Policy Number	PPOIC-PRIV-001	Version	1.0
Effective Date	January 22, 2026	Last Reviewed	January 22, 2026
Policy Owner	Chief Information Security Officer	Classification	Public
Compliance Framework	California Consumer Privacy Act (CCPA), General Data Protection Regulation (GDPR) where applicable

1. Introduction

1.1 Purpose and Scope

Planned Packaging of Illinois Corp ("PPOIC," "we," "us," or "our") is committed to protecting your privacy and being transparent about the technologies we use on our websites, web applications, and digital platforms. This Cookie Policy explains how we use cookies and similar tracking technologies when you visit our websites, including www.ppoic.com and any associated subdomains, mobile applications, and online services (collectively, the "Services").

This policy is designed to help you understand:

• What cookies and similar technologies are and why we use them
• The types of cookies we deploy and their purposes
• How you can control and manage cookie preferences
• Your rights under applicable privacy laws, including the California Consumer Privacy Act (CCPA) and the General Data Protection Regulation (GDPR)
• How to contact us with questions or concerns about our cookie practices

1.2 Our Commitment to Transparency

At PPOIC, we believe in complete transparency regarding how we collect and use data through cookies and similar technologies. We are committed to:

• Clear Communication: Providing straightforward explanations of our cookie practices
• User Control: Giving you meaningful choices about the cookies used during your visits
• Minimal Data Collection: Only collecting data necessary for legitimate business purposes
• Security: Implementing appropriate security measures to protect cookie data
• Compliance: Adhering to all applicable privacy laws and regulations

1.3 Relationship to Other Policies

This Cookie Policy should be read in conjunction with our:

• Privacy Policy: Which describes our overall data collection and processing practices
• Terms of Service: Which governs your use of our Services
• Data Protection Policy (PPOIC-SEC-009): Which outlines our comprehensive data protection framework
• Information Security Policy: Which describes our security controls and measures

2. What Are Cookies

2.1 Definition of Cookies

Cookies are small text files that are placed on your device (computer, tablet, smartphone, or other internet-enabled device) when you visit a website. Cookies are widely used by website owners to make their websites work more efficiently, provide a better user experience, and gather information about how visitors interact with their sites.

Each cookie typically contains:

• Name: A unique identifier for the cookie
• Value: The data stored within the cookie
• Domain: The website that created the cookie
• Path: The specific pages where the cookie is active
• Expiration Date: When the cookie will be automatically deleted
• Secure Flag: Whether the cookie should only be transmitted over HTTPS
• HttpOnly Flag: Whether the cookie can be accessed by client-side scripts

2.2 How Cookies Work

When you first visit our website, our web server sends cookies to your browser, which stores them on your device. On subsequent visits, your browser sends these cookies back to our server, allowing us to recognize your device and remember information about your previous visits.

2.3 Types of Tracking Technologies

In addition to traditional cookies, we may use other tracking technologies:

Technology	Description	Purpose
HTTP Cookies	Small text files stored in your browser that contain data about your visits	Session management, personalization, analytics, and advertising
Web Beacons (Pixel Tags)	Tiny, invisible images (usually 1x1 pixels) embedded in web pages or emails	Track page views, email opens, and user interactions
Local Storage	Browser-based storage that allows websites to store larger amounts of data locally	Store user preferences and application state
Session Storage	Similar to local storage but data is cleared when the browser session ends	Temporary data storage during a browsing session
JavaScript Tags	Code snippets that execute when a page loads to collect information	Analytics, functionality, and third-party integrations
ETags	HTTP header values used for cache validation that can function as identifiers	Cache management and potential tracking
Fingerprinting	Collecting device and browser characteristics to create a unique identifier	Fraud prevention and security (we minimize use of this technology)

2.4 First-Party vs. Third-Party Cookies

Cookies can be classified based on who creates and manages them:

• First-Party Cookies: These are cookies set by PPOIC directly when you visit our websites. They are stored under our domain (ppoic.com) and are primarily used for essential functionality, user preferences, and basic analytics. We have complete control over these cookies.
• Third-Party Cookies: These are cookies set by third-party services that we integrate into our websites, such as analytics providers, advertising networks, and social media platforms. These cookies are stored under the third party's domain, and we have limited control over how these organizations use the data collected.

