Dirty Penny Privacy Policy

Last Updated: August 2, 2026

This Privacy Policy explains how Dirty Penny collects, uses, discloses, stores, and protects information when you access our website, create an account, place an order, contact us, subscribe to communications, participate in promotions, or otherwise interact with Dirty Penny.

Dirty Penny means Dirty Penny Vape & Ale, LLC, doing business as Dirty Penny Hemp Co ("Dirty Penny," "we," "us," or "our"), a Florida limited liability company.

Website: https://dirtypennyhempco.com/ Email: Info@dirtypennydispensary.com Phone: +1 (305) 336-0220 Contact page: https://dirtypennyhempco.com/pages/contact

By using our website or services, you agree to the practices described in this Privacy Policy.

---

Summary

This summary is provided for convenience only. It is not a substitute for the full Policy below and does not form part of it. Where the summary and the Policy differ, the Policy controls.

• Dirty Penny sells age-restricted products, so we collect more verification information than a typical retailer, including date of birth and identity-verification results.
• We do not sell personal information or sensitive personal information.
• We use cookies and analytics, and we use advertising and retargeting technologies where permitted.
• We do not knowingly collect information from anyone under 21.
• You can opt out of marketing email at any time. Transactional and compliance messages continue regardless.
• To make a privacy request, email Info@dirtypennydispensary.com.

---

1. Information We Collect

Dirty Penny may collect information that you provide directly, information collected automatically, and information received from service providers or compliance partners.

This may include:

• Name
• Billing address
• Shipping address
• Email address
• Phone number
• Date of birth or age-confirmation information
• Identity-verification information
• Order history
• Payment-related information
• Customer-support messages
• Account login information
• Product preferences
• Marketing preferences
• IP address
• Device information
• Browser type
• Location-related data derived from your device, IP address, delivery address, or checkout information
• Website usage data
• Cookies and similar tracking data
• Fraud-prevention and compliance-review information

Dirty Penny does not intentionally collect information from persons under 21. If we believe a person under 21 has attempted to use the website, create an account, or place an order, we may delete the account, cancel the order, restrict access, and retain limited information as needed for fraud prevention, compliance, and legal protection.

2. Age Verification and Compliance Information

Because Dirty Penny sells age-restricted products, we may collect or process information necessary to verify that customers are 21 years of age or older and legally eligible to purchase, receive, and use the products offered on the website.

This may include:

• Date of birth
• Name
• Address
• Phone number
• Email address
• Identity-verification results
• AgeChecker or other age-verification results
• Adult-signature delivery information
• Order-review information
• Fraud-screening data
• Compliance-review records

Dirty Penny may use AgeChecker and other third-party age-verification, identity-verification, fraud-prevention, payment, shipping, delivery, and compliance providers to process this information.

3. Payment Information

Dirty Penny may use Best Rate or another third-party payment processor or merchant-account provider to process transactions.

We do not intentionally store complete payment card numbers on our own servers unless expressly stated. Payment information may be processed, tokenized, stored, reviewed, approved, or declined by payment processors, banks, card networks, fraud-prevention providers, or other payment-related service providers.

Payment processing is subject to the terms and privacy practices of the relevant payment provider.

4. How We Use Information

Dirty Penny may use collected information to:

• Operate the website
• Create and manage accounts
• Process orders
• Verify age and identity
• Confirm delivery eligibility
• Process payments
• Ship or deliver orders
• Provide customer support
• Send order confirmations and delivery updates
• Manage returns, refunds, cancellations, and disputes
• Prevent fraud, abuse, underage access, and unlawful purchases
• Maintain legal, regulatory, tax, accounting, and compliance records
• Comply with federal, state, local, carrier, payment-processor, supplier, and age-restricted product requirements
• Improve website functionality
• Analyze website performance
• Personalize content where permitted
• Send marketing communications where permitted
• Enforce our Terms & Conditions and other policies
• Protect Dirty Penny, customers, service providers, and the public

5. Automated Processing

Age verification, identity verification, and fraud screening involve automated processes provided by third-party services. These processes may result in an order being held, declined, or cancelled without individual human review at the point of decision.

