Cookie Policy

1. Scope; Jurisdictional Intent; Relationship to Other Policies #

1.1 Services covered #

This Policy applies to Cookies, Similar Technologies, and Trackers used on or through ZNF-owned, ZNF-operated, ZNF-controlled, licensed, or lawfully administered services, including:

• ZNaturalFoods.com, successor domains, subdomains, mobile experiences, landing pages, and product pages;
• ecommerce storefronts, shopping carts, checkout, payment, subscription, reorder, account, and order-management functions;
• retail, wholesale, B2B, quote, invoice, freight, export, and local-pickup digital workflows;
• customer-service, chat, survey, review, loyalty, wishlist, media, accessibility-supporting, and embedded tools;
• email, SMS/MMS, and similar communications that use pixels, tags, or comparable technologies;
• Shopify-powered storefront or checkout components and other service-provider integrations; and
• marketplace, social-commerce, third-party storefront, or platform experiences to the extent ZNF controls the relevant content, tracking configuration, or privacy disclosures.

1.2 Integrated ZNF legal framework #

This Policy is incorporated into and must be read together with the following policies, each as amended from time to time:

• Terms of Use;
• Privacy Policy;
• Your Privacy Choices / Privacy Control Center;
• U.S. State Privacy Addendum;
• International Privacy Addendum;
• GDPR Statement / EEA-UK-Switzerland Privacy Notice;
• Digital Advertising & Analytics Policy;
• Information Security Policy & Responsible Vulnerability Disclosure Policy;
• Accessibility Statement;
• Mobile Terms of Service; and
• all other applicable policies posted on the ZNF Legal page (collectively, the "ZNF Legal Policies").

1.3 Order of precedence #

If there is a direct conflict among ZNF Legal Policies on the same subject matter:

1. the Terms of Use control for arbitration, class-action waiver, limitation of liability, governing law, venue, evidentiary standards, survival, and other general risk-allocation provisions;
2. the Privacy Policy controls for baseline personal-information practices and general privacy disclosures;
3. this Policy controls for Cookie-, Tracker-, browser-, device-, consent-, and preference-specific disclosures;
4. the Your Privacy Choices / Privacy Control Center notice and the U.S. State Privacy Addendum control sale, sharing, targeted advertising, universal opt-out signals, state-specific rights, and appeal processes; and
5. the International Privacy Addendum and GDPR Notice control where applicable non-U.S. laws require more specific consent, rights, complaint, or transfer treatment.

1.4 No overstatement of legal coverage #

Nothing in this Policy shall be construed as:

• an admission that every federal, state, local, or foreign law applies to ZNF in every circumstance;
• a waiver of any exemption, threshold limitation, jurisdictional defense, safe harbor, technical-feasibility limitation, privilege, or lawful exception;
• a promise that identical rights or controls exist in every jurisdiction, browser, device, platform, or third-party environment; or
• a waiver, limitation, or override of any non-waivable right or obligation under applicable law.

2. Definitions #

"Cookies" means small text files, code snippets, or identifiers placed on, stored on, or accessed from a browser, device, application, or session.

"Similar Technologies" includes pixels, tags, web beacons, embedded scripts, local shared objects, local storage, SDKs, APIs, browser or device identifiers, advertising identifiers, server-side event tools, session-replay tools, heatmaps, and comparable mechanisms.

"Trackers" means Cookies and Similar Technologies that allow ZNF or another party to access or store information on a device, use device resources, recognize a browser or device, observe interactions, or distinguish users, sessions, devices, or behaviors over time or across contexts.

"Necessary Technologies" means technologies reasonably required for service operation, security, fraud prevention, authentication, network management, checkout continuity, account functions, privacy-choice preservation, consent recordkeeping, or a service expressly requested by a user.

"Functional Technologies" means technologies used to remember choices, settings, language, region, accessibility preferences, or user-interface features.

"Analytics Technologies" means technologies used to measure traffic, interactions, site performance, engagement, conversion, attribution, diagnostics, experimentation, or related operational and business analytics.

"Advertising Technologies" means technologies used for marketing, audience building, segmentation, remarketing, retargeting, cross-context behavioral advertising, targeted advertising, attribution, ad measurement, personalization, or similar promotional purposes.

