Effective Date: February 2, 2023
Information We Collect from You
We collect the following categories of personal information from you when you actively share it with us, visit our stores, and when you provide it to us passively through use of our Services:
- First name and last name
- Phone number
- Mailing address
- Email address
- Payment card information (immediately transferred to our payment processor – we do not retain this)
- User account credentials (user ID and password)
- Account information (billing name, billing address, billing phone number, payment method)
- Purchase/return/exchange information
- Your activity (such as the products you view and products you purchase) and interests (such as hunting, fishing, shooting)
- Your Internet Protocol (“IP”) address and location associated with your IP address
- Browser type and settings device information and network information
- Audio/Video information about you (CCTV, when you visit our stores)
If you purchase a firearm, we will also collect the following information in connection with certain forms that are required by the federal Bureau of Alcohol, Tobacco, Firearms and Explosives and by the state:
- Place of birth
- Date of Birth
- Social Security number (optional)*
- Unique Personal Identification Number (UPIN) or Appeals Management Database Identification (AMD ID) (if applicable)*
- Country of Citizenship*
- U.S. issued alien or admission number (AR#, USCIS# or 194#)*
- Criminal history
- Mental health history*
- Driver’s license number or another valid government-issued identification number*
*Sensitive personal information
Information We Collect From Our Service Providers About You
We use tools like Google Analytics to measure traffic on our Services and how users interact with our Services. Google Analytics utilizes cookies to gather information regarding use of our Services, which Google uses to generate reports for us regarding our Services. Google Analytics collects information when you use the Services, such as time of visit, pages visited, and time spent on each page of the webpages, referring site details, type of web browser, type of operating system, screen resolution, and IP address. Green Top does not link this information with a particular individual user. The details of the cookies used by Google Analytics on our website are available in our cookies policy. To find out more about how Google uses data when you use our Services and your options for controlling the information collected by Google from the Services, please click here. You may opt-out of having your activity on our Services made available to Google Analytics by installing the Google Analytics browser add-on, available here.
How We Collect Your Personal Information
We collect your personal information through various means and sources. A summary of the categories of the sources from which we collect personal information is set forth below and a more detailed explanation of those categories of sources follows after the chart.
|Category of Personal Information||Category of Sources from Which We Collect Personal Information|
||Directly from you. Please see below for a further explanation.|
|Internet or Other Electronic Network Activity Information||
Directly from you as you visit our websites or transact in our stores using your loyalty account.
Indirectly from you by observing your actions on our website or interactions with our emails.
Third-party fraud assessment tool when you place an order via one of our websites.
Indirectly from you by observing your actions on our website or interactions with our emails.
Third-party fraud assessment tool and directly from you when you place an order via one of our websites.
|Audio, Electronic, or Visual Information||
Via security camera recordings when you visit our stores.
Directly from you when you submit picture or videos to us.
|Professional or Employment-Related Information||
Directly from you as you apply for or become employed by us.
|Inferences About You From Any Other Category of Information We Collect||
Directly from you based on purchases you make from our websites or stores.
Our service providers.
|Category of Sensitive Personal Information||Category of Sources from Which We Collect Sensitive Personal Information|
Directly from you when you purchase a firearm from us.
Third-party payment vendor and third-party fraud assessment tool.
How We Use Your Personal Information
We use the personal information that we collect for the following purposes:
(1) We use your account information to:
- verify your identity or other information
- fulfill transactions and provide the Services
- send you information about promotions and products and services that may be of interest to you
- administer contests and sweepstakes
- operate, improve and personalize the Service
- respond to your comments and questions and otherwise provide customer service
- understand and analyze patterns of use of our Services and trends
- customize our advertising and marketing materials so that they are useful, relevant, valuable or otherwise of interest
- help us develop new products and services and improve our existing products and services
- ensure the Services function properly and to track logins
- enable our other business purposes, such as dispute resolution, audits and security, detection, prevention and mitigation of fraudulent or illegal activities
- comply with our legal obligations, policies and procedures
(2) Third Party Services. We and our service providers use anonymous identifiers, such as cookies and other technologies to collect and store certain types of information (e.g. click stream information, browser type, time and date, subject of advertisements clicked or scrolled over, hardware/software information, cookie and session ID) whenever you interact with our Services.
We use this information to:
- understand and analyze patterns of use of our Services and trends
- to examine metrics regarding how you are shopping on our Services, the performance of our marketing efforts and your response to those marketing efforts
Deidentified or Aggregated Data.
Sharing of Personal Information
- Third party service providers. We sometimes use third-party service providers to act on our behalf, to process transactions and payments and provide other services related to the operation of our business. These service providers are only allowed to use your information in connection with the specific service they provide on our behalf.
- Corporate Affiliates. We may share personal information with our corporate affiliates, parents and/or subsidiaries.