If your order is declined or cancelled following an automated check and you believe the outcome is incorrect, contact Dirty Penny using the details in Section 22 and the decision will be reviewed.

6. How We Share Information

Dirty Penny may share information with service providers and partners who help operate the business.

This may include:

• Payment processors and merchant-account providers
• Age-verification providers, including AgeChecker
• Identity-verification providers
• Fraud-prevention providers
• Shipping carriers and delivery providers
• Website hosting and ecommerce platform providers, including Shopify
• Email marketing providers, including Klaviyo or another email provider
• Analytics providers, including Google Analytics and Shopify Analytics
• Advertising and retargeting providers
• Customer-support tools
• Tax and accounting providers
• Legal, compliance, regulatory, or insurance advisors
• Product suppliers, manufacturers, or distributors where needed to fulfill, investigate, replace, refund, or verify an order

Dirty Penny may also disclose information where required or permitted by law, including to comply with legal process, respond to government or regulatory requests, enforce our policies, protect rights or safety, investigate fraud or underage access, and comply with hemp, vape, tax, shipping, delivery, or age-restricted product regulations.

7. No Sale of Personal Information

Dirty Penny does not sell personal information in exchange for monetary consideration.

Dirty Penny does use cookies, pixels, and similar technologies that support advertising and retargeting. Under some state privacy laws, sharing information with advertising partners for targeted advertising may be treated as a "sale" or as "sharing" even where no money changes hands. Where applicable law provides a right to opt out of such processing, you may exercise it using the mechanisms described in Section 8 and Section 14.

8. Cookies and Tracking Technologies

Dirty Penny may use cookies, pixels, tags, scripts, local storage, analytics tools, and similar technologies to operate the website and improve user experience.

These technologies may be used to:

• Keep items in your cart
• Maintain login sessions
• Remember preferences
• Measure website traffic
• Understand product interest
• Improve website performance
• Support advertising and retargeting where permitted
• Detect fraud or suspicious activity
• Support age-gating and compliance controls

Dirty Penny may use Google Analytics and Shopify Analytics to understand website performance, traffic, product interest, and customer interaction with the website.

Customers may be able to limit cookies through browser settings. Customers may also use Google browser tools, where available, to opt out of having website activity made available to Google Analytics. These tools may not prevent data from being sent to Dirty Penny, Shopify, or other analytics or service providers.

You may adjust browser settings to block or delete cookies. Some website features may not work properly if cookies are disabled.

Where our website recognizes an opt-out preference signal such as Global Privacy Control, we will treat it as a request to opt out of targeted advertising to the extent required by applicable law. Browser Do Not Track signals are not currently standardized and may not be recognized.

9. Marketing Communications

Dirty Penny may send promotional emails, newsletters, product updates, educational content, offers, and other marketing communications where permitted by law.

Dirty Penny may use Klaviyo or another email marketing provider to send commercial email. Commercial email messages from Dirty Penny will be sent in a manner intended to comply with applicable email marketing laws, including the CAN-SPAM Act.

Commercial email messages may include:

• Accurate sender identification
• Non-deceptive subject lines
• A valid physical postal address for Dirty Penny
• A clear unsubscribe or opt-out mechanism
• Required advertising disclosures where applicable

To stop receiving marketing email, use the unsubscribe link in any marketing message, or email Info@dirtypennydispensary.com with the word Unsubscribe and the email address concerned.

Dirty Penny will process email marketing opt-out requests in accordance with applicable law. Customers who unsubscribe from marketing emails may still receive transactional, legal, safety, compliance, account, order, shipping, refund, age-verification, or policy-related messages.

Dirty Penny does not currently use SMS marketing. If Dirty Penny adopts SMS marketing in the future, Dirty Penny will obtain prior express written consent where required by the Telephone Consumer Protection Act ("TCPA") and other applicable laws before sending automated marketing text messages.