"First-Party Technologies" means technologies placed or controlled by ZNF or by a provider acting on ZNF's behalf.

"Third-Party Technologies" means technologies placed or controlled by another party, including commerce, payment, analytics, advertising, social-media, embedded-content, communication, security, or logistics providers.

"Session Technologies" generally expire when the applicable browser or session ends. "Persistent Technologies" may remain for a specified period or until deleted.

"Global Privacy Control" or "GPC" means a browser- or device-based privacy preference signal that may communicate an opt-out request where recognized by applicable law.

"Universal Opt-Out Mechanism" or "UOOM" means a legally recognized browser-, device-, or platform-level mechanism that communicates one or more privacy choices under applicable U.S. state law.

"Consent Management Platform" or "CMP" means a technology or interface used to present choices, store preferences, transmit consent or privacy signals, or manage withdrawal and opt-out records.

3. Categories of Cookies, Similar Technologies, and Trackers #

3.1 Necessary, essential, operational, and security technologies #

These technologies may be used to operate the Services, maintain cart or checkout state, authenticate sessions, prevent fraud and abuse, route traffic, provide network security, preserve privacy choices, maintain account functions, process payments, support local pickup and order management, and provide services expressly requested by a user.

3.2 Functional and preference technologies #

These technologies may remember language, country, currency, accessibility settings, account preferences, saved items, interface choices, or other features intended to make the Services more convenient or personalized.

3.3 Analytics, measurement, diagnostics, and experimentation technologies #

These technologies may measure traffic, referral sources, page use, checkout paths, errors, performance, campaign outcomes, conversions, interactions, search behavior, and aggregated or pseudonymous usage patterns. They may also support testing, site optimization, troubleshooting, fraud analysis, and operational reporting.

3.4 Advertising, attribution, personalization, and social-media technologies #

These technologies may support audience matching, remarketing, retargeting, advertising measurement, campaign attribution, content or offer personalization, social-media integrations, suppression lists, frequency control, and interest-based or targeted advertising where legally permitted.

3.5 Communications, reviews, support, and embedded-content technologies #

These technologies may support customer-service tools, forms, chat, surveys, reviews, loyalty programs, email or message engagement, media players, widgets, social content, and other embedded services.

3.6 Server-side, local-storage, and device-level technologies #

Some technologies operate through local storage, APIs, server-to-server event transmission, hashed or pseudonymous identifiers, device identifiers, consent strings, or other mechanisms that may not appear as conventional browser cookies.

4. Information Collected and Purposes of Processing #

Depending on the technology, configuration, and interaction, ZNF and its providers may collect or receive information such as:

• IP address, browser type, device type, operating system, language, time zone, and approximate location inferred from network information;
• session identifiers, device or browser identifiers, consent identifiers, and privacy-choice records;
• referral URLs, landing pages, search terms, page views, scrolls, clicks, interactions, timestamps, and session duration;
• cart, checkout, subscription, order, product-view, promotion, conversion, and transaction-related events;
• email, message, review, survey, chat, or embedded-content interaction events where legally permitted;
• security, fraud, bot, abuse, error, diagnostic, or performance information; and
• inferences, segments, audiences, or measurement outputs derived from the foregoing where legally permitted.

ZNF may use that information to:

• provide, maintain, secure, and troubleshoot the Services;
• process carts, checkouts, payments, subscriptions, orders, shipping, pickup, and customer-service interactions;
• authenticate users, prevent fraud, protect accounts, enforce rate limits, and defend against malicious automation or unauthorized access;
• remember preferences and privacy choices;
• analyze traffic, performance, merchandising, conversion, and customer journeys;
• measure, personalize, suppress, or optimize advertising and communications where permitted;
• support reviews, surveys, chat, embedded content, loyalty, and related features;
• comply with legal, regulatory, contractual, audit, security, and recordkeeping obligations; and
• preserve evidence, enforce the ZNF Legal Policies, resolve disputes, and protect ZNF, its customers, and its providers.

Tracker-derived information may constitute personal information under applicable law or may be linked with other information maintained by ZNF. Broader processing practices are described in the Privacy Policy.

