PRIVACY POLICY

Last Updated: March 11, 2026

DATA PRIVACY NOTICE

This Privacy Policy describes the privacy practices of Smokey Point Concrete (“SPC”) and Skagit Readymix (“SRM”) (together, the “Company,” “we,” “our,” or “us”) in connection with your access to and use of our website www.smokeypointconcrete.com (the “Site”). It explains how we collect, use, disclose, and retain personal information, and the choices you may have under applicable law, including Washington’s My Health My Data Act (RCW 19.373) where applicable.

This Privacy Policy applies only to information collected through the Site and in connection with our products and services. It does not apply to third‑party websites, applications, or services that may link to, be linked from, or be accessible through the Site. We encourage you to review the privacy practices of any third parties before providing information to them.

WHO IS RESPONSIBLE FOR YOUR PERSONAL INFORMATION?

Smokey Point Concrete (SPC) and Skagit Readymix (SRM), 23315 Dike Road, Arlington, WA 98223, are responsible for personal information processed in connection with the Site and our business relationship with you.

WHAT INFORMATION WE COLLECT

When you use the Site, we may collect information (1) you provide to us, (2) you provide about others, and (3) information collected automatically about your interactions with the Site and our content or ads on third‑party websites, apps, or other media.

Information you provide to us.

We may collect personal information you provide when you contact us, request information, submit an order or inquiry, sign up to receive communications, download materials, or otherwise interact with us. This may include identifiers and contact information such as your name, job title, company name, address, telephone number, and email address, and business‑related information such as purchase history, service requests, product feedback, and any other information you choose to provide.

Information you provide about others.

If you provide information about another person, you represent that you have authority or consent to provide that information. Do not provide information about anyone under the age of 13.

Information collected automatically.

When you visit the Site, we and our service providers may automatically collect information such as the pages you view, the date and time of your visit, browser type and settings, device identifiers, approximate location derived from IP address, and log data. We may use cookies, pixels, tags, scripts, and similar technologies to support Site functionality, analytics, and marketing. For more information, please review our Cookie Policy (if available) or the cookie settings on your browser/device.

Sensitive information; precise geolocation.

Certain information we collect may be considered sensitive under applicable laws (for example, precise geolocation if collected). We use sensitive information only as permitted by law and for the purposes described in this Privacy Policy. Where applicable law requires opt‑in consent for collection or sharing of sensitive information, we will obtain it before processing.

WASHINGTON CONSUMER HEALTH DATA (RCW 19.373)

Washington’s My Health My Data Act (“MHMD Act”), RCW 19.373, provides specific requirements for “consumer health data” (“CHD”), which includes personal information linked or reasonably linkable to a consumer that identifies the consumer’s past, present, or future physical or mental health status, including certain inferences. The MHMD Act generally applies in a consumer (non‑employment) context.

We do not seek to collect CHD through the Site in the ordinary course of providing ready‑mix concrete and related services. However, CHD could be collected or inferred in limited contexts depending on your interactions with us (for example, if you voluntarily provide health‑related details in a request or incident report, if biometric timekeeping is used for certain visitors or contractors, or if precise location data is collected and could reasonably indicate an attempt to obtain health care services).

If we collect, process, share, sell, or otherwise handle CHD subject to the MHMD Act, we will comply with RCW 19.373. Our Washington Consumer Health Data Privacy Policy (“CHD Privacy Policy”) is provided in Attachment B and will be available via a prominent link on our website homepage labeled “Washington Consumer Health Data Notice.”

HOW WE USE INFORMATION WE OBTAIN

We may use personal information to:

• Provide and administer products and services; process transactions; manage accounts and customer relationships.
• Respond to inquiries; provide customer service, technical support, and service communications.
• Operate, maintain, and improve the Site; personalize content; remember preferences; troubleshoot and perform analytics.
• Conduct internal business operations such as accounting, auditing, compliance, security, fraud prevention, and legal support.
• Send informational and, where permitted, marketing communications (you may opt out as described below).
• Comply with applicable legal obligations and enforce our terms and policies.