SMS marketing consent will not be required as a condition of purchase. SMS marketing messages will include opt-out instructions, such as replying "STOP," where required by law.

10. Data Retention

Dirty Penny may retain information for as long as reasonably necessary to:

• Fulfill orders
• Maintain customer accounts
• Provide support
• Comply with legal obligations
• Maintain tax and accounting records
• Comply with age-restricted product obligations
• Maintain shipping and delivery records
• Resolve disputes
• Prevent fraud and underage access
• Enforce policies
• Protect legal rights
• Maintain product-safety, recall, COA, batch, and compliance records where applicable

Retention periods may vary depending on the type of information, purpose of processing, applicable law, payment-processor requirements, carrier requirements, regulatory obligations, and product category.

11. Where Information Is Processed

Dirty Penny operates in the United States and information is generally processed and stored in the United States. Some service providers may process information in other jurisdictions in the course of providing their services.

12. Security

Dirty Penny uses reasonable administrative, technical, and physical safeguards designed to protect personal information.

However, no website, ecommerce system, payment system, email system, or online transmission is completely secure. Dirty Penny cannot guarantee absolute security of information.

You are responsible for keeping your account login information confidential and for promptly notifying Dirty Penny of any suspected unauthorized access.

13. Data Breach Notification

Dirty Penny takes data security seriously and uses reasonable administrative, technical, and physical safeguards designed to protect personal information.

If Dirty Penny determines that a breach of security has occurred involving personal information, Dirty Penny will investigate the incident and provide notices where required by applicable law.

For Florida residents, Dirty Penny will provide notice of a qualifying breach as expeditiously as practicable and without unreasonable delay, and no later than 30 days after determining that a breach occurred or that there is reason to believe a breach occurred, unless a lawful delay or exception applies.

Where required by Florida law, a breach notice may include:

• The date, estimated date, or estimated date range of the breach
• A description of the personal information accessed or reasonably believed to have been accessed
• Information customers may use to contact Dirty Penny about the breach
• Any additional information required by applicable law

If a breach affects 500 or more Florida residents, Dirty Penny will notify the Florida Department of Legal Affairs / Office of the Attorney General where required by law.

If a breach requires notice to more than 1,000 individuals at a single time, Dirty Penny may also notify consumer reporting agencies where required by law.

If a third-party service provider, age-verification provider, payment provider, shipping provider, marketing provider, ecommerce platform, or other third-party agent experiences a breach involving Dirty Penny customer information, Dirty Penny will work with that provider to evaluate the incident and provide any legally required notices.

14. Sensitive Personal Data and No Sale of Sensitive Data

Dirty Penny may collect or process certain information that may be considered sensitive, confidential, compliance-related, or high-risk personal information depending on applicable law and context.

This may include:

• Date of birth
• Age-verification information
• Identity-verification results
• Information derived from identity documents where required for age-restricted products
• Fraud-prevention information
• Compliance-review information
• Precise location information if used for delivery, restricted shipping, fraud prevention, or compliance purposes
• Payment-related verification information
• Information connected to age-restricted purchases

Dirty Penny does not sell sensitive personal data, age-verification information, identity-verification information, fraud-prevention information, compliance-review information, or information collected from identity documents to third parties without prior consumer consent where such consent is required by law.

Dirty Penny may share this information with service providers, processors, vendors, carriers, payment providers, age-verification providers, fraud-prevention providers, regulators, legal advisors, or compliance partners only as reasonably necessary to operate the business, verify age, process orders, prevent fraud, comply with law, fulfill deliveries, maintain records, protect rights, or provide services requested by the customer.

Dirty Penny does not knowingly collect, sell, or process personal information from persons under 21. Persons under 21 are not permitted to use the website or purchase Dirty Penny products.

15. Your Choices and Privacy Requests

Depending on your location and applicable law, you may have certain privacy rights regarding personal information.