5. Cookie Preferences; Consent; Withdrawal and Choice Management #

5.1 Available controls #

Where available and applicable, the Privacy Control Center or another ZNF-selected CMP may allow users to:

• accept or reject optional categories;
• withdraw or modify prior consent;
• opt out of covered sale, sharing, targeted advertising, or cross-context behavioral advertising;
• submit a privacy request or appeal; and
• review channel-specific privacy and marketing choices.

5.2 Necessary technologies #

Necessary Technologies may continue where permitted by law because they support security, fraud prevention, checkout, account, network, consent, and core service functions. Blocking them through browser settings may prevent portions of the Services from operating correctly.

5.3 Browser- and device-specific operation #

Cookie and tracker choices are often stored for the browser, device, app, session, or context in which the choice is made. You may need to repeat your selections on other browsers or devices. Clearing cookies, browser storage, app data, or privacy settings may remove stored choices.

5.4 Shopify and other consent integrations #

ZNF may use Shopify's Customer Privacy tools, iubenda, or another CMP to record and communicate choices to supported Shopify-managed surfaces and participating providers. Non-Shopify providers may require separate consent or suppression integrations. ZNF may update, replace, or supplement those integrations as technologies and legal requirements change.

5.5 Browser controls and third-party choices #

Most browsers allow users to block, delete, or restrict cookies. Operating systems, mobile devices, advertising platforms, and industry tools may also provide controls. Browser-level blocking may be less granular than a CMP and may not control server-side processing, independent third-party processing, or technologies outside that browser.

5.6 Consent-interface and withdrawal standards #

Where applicable law requires prior consent for a technology or purpose, ZNF intends its consent-management implementation to obtain the required valid consent before that optional technology or purpose is activated, except where a lawful statutory exception applies.

Where required by law, consent or preference interfaces are intended to:

• provide clear and understandable information about relevant purposes and, where required, relevant third parties or providers;
• avoid pre-selecting optional categories or treating continued browsing, silence, inactivity, or another legally insufficient act as consent;
• provide a genuine ability to decline or reject optional processing without an unlawful penalty or deceptive design;
• avoid making a legally required rejection or withdrawal path materially more difficult than the corresponding acceptance path;
• record and honor applicable consent, rejection, withdrawal, and opt-out states for the context in which the choice is made; and
• make withdrawal or revision available through a reasonably accessible method when the underlying law requires it.

ZNF may use different interface designs, categories, defaults, or regional logic when different laws validly require or permit different treatment, provided any mandatory choice or disclosure remains available.

5.7 Consent propagation across the technology stack #

Where a Cookie, Tracker, tag, pixel, SDK, server-side destination, CDN or edge function, tag-management rule, advertising integration, analytics destination, or similar technology is subject to a legally required consent or opt-out state, ZNF intends the applicable choice to be communicated and enforced across the relevant supported implementation. A policy disclosure, consent-mode signal, tag-manager setting, or vendor API is an implementation aid and does not independently authorize processing that applicable law requires to remain blocked, suppressed, or opted out.

ZNF may audit, test, reconcile, correct, or replace consent and suppression integrations when vendor changes, configuration drift, browser behavior, regional logic, server-side processing, or other technical conditions cause a mismatch between the choice presented to a user and the downstream processing state. To the fullest extent permitted by law, ZNF may use reasonable diagnostic, security, and consent-recordkeeping technologies necessary to verify and enforce privacy choices.

6. Legal Bases; Consent; Opt-Out; Jurisdiction-Specific Treatment #

ZNF's treatment of Cookies and Trackers may vary according to the user's jurisdiction, the technology involved, the purpose of processing, and applicable law. Where permitted, ZNF may rely on one or more of the following:

• necessity to provide a requested service or complete a transaction;
• security, fraud prevention, network integrity, or service-integrity needs;
• performance of a contract or steps requested before entering a contract;
• legitimate interests or analogous permitted interests where available;
• compliance with legal or regulatory obligations;
• consent, express consent, or opt-in where required; and
• opt-out, withdrawal, objection, or universal-signal mechanisms where required.

In jurisdictions requiring prior consent, ZNF intends that non-essential categories be subject to the required consent before activation. In jurisdictions primarily using an opt-out model, covered processing may occur until a valid opt-out is received, subject to applicable law and configuration. Where processing is based on consent, consent may be withdrawn using a legally recognized and reasonably available method.