We may also use information for other purposes disclosed at the time of collection or with your consent. If you do not provide information needed for a request or transaction, we may be unable to fulfill it.

SALE OR SHARING OF PERSONAL INFORMATION

We do not sell personal information for monetary consideration. We may share certain information with analytics or advertising partners in connection with our website and marketing activities. Depending on your state of residence and applicable law, such disclosures may be considered “sharing” for cross‑context behavioral advertising. Where required by law, we provide choices to opt out of such sharing, including honoring Global Privacy Control signals as described below.

WHO WE SHARE PERSONAL INFORMATION WITH

We may disclose personal information to:

• Service providers and contractors that perform services on our behalf (e.g., hosting, analytics, customer support, IT, security, payment processing), under written agreements restricting their use of personal information to specified purposes.
• Our affiliates, where necessary to provide services or operate our business (if applicable).
• Professional advisors (e.g., legal, auditors, insurers) as needed for business operations and compliance.
• Third parties in connection with corporate transactions (e.g., merger, acquisition, financing, or sale of assets), subject to appropriate safeguards.
• Government authorities or other third parties where required by law or to protect our rights, customers, employees, and property.

We do not permit recipients to use personal information for their own independent marketing purposes unless you have provided consent where required.

DATA SECURITY

We maintain reasonable administrative, technical, and physical safeguards designed to protect personal information against loss, theft, misuse, and unauthorized access, disclosure, alteration, or destruction. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

WHERE WE STORE AND PROCESS INFORMATION

We store and process personal information in the United States. If we disclose information to service providers, we require them to protect it consistent with this Privacy Policy and applicable law.

DATA RETENTION

We retain personal information only for as long as reasonably necessary to fulfill the purposes described in this Privacy Policy, unless a longer retention period is required or permitted by law (for example, recordkeeping, dispute resolution, and compliance).

YOUR CHOICES AND RIGHTS

Email communications.

You may opt out of promotional emails by using the unsubscribe link in the email. You may still receive service‑related communications such as transaction confirmations or legal notices.

Global Privacy Control (GPC).

Where required by applicable law, we recognize and process Global Privacy Control (GPC) signals as a request to opt out of certain online disclosures for cross‑context behavioral advertising for the browser or device that sends the signal.

Access, correction, and deletion requests.

Depending on your state of residence and applicable law, you may have rights to request access to, correction of, or deletion of certain personal information. We will process such requests as required by law and may need to verify your identity before responding.

CHILDREN

The Site is not intended for children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us so we can delete it.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time. The “Last Updated” date at the top indicates when this Privacy Policy was last revised. Changes are effective when posted on the Site.

CONTACT US

If you have questions about this Privacy Policy or wish to submit a request, contact us at:

Smokey Point Concrete / Skagit Readymix
Attn: Privacy
23315 Dike Road
Arlington, WA 98223
Online: https://www.smokeypointconcrete.com/privacy-policy/
Contact form: https://www.smokeypointconcrete.com/contact/

ATTACHMENT A – WASHINGTON PRIVACY NOTICE ADDENDUM

This Washington Privacy Notice Addendum applies to Washington residents and supplements the Privacy Policy. Washington does not currently maintain a comprehensive consumer privacy statute applicable to all personal data processing in the same manner as certain other states. This Addendum is provided to enhance transparency and to describe voluntary practices and any rights available under applicable Washington law or otherwise.

Notice at collection (personal data categories and purposes).

Depending on your interactions with us, we may collect the following categories of personal data: identifiers; customer records (contact and account information); commercial information (transactions and service history); internet or network activity (usage and device data); geolocation (approximate location from IP address, and precise geolocation if enabled); professional information; and inferences derived from the foregoing for internal business purposes. We use these categories for the purposes described in the “How We Use Information We Obtain” section above.

Disclosure.

We may disclose personal data to service providers and third parties as described in “Who We Share Personal Information With.” We do not sell personal data for monetary consideration.

Requests and verification.

To submit a request or question, use the contact methods in the Contact Us section. We may request information to authenticate your request, and we will respond within the time required by applicable law.