These rights may include the ability to:

• Request access to certain personal information
• Request correction of inaccurate information
• Request deletion of certain information
• Request a copy of certain information in a portable format
• Opt out of marketing communications
• Opt out of targeted advertising where applicable law provides that right
• Ask questions about how information is used or shared
• Request that Dirty Penny not sell sensitive personal data where applicable law provides such a right

To make a privacy request, email Info@dirtypennydispensary.com with the subject line Privacy Request, or use the contact details in Section 22. Include the email address associated with your account or orders and describe the request.

Dirty Penny will take reasonable steps to verify your identity before acting on a request, which may include confirming information already held about you or asking you to respond from the email address on the account. Requests that cannot be verified may be declined.

Dirty Penny will respond to verifiable privacy requests within the timeframe required by applicable law, and in any event without undue delay. Where permitted, a response period may be extended where a request is complex or numerous, and you will be informed if that occurs.

If you are a Florida resident, your specific data rights may be limited based on the nature of the information, Dirty Penny's size and business model, and applicable Florida law. Residents of other states may have rights under the privacy laws of those states, and Dirty Penny will honor those rights where it is subject to them.

Some requests may be denied, limited, or delayed where Dirty Penny must retain information for legal, tax, regulatory, age-verification, fraud-prevention, product-safety, shipping, payment, accounting, dispute-resolution, law-enforcement, or compliance purposes.

Dirty Penny will not discriminate against you for exercising a privacy right.

16. Children and Minors

Dirty Penny products and services are intended only for adults aged 21 or older.

We do not knowingly sell to or collect information from persons under 21. If we learn that a person under 21 has submitted information or attempted to purchase products, we may delete the information where appropriate, cancel the order, restrict access, and retain limited information where necessary for compliance, fraud prevention, and legal protection.

17. Third-Party Websites and Services

The Dirty Penny website may link to third-party websites, lab reports, payment systems, age-verification services, shipping tools, social media platforms, manufacturer pages, or other external services.

Dirty Penny is not responsible for the privacy practices, content, security, accuracy, or policies of third-party websites or services.

18. Business Transfers

If Dirty Penny is involved in a merger, acquisition, sale of assets, restructuring, financing, bankruptcy, or other business transfer, customer information may be transferred as part of that transaction, subject to applicable law.

19. Changes to This Privacy Policy

Dirty Penny may update this Privacy Policy at any time. Changes will be effective when posted on the website unless otherwise stated, and the Last Updated date above indicates when this Policy was most recently revised.

Where a change materially affects how personal information is collected, used, or shared, Dirty Penny will make reasonable efforts to provide notice through website notices, account notices, email, or other reasonable methods where practicable and required by applicable law.

Your continued use of the website after changes are posted means you accept the updated Privacy Policy, except where applicable law requires your consent.

20. Related Policies

This Privacy Policy should be read alongside Dirty Penny's Terms & Conditions, Shipping Policy, and Return & Refund Policy, all available at https://dirtypennyhempco.com/.

21. General

Nothing in this Privacy Policy is intended to limit or exclude any right a customer has under applicable privacy or consumer-protection law that cannot lawfully be limited or excluded.

If any provision of this Privacy Policy is found to be unenforceable, that provision will be modified or severed to the minimum extent necessary, and the remaining provisions will continue in full force.

This Privacy Policy is governed by the laws of the State of Florida, United States, without regard to conflict-of-law principles. Subject to applicable law, any dispute arising out of or relating to this Privacy Policy, Dirty Penny's privacy practices, or the use of personal information shall be subject to the jurisdiction of the state or federal courts located in Florida.

22. Contact

For privacy-related questions, customer support, compliance questions, or requests regarding this Privacy Policy, contact Dirty Penny at:

Dirty Penny Vape & Ale, LLC DBA: Dirty Penny Hemp Co State of Florida, United States

Email: Info@dirtypennydispensary.com Phone: +1 (305) 336-0220 Website: https://dirtypennyhempco.com/ Contact Page: https://dirtypennyhempco.com/pages/contact