Legal
Privacy Policy
Effective date:
NextGen Lamination Solutions (“NextGen,” “we,” “us,” or “our”) operates the website located at nextgenlam.com (the “Site”). This Privacy Policy explains what information we collect, how we use it, and your rights with respect to that information. By using the Site or placing an order, you agree to the practices described in this policy.
1. Information We Collect
We collect information you provide directly to us and information collected automatically when you use the Site.
Information you provide
- Account registration: name, email address, and password when you create an account.
- Orders and purchases: billing address, shipping address, and payment information (processed securely through our payment processor — we do not store full card numbers).
- Contact forms and inquiries: name, email, phone number, company name, and the content of your message.
- Tax exemption requests: organization name, exemption certificate, and related documentation.
- Account security: if you enable two-factor authentication, we store a hashed TOTP secret and encrypted backup codes.
Information collected automatically
- Usage data: pages visited, time spent, referring URLs, and browser/device type, collected via Google Analytics 4.
- Cookies: session cookies for authentication and preference cookies for cart state. We do not use third-party advertising cookies.
- Server logs: IP address, request timestamps, and HTTP status codes retained for security and debugging purposes.
2. How We Use Your Information
- Process and fulfill orders, including sending order confirmations and shipping notifications.
- Maintain your account and authenticate your identity.
- Respond to inquiries, quote requests, and customer support communications.
- Calculate and collect applicable sales tax.
- Process and verify tax exemption certificates.
- Send transactional emails (order confirmations, invoice notifications, password resets).
- Improve the Site through aggregated analytics data.
- Detect and prevent fraud, unauthorized access, and other security incidents.
- Comply with legal obligations.
We do not sell your personal information to third parties. We do not use your information for behavioral advertising.
3. Sharing of Information
We share your information only as necessary to operate our business:
- Payment processors: your payment details are transmitted directly to our payment processor (GoDaddy Payments) and are not stored on our servers. GoDaddy Payments is PCI DSS compliant. Bank wire and ACH transfers are processed directly through our banking institution.
- Shipping carriers: name and shipping address are shared with carriers to fulfill your order.
- Analytics: anonymized usage data is shared with Google Analytics. You can opt out via the Google Analytics opt-out browser add-on.
- Service providers: hosting, email delivery, and other infrastructure providers who process data on our behalf under confidentiality obligations.
- Legal requirements: we may disclose information if required by law, court order, or to protect the rights and safety of NextGen, our customers, or the public.
4. Payment Security
All payment transactions are processed through GoDaddy Payments, a PCI DSS Level 1 compliant payment processor. We do not store, transmit, or process full credit card numbers on our servers. Your payment data is encrypted in transit using TLS 1.2 or higher and handled entirely within the payment processor's secure environment.
5. Data Retention
We retain your account information for as long as your account is active. Order records are retained for a minimum of seven (7) years for tax and accounting purposes. You may request deletion of your account at any time; we will delete or anonymize personal data except where retention is required by law.
6. Security
We use industry-standard security measures including HTTPS/TLS encryption, hashed passwords (bcrypt), and access controls. No method of transmission over the internet is 100% secure. We encourage you to use a strong, unique password and to enable two-factor authentication on your account.
7. Cookies
We use the following types of cookies:
- Strictly necessary: session authentication and cart state. These cannot be disabled without breaking core site functionality.
- Analytics: Google Analytics 4 cookies that help us understand how visitors use the Site. Analytics cookies are enabled by default. You may opt out at any time using the Google Analytics opt-out browser add-on or your browser's cookie settings.
You can manage or disable analytics cookies through your browser settings or the Google Analytics opt-out browser add-on at any time.
8. Your Privacy Rights
Depending on your location, you may have the following rights regarding your personal data:
- Access: request a copy of the personal data we hold about you.
- Correction: update inaccurate or incomplete information through your account profile or by contacting us.
- Deletion: request deletion of your account and associated personal data.
- Portability: request your data in a structured, machine-readable format.
- Opt-out of sale: we do not sell personal information. No opt-out is required, but you may confirm this in writing by contacting us.
- Opt-out of analytics: disable Google Analytics tracking via the opt-out browser add-on or your browser's cookie settings.
To exercise any of these rights, contact us at [email protected]. We will respond within 45 days.
9. State-Specific Privacy Notices
California — CCPA / CPRA
Under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), California residents have the right to:
- Know what personal information we collect, use, disclose, and sell or share.
- Delete personal information we have collected, subject to certain exceptions.
- Correct inaccurate personal information we maintain about you.
- Opt out of sale or sharing of personal information. We do not sell or share personal information for cross-context behavioral advertising.
- Limit use of sensitive personal information to necessary purposes.
- Non-discrimination — we will not discriminate against you for exercising any of these rights.
To submit a verifiable consumer request, email [email protected] with the subject line “California Privacy Request.” We will respond within 45 days, with one 45-day extension where reasonably necessary.
California's “Shine the Light” law (Civil Code § 1798.83) permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. We do not make such disclosures.
Virginia — VCDPA
Under the Virginia Consumer Data Protection Act (VCDPA), Virginia residents have the right to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. We do not sell personal data or use it for targeted advertising or profiling. To exercise your rights, contact us at [email protected]. If we decline to act on your request, you may appeal by sending a follow-up email with the subject line “Virginia Privacy Appeal.”
Colorado — CPA
Under the Colorado Privacy Act (CPA), Colorado residents have the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. We do not sell personal data or conduct targeted advertising. To submit a request, email [email protected]. You may appeal a denial by emailing us with the subject line “Colorado Privacy Appeal” within 45 days of our response.
Connecticut — CTDPA
Under the Connecticut Data Privacy Act (CTDPA), Connecticut residents have the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. We do not sell personal data or conduct targeted advertising. To submit a request, email [email protected]. You may appeal a denial within 60 days of our response by emailing us with the subject line “Connecticut Privacy Appeal.”
Texas — TDPSA
Under the Texas Data Privacy and Security Act (TDPSA), Texas residents have the right to access, correct, delete, and obtain a copy of personal data, and to opt out of targeted advertising, the sale of personal data, and profiling. We do not sell personal data or conduct targeted advertising. To submit a request, email [email protected].
Nevada — SB 220
Nevada residents may opt out of the sale of personal information under Nevada SB 220. We do not sell personal information as defined under Nevada law. To submit a written opt-out request, email [email protected] with the subject line “Nevada Opt-Out Request.”
10. Children's Privacy
The Site is intended for business use and is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us immediately at [email protected].
11. Third-Party Links
The Site may contain links to third-party websites (such as manufacturer sites or financing partners). We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.
12. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised policy on this page with an updated effective date. Continued use of the Site after changes are posted constitutes your acceptance of the revised policy.
13. Contact Us
If you have questions about this Privacy Policy, wish to exercise your privacy rights, or have a complaint about our data practices, please contact us:
NextGen Lamination Solutions1699 King Street, Enfield, CT 06082
Email: [email protected]
Phone: 1-959-333-9862