3. Types of Cookies We Use

We categorize the cookies used on our Services into four main categories based on their purpose and functionality. Below is a detailed explanation of each category:

3.1 Essential/Strictly Necessary Cookies

These cookies are essential for the proper functioning of our website and cannot be disabled in our systems. They are usually set in response to actions you take that constitute a request for services, such as setting your privacy preferences, logging in, or filling out forms.

Purposes of Essential Cookies:

• Maintaining user sessions and authentication states
• Remembering items in your shopping cart during checkout
• Preventing cross-site request forgery (CSRF) attacks
• Enabling secure areas of our website
• Load balancing to ensure website availability
• Storing cookie consent preferences

Cookie Name	Purpose	Duration	Provider	Category
PHPSESSID	Maintains user session state across page requests	Session	PPOIC	Essential
ppoic_session	Stores encrypted session data for authenticated users	2 hours	PPOIC	Essential
csrf_token	Security token to prevent cross-site request forgery attacks	Session	PPOIC	Essential
cookie_consent	Stores your cookie consent preferences	1 year	PPOIC	Essential
__secure-auth	Secure authentication token for logged-in users	30 days	PPOIC	Essential
load_balancer	Ensures requests are routed to the same server for session consistency	Session	PPOIC	Essential

3.2 Functional Cookies

Functional cookies enable our website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. If you do not allow these cookies, some or all of these features may not function properly.

Purposes of Functional Cookies:

• Remembering your language and region preferences
• Storing your display preferences (font size, layout)
• Remembering if you've been asked to participate in a survey
• Providing live chat functionality
• Enabling social media sharing features
• Personalizing content based on your preferences

Cookie Name	Purpose	Duration	Provider	Category
ppoic_lang	Stores your preferred language setting	1 year	PPOIC	Functional
ppoic_region	Stores your selected region for localized content	1 year	PPOIC	Functional
user_preferences	Stores display and accessibility preferences	1 year	PPOIC	Functional
recently_viewed	Tracks recently viewed products for quick access	30 days	PPOIC	Functional
chat_session	Maintains state for live chat support sessions	Session	LiveChat	Functional
survey_shown	Prevents showing the same survey multiple times	90 days	PPOIC	Functional

3.3 Analytics/Performance Cookies

Analytics cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. They allow us to measure and improve the performance of our site by understanding which pages are most and least popular and how visitors navigate around the site.

Purposes of Analytics Cookies:

• Counting page views and unique visitors
• Understanding how users navigate through the site
• Measuring the effectiveness of our content
• Identifying technical issues and performance problems
• Testing different versions of pages (A/B testing)
• Generating statistical reports about website usage

Cookie Name	Purpose	Duration	Provider	Category
_ga	Google Analytics - Distinguishes unique users by assigning a randomly generated number	2 years	Google	Analytics
_gid	Google Analytics - Stores and updates a unique value for each page visited	24 hours	Google	Analytics
_gat	Google Analytics - Used to throttle request rate to limit data collection	1 minute	Google	Analytics
_ga_[ID]	Google Analytics 4 - Persists session state	2 years	Google	Analytics
ppoic_analytics	Internal analytics tracking for site performance monitoring	1 year	PPOIC	Analytics
_hjid	Hotjar - Set when the customer first lands on a page	1 year	Hotjar	Analytics
_hjSessionUser	Hotjar - Ensures data from subsequent visits is attributed to the same user	1 year	Hotjar	Analytics
_hjSession	Hotjar - Holds current session data	30 minutes	Hotjar	Analytics

3.4 Marketing/Advertising Cookies

Marketing cookies are used to track visitors across websites with the intention of displaying ads that are relevant and engaging for individual users. These cookies may be set through our site by our advertising partners and are used to build a profile of your interests and show you relevant advertisements on other sites.

