Privacy Policy

Effective Date: November 19, 2025
Last Updated: November 19, 2025

1. Introduction

Ongaro & Sons, Inc. ("Ongaro & Sons," "we," "us," or "our") has been serving Northern California since 1932. Protecting your privacy is as important to us as providing quality HVAC, plumbing, electrical, and solar services.

This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you:

• Visit our website at https://ongaroandsons.com (the "Website");
• Use our mobile applications or other online services that link to this Privacy Policy (collectively, the "Online Services");
• Contact us by phone, email, text message, chat, or in person;
• Schedule or receive services at your property;
• Interact with us on social media; or
• Apply for employment with Ongaro & Sons.

By accessing or using our Website or services, you acknowledge that you have read and understand this Privacy Policy. If you do not agree with this Privacy Policy, please do not use the Website or our services.

This Privacy Policy works together with, and is incorporated into, our Terms of Use. If there is a conflict between this Privacy Policy and the Terms of Use, the Terms of Use control to the extent of the conflict solely with respect to contractual and dispute-resolution matters.

We may update this Privacy Policy from time to time. When we do, we will revise the "Last Updated" date above. If we make material changes, we will provide additional notice (for example, by posting a notice on our Website or, when appropriate, by email). Your continued use of our Website or services after the effective date of any changes means that you accept the revised Privacy Policy.

Accessibility: If you have a disability and need this Privacy Policy in an alternative format, please contact us at (707) 908-8025 or info@ongaroandsons.com and we will provide it in an accessible format.

For purposes of this Privacy Policy, "personal information" (or "personal data") and "sensitive personal information" have the meanings given to them under applicable privacy laws, including the California Consumer Privacy Act (as amended). Where we describe categories of information below, they should be understood to include all information falling within those legal definitions.

2. Information We Collect

We collect information to provide our services, operate our business, comply with legal obligations, and improve your experience. We may collect the following categories of information.

2.1 Information You Provide Directly

Contact and Identification Information

• Name, email address, phone number(s);
• Mailing address and service property address;
• Date of birth (for financing applications, where required);
• Driver's license or other government-issued ID (for identity verification or financing);
• Social Security number or Tax ID (for financing applications only, as described below).

Service Request Information

• Type of service requested (HVAC, plumbing, electrical, solar, etc.);
• Description of issues or service needs;
• Property details (e.g., type of home, approximate square footage, age of systems);
• Preferred appointment dates and times;
• Access instructions and gate codes;
• Emergency contact information.

Payment and Financial Information

• Billing address;
• Payment method details (collected and processed by third-party payment processors);
• Credit application information (for financing through third-party lenders);
• Invoice and payment history.

We do not store full payment card numbers or CVV codes on our systems; those are handled by PCI-compliant processors.

Communication Records

• Emails, text messages, and chat transcripts;
• Phone call recordings (with notice and where permitted by law);
• Messages submitted via Website forms;
• Social media messages and public comments;
• Customer service inquiries and responses.

Job Site and Service Information

• Photos and videos of your property, equipment, and systems (taken by our technicians);
• Condition reports, inspection findings, and recommendations;
• Equipment serial numbers, model numbers, and warranty data;
• Service history, maintenance records, and installed equipment details;
• Smart home device data if you authorize integration (e.g., thermostats, panels, sensors).

Marketing and Preferences

• Newsletter subscriptions and marketing opt-ins;
• Service and product preferences;
• Survey responses, reviews, and feedback;
• Contest or promotion entries.

Employment Application Information (Job Applicants)

• Resume, cover letter, and application materials;
• Work history, references, education, certifications, and licenses;
• Background check authorization and results (with your consent, as required by law);
• Drug test results (with consent, for employees where permitted by law);
• Information from interviews or assessments.

This policy applies to website visitors, customers, and job applicants interacting with the site. Employees, independent contractors, and certain job applicants may receive a separate, controlling privacy notice for HR purposes.

2.2 Information We Collect Automatically

When you use our Website or Online Services, we and our service providers automatically collect certain information using cookies, pixels, logs, SDKs, and similar technologies.

Device and Usage Information

• IP address and approximate general location;
• Device identifiers, operating system, browser type, and settings;
• Pages you visit, time spent on each page, navigation paths, and referring URLs;
• Date and time stamps of visits, links clicked, and actions taken;
• Files downloaded and forms started or submitted.

Location Information

• General location based on IP address;
• Precise location from your device or app, if you grant permission;
• Property addresses where services are performed.

Cookies, Pixels, and Similar Technologies

• Cookies (session and persistent);
• Web beacons, tags, SDKs, local storage, and similar technologies;
• Analytics and advertising identifiers used by platforms such as Google, Meta, and other current or future providers.

We describe these technologies in more detail in Section 4 (Cookies and Tracking Technologies).

2.3 Information We Obtain from Third Parties

We may receive information about you from:

Service Partners and Vendors

• Scheduling, dispatch, and appointment platforms;
• Payment processors and financial institutions;
• Third-party financing partners (e.g., credit decisions and status);
• Warranty registration partners and equipment manufacturers;
• Background check providers (for employees and job applicants, with consent).

Public and Commercial Sources

• Property records, tax assessor data, and similar public records;
• Business directories and review platforms;
• Public social media profiles and posts;
• Professional licensing databases and trade registries.

Marketing and Advertising Partners

• Information from advertising platforms (e.g., Google, Meta, Microsoft, LinkedIn, and similar platforms);
• Lead generation partners and referral sources;
• Data used to create audiences and measure marketing performance.