- Legal purposes. If required to do so by law or in the good faith belief that such action is appropriate: (a) under applicable law, including laws outside your country of residence; (b) to comply with legal process; (c) to respond to requests from public and government authorities, including public and government authorities outside your country of residence; (d) to enforce our terms and conditions; (e) to protect our operations or those of any of our affiliates; (f) to protect our rights, privacy, safety or property, and/or that of our affiliates, you or others; and (g) to allow us to pursue available remedies or limit the damages that we may sustain.
- Corporate transactions. With a potential or actual acquirer, successor, or assignee as part of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of our business, assets or stock (including in bankruptcy or similar proceedings).
- With your consent.
Notice Regarding “Do Not Track” Signals
At this time, the Services are not able to respond to Do Not Track (DNT) signals.
Third Party Services
We retain the personal information we receive for as long as you use our services or as necessary to fulfill the purpose(s) for which it was collected, provide our services, resolve disputes, establish legal defenses, conduct audits, pursue legitimate business purposes, enforce our agreements, and comply with applicable laws.
When determining how long this retention period will last once the purpose of processing the personal information has been satisfied, we consider the length of time personal information is required to:
- continue to develop, tailor, upgrade, and improve our Site;
- maintain business records for analysis and/or audit purposes
- comply with record retention requirements under the law;
- defend or bring any existing or potential legal claims; or
- address any complaints regarding our Site.
We are committed to the protection of your personal information and have implemented appropriate and reasonable physical, technical, and administrative safeguards to help prevent unauthorized access to, use of, and disclosure of, your personal information. When you place an order through the website, we protect your information using encryption technology. Please know, however, that no system or network can be guaranteed to be 100% secure. Users are responsible for maintaining the secrecy of their own passwords. If you have reason to believe that your interaction with us is no longer secure (for example, if you feel that the security of any account you might have with us has been compromised), please immediately notify us by calling 804-550-2188 or emailing us here.
Your Choices About How We Collect Information
- How You Can Access or Change Your Personal Information or Deactivate Your Account. You may delete your user account or change your personal information by contacting us here. We will use commercially reasonable efforts to honor your request. We may retain an archived copy of your records as required by law or for legitimate business purposes.
- Communications. You may opt-out of receiving promotional email communications from us by following the unsubscribe options on such communications. Your personal information may persist in historical or archived copies if needed for legal or other legitimate business reasons. We do not use text messaging for marketing purposes.
Your California Privacy Rights
If you are a resident of California, your right to submit certain requests relating to your personal information is described below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms. You may designate an authorized agent to make the requests below on your behalf; however, you will still need to verify your identity directly with us before your request can be processed.
Rights to Know, Correct and Delete
Right to Know Personal Information Collected About You
If you are a California resident, you have the right to know: (1) the categories of personal information we have collected about you; (2) the categories of sources from which the personal information is collected; (3) the business or commercial purpose for collecting, selling, or sharing personal information; (4) the categories of third parties to whom we disclose personal information; and (5) the specific pieces of personal information we have collected about you. You also have the right to know the list of all third parties to whom we have disclosed personal information, as defined under California Civil Code Section 1798.83(e) (a/k/a the “Shine the Light Law”), during the preceding year for third party direct marketing purposes.
Right to Know Personal Information Disclosed or Shared
For California residents, since we share and/or disclose your personal information, as described above, you have the right to request that we tell to you: (1) the categories of personal information that we collected about you; (2) the categories of personal information that we sold or shared about you and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of third parties to whom the personal information was sold or shared; and (3) the categories of personal information that we disclosed about you for a business purpose and the categories of persons to whom it was disclosed for a business purpose.
Right to Correct Inaccurate Information
California residents also have the right to request that we correct your personal information collected or maintained by us. If you believe that any of the personal information we maintain about you is inaccurate, you have the right to submit a request for us to correct that information. Upon receipt of a request, we will use commercially reasonable efforts to correct the information as you direct.
Right to Request Deletion of Your Personal Information
California residents also have the right to request that we delete your personal information collected or maintained by us. We will let you know what, if any, personal information we can delete from our records, and we will direct any service providers that may have collected personal information about you to delete your personal information from their records. There may be circumstances where we cannot delete your personal information or direct service providers to delete your personal information from their records. For example, if we need to: (1) retain your personal information to complete a transaction or provide services; (2) detect security incidents; (3) protect against unlawful activities; (4) identify, debug or repair errors; or (5) comply with a legal obligation.
Exercising Rights to Know, Correct and Delete, and Related Verification Measures
You may submit a request regarding your rights to know, correct and/or delete by clicking here or by calling us at 804-550-2188.
Upon submission of a request to know, correct or delete, we will take reasonable steps to confirm that the person submitting the request to know or request to delete is the person to whom the information relates (or his or her authorized agent), and to prevent unauthorized access or deletion of information. The specific steps taken to verify the identity of the requesting person may vary based on the nature of the request, including the type, sensitivity, and value of the information requested, the risk of harm posed by unauthorized access or deletion, the likelihood that fraudulent or malicious actors may seek the information, the robustness of personal information provided to verify your identity, the nature of our business relationship with you, and available technology for verification.
