPC unless a law requires that treatment.
Email and text messages
Use the unsubscribe link in a marketing email, reply STOP to a reply-enabled marketing text, or contact us with a clear request to stop marketing. Other reasonable revocation methods remain available as required by law. Marketing consent is not a condition of purchase. We honor applicable deadlines, including the U.S. commercial-email deadline of ten business days and any shorter rule that applies.
Necessary order, account, security, recall, or legal messages may still be sent on an appropriate basis; we do not relabel marketing as transactional to avoid an opt-out. A request withdrawing consent from covered texts or calls is handled with the scope the law requires. See our Mobile Terms.
Loyalty, discounts, and sensitive-data limits
Participation in an optional program is voluntary. When a program is a regulated financial incentive, its separate notice must explain material terms, information involved, how to join or withdraw, and the required data-value explanation before enrollment. This Policy is not that program-specific notice. Exercising a privacy right must not result in unlawful discrimination. Consent does not permit a prohibited sensitive-data sale, targeted advertisement, or individualized-pricing practice.
How long we keep information
We keep information only as long as reasonably necessary for its disclosed purpose and applicable legal requirements. These category-specific criteria apply when a precise period cannot reasonably be specified:
- Account and contact information
- For the active relationship or requested feature, then only what remains necessary for transactions, support, security, suppression, or lawful records. Account closure does not automatically erase required order records.
- Orders, payments, shipping, and business records
- Through fulfillment and the relevant tax, accounting, customs, recall, dispute, and statutory recordkeeping periods. A preservation duty applies only to relevant records.
- Chat, email, and other support records
- Through resolution and follow-up, then for the period reasonably needed for related service history, quality review, safety, complaints, or claims. Sensitive attachments should be removed or redacted when their limited purpose ends, unless a specific lawful retention need remains.
- Device, tracking, and diagnostic data
- For the technology’s disclosed or configured duration and the relevant measurement or security purpose. Session and persistent technologies differ; review the Cookie Policy and available provider details. Continued access alone is not a reason to keep every event indefinitely.
- Reviews and program information
- For the publication or active program purpose, with removal, withdrawal, and legal obligations considered. Copies independently retained by other people may remain outside our control.
- Consent, opt-out, and request records
- For the period needed to honor your choices, prevent unwanted reenrollment, document compliance, and address related claims. A limited suppression record may remain after marketing data is removed.
- Accessibility preferences
- Temporary page settings remain in page memory. Browser-saved settings remain until reset or removed; session settings may be restored by the browser. An optional account copy can be deleted through its supported controls, subject to the handling explained in Section 18.
- Sensitive, health, security, and incident information
- For the shortest period needed for the specific authorized purpose, relevant investigation, mandatory safety or legal records, and applicable retention limits. We do not extend all sensitive-data retention merely because some records are subject to a hold.
When information is no longer needed, it is deleted or appropriately anonymized or deidentified. Backups may be cleared on their protected lifecycle only where law allows; shorter statutory deletion limits take precedence. Information retained under a valid exception is restricted to that purpose. Required deletion is reapplied if a backup is restored. A legal hold is not permission to continue marketing with retained information.
Section guide ↑Security and provider safeguards
We use reasonable safeguards appropriate to the information and applicable law, including access, secure-handling, and provider controls. No system eliminates risk; this Policy does not certify a security framework.
Required processor contracts, confidentiality, security, rights assistance, and onward-processing restrictions apply to provider relationships. Outsourcing does not remove our duties. See the Information Security Policy.
Protect your credentials and tell us about suspected unauthorized activity. Do not send passwords, authentication codes, or full card details in a report. These precautions do not transfer our legal responsibilities to you.
Section guide ↑Security incidents and breach notices
We assess suspected incidents, take appropriate response steps, and provide legally required notices. Notification rules depend on the affected information, people, jurisdictions, and statutory trigger; they do not share one clock. Florida breach duties can apply independently of its Digital Bill of Rights.
We may preserve relevant evidence and involve appropriate providers, advisers, or authorities. An incomplete investigation or confidentiality concern does not override a mandatory notice, deadline, or statutory right.
Section guide ↑Children and teenagers
Our Services are for a general audience and are not directed to children under 13. We do not knowingly collect a child’s personal information online in circumstances requiring verifiable parental consent without that consent. If you believe a child has provided information that needs special handling, contact privacy@znaturalfoods.com. We will assess and take the deletion, restriction, or other action required by law.