Purposes of Marketing Cookies:

• Delivering targeted advertisements based on your interests
• Limiting how often you see an advertisement
• Measuring the effectiveness of advertising campaigns
• Enabling remarketing to previous site visitors
• Building profiles of user interests across websites
• Connecting with social media platforms for targeted advertising

Cookie Name	Purpose	Duration	Provider	Category
_fbp	Facebook Pixel - Delivers advertising when users are on Facebook or a digital platform	3 months	Meta	Marketing
fr	Facebook - Delivers advertising and measures effectiveness	3 months	Meta	Marketing
IDE	Google DoubleClick - Used to track users across Google services for ad targeting	1 year	Google	Marketing
NID	Google - Stores preferences and information for Google Maps pages	6 months	Google	Marketing
_gcl_au	Google AdSense - Stores conversion information	3 months	Google	Marketing
li_sugr	LinkedIn Insight Tag - Collects data for ad targeting	3 months	LinkedIn	Marketing
bcookie	LinkedIn - Browser identifier cookie for analytics	1 year	LinkedIn	Marketing

4. Specific Cookies Deployed

The following table provides a comprehensive list of all cookies that may be set when you visit PPOIC websites and digital services. This list is regularly reviewed and updated to ensure accuracy.

4.1 Complete Cookie Inventory

Cookie Name	Purpose	Type	Duration	Provider	Category
PHPSESSID	Preserves user session state across page requests	Session	Session	PPOIC	Essential
ASP.NET_SessionId	Session identifier for .NET applications	Session	Session	PPOIC	Essential
ppoic_auth_token	Authentication token for secure user sessions	Persistent	30 days	PPOIC	Essential
XSRF-TOKEN	Cross-site request forgery prevention token	Session	Session	PPOIC	Essential
__Host-session	Secure session cookie with strict security attributes	Session	Session	PPOIC	Essential
cookie_preferences	Stores user's cookie consent choices	Persistent	1 year	PPOIC	Essential
cart_id	Identifies shopping cart for order processing	Persistent	14 days	PPOIC	Essential
cf_clearance	Cloudflare security verification	Persistent	30 minutes	Cloudflare	Essential
ppoic_locale	Stores language and regional preferences	Persistent	1 year	PPOIC	Functional
timezone	Stores detected timezone for local time display	Persistent	1 year	PPOIC	Functional
ppoic_theme	Stores user's display theme preference (light/dark)	Persistent	1 year	PPOIC	Functional
accessibility_settings	Stores accessibility preferences (font size, contrast)	Persistent	1 year	PPOIC	Functional
__lc_cid	LiveChat customer ID for support continuity	Persistent	3 years	LiveChat	Functional
__lc_cst	LiveChat session token	Session	Session	LiveChat	Functional
viewed_products	List of recently viewed products	Persistent	30 days	PPOIC	Functional
_ga	Google Analytics main tracking cookie	Persistent	2 years	Google	Analytics
_gid	Google Analytics daily user identifier	Persistent	24 hours	Google	Analytics
_gat_UA-XXXXXXX-X	Google Analytics throttling cookie	Persistent	1 minute	Google	Analytics
_ga_XXXXXXXX	Google Analytics 4 session persistence	Persistent	2 years	Google	Analytics
_hjid	Hotjar user identifier	Persistent	1 year	Hotjar	Analytics
_hjFirstSeen	Identifies a new user's first session	Session	Session	Hotjar	Analytics
_hjIncludedInPageviewSample	Determines if user is included in page view sample	Session	2 minutes	Hotjar	Analytics
_hjAbsoluteSessionInProgress	Detects first pageview session	Session	30 minutes	Hotjar	Analytics
_fbp	Facebook Pixel tracking	Persistent	3 months	Meta	Marketing
_fbc	Facebook click identifier	Persistent	3 months	Meta	Marketing
IDE	Google DoubleClick ad targeting	Persistent	13 months	Google	Marketing
test_cookie	Google DoubleClick cookie support check	Session	15 minutes	Google	Marketing
_gcl_au	Google Ads conversion tracking	Persistent	3 months	Google	Marketing
lidc	LinkedIn data center routing	Persistent	24 hours	LinkedIn	Marketing
UserMatchHistory	LinkedIn Ads ID syncing	Persistent	30 days	LinkedIn	Marketing
AnalyticsSyncHistory	LinkedIn analytics sync	Persistent	30 days	LinkedIn	Marketing