ATTACHMENT B – WASHINGTON CONSUMER HEALTH DATA PRIVACY POLICY (RCW 19.373)

Effective Date: March 11, 2026

This Washington Consumer Health Data Privacy Policy (“CHD Privacy Policy”) applies to “consumer health data” (“CHD”) as defined by Washington’s My Health My Data Act, RCW 19.373. This CHD Privacy Policy supplements the Privacy Policy and applies only to CHD within the scope of RCW 19.373.

1. Categories of consumer health data we collect

We do not seek to collect CHD in the ordinary course of providing ready‑mix concrete and related services. However, CHD could be collected or inferred in limited contexts depending on your interactions with us. Examples may include: (i) health‑related details you voluntarily provide in a request, complaint, or incident/safety report; (ii) biometric identifiers used for timekeeping or access control if such systems are used; and (iii) precise location information, if collected, that could reasonably indicate an attempt to obtain health care services or supplies.

2. Purposes for which we collect and use CHD

If we collect CHD, we may use it for: providing requested services; safety and incident response; security, fraud prevention, and access management; legal and compliance obligations; and other purposes specifically disclosed at the time of collection and consistent with RCW 19.373.

3. Categories of sources from which CHD is collected

CHD may be collected: directly from you (e.g., forms or communications you submit); automatically from devices or systems you use to interact with us (where applicable); or from service providers/processors acting on our behalf (where applicable).

4. Categories of CHD we share

If we collect CHD, we may share the following categories of CHD, to the extent necessary for the purposes described above and consistent with RCW 19.373: (i) health‑related details contained in safety or incident reports; (ii) biometric identifiers used for timekeeping or access control (if used); and (iii) precise location information that could reasonably indicate an attempt to obtain health care services or supplies (if collected). We do not share CHD for cross‑context behavioral advertising.

5. Third parties and affiliates with whom we share CHD

We may share CHD with the following categories of third parties, under contracts restricting use to specified business purposes: cloud hosting and IT service providers; security and fraud‑prevention vendors; HR/timekeeping vendors (if biometric systems are used); incident reporting or safety‑management platform providers; and professional advisors (legal, audit, and compliance) as necessary. We do not share CHD with affiliates unless specifically listed here. Specific affiliates (if any): None.

6. Consent and sale authorization

Where required by RCW 19.373, we will obtain affirmative, opt‑in consent before collecting or sharing CHD for non‑necessary purposes. We will not sell CHD as defined by RCW 19.373 without a valid, signed, and revocable authorization from the consumer.

7. Consumer rights (Washington CHD)

Washington consumers have rights under RCW 19.373 to: (i) confirm whether we collect, share, or sell CHD and access such CHD; (ii) receive a list of all third parties and affiliates with whom we have shared or sold the consumer’s CHD and an active email address or other online mechanism to contact those recipients; (iii) withdraw consent for our collection and sharing of CHD; (iv) request deletion of CHD; and (v) appeal a denial of a request.

Deletion requests: If you request deletion of CHD, we will delete CHD from our records and instruct our affiliates, processors, contractors, and other third parties with whom we have shared CHD to delete it as required by RCW 19.373. If CHD is stored on archived or backup systems, deletion may be delayed to enable restoration of those systems, and such delay will not exceed six months from authenticating the deletion request.

8. How to exercise your CHD rights; appeals

To exercise CHD rights, submit a request using the Contact Us information in the Privacy Policy, including the online privacy policy page or contact form. We will use reasonable steps to authenticate your request. If we deny your request, we will provide the reason for denial and instructions for submitting an appeal.

9. Data security practices

We maintain reasonable administrative, technical, and physical safeguards designed to protect CHD, including access controls appropriate to the sensitivity of the data. We also require processors to protect CHD consistent with RCW 19.373 and to process CHD only on documented instructions.

10. Geofencing

We do not use geofencing around health care facilities to identify, track, collect data from, or target consumers for prohibited purposes under RCW 19.373.

11. Homepage link

We will provide a prominent link to this CHD Privacy Policy from our website homepage labeled “Washington Consumer Health Data Notice.”