We may combine information we receive from these sources with other information we maintain about you, and we will treat the combined information as personal information under this Privacy Policy. We may obtain contact details or profile information from data brokers and such sources are disclosed here and/or in any required state data-broker registry disclosures.

2.4 Sensitive Information

Some information we collect may be considered "sensitive" under California and other privacy laws, including:

• Financial Information: Limited bank or account identifiers processed by third-party payment processors; credit information for financing applications.
• Government Identifiers: Driver's license or state ID numbers and, where applicable, Social Security numbers for financing applications or identity verification.
• Precise Geolocation: Only when you grant permission (for example, in a mobile app or device setting).
• Communication Content: Call recordings, text message content, and email content.
• Property and Security Information: Photos and videos of your home's interior and exterior; information about security systems and access codes; smart home device data, if integrated.

We do not intentionally collect health information, racial or ethnic origin, religious beliefs, sexual orientation, or union membership. If such information is incidentally disclosed (for example, in a call or email), we will use it only as necessary to provide services and will delete or minimize it as appropriate.

Social Security Number Handling (Financing Only)

If you choose to apply for financing through a third-party lender:

• We may collect your SSN and related information solely to facilitate your application;
• We transmit SSNs to financing partners via secure, encrypted channels;
• We do not store SSNs in our core business systems;
• If an SSN is provided verbally or via a photographed document, we use it only as necessary to submit the application and then securely delete it within a commercially reasonable time (typically within 24 hours) after transmission;
• We do not use SSNs for marketing or any purposes other than processing your financing application.

Access to any SSN data is strictly limited to personnel who need it for this specific purpose. Our handling of Social Security numbers complies with California Civil Code § 1798.85, and we do not publicly post or display SSNs in any manner.

2.5 Summary of CCPA Categories

For California residents, the personal information we collect falls into these categories under California law:

• Identifiers (name, address, email, phone, IP address)
• Customer Records/Commercial Information (service history, invoices, payment data)
• Internet or Network Activity (Website interactions, browsing data)
• Geolocation Data (general location from IP; precise location if enabled)
• Audio, Electronic, Visual Information (call recordings, property photos/videos)
• Professional/Employment Information (job applicants only)
• Inferences (drawn from above to tailor services and communications)
• Sensitive Personal Information (as described in Section 2.4)

We use and disclose these categories for the purposes and to the recipients described in Sections 3 and 5.

2.6 Special Collection Scenarios

Phone Calls

When you call us (including at (707) 908-8025, (415) 454-7400, or (707) 579-3511), your call may be recorded for quality assurance, training, dispute resolution, and compliance. Call recording occurs only after we provide an audible notice at the beginning of the call, as required under California law. You will hear a recording announcement informing you that the call is being recorded. By continuing the call after the announcement, you consent to the recording. You may choose to end the call if you do not consent to the recording.

Text Messages

If you opt in to receive text messages from us, we collect your mobile number and message content. You can opt out at any time by replying STOP.

On-Site Service Visits and Property Documentation

When you schedule service at your property, you authorize our technicians to:

• Enter your property to perform the requested services;
• Take photographs and videos of HVAC, plumbing, electrical, solar, and related systems, equipment, and surrounding areas as reasonably necessary to document conditions, diagnose issues, create service records, and maintain safety and quality standards;
• Access areas of your property where systems or equipment are located.

By scheduling service, you represent and warrant that:

• You have authority to grant such access and authorize such documentation;
• You have informed any co-owners, residents, or tenants of such access and documentation.

Any additional terms regarding property access, liability, or indemnification are governed by the applicable work order, service agreement, or Terms of Use, which control in the event of any conflict.

Photographic/video documentation may include incidental capture of surrounding areas. We do not intentionally photograph individuals without consent, but security and safety may require capturing images in occupied spaces. If you have specific areas you wish to exclude from photography, please inform our technician before service begins, and we will accommodate your request to the extent consistent with safe and effective service delivery.

You may request deletion of specific photos or videos by contacting us at info@ongaroandsons.com within 30 days of service. After such time, images are retained as part of service records under our standard retention policies.

Security Cameras

Our offices and some service vehicles may use security cameras for safety, loss prevention, and security purposes.

Social Media

If you interact with us on platforms such as Facebook, Instagram, YouTube, LinkedIn, or TikTok, we may collect your username, profile information (if publicly available), and the content of messages or comments. Those platforms' privacy policies also apply.

Chat, Analytics, and Session Replay Technologies

We may use chat tools, heat-mapping tools, and session replay or analytics tools to understand how visitors navigate our Website and to improve user experience. These tools may capture:

• Mouse movements, clicks, taps, and scrolling;
• General browsing behavior and time on pages;
• Interactions with forms and user interface elements.

We configure these tools not to intentionally capture keystrokes in password fields, payment card numbers, or other fields designated as sensitive.

By accessing the Website, you expressly consent to the monitoring, recording, and storage of your interactions (including keystrokes, mouse clicks, and form inputs) by us and our third-party service providers for fraud prevention, session optimization, and customer support. You agree that these third parties are acting as our agents and extensions of our business operations.

2.7 Biometric Information

We do not collect or process biometric identifiers or biometric information (such as fingerprints, facial templates, voiceprints, retina or iris scans, or other unique biological characteristics).