Where applicable law requires a choice to be freely given, specific, informed, unambiguous, comparably prominent, or free from deceptive design, ZNF intends its consent and preference interfaces to provide the legally required choice mechanics and to avoid obtaining consent through dark patterns or other methods that applicable law treats as invalid.

6.1 U.S. federal baseline #

ZNF intends statements about Cookies, Trackers, privacy choices, and advertising practices to be accurate and not materially misleading. Federal requirements may also apply to particular data, audiences, technologies, or activities, including the Federal Trade Commission Act and, where applicable, the Children's Online Privacy Protection Act and its implementing rule. Nothing in this Policy is an admission that a sector-specific federal privacy statute applies where its statutory scope is not met.

Nothing in this Policy expands any right beyond what applicable law requires or eliminates any right that applicable law makes non-waivable.

6.2 European Union / EEA storage-and-access rules #

Where the EU ePrivacy framework or a Member State's implementing law validly applies, storing information on, or accessing information from, a user's terminal equipment generally requires the legally required clear information and consent unless a recognized exception applies, such as storage or access used solely to transmit a communication or that is strictly necessary to provide an information-society service the user explicitly requested. Personal-data processing associated with those technologies may also be governed by the GDPR and applicable national law.

6.3 United Kingdom PECR and the Data (Use and Access) Act #

Where UK law validly applies, ZNF intends to follow the Privacy and Electronic Communications Regulations (PECR), as amended. UK law may permit limited uses of certain low-intrusion storage or access technologies without prior consent when the statutory conditions are satisfied, including certain service-improvement statistics or appearance/function preferences accompanied by clear information and a simple, free means of objecting. Technologies or purposes outside an applicable exception remain subject to the consent or other requirements that UK law imposes.

6.4 Florida and other U.S. state privacy laws #

ZNF operates from Florida. To the extent the Florida Digital Bill of Rights or another U.S. state privacy law validly applies to ZNF and the processing at issue, ZNF intends to provide the legally required rights and disclosures, including applicable rights concerning targeted advertising, sale of personal data, sensitive data, recognized universal opt-out mechanisms, or other covered activities. Nothing in this Policy concedes that a particular law's applicability threshold, scope, or covered-processing requirements are met in every circumstance.

7. U.S. State Privacy Rights; Sale; Sharing; Targeted Advertising; GPC and UOOMs #

Depending on the facts and applicable law, advertising, analytics, attribution, audience, social-media, or similar technologies may involve processing characterized as:

• a sale of personal data or personal information;
• sharing of personal information;
• targeted advertising or cross-context behavioral advertising; or
• profiling subject to a statutory opt-out right.

Residents of certain U.S. states may have rights to opt out of one or more of those activities. Where required by applicable law, ZNF will process a valid Global Privacy Control (GPC), universal opt-out mechanism (UOOM), opt-out preference signal, or legally recognized successor signal for the browser or device transmitting the signal, subject to applicable scope, authentication, technical, and legal requirements.

A browser-based signal generally applies only to the browser or device that transmits it. Where applicable law requires broader account-level treatment and ZNF can reasonably associate the signal with an authenticated account, ZNF may apply the preference more broadly as required. Where a law requires a business to communicate whether a recognized signal has been processed, ZNF intends to provide the required indication through its privacy interface or another legally sufficient method.

ZNF does not represent that every disclosure, provider relationship, transfer, or advertising practice constitutes a sale, sharing, targeted advertising, or profiling in every state.

7.1 Do Not Track #

Some browsers transmit a "Do Not Track" signal. Because no single, generally accepted legal or technical standard governs all Do Not Track signals, ZNF may not respond to them uniformly unless applicable law requires otherwise. This does not limit ZNF's handling of GPC or another legally recognized UOOM.

8. International Users and Cross-Border Processing #

ZNF operates primarily from the United States and may sell or ship to users in Canada and other international jurisdictions. Tracker-derived information may be processed in the United States or in other jurisdictions where ZNF or its service providers operate.

Privacy rules differ across countries, and we want international visitors to have a clear path to the information that applies to them. Where applicable non-U.S. law validly applies, ZNF intends to address required consent, withdrawal, objection, disclosure, transfer, complaint, and data-subject rights through this Policy and the more specific:

• GDPR Statement / EEA-UK-Switzerland Privacy Notice; and
• International Privacy Addendum.