Where COPPA applies, parental notice, access and deletion rights, reasonable security, purpose-limited retention, and any separate consent for non-integral third-party disclosures must be provided. Adult supervision of shopping is not a substitute for a required child-privacy consent.
Teen protections may continue through age 16 or 18. Under California law, covered sale or sharing of information of a consumer known to be under 16 requires the applicable affirmative authorization, including parental authorization for a child under 13. Where a stricter law prohibits sale, targeted advertising, or covered profiling involving a minor, we do not undertake that activity; consent does not defeat the prohibition. Where applicable, Maryland prohibits sale or targeted advertising when a controller knows or should know the consumer is under 18. Oregon prohibits sale, targeted advertising, and covered profiling for consumers under 16 under its statutory knowledge standard.
Parents, guardians, and authorized representatives may contact us about a minor’s information. Any verification is proportionate to the request and required authority. A privacy request does not require sending us unnecessary identity documents or a diagnosis.
Section guide ↑International processing and rights
ZNF operates in the United States. Information may be processed there and where relevant providers, support teams, carriers, and other recipients operate. Richpanel describes service processing involving the United States, India, and other provider locations. Shipping data may reach the destination country. Laws and government-access protections differ.
Where EEA/UK/Swiss law requires a transfer safeguard, an applicable adequacy decision or appropriate contractual safeguards and required supplementary measures must support the restricted transfer. Examples include the European Commission’s standard contractual clauses with applicable UK or Swiss adaptations. A recipient’s Data Privacy Framework participation can be relied on only when its current certification and the particular transfer are covered. ZNF does not claim its own certification or that every provider transfer uses the same mechanism. You can contact GDPR@znaturalfoods.com for information about the recipients, countries, and safeguards applicable to your data and a copy or explanation where required.
Using our site is not blanket consent to international transfers. A transfer exception is not a substitute for a valid routine transfer arrangement. Our U.S. privacy mailbox is not an appointed EU, UK, or Swiss representative; where a representative is legally required, a U.S. mailbox cannot replace that appointment and its published contact details.
EEA/UK: applicable rights include access, correction, erasure, restriction, portability, objection, withdrawal of consent, and protections concerning significant automated decisions. You may object to direct marketing, including related profiling, at any time. Other legitimate-interest processing may continue only on grounds the law permits. You may complain to the relevant supervisory authority.
Switzerland: applicable rights include information, access, correction, objection and remedies, with relevant automated-decision protections. Canada: applicable federal and provincial rules may provide access, correction, withdrawal of consent subject to lawful limits, complaint rights, and transparency about foreign processing. Québec can require express consent for sensitive information, profiling/location notices, transfer assessments, and specific automated-decision information.
Other countries: local notice, consent, rights, transfer, representative, or complaint rules may also apply. Our International Privacy Addendum and EEA/UK/Switzerland Notice supplement this Policy. We preserve mandatory local rights rather than treating Florida law as their replacement.
Section guide ↑U.S. rights and California disclosures
Depending on the law that applies, you may ask to confirm processing; access, correct, or delete information; receive a portable copy; obtain required recipient information; opt out of sale, sharing, targeted advertising, or covered profiling; limit certain sensitive-data uses; withdraw consent; or appeal a denial. Some state laws exclude employment or business-contact information; California can cover it when its requirements are met. Section 17 gives the request methods.
Applicable recipient-list rights, including those provided by Oregon and Minnesota, are not limited to a generic vendor-category description when the law requires specific names. Nevada residents can submit an applicable sale opt-out to privacy@znaturalfoods.com. California residents can also contact us for an applicable Shine the Light disclosure about sharing for third parties’ own direct marketing.
California: categories and preceding 12 months
The following identifies our collection and business-purpose disclosure categories for the preceding 12 months and the categories implicated by the advertising practices described in Sections 9–10. Sources are identified in Section 6, purposes in Section 7, and retention criteria in Section 11. Sensitive information receives the additional limits in Section 5. Not every example applies to every person.