2.8 Summary of Information Sources

3. How We Use Your Information

We use the information we collect for the following business and commercial purposes:

3.1 Service Delivery and Performance

• Scheduling and dispatching technicians;
• Providing HVAC, plumbing, electrical, solar, radiant heating, drain, and commercial services;
• Diagnosing and repairing equipment, documenting service, and issuing work orders and invoices;
• Maintaining service history, system documentation, and warranty records;
• Integrating with smart home devices if you authorize such integration;
• Responding to emergency or urgent service needs during our available business hours;
• Providing service reminders and recommended maintenance communications.

3.2 Communication and Customer Support

• Responding to inquiries and service requests;
• Sending appointment confirmations, reminders, and follow-ups;
• Providing invoices, estimates, receipts, and account communications;
• Conducting customer satisfaction surveys and requesting reviews;
• Communicating about safety notices, recalls, or material changes to services.

3.3 Business Operations and Improvement

• Processing payments and managing billing and collections;
• Facilitating financing through third-party lenders;
• Operating and improving our Website, Online Services, and internal systems;
• Training staff using de-identified service notes and call recordings;
• Conducting internal analytics and performance measurement;
• Managing insurance claims, risk, and safety programs;
• Conducting audits, compliance checks, and regulatory reporting.

3.4 Marketing, Advertising, and CRM

• Sending newsletters, promotions, and service reminders (with consent where required);
• Managing customer relationships through our CRM and marketing automation platforms;
• Creating customer segments and audiences for advertising and service communications;
• Conducting remarketing and retargeting using pixels, tags, and server-side integrations;
• Measuring and optimizing ad performance across channels (e.g., search, social, display);
• Running referral or loyalty programs and tracking referrals.

We use a variety of advertising and analytics tools, which may include (now or in the future) Google Analytics, Google Ads, Meta (Facebook/Instagram) tools, including Meta Pixel and Advanced Matching, Metricool, Microsoft/Bing, LinkedIn, YouTube, and other ad networks and marketing technology providers.

3.5 Research, Development, and Analytics

• Developing new services and improving existing ones;
• Conducting market research and analyzing trends;
• Evaluating the effectiveness of campaigns and promotions;
• Conducting internal testing, quality assurance, and troubleshooting.

3.6 Legal, Safety, and Compliance

• Complying with applicable laws, regulations, and industry standards;
• Responding to lawful requests, court orders, subpoenas, and regulatory inquiries;
• Investigating and helping prevent fraud, abuse, and security incidents;
• Protecting our rights, property, and the safety of our customers, employees, and the public;
• Managing disputes, claims, and litigation.

3.7 Employment and Human Resources (Job Applicants and Employees)

• Evaluating job applications and making hiring decisions;
• Conducting background checks and verifying credentials (with consent);
• Complying with employment laws and recordkeeping obligations.

(Additional internal employment-related privacy practices may be covered by separate notices provided to employees and applicants.)

4. Cookies and Tracking Technologies

This section describes how Ongaro & Sons uses cookies, pixels, software development kits, and similar tracking technologies (collectively, "cookies") on ongaroandsons.com (the "Site"). It supplements, and should be read together with, the rest of this Privacy Policy.

4.1 What Are Cookies?

Cookies are small text files placed on your device (computer, phone, tablet) when you visit a website. They allow the website to recognize your device, remember your preferences, and collect information about how you interact with the site. Some cookies are set by us ("first-party cookies") and some are set by third parties whose services we use ("third-party cookies"). We also use related technologies such as tracking pixels, web beacons, JavaScript tags, and local storage; for simplicity we refer to all of these as "cookies" in this section.

4.2 Categories of Cookies We Use

We organize cookies into four categories. Before you make a choice on our cookie banner, only Essential and Functional (accessibility) cookies are loaded. Statistics and Marketing cookies are blocked until you grant permission.

Essential Cookies

These cookies are necessary for the Site to function and cannot be switched off. They are usually set in response to actions you take, such as setting your privacy preferences, logging in, or filling in forms. They do not store any personally identifiable information for advertising or analytics purposes. An example is the cookie that remembers your cookie-consent choice so we do not show you the banner again on every page.

Statistics (Analytics) Cookies

These cookies help us understand how visitors interact with the Site by collecting information such as which pages are visited, how long visitors stay, and which features are used. We use this information to improve the Site's performance and content. Analytics providers we use include Google Analytics and PostHog.

Marketing (Advertising and Attribution) Cookies

These cookies are used to measure the effectiveness of our advertising campaigns, build audiences for advertising, and attribute leads and conversions to the marketing source that generated them. Some of these cookies are set by advertising networks we work with and may be used to show you ads on other websites.

Ongaro & Sons does not sell your personal information for money. However, our use of certain advertising cookies allows information about your visit to be transmitted to advertising networks for the purpose of measuring conversions and showing relevant ads. Under California law, this is considered "sharing" of personal information for cross-context behavioral advertising. You have the right to opt out of this sharing at any time; see "Your Choices" below in Section 4.5.

Functional Cookies

These cookies enable enhanced features and personalization. On our Site, the principal functional service is the accessiBe accessibility widget, which provides screen-reader optimization, contrast adjustments, keyboard navigation, and other accommodations required to make the Site usable for visitors with disabilities. Because blocking the accessibility widget behind a consent gate would itself create an accessibility barrier, this widget loads regardless of your other cookie choices. You can still adjust its settings using the accessibility menu in the corner of the page.