Those notices may address, where applicable, requirements arising under the EU GDPR, UK GDPR, Swiss law, Canadian privacy law, Brazil's LGPD, Australian or New Zealand privacy law, and other mandatory non-U.S. privacy regimes.

Nothing in this Policy shall be construed as an admission that ZNF is established in, specifically targets, or is subject to the law of every country to which a shipment may be sent. ZNF reserves all lawful territorial, threshold, role-based, enterprise, and other jurisdictional arguments.

9. Representative Technology and Provider Inventory #

ZNF may use or permit providers to use technologies supporting the functions described below. This table is representative, not exhaustive, and does not mean every named provider or function is active for every user, page, device, jurisdiction, or transaction.

This provider table may be horizontally scrollable at narrow widths. Use arrow keys or touch scrolling while the table region is focused.

9.1 No permanent exhaustive cookie-name list #

Cookie names, domains, providers, purposes, and durations may change because of software releases, vendor updates, security needs, A/B tests, configuration changes, region-specific settings, and user paths. Unless applicable law requires otherwise, ZNF may provide detailed names and durations through a CMP, browser-detectable inventory, provider notice, or other legally sufficient disclosure rather than maintaining a permanent name-by-name list in this Policy.

Where applicable law requires more granular provider-, purpose-, or duration-specific disclosure, ZNF intends its live consent-management platform, provider list, or another legally sufficient interface to supply that detail and to be updated as the active technology stack changes. ZNF may periodically reconcile automated scans, vendor records, tag-manager configurations, and CMP records to reduce stale or incomplete disclosures.

9.2 Provider documentation #

More current provider-specific information may be available in the relevant provider's privacy or cookie documentation, including the Shopify Consumer Privacy Policy and the privacy documentation of other providers actually used in the relevant transaction or page experience.

9.3 Consent-mode and provider-signal technologies #

Where ZNF uses Google Consent Mode, Shopify consent signals, iubenda consent strings, IAB transparency signals, or comparable provider APIs, those signals are technical mechanisms used to communicate a privacy state; they are not a substitute for the legally required notice, consent, rejection, withdrawal, or opt-out itself. ZNF intends such mechanisms to be configured and updated consistently with the legally effective choice for the relevant jurisdiction, purpose, browser, device, and provider to the extent technically supported and required by law.

10. Third-Party Technologies, Independent Controllers, and External Policies #

Third-party providers may act as ZNF's service provider, processor, contractor, independent controller, separate business, or a combination of roles depending on the service, data flow, contract, and applicable law.

Third parties may place or access their own Cookies or Trackers under their own terms and privacy notices. ZNF does not control every third-party technology, browser, operating system, platform, marketplace, ad network, embedded service, or independent use of information.

To the fullest extent permitted by law, ZNF disclaims responsibility for independent third-party practices, outages, accessibility, security, signal handling, or legal compliance, except to the extent applicable law or ZNF's direct contractual obligations provide otherwise.

ZNF may add, remove, replace, reconfigure, throttle, suppress, geofence, geoblock, or discontinue a provider or technology at any time, with or without notice, subject to applicable law.

11. Duration, Retention, Deletion, and Data Minimization #

Cookie and Tracker durations vary. Some expire at the end of a session. Others may remain until a specified expiration date, until deleted, until consent is withdrawn, until an account or service is terminated, or for another period established by ZNF or the relevant provider.

ZNF intends to retain Tracker-derived information for no longer than reasonably necessary for the disclosed or compatible purpose, subject to operational, security, fraud-prevention, transaction, tax, accounting, legal-retention, dispute, evidence-preservation, safety, and enforcement needs.

Deleting a Cookie from a browser does not necessarily delete information already transmitted to ZNF or another provider. Requests concerning retained personal information are governed by the Privacy Policy and the applicable privacy addendum.

ZNF may aggregate, de-identify, anonymize, delete, suppress, or otherwise reduce information where appropriate and legally permitted.

12. Sensitive Data, Consumer Health Data, Precise Location, and Minors #

ZNF does not intentionally deploy Cookies or Trackers for the purpose of collecting or disclosing sensitive personal information, consumer health data, precise geolocation, biometric identifiers, or other specially protected information in a manner prohibited by applicable law.