We will generally try to avoid requesting additional information from you for the purpose of verification, but we may need to do so if we cannot verify your identity based on the information already maintained by us. If we request additional information to verify your identity, it will be for that purpose only and will be deleted as soon as practical after processing the request, except as otherwise provided by law.
The following generally describes the verification processes we use:
- Password Protected Accounts. If you have a password-protected account with us, we may use existing authentication practices to verify your identity but will require re-authentication before disclosing, correcting or deleting data. If we suspect fraudulent or malicious activity relating to your account, we will require further verification (as described below) before complying with a request to know or delete.
- Verification for Non-Accountholders. If you do not have, or cannot access, a password-protected account with us, we will generally verify your identity as follows:
- For requests to know categories of personal information, we will verify your identity to a reasonable degree of certainty by matching at least two data points provided by you with reliable data points maintained by us.
- For requests to know specific pieces of personal information, we will verify your identity to a reasonably high degree of certainty by matching at least three data points provided by you with reliable data points maintained by us. We will also require a declaration, signed under penalty of perjury, that the person requesting the information is the person whose information is the subject of the request or that person’s authorized representative. We will maintain all signed declarations as part of our records.
- For requests to correct or delete personal information, we will verify your identity to a reasonable degree or a reasonably high degree of certainty depending on the sensitivity of the personal information and the risk of harm posed by unauthorized deletion. We will act in good faith when determining the appropriate standard to apply.
If there is no reasonable method by which we can verify your identity, we will state so in response to a request to know or delete personal information, including an explanation of why we have no reasonable method to verify your identity.
If you use an authorized agent to submit a request to know, delete or correct, we may require the authorized agent to provide proof that you gave the agent signed permission to submit the request. We may also require you to do either of the following: (a) verify your own identity directly with us; or (b) directly confirm with us that you provided the authorized agent permission to submit the request. This requirement does not apply if you have provided the authorized agent with power of attorney pursuant to Probate Code sections 4121 to 4130.
We will respond to requests to know, requests to delete and / or delete no later than 45 calendar days. If we cannot verify your request within 45 days, we may deny your request. If necessary, we may take up to an additional 45 days to respond to your request but in such an event will provide you a notice and an explanation of the reason that we will take more than 45 days to respond to your request.
Right to Opt-Out of the Sharing of Your Personal Information
You may opt-out of the sharing of your personal information by completing the form here.
Right to Limit the Use of Your Sensitive Personal Information
We limit the processing of your Sensitive Personal Information to the following: (i) to that use which is necessary to perform the services or provide the goods reasonably expected by you; (ii) to help to ensure security and integrity; (iii) to perform services on our behalf; (iv) to undertake activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by us; and (v) to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by us.
Right to Non-Discrimination for the Exercise of Your Privacy Rights
If you choose to exercise any of the privacy rights conferred by the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020, you also have the right not to receive discriminatory treatment by us. This means that consistent with California law, we will not deny providing our services to you, charge you different prices or provide a different level or quality of service to you unless those differences are related to the value of your personal information.
Your Rights If You Are A Resident of Virginia
If you are a resident of Virginia (except as noted), you have, or will soon have, certain additional rights set forth below. Please note that these rights are subject to certain exceptions and certain of these rights are subject to verification mechanisms.
The Right to Know: You have the right to know whether we are processing your personal information.
The Right of Access: You have the right to access your personal information, and to obtain a copy of it in a readily usable format, if feasible.
The Right to Correct Inaccuracies: You may request that inaccuracies in your personal information be corrected.
The Right to Delete: You have the right to request that your personal information be deleted, except in cases where retention is required by law or contractual obligation.
The Right to Data Portability: You have the right to obtain a copy of your data in a portable and, if feasible, readily usable format.
The Right to Opt-Out: You may elect to prevent your personal information from being:
Used in targeted advertising;
Used for profiling purposes that may produce legal or similarly significant effects.
Furthermore, in connection with your sensitive personal data: if you are a resident of Virginia, we will not process sensitive personal data without obtaining your consent.
You may submit a request by clicking here or by calling us at 804-550-2188. Information requests under “Right of Access” will be transmitted securely. If we cannot fulfill your request, we will notify you of that decision and the reasons why within 45 days. At that point, if you believe our decision was in error, you can submit an appeal using the method(s) above. If the result is the same, you can also seek assistance and/or redress from your state attorney general.
Your Nevada Privacy Rights
If you reside in Nevada, you have the right to direct us to not sell your covered information, as defined in Chapter 603A of the Nevada Revised Statutes. We do not and will not sell your personal information to third parties. As such, there is no need to submit a request for us not to sell your personal information. If you have any questions, please contact us here.
Green Top does not intend for children under the age of 18 to use the Services or submit information. In accordance with privacy laws regarding personal information of children, if we learn that we have collected personal information from a child under the age of 18, we will delete that information from our records, unless we are legally required to retain it. Contact us if you believe that we have mistakenly or unintentionally collected information from a child under the age of 18.
If you have any questions regarding our privacy practices or this policy, please contact us here.