4.3 Third-Party Services We Use

We use the following third-party services on the Site. Each provider operates under its own privacy policy, which we encourage you to review. A current and complete list (with cookie names, durations, and links to provider policies) is also available in our cookie preference center, which you can open at any time using the "Cookie Preferences" link in the Site footer.

Analytics and Product Measurement

• Google Analytics (Google LLC) — aggregated traffic and behavior measurement.
• PostHog (PostHog, Inc.) — product analytics and session-level event tracking.
• Metricool (Metricool Software S.L.) — cookieless website analytics and visit measurement. This service uses a server-side script that does not store cookies or identifiers on the visitor's device.

Advertising, Attribution, and Audience Measurement

• Google Ads and Google Tag Manager (Google LLC) — conversion measurement, tag deployment, and remarketing.
• Meta Pixel (Meta Platforms, Inc.) — conversion measurement and audience building for Facebook and Instagram ads.
• Reddit Pixel (Reddit, Inc.) — conversion measurement for Reddit advertising.
• The Trade Desk (The Trade Desk, Inc.) — programmatic advertising and cross-site identity (UID2).
• Basis Technologies (Basis Global Technologies, Inc., formerly Centro/Sitescout) — programmatic advertising pixel.
• StackAdapt (StackAdapt Inc.) — programmatic advertising and conversion measurement.
• Ruler Analytics (Ruler Analytics Ltd.) — marketing attribution, including matching phone calls and form submissions to campaign sources.
• Searchlight Partners — multi-touch marketing attribution.
• Campaign Attribution (first-party UTM capture) — stores marketing source parameters from the URL so we can attribute leads to the campaign that referred you.

Customer Service and Commerce Widgets

• Broccoli Chat (Broccoli) — chat-to-text widget that relays messages you send via the "Have a question?" feature to Ongaro & Sons as SMS.
• Contractor Commerce — e-commerce and consumer-financing widget for accessories and equipment. This widget uses cookies for cart sessions, checkout flow, customer authentication, and storefront analytics. These cookies are required for the online store to function properly.
• AddToAny — social sharing buttons.

Accessibility

• accessiBe (accessiBe Ltd.) — web accessibility widget supporting compliance with the Americans with Disabilities Act (ADA) and the Web Content Accessibility Guidelines (WCAG).

4.4 Information These Services May Receive

Depending on which categories you allow, the services listed above may receive information such as:

• The pages you visit on the Site and the date and time of your visit;
• The page that referred you to us;
• Your approximate (IP-derived) geographic location;
• Your device type, operating system, and browser;
• Anonymized or hashed identifiers used to recognize a returning visitor;
• Interactions you have with forms or the chat widget;
• Conversion and lead-event signals;
• Marketing campaign parameters present in the URL (UTM tags).

We do not knowingly share government-issued identifiers, financial-account numbers, precise geolocation, or other sensitive personal information with advertising or analytics providers.

4.5 Your Choices

On-Site Cookie Controls

When you first visit the Site, a banner asks you to accept all cookies, reject all non-essential cookies, or customize your preferences by category. You can change your choice at any time by clicking the persistent "Cookie Preferences" link in the Site footer.

Browser Controls

Most browsers allow you to refuse cookies, delete cookies that have already been set, or alert you when cookies are being set. If you disable cookies entirely, some features of the Site may not work as intended. Information on managing cookies in popular browsers:

• Google Chrome
• Mozilla Firefox
• Apple Safari
• Microsoft Edge

Platform Opt-Outs and Industry Tools

You may also manage certain advertising preferences directly with platforms (for example, Google Ads settings, Meta Ad preferences) or by using industry opt-out tools:

• Digital Advertising Alliance (DAA)
• Network Advertising Initiative (NAI)

These tools are browser- and device-specific.

California "Do Not Track" Disclosure

California Business and Professions Code § 22575 requires us to disclose how we respond to browser "Do Not Track" (DNT) signals. At this time, we do not alter our data collection practices in response to DNT signals from browsers because no uniform industry standard has been established for how companies should respond to DNT signals. However, we honor Global Privacy Control (GPC) signals as described below and as required by California law.

Global Privacy Control (GPC)

Where required by applicable law (including California and certain other states), we will treat a valid, recognized Global Privacy Control (GPC) signal from your browser as a request to opt out of any "sale" or "sharing" of your personal information for cross-context behavioral advertising for that browser and device. We will honor that signal to the extent required by law and as technically feasible.

Opting Out of "Sharing" for Cross-Context Behavioral Advertising

You may exercise your right to opt out at any time by:

• Clicking the "Do Not Sell or Share My Personal Information" link in the footer of any page of the Site;
• Clicking the "Cookie Preferences" link in the footer and rejecting the Marketing category (or all non-essential categories);
• Browsing the Site with a browser or browser extension that transmits the Global Privacy Control (GPC) signal; or
• Contacting us at info@ongaroandsons.com or (707) 908-8025 and stating that you wish to opt out.

We will not treat you differently because you exercise this right. You do not need to create an account, verify your identity, or pay anything in order to opt out of this "sharing."

4.6 Advanced Matching and Server-Side Integrations

We may use "Advanced Matching" or similar features offered by advertising platforms (such as Meta). These tools allow us to send hashed identifiers (such as email address, phone number, and other contact information) to advertising platforms to:

• Improve the accuracy of conversion tracking;
• Create or exclude custom audiences;
• Measure and optimize campaigns.