ZNF does not intend ordinary product browsing, search, cart, purchase, review, or interaction data to be used to infer a person's diagnosis, disease, treatment, symptom, reproductive status, health condition, or other protected health status for advertising or profiling where applicable law prohibits that use or requires consent or another heightened authorization.

Where a higher-risk activity requires consent, express consent, authorization, a separate notice, or another heightened legal basis, ZNF intends to use the legally required process to the extent the law validly applies. If a consumer-health-data law such as Washington's My Health My Data Act or an analogous law requires a separate consumer health data privacy policy, separate consent, or separate authorization for a processing activity that ZNF actually undertakes, that separate legally required notice or process will control for that activity. This Cookie Policy does not replace a legally required separate consumer-health-data notice.

12.1 Children and minors #

The Services are not directed to children under 13. ZNF does not knowingly use Cookies or Trackers to collect children's personal information in a manner prohibited by the Children's Online Privacy Protection Act (COPPA) or other applicable law. If ZNF becomes subject to COPPA for a covered child-directed or actual-knowledge interaction, ZNF intends to obtain verifiable parental consent where required, including any separate parental consent required for disclosure of children's personal information to third parties for targeted advertising or other covered purposes.

Where required by applicable state or international law, ZNF does not knowingly sell, share, use for targeted advertising, or otherwise process minors' personal information in a prohibited manner without the authorization, consent, or age-appropriate safeguards required by law.

Additional information concerning sensitive data and minors appears in the Privacy Policy, U.S. State Privacy Addendum, International Privacy Addendum, and applicable jurisdiction-specific notices.

13. Security, Fraud Prevention, and Service Integrity #

ZNF may use Necessary Technologies and related logs to authenticate sessions, preserve checkout integrity, detect fraud, prevent account misuse, manage bots and traffic, enforce security rules, diagnose errors, protect systems, and preserve evidence.

ZNF uses commercially reasonable administrative, technical, contractual, physical, and organizational safeguards appropriate to the circumstances. No method of transmission, storage, tracking, or digital security is completely secure, and ZNF cannot guarantee absolute security or uninterrupted operation.

More information appears in the Information Security Policy & Responsible Vulnerability Disclosure Policy.

14. Accessibility, Effective Communication, and Inclusive Access #

ZNF seeks to make this Policy and ZNF-controlled privacy-choice interfaces usable by people with a wide range of visual, auditory, mobility, speech, cognitive, neurological, and other disabilities, as well as by people using different devices, input methods, browsers, zoom levels, screen sizes, and assistive technologies. Accessibility is treated as a functional design and service requirement, not as an overlay-only feature.

14.1 Current technical baseline and enhanced usability #

For ZNF-controlled web content, WCAG 2.2 Level AA is the current stable technical benchmark. This policy fragment also incorporates selected Level AAA-oriented and usability enhancements where practical, including enlarged interactive targets, two-color focus treatment, focus-obstruction spacing, optional reading controls, color-independent link cues, responsive reflow, text-spacing resilience, reduced-motion and reduced-transparency handling, enhanced-contrast and forced-colors support, print formatting, semantic structure, and progressive enhancement.

The page is designed so that core content and navigation remain available without JavaScript. It avoids mouse-only interaction, dragging requirements, motion activation, time-limited reading, fixed-height text containers, and horizontal page scrolling at common mobile widths. The provider table changes to labeled cards on narrow screens; when horizontal scrolling is required at intermediate widths, the scroll region is keyboard focusable and described for assistive technology.

14.2 United States — ADA Title III and effective communication #

To the extent Title III of the Americans with Disabilities Act or another U.S. disability-access law applies to a ZNF service, ZNF intends to provide full and equal access, reasonable modifications, and effective communication as required by non-waivable law. The U.S. Department of Justice does not currently prescribe one detailed private-sector web technical standard under Title III; ZNF therefore uses WCAG 2.2 Level AA as a strong engineering benchmark while also evaluating whether the actual customer experience provides effective access and communication.

Where required by law and appropriate to the circumstances, an accessible alternative may include assistance by email or telephone, accessible electronic text, a screen-reader-compatible document, a plain-language explanation, a different accessible transaction or preference path, or another auxiliary aid, service, or reasonable modification that provides effective access without an unlawful surcharge.