On a small screen, scroll this table horizontally to read all columns. Keyboard users can focus the table region and use the arrow keys.
| Collected category | Business-purpose recipients | Sale / sharing for advertising |
|---|---|---|
| Identifiers and customer records: contact, account, device, signature, and payment-related information | Commerce, payment, fulfillment, communications, security, and professional providers | Online and matching identifiers may be involved; payment credentials and identity documents are excluded from this advertising purpose. |
| Commercial information: products, transactions, and participation history | Commerce, fulfillment, support, program, measurement, and professional providers | Product-interest and conversion events may be involved, subject to health-data and other sensitive-data restrictions. |
| Internet activity and approximate geolocation | Hosting, security, consent, analytics, and advertising services | Browsing, interaction, online identifiers, and approximate location may be involved in covered advertising disclosures. |
| Audio, visual, and communications content | Support, relevant publication, security, safety, and legal recipients | Private chats, calls, and support uploads are not authorized for cross-context advertising. Intentional public reviews are a separate publication activity. |
| Professional and business-contact information | Business administration, verification, logistics, communications, and professional providers | Not ordinarily disclosed for cross-context advertising; a contact used in audience matching falls within the identifiers row. |
| Inferences: interests, recommendations, audiences, and risk indicators | Relevant commerce, support, security, analytics, and advertising services | Non-sensitive interest or audience inferences may be involved. Fraud indicators are used for the security purpose. |
| Sensitive personal information, including relevant health, account-security, or verification information | Limited recipients necessary for the requested service, safety, security, or legal purpose | Subject to separate consent, authorization, and statutory prohibitions; no unrestricted advertising permission is granted by this Policy. |
We do not collect every statutory example within these categories. We do not ordinarily request education records or biometric identifiers for ordinary retail transactions. Health-related information may also be a protected characteristic or sensitive information depending on its content.
California rights include knowing categories and specific information, correction, deletion, portability, opting out of sale/sharing, and limiting covered use or disclosure of sensitive personal information. An access right is not automatically limited to 12 months where the law requires access to information maintained beyond that period. You can use the Do Not Sell or Share and sensitive-information choices or contact us. We do not have actual knowledge of selling or sharing information of consumers under 16 during the preceding 12 months.
No price, service, or access penalty is imposed simply for exercising a right except a difference the applicable law specifically permits. A separate financial-incentive notice is required where applicable. The U.S. State Privacy Addendum supplements these rights; mandatory protections control any older or more general description.
Section guide ↑Requests, deadlines, appeals, and complaints
Use Your Privacy Choices, email, telephone, or the address in Section 2. Describe your request and relevant records. Your state/country helps identify rights; legal terminology, an account, a special subject line, and arbitration consent are not required.
Verification and agents
For access, correction, deletion, or similar requests, we may verify identity and authority using information proportionate to the risk. No new account or unrelated sensitive data is required. Covered opt-outs and signals do not require identity verification except where a specific legal rule permits it.
Authorized agents may act where permitted. Proof of authority and direct confirmation may be required, subject to exceptions such as a valid power of attorney. We explain lawful grounds for denying or limiting requests and available review routes. Technical difficulty is not an unlimited exception.
Deadlines and fees
Applicable clocks, permitted pauses, and extension notices govern. Verification does not automatically restart a deadline.
- California: acknowledge covered access/correction/deletion requests within 10 business days; respond within 45 calendar days, extendable by another 45 when lawfully justified and explained. Covered sale/sharing opt-outs and limit requests are implemented as soon as feasibly possible, no later than 15 business days.
- Other U.S. laws: many, including Indiana, use 45 days, with a further 45 days where permitted and explained. Iowa uses 90 days, with a further 45 days where permitted and explained. Shorter rules for particular withdrawals, opt-outs, or requests control.
- EEA/UK: without undue delay, normally one month; up to two additional months for complexity or number when permitted and explained within the initial month.
- Canada: PIPEDA access requests generally use 30 days, subject to its extensions. Provincial and other international periods differ.
Requests are free within statutory entitlements. Any permitted fee or refusal for an excessive or unfounded request follows the specific legal standard and required explanation.
Appeals
Where an appeal right applies, reply to a denial or email us asking for a privacy appeal. Identify the request and why you disagree. We review, explain the outcome within the applicable state-specific period, and provide the required regulator complaint method if denied.
Complaints
Raise a concern by email, phone, or mail, including a failed cookie/chat control. Where UK complaint rules apply, we acknowledge within 30 days, investigate and respond without undue delay, keep you informed, and provide the outcome. This does not replace a shorter data-rights deadline.
You may complain directly to the relevant attorney general or privacy regulator, the UK ICO, an EEA supervisory authority, the Swiss FDPIC, or the applicable Canadian commissioner. Internal appeals and contractual dispute procedures do not restrict non-waivable regulator or court rights.