We treat such activity as "sharing" personal information for cross-context behavioral advertising under California law where applicable, and you may opt out as described in Section 4.5 and Sections 8 and 9.

4.7 Social Media Integrations

If we embed social media content or share buttons (for example, Facebook, Instagram, YouTube, LinkedIn, TikTok, or through AddToAny), those providers may set their own cookies or similar technologies. Their privacy policies govern their use of these tools.

4.8 How Long Cookies Last

Cookies vary in how long they persist on your device. Session cookies are deleted when you close your browser. Persistent cookies remain until they expire or until you delete them. The cookies we use range from session-only to up to two years, depending on the provider and purpose. Specific durations for each cookie are listed in the Cookie Preferences center. Your cookie-consent choice itself is remembered for 30 days, after which the banner will re-prompt you to confirm your preferences.

4.9 "Sale" and "Sharing" Under California Law

Ongaro & Sons does not sell your personal information. We do not exchange your data for money or other valuable consideration. However, under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, the "CCPA"), the term "sharing" covers a broader set of activities: it includes any disclosure of personal information to a third party for cross-context behavioral advertising, regardless of whether money changes hands. Some of the Marketing-category cookies described above fall within that definition of "sharing" because they transmit information about your visit to advertising networks that use it to target ads to you on other sites and apps.

4.10 Children

Our Site is intended for a general adult audience and is not directed to children under 16. We do not knowingly collect personal information from, or "sell" or "share" the personal information of, children under 16. If you believe a child under 16 has provided personal information to us, please contact us using the details in Section 15 and we will take appropriate steps to delete it.

4.11 Changes to This Section

We may update this section from time to time to reflect changes to the services we use, changes in applicable law, or improvements to our consent technology. When we make material changes, we will update the "Last Updated" date at the top of this Privacy Policy and, where appropriate, re-prompt visitors for consent through the cookie banner.

5. How We Share Your Information

We do not sell your personal information for money. However, under some state privacy laws (including the California Consumer Privacy Act as amended by the CPRA), certain uses of advertising and analytics tools may be considered a "sale" or "sharing" of personal information for cross-context behavioral advertising. We explain your rights related to that in Sections 8 and 9.

We may share your information in the following circumstances:

5.1 Service Providers and Contractors

We share information with third-party service providers and contractors who perform services on our behalf, such as:

• Scheduling and dispatch platforms;
• CRM, marketing automation, and email service providers;
• SMS/text messaging platforms;
• Payment processors and gateways;
• Financing partners and credit bureaus (with your consent);
• Cloud hosting and storage providers;
• Cybersecurity, IT, and infrastructure providers;
• Analytics and business intelligence providers;
• Legal, accounting, and professional advisors;
• Background check providers (for applicants and employees, with consent);
• Insurance companies and claims administrators.

We require these parties, by contract, to use personal information only as necessary to perform services for us, to maintain confidentiality and security, and to comply with applicable privacy laws.

5.2 Advertising and Analytics Partners

We may share information with advertising and analytics partners, including:

• Ad platforms (e.g., Google, Meta, Microsoft, LinkedIn, YouTube);
• Measurement providers and attribution partners;
• Vendors that help manage tags, pixels, and audience segments.

This sharing may include:

• Online identifiers (such as IP address, cookie IDs, device IDs);
• Limited contact information (e.g., hashed email or phone) for Advanced Matching or similar features;
• Information about your interactions with our Website, ads, or communications.

Where required by law, we treat this activity as "sharing" for cross-context behavioral advertising and honor opt-out rights as described in Sections 8 and 9.

5.3 Legal, Compliance, and Safety

We may disclose information when we believe it is necessary or appropriate to:

• Comply with applicable laws, regulations, legal processes, or government requests;
• Respond to subpoenas, court orders, or regulatory inquiries;
• Protect the rights, property, or safety of Ongaro & Sons, our customers, our employees, or the public;
• Investigate and help prevent fraud, abuse, or security incidents;
• Enforce our Terms of Use or other agreements.

5.4 Business Transfers

If we are involved in a corporate transaction, such as a merger, acquisition, sale of assets, joint venture, reorganization, or bankruptcy, your information may be transferred as part of that transaction. Any successor entity will be bound by obligations consistent with this Privacy Policy regarding your information.

5.5 Affiliates

If Ongaro & Sons has or forms affiliates, subsidiaries, or related entities, we may share information among them for purposes consistent with this Privacy Policy, such as centralized operations, analytics, or shared services.

5.6 With Your Consent or at Your Direction

We may share your information with third parties when you direct us or consent to us doing so, for example:

• Registering equipment with a manufacturer;
• Coordinating with a third-party energy or rebate program;
• Sharing information with another contractor at your request.

5.7 Aggregated and De-Identified Information

We may use and share aggregated or de-identified information that does not reasonably identify you, such as aggregated statistics about service requests, general usage trends, and de-identified analytics reports. We maintain and use this information in de-identified form and will not attempt to re-identify it, except as permitted by law.

5.8 Flexibility in Service Providers

Ongaro & Sons reserves the right to select, change, add, or remove any service providers, technology vendors, cloud platforms, or data processors at any time as necessary for business operations. Our contractual requirements for such providers remain consistent regardless of the specific vendor, and such routine changes do not require amendment of this Privacy Policy unless they materially affect the purposes for which we process data or the rights available to consumers.