14.3 European Union — European Accessibility Act and national implementation #

For covered consumer services within the territorial and material scope of Directive (EU) 2019/882 (the European Accessibility Act, or "EAA") and applicable national implementing laws, ZNF intends to support perceivable, operable, understandable, and robust digital access; compatibility with assistive technologies; accessible information about service functionality; and accessible support channels to the extent legally required. The EAA applies to specified services, including covered e-commerce services provided to consumers after June 28, 2025, subject to statutory scope rules, exemptions, transitional provisions, microenterprise rules, and disproportionate-burden provisions.

Where relevant to a covered service, ZNF may use WCAG 2.2, EN 301 549 concepts, harmonized standards, implementing acts, national rules, and other recognized accessibility specifications as technical evidence or implementation guidance. Nothing in this Policy waives any right or duty that applicable EAA implementing law makes non-waivable.

14.4 United Kingdom #

Where the UK Equality Act 2010, the Equality and Human Rights Commission's 2026 Code of Practice for services, public functions and associations (in force from August 5, 2026), or another UK accessibility requirement validly governs a ZNF service, ZNF intends to make legally required reasonable adjustments and avoid disability discrimination in access to services. Because legal duties depend on the particular service, barrier, user need, and facts, ZNF does not treat a technical checklist as the sole measure of compliance; effective access, anticipatory consideration of barriers where required, and reasonable alternative methods remain part of the assessment.

14.5 Canada — federal and provincial accessibility frameworks #

Where Canada’s Accessible Canada Act, Accessible Canada Regulations, 2025–2026 digital-technology accessibility requirements, or another Canadian accessibility rule applies because the relevant activity falls within its regulated scope, ZNF intends to meet the mandatory requirements applicable to that activity, organization type, size, and implementation date. Canada’s current federal ICT framework uses CAN/ASC–EN 301 549:2024 for covered digital technologies. Provincial accessibility and human-rights requirements may also apply in particular circumstances; for example, Ontario’s AODA framework imposes specified web-accessibility duties on covered organizations, subject to its own scope and exceptions.

ZNF also recognizes the broader accessibility principle reflected in Canadian guidance that service information, policies, and alternative service methods should be easy to find, understandable, and usable by people with disabilities. Where legally required, ZNF will provide an accessible format or communication support appropriate to the circumstances.

14.6 WCAG 3 and future accessibility standards #

W3C is developing WCAG 3. As of September 3, 2026, W3C describes WCAG 3 as an incomplete, in-progress draft whose exploratory and developing requirements will change substantially and whose final requirements will differ from the current draft. ZNF therefore does not claim WCAG 3 conformance. ZNF may nevertheless evaluate mature WCAG 3 research, outcomes, methods, assertions, and emerging accessibility practices when they improve real-world usability or help prepare for future standards.

ZNF may likewise consider successor versions of WCAG, EN 301 549, CAN/ASC standards, national standards, regulations, court decisions, agency guidance, and other internationally recognized accessibility frameworks as they become final or legally applicable. No statement about future readiness is a guarantee of compliance with a law or standard that has not yet been enacted, finalized, interpreted, or become applicable.

14.7 Third-party services, equivalent access, and non-interference #

Some privacy controls, checkout functions, embedded content, security tools, payment tools, reviews, maps, media, analytics controls, or other features may be supplied or rendered by independent third parties. ZNF cannot warrant that every third-party service will be compatible with every browser, device, assistive technology, or accessibility standard at all times. However, third-party involvement does not waive any accessibility duty that applicable law makes non-waivable.

If a third-party feature creates a material accessibility barrier, ZNF may, as appropriate and legally required, escalate the issue to the provider, modify or replace the integration, provide an accessible alternative route or communication method, assist the user through another channel, temporarily restrict a nonessential feature, or take another reasonable step intended to provide equivalent or effective access. Accessibility alternatives are not intended to reduce privacy rights or force a person with a disability to accept materially inferior privacy choices.

14.8 Accessibility assistance and feedback #

If a disability-related barrier prevents you from reading this Policy, understanding it, opening Cookie Preferences, changing a privacy choice, or using a related ZNF-controlled process, please tell us what barrier you encountered and, if you wish, the format or communication method that would help. You do not need to disclose a diagnosis to request accessibility assistance.