Accessibility and preference privacy
We target WCAG 2.2 Level AA for technical design and improvement while addressing applicable disability-access and effective-communication duties. See the Accessibility Statement. For an accessible format or help with controls/verification, email Accessibility or call us. Describe the barrier and assistance needed; no diagnosis is required. Required accommodations carry no added disability-related charge.
Preference privacy
Page reading tools use temporary settings in page memory. An optional saved reading position can associate a page with your reading location in browser storage. The Accessibility Control Center can save text, contrast, spacing, motion, and pinned-control preferences in your browser without an account or advertising consent. Resetting or clearing storage removes local settings. Temporary-session mode uses session storage; browsers may restore sessions.
Where account saving is offered and affirmatively enabled, supported preferences can be associated with your account. You can disable synchronization and delete the account copy through supported controls. Deleting that copy does not remove local settings. Page-tool reset, local/global reset, and account deletion have different scopes.
Preferences provide the requested accessibility behavior. They must not be used for disability/diagnosis inference, advertising audiences, customer scoring, pricing, eligibility, or unrelated analytics. A preference is not a medical declaration. Barrier reports are support communications; the tool’s email draft is sent only if you send it.
Read-aloud prefers available local device voices and does not activate your microphone. You may allow browser or online voices for the current page session; spoken text may then be processed by your browser or operating-system speech provider under its terms. Avoid using online voices for private account or health content you do not want sent to that provider. This choice is not saved or synced. Availability depends on your browser and device. Tools supplement assistive technology and browser controls; their use is never required to read the Policy or exercise rights.
Third-party barriers do not remove ZNF’s own duties. Contact us for an effective alternative. A widget, scan, or statement cannot establish site-wide conformance. WCAG 3 remains a draft, not our conformance claim.
Section guide ↑Legal requests, safety, and protection of rights
We may use or disclose relevant information for valid legal obligations or process, proportionate fraud/security investigations, safety, recalls, or legal claims. Each disclosure requires an appropriate basis, scope, and safeguards.
Applicable confidentiality, privilege, government-access restrictions, and required notices remain effective. A legal hold does not authorize unrelated reuse. Honest reviews, protected complaints, and privacy or accessibility requests are not themselves evidence of abuse.
Section guide ↑Your rights remain protected
This Policy does not waive mandatory privacy, consumer, accessibility, complaint, or judicial rights, create arbitration assent, shorten statutory periods, or require a contractual dispute process before a privacy request.
Valid private-dispute agreements follow the Terms of Use, its exceptions and opt-outs, and mandatory law; they cannot limit regulators or non-waivable local remedies. Mandatory law controls an inapplicable or unenforceable term; other lawful disclosures remain effective.
Section guide ↑Changes to this Policy
We update the Policy and revision date as practices or requirements change, providing advance or additional notice when required. A revision cannot retroactively authorize incompatible use or erase a binding earlier privacy commitment.
We obtain additional consent or take other required steps before materially different uses where law or prior representations require them. Continued browsing does not supply separately required consent.
Section guide ↑Contact and assistance
Privacy requests and complaints
Accessible help
EEA/UK/Switzerland: GDPR@znaturalfoods.com. International telephone: +1-561-242-1880. Order/chat assistance: Orders@znaturalfoods.com. Mail can be sent to the address in Section 2.
Include a contact method and relevant details. Special subject lines are optional; avoid unrequested sensitive information.
Section guide ↑Key definitions
- Personal information / personal data
- Information identifying or reasonably linkable to a person or household, including linkable pseudonymous identifiers.
- Processing
- Collecting, using, storing, analyzing, disclosing, deleting, or otherwise handling data.
- Controller / processor
- A controller determines purposes and means; a processor acts on its behalf. Actual conduct and law determine roles.
- Sale / sharing / targeted advertising
- Legal concepts that can include advertising disclosures without cash payment. Exceptions require their legal conditions.
- Sensitive information / consumer health data
- Legally protected categories, including certain health inferences, precise location, credentials, identifiers, and minors’ data.
- GPC
- Global Privacy Control, a browser or device privacy signal recognized by certain laws.
These explanations do not narrow statutory definitions or rights.
Section guide ↑Effective date and policy versions
This revision is dated September 16, 2026 and takes effect when published by ZNF, subject to any later date or advance notice legally required. The preceding published revision was dated September 14, 2026.
Find the current Policy in our Legal Hub. Earlier binding commitments, mandatory law, and required local-language disclosures remain effective. Contact us for help identifying the version that governs your information.
Section guide ↑