5.9 Third-Party Service Providers and Data Protection

We select service providers using commercially reasonable due diligence and require them by contract to maintain appropriate security measures and comply with applicable privacy laws. Under California privacy law, we remain responsible as a "business" for the data practices of service providers acting as our "service providers" or "contractors" under CCPA/CPRA. We maintain oversight of these relationships and require contractual compliance with applicable requirements.

When you interact directly with third-party platforms (such as payment processors, financing applications, or manufacturer warranty systems), those parties' own terms and privacy policies govern your relationship with them. We recommend reviewing those policies.

We are not responsible for: (a) the independent data practices of third parties when you interact with them directly outside our services; (b) third-party platform outages or technical failures; or (c) third-party breaches of their own systems, except where we failed to exercise reasonable care in vendor selection or oversight.

Nothing in this section limits: (a) rights you may have under non-waivable consumer protection or privacy laws; or (b) our obligations under CCPA/CPRA as a business for the acts of our service providers.

6. Data Retention

We retain personal information for as long as reasonably necessary to achieve the purposes described in this Privacy Policy, to comply with legal obligations, to resolve disputes, and to enforce our agreements. Actual retention periods may vary based on context.

Our retention periods are determined based on criteria such as:

• The type and sensitivity of the information;
• Legal, tax, accounting, and warranty obligations;
• The need to maintain business records for operational purposes;
• Security, fraud-prevention, and operational requirements; and
• Whether ongoing retention is reasonably necessary or relevant to the purposes for which it was collected.

Illustrative Retention Periods

We may retain information longer where required by law, where necessary for ongoing legal obligations or disputes, or where information has been de-identified or aggregated. When we no longer need personal information, we take reasonable steps to delete, de-identify, or anonymize it.

7. Data Security

We use a combination of technical, administrative, and physical safeguards designed to protect personal information against unauthorized access, use, disclosure, alteration, and destruction. These measures include, for example:

• Encryption of data in transit (e.g., SSL/TLS);
• Encryption and access controls for sensitive systems;
• Firewalls, intrusion detection, and security monitoring;
• Role-based access controls and multi-factor authentication for staff;
• Security training and awareness programs for employees;
• Secure data-disposal practices for physical and electronic records;
• Vendor due diligence and contractual data-security requirements.

However, no system or transmission of data over the internet can be guaranteed to be 100% secure. You are responsible for using strong passwords (where applicable), protecting your devices, and promptly notifying us of any suspected unauthorized activity related to our services.

If we believe that a security incident has compromised your personal information, we will investigate promptly and, where required by law, notify you and appropriate regulators.

Security Incident Response

While we implement reasonable security measures, no system can be guaranteed to be 100% secure. You acknowledge that use of any online service involves inherent cybersecurity risks.

In the event of a security incident that compromises your personal information, we will investigate promptly and comply with all applicable breach notification requirements under California Civil Code § 1798.82 and other applicable laws.

Our liability for security incidents shall be limited to the maximum extent permitted by law, except that nothing in this section limits remedies or rights that cannot be waived under applicable data breach, privacy, or consumer protection laws.

8. Your Privacy Rights (General)

Depending on your jurisdiction, you may have some or all of the following rights:

• Right to Know / Access: To request information about the personal information we collect, use, and share, and to obtain a copy.
• Right to Correct: To request correction of inaccurate personal information.
• Right to Delete: To request deletion of personal information, subject to legal and operational exceptions.
• Right to Data Portability: To receive certain information in a portable and, where technically feasible, readily usable format.
• Right to Opt Out of Marketing: To opt out of emails, texts, and certain marketing communications.
• Right to Opt Out of "Sale" or "Sharing" / Targeted Advertising: You may exercise your right to opt out by:
  • Enabling a supported Global Privacy Control (GPC) signal in your browser; or
  • Contacting us at info@ongaroandsons.com or (707) 908-8025 and stating that you wish to opt out.
• Right to Limit Use of Sensitive Personal Information: In states where this right applies, to limit our use of sensitive information to what is reasonably necessary to provide the requested services.

We describe California and other state-specific rights in Section 9.

Exercising Your Rights

You (or your authorized agent) may exercise applicable rights by contacting us:

• Email: info@ongaroandsons.com
• Phone: (707) 908-8025

We may request information from you to verify your identity before acting on your request. If we cannot verify your identity, we may not be able to fulfill your request, and we will explain why.

If you use an authorized agent to submit a request on your behalf, we may require: (a) a signed authorization from you demonstrating that the agent has permission to act on your behalf; (b) proof of the agent's identity; and (c) direct verification of your identity with us. We may deny a request from an agent that does not submit proof of proper authorization.

We will respond within the timelines required by applicable law, typically within 45 days, with an extension of up to 45 additional days where permitted by law for complex requests. We reserve the right to deny requests where permitted by applicable exceptions, including but not limited to where verification cannot be completed, where the request is manifestly unfounded or excessive, or where legal or regulatory obligations require us to retain the information.

We will not discriminate against you for exercising your privacy rights.

9. State-Specific Privacy Rights

This section supplements the rest of this Privacy Policy for residents of certain U.S. states whose privacy laws apply to us. Ongaro & Sons primarily serves customers in California, but our Website may be accessed from other locations.

9.1 California Residents (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act ("CCPA"), as amended by the California Privacy Rights Act ("CPRA"), provides you with specific rights regarding your personal information, subject to certain exceptions.