To the extent required by applicable law, ZNF will not charge an additional fee merely because a person needs an accessible format, auxiliary aid, effective-communication method, or reasonable accessibility alternative. Any mandatory complaint, enforcement, regulator, ombuds, tribunal, court, or other accessibility right that applicable law makes non-waivable remains available notwithstanding this Policy or the Terms of Use.

14.9 Testing, remediation, and no overlay-only substitute #

Accessibility widgets, automated scanners, browser tools, and the Reading & navigation tools on this page are supplemental aids. ZNF does not treat any overlay, widget, scanner score, or automated test as a substitute for accessible design, semantic HTML, keyboard testing, zoom and reflow testing, assistive-technology evaluation, complete-process testing, remediation, vendor management, or individualized assistance where required.

ZNF may use a combination of automated and manual testing, user feedback, accessibility support requests, vendor escalation, code review, browser and device testing, and periodic remediation to identify and address barriers. Because software, assistive technologies, laws, standards, and third-party integrations change, accessibility is an ongoing process rather than a one-time certification.

15. Changes to Technologies, This Policy, and Future Laws #

ZNF may modify this Policy and may add, remove, replace, or reconfigure Cookies, Trackers, providers, platforms, consent tools, categories, purposes, retention periods, and technical controls at any time, subject to applicable law.

This Policy is intended to be interpreted to include applicable amendments, regulations, successor laws, replacement laws, newly effective privacy and accessibility laws, and mandatory legal developments to the extent they validly govern the relevant activity. That includes legally applicable changes affecting cookies, tracking, consent, digital accessibility, effective communication, accessible alternatives, or user-interface requirements. No policy can guarantee compliance with laws or technical standards that have not yet been enacted, finalized, interpreted, or become effective.

Where a future or amended mandatory law provides a non-waivable right or imposes a requirement inconsistent with this Policy, the mandatory law controls to the minimum extent necessary to resolve the conflict, while the remainder of this Policy continues in effect. ZNF may update this Policy, the Privacy Control Center, consent logic, vendor configuration, or a jurisdiction-specific notice by the applicable compliance date where reasonably required.

If a new law becomes legally applicable before this Policy is updated, this Policy is intended to be interpreted consistently with that mandatory law to the extent legally required, without creating obligations broader than the law itself or waiving any exemption, threshold, defense, cure right, jurisdictional objection, or other protection available to ZNF.

Changes become effective when posted unless a later date is stated. Where applicable law requires prior notice, renewed consent, or another affirmative mechanism for a material change, ZNF intends to provide the required mechanism.

16. Arbitration, Governing Law, Limitations, and Non-Waivable Rights #

This Policy is incorporated into and governed by the Terms of Use, including its binding individual arbitration agreement, class-action waiver, delegation provisions, governing-law provisions, venue provisions, limitations of liability, warranty disclaimers, notice-and-cure requirements, and survival terms, to the fullest extent permitted by law.

Any dispute arising out of or relating to this Policy, Cookies, Trackers, consent, privacy-choice interfaces, or related ZNF-controlled processing shall be handled under the Terms of Use except to the extent non-waivable law requires otherwise.

Nothing in this Policy is intended to limit a non-waivable right to submit a complaint to a privacy regulator, attorney general, supervisory authority, accessibility authority, or other governmental body where applicable law requires that right to remain available.

If any provision is invalid, unlawful, or unenforceable, it shall be modified, blue-penciled, or severed only to the minimum extent necessary, and the remaining provisions shall remain in effect. No failure to enforce a provision constitutes a waiver.

17. Contact Information and Privacy Request Paths #

If you have a question about this Policy or our use of Cookies and Trackers, please contact us. We are happy to help explain the available controls or direct you to the right privacy or accessibility resource.

Use the request path most appropriate to the subject:

• Privacy Control Center for cookie preferences, sale/sharing or targeted-advertising choices, and privacy requests;
• U.S. State Privacy Addendum for state-specific rights and appeals;
• GDPR Notice for EEA, UK, or Switzerland matters;
• International Privacy Addendum for other non-U.S. matters; and
• Accessibility Statement for access barriers or effective-communication assistance.

Canonical online version: https://www.znaturalfoods.com/pages/legal#tab-12