Categories of Personal Information

The categories of personal information we collect, the purposes for which we use them, and the categories of recipients are summarized in this Policy and generally align with the statutory categories (identifiers, commercial information, internet activity, geolocation data, professional information, inferences, and limited sensitive personal information).

Right to Know / Access

You may request that we disclose: the categories and specific pieces of personal information we have collected about you; the categories of sources from which the information is collected; the business or commercial purposes for collecting, using, or "sharing" personal information; the categories of third parties to whom we disclose personal information; and the categories of personal information "shared" for cross-context behavioral advertising.

Right to Delete

You may request that we delete personal information we have collected from you, subject to exceptions (for example, information we need to complete transactions, comply with law, or maintain records related to warranties or disputes).

Right to Correct

You may request that we correct inaccurate personal information about you.

Right to Opt Out of Sale or Sharing / Targeted Advertising

We do not sell personal information for monetary consideration. However, we may "share" personal information (as that term is used in California law) with advertising and analytics partners for cross-context behavioral advertising. You may exercise your right to opt out by:

• Clicking the "Do Not Sell or Share My Personal Information" link located in the footer of our Website;
• Contacting us at info@ongaroandsons.com (subject line: "Do Not Share My Information") or (707) 908-8025 and stating that you wish to opt out;
• Enabling a supported Global Privacy Control (GPC) signal in your browser; or
• Managing your cookie preferences through third-party platforms such as Google Ad Settings, Meta Ad Preferences, or industry opt-out tools like the NAI or DAA.

We will treat a valid, recognized GPC signal as an opt-out request for that browser or device, as required by California law.

Right to Limit Use of Sensitive Personal Information — Enhanced Disclosure

California law requires businesses to permit consumers to limit the use of their sensitive personal information to purposes explicitly permitted by statute. We use sensitive personal information only for the following purposes permitted by California Civil Code § 1798.121:

• Performing services reasonably expected by an average consumer (HVAC, plumbing, electrical, solar services);
• Preventing, detecting, and investigating security incidents;
• Resisting malicious, deceptive, fraudulent, or illegal actions;
• Ensuring physical safety;
• Short-term, transient use;
• Performing services on our behalf (via service providers);
• Quality and safety verification;
• Collecting or processing sensitive personal information where such collection would not be considered a "sale" or "sharing" under CPRA.

We do not use or disclose sensitive personal information for purposes of inferring characteristics about consumers. Given our limited use of sensitive personal information as described above, we believe there is no additional use to limit. If you nonetheless wish to submit a request to limit use of sensitive personal information, you may contact us using the methods described in Section 8, and we will process your request in accordance with CPRA requirements.

Right to Non-Discrimination

We will not deny services, charge different prices, or provide a different level or quality of services solely because you exercised your rights under the CCPA/CPRA.

Minors Under 16

We do not knowingly sell or "share" the personal information of consumers under 16 years of age. If we learn that a consumer under 16 has provided us with personal information and that such information has been "sold" or "shared" in a way that requires opt-in consent under California law, we will cease such activity and honor applicable opt-out or deletion rights.

Financial Incentives

We do not currently offer programs or incentives that provide discounts, payments, or different prices in exchange for the collection, retention, or sale of personal information. If we introduce such a program in the future, we will provide a detailed "Notice of Financial Incentives" before collecting personal information for that program, including: (a) the material terms of the program; (b) how we calculate the value of the personal information; (c) how you may opt in to the program; and (d) how you may withdraw consent at any time. You will not be required to participate in any such program as a condition of receiving our services.

How to Submit Requests

California residents may submit requests by:

• Email: info@ongaroandsons.com (subject line: "California Privacy Rights Request")
• Phone: (707) 908-8025

We will verify your identity using information we reasonably request, which may include contact information, service history, or other data we already maintain. You may use an authorized agent to submit a request, provided we can verify both your identity and the agent's authority to act on your behalf.

Enforcement and Private Right of Action

You acknowledge that certain violations of California data breach notification or security laws may give rise to a private right of action. To the maximum extent permitted by law, in the event of any such violation, our liability shall be limited to actual damages and statutory minimums (where applicable), and we disclaim liability for speculative, consequential, or punitive damages except where expressly prohibited by law.

"Shine The Light" Law

California Civil Code § 1798.83 permits California residents to request certain information regarding our disclosure of personal information to third parties for their direct marketing purposes. We do not share personal information with third parties for their direct marketing purposes. To make a request or verify this status, please contact us at info@ongaroandsons.com.

9.2 Other U.S. State Privacy Laws

Residents of certain other states (such as Virginia, Colorado, Connecticut, Utah, and additional states that may enact comprehensive privacy laws in the future) may have similar rights, including rights to confirm whether we process your personal data, access and obtain a copy, correct inaccuracies, delete personal data, and opt out of targeted advertising, sale of personal data, and certain profiling.

We will honor these rights to the extent required by applicable law and consistent with the principles described in this Privacy Policy. To exercise these rights, please contact us using the methods described in Section 8. If applicable law provides an appeal process for denied requests, we will provide instructions in our response.

10. International Users and Data Transfers

Ongaro & Sons is based in the United States, and our Website and services are intended for use in the U.S., primarily in California.

If you are located outside the United States: your information may be transferred to, stored in, and processed in the United States or other jurisdictions where our service providers are located; data protection laws in those jurisdictions may differ from the laws in your location. If you access our services from outside the United States, you acknowledge that your information will be processed in the United States in accordance with this Privacy Policy and U.S. law, which may provide different levels of protection than the laws in your jurisdiction. By using our services from outside the United States, you consent to this transfer.

We do not actively market or target our services to individuals in the European Union or United Kingdom. If you choose to use our services from those regions, you do so on your own initiative, and your data will be handled in accordance with this Privacy Policy and U.S. law.

11. Third-Party Services and Links

Our Website and communications may include links to third-party websites, apps, or services that are not controlled by Ongaro & Sons. Examples include:

• Scheduling or payment platforms hosted by third parties;
• Social media pages and widgets;
• Manufacturer sites, rebate programs, or educational resources;
• Review platforms (e.g., Google, Yelp, BBB, Diamond Certified).

This Privacy Policy does not govern those third-party services. Their privacy policies and terms apply to your use of their services. We are not responsible for the privacy, security, or practices of third-party sites or services, and we encourage you to review their policies before providing personal information.

12. Children's Privacy

Our Website and services are not directed to children under 13, and we do not knowingly collect personal information from children under 13 without appropriate consent as required by law. If you are under 13, please do not use the Website or submit any personal information to us.

California law provides additional protections for minors between 13 and 15 years of age in certain contexts, including marketing and "sale" or "sharing" of personal information. We handle information about minors consistent with those requirements as described in Sections 8 and 9.

If we learn that we have collected personal information from a child in violation of applicable law, we will delete it as soon as reasonably practicable.

If you are a parent or guardian and believe we may have collected information from your child, please contact us at info@ongaroandsons.com or (707) 908-8025.

13. AI and Automated Decision-Making

We may use artificial intelligence (AI), machine learning, algorithms, or automated tools for business operations, including but not limited to:

• Customer service (e.g., chatbots, inquiry routing, sentiment analysis);
• Scheduling optimization and technician dispatch;
• Predictive maintenance recommendations;
• Fraud detection and security monitoring;
• Marketing optimization and audience analysis;
• Analyzing service data to improve operational efficiency.

Solely Automated Decisions

We do not make decisions producing legal or similarly significant effects concerning you based solely on automated processing without human involvement. Specifically:

• Service eligibility and pricing decisions involve human review;
• Financing decisions are made by third-party lenders (not by us);
• Scheduling and service recommendations may be system-generated but are confirmed by staff;
• Emergency service dispatch involves human oversight.

California CPRA Compliance (§ 1798.185(a)(16))

To the extent we deploy automated decision-making that may produce legal or similarly significant effects, we will: provide meaningful information about the logic involved; disclose the likely significance and consequences; permit you to request human review of the decision where required by law; and comply with any regulations adopted under CPRA § 1798.185(a)(16).

As AI regulations evolve (including potential California AI laws and federal frameworks), we will maintain compliance and update this section accordingly. You may contact us at info@ongaroandsons.com with questions about automated decision-making.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technologies, or legal requirements.

When we make changes: we will update the "Last Updated" date at the top of this page; for material changes, we may provide additional notice (such as a prominent notice on the Website or an email, when appropriate); and updated policies will apply going forward from the Effective Date, and your continued use of the Website or services after the Effective Date constitutes your acceptance of the updated Policy.

We encourage you to review this Privacy Policy periodically.

15. Contact Us

If you have questions, requests, or concerns about this Privacy Policy or our privacy practices, please contact us:

16. Platform and Technology Changes

16.1 Right to Modify Technologies

Ongaro & Sons operates in a rapidly evolving technology environment. We explicitly reserve the right to:

• Add, change, substitute, or discontinue any analytics, advertising, CRM, payment, scheduling, or other technology platforms at any time;
• Migrate data between systems, cloud providers, or service providers as necessary for business operations;
• Implement new technologies (including artificial intelligence, machine learning, or emerging marketing technologies) as necessary for business operations, provided such implementations comply with applicable law and do not materially change the purposes for which we process personal information;
• Modify our use of cookies, pixels, tags, and similar technologies to adapt to industry standards, browser changes, and platform requirements.

16.2 Continuity of Privacy Principles

While specific technologies and vendors may change, our commitment to the privacy principles outlined in this Policy remains constant:

• We collect only information reasonably necessary for the purposes described;
• We maintain reasonable security for personal information;
• We provide transparency about our practices;
• We honor consumer rights required by applicable law;
• We limit sharing of personal information to purposes consistent with this Policy.

16.3 Material vs. Routine Changes

"Material changes" requiring notice under Section 14 are limited to changes that: introduce new purposes for processing personal information that are not compatible with or reasonably encompassed by the purposes disclosed in this Policy; materially reduce consumer rights or protections; change the legal basis for processing (where applicable); or are otherwise required by law to be disclosed with notice.

Routine changes that do not constitute "material changes" include: switching from one email service provider to another; changing analytics platforms (e.g., from Google Analytics to a similar service); updating advertising pixels or tags (e.g., implementing a new social media platform's pixel); migrating to new cloud infrastructure or hosting providers; adopting new CRM, payment processing, or scheduling platforms; and technical updates to tracking technologies to maintain functionality as browsers evolve.

Such routine changes are within the scope of this Policy because they do not materially alter how we collect, use, or share your personal information or affect your rights under this Policy. Accordingly, we are not required to update the Policy or provide individual notice for these types of routine vendor substitutions. Material changes that affect data handling practices, consumer rights, or the purposes of processing will be disclosed through Policy updates and notices as described in Section 14.