4.2 Cookie Data Collection Summary

Category	Number of Cookies	Data Collected	Consent Required
Essential	8	Session IDs, security tokens, consent preferences	No (Required for functionality)
Functional	7	Language, timezone, theme, accessibility settings, chat history	Yes
Analytics	8	Page views, session duration, navigation paths, user interactions	Yes
Marketing	8	Ad interactions, conversion data, interest profiles	Yes

5. Third-Party Cookies

5.1 Understanding Third-Party Cookies

Third-party cookies are set by domains other than PPOIC when you visit our websites. These cookies are typically used for analytics, advertising, and social media integration. When you interact with third-party services embedded on our site, those services may collect information through their own cookies.

5.2 Third-Party Services We Use

Service Provider	Purpose	Cookie Types	Privacy Policy
Google Analytics	Website analytics and performance measurement	Analytics	Google Privacy Policy
Google Ads	Advertising and conversion tracking	Marketing	Google Privacy Policy
Meta (Facebook)	Social media integration and advertising	Marketing, Functional	Meta Privacy Policy
LinkedIn	B2B advertising and professional network integration	Marketing	LinkedIn Privacy Policy
Hotjar	User behavior analytics and heatmaps	Analytics	Hotjar Privacy Policy
LiveChat	Customer support chat functionality	Functional	LiveChat Privacy Policy
Cloudflare	Security, DDoS protection, and CDN services	Essential	Cloudflare Privacy Policy
YouTube (Google)	Video embedding and playback	Functional, Marketing	Google Privacy Policy

5.3 Third-Party Data Collection

When third-party services are active on our website, they may collect the following types of information:

• Device Information: Browser type, operating system, device type, screen resolution
• Network Information: IP address, ISP, geographic location (city/country level)
• Behavioral Data: Pages visited, time on site, click patterns, scroll depth
• Referral Data: How you arrived at our site (search engine, social media, direct link)
• Interaction Data: Buttons clicked, forms submitted, videos watched

6. Cookie Duration

6.1 Session Cookies vs. Persistent Cookies

Cookies can be classified by their lifespan into two categories:

Cookie Type	Duration	Description	Typical Uses
Session Cookies	Temporary - deleted when browser closes	These cookies exist only during your browsing session and are automatically deleted when you close your browser. They are stored in temporary memory and never written to your hard drive.	Maintaining login state Shopping cart contents Security tokens Page navigation tracking
Persistent Cookies	Stored until expiration date or manual deletion	These cookies remain on your device for a set period (specified by the expiration date) or until you delete them manually. They are stored on your hard drive and survive browser restarts.	Remembering login credentials User preferences Analytics tracking Marketing personalization

6.2 Retention Periods by Category

Cookie Category	Typical Duration	Justification
Essential	Session to 30 days	Short durations for security; longer for convenience features like "remember me"
Functional	30 days to 1 year	Longer retention to remember user preferences across visits
Analytics	24 hours to 2 years	Longer periods needed for accurate trend analysis and user journey mapping
Marketing	30 days to 13 months	Extended periods for conversion tracking and campaign measurement

6.3 Automatic Expiration

All persistent cookies on our website have defined expiration dates. When a cookie expires:

• The cookie is automatically deleted by your browser
• A new cookie may be set on your next visit (subject to your consent preferences)
• Historical data associated with expired cookies is handled according to our data retention policies

7. Your Cookie Choices and Rights

7.1 Cookie Preference Center

We provide a comprehensive cookie preference center that allows you to control which non-essential cookies are active during your visits to our website. You can access the preference center at any time by:

• Clicking the "Cookie Settings" link in our website footer
• Clicking on the cookie icon floating on the bottom-left of our pages
• Visiting www.ppoic.com/cookie-preferences directly

Through the preference center, you can:

• View all cookie categories and their purposes
• Enable or disable each category of non-essential cookies
• See detailed information about individual cookies
• Update your preferences at any time
• Withdraw previously given consent

7.2 Browser-Level Cookie Controls

Most web browsers provide settings that allow you to control cookies. Common options include:

Browser Setting	Description	Impact
Block All Cookies	Prevents any website from setting cookies on your device	Many websites, including ours, will not function properly
Block Third-Party Cookies	Allows first-party cookies but blocks cookies from other domains	Analytics and marketing features may not work; core functionality preserved
Delete Cookies on Exit	Automatically deletes all cookies when you close the browser	You'll need to log in and set preferences each session
Allow All Cookies	Permits all first-party and third-party cookies	Full website functionality but maximum data collection
Private/Incognito Mode	Creates a temporary session that doesn't persist cookies after closing	Good for one-time visits; cookies deleted when window closes

7.3 Industry Opt-Out Tools

You can opt out of interest-based advertising from many companies through these industry tools:

• Network Advertising Initiative (NAI): optout.networkadvertising.org
• Digital Advertising Alliance (DAA): optout.aboutads.info
• European Interactive Digital Advertising Alliance (EDAA): youronlinechoices.eu
• Google Ad Settings: adssettings.google.com
• Facebook Ad Preferences: facebook.com/ads/preferences

7.4 Your Rights Under CCPA

If you are a California resident, the California Consumer Privacy Act (CCPA) provides you with specific rights regarding the personal information collected through cookies and similar technologies:

7.5 Your Rights Under GDPR

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, the General Data Protection Regulation (GDPR) and related laws provide additional rights:

• Right of Access: Request a copy of the personal data we hold about you through cookies
• Right to Rectification: Request correction of inaccurate cookie data
• Right to Erasure: Request deletion of your cookie data ("right to be forgotten")
• Right to Restrict Processing: Request limitation of cookie data processing
• Right to Data Portability: Receive your cookie data in a structured, machine-readable format
• Right to Object: Object to processing of cookie data for legitimate interests or direct marketing
• Right to Withdraw Consent: Withdraw consent for cookie processing at any time
• Right to Lodge a Complaint: File a complaint with your local data protection authority

8. How to Disable/Delete Cookies

This section provides detailed instructions for managing cookies in the most popular web browsers. Please note that these instructions may change as browsers are updated.

8.1 Google Chrome

8.2 Mozilla Firefox

8.3 Apple Safari

8.4 Microsoft Edge

8.5 Impact of Disabling Cookies

If you choose to disable or delete cookies, please be aware of the following potential impacts:

Cookies Disabled	Impact on Website Experience
Essential Cookies	Unable to log in to your account Shopping cart will not retain items Security features may not function Some pages may not load correctly
Functional Cookies	Language preferences won't be remembered Display settings reset each visit Live chat history lost between sessions Recently viewed items won't be tracked
Analytics Cookies	No impact on your experience We lose ability to improve the site based on usage data Cannot measure performance issues
Marketing Cookies	You'll see generic ads instead of personalized ones Total number of ads seen won't decrease Cannot track marketing campaign effectiveness

9. Do Not Track Signals

9.1 What is Do Not Track?

Do Not Track (DNT) is a web browser setting that sends a signal to websites requesting that they not track the browsing behavior of the user. When enabled, your browser sends an HTTP header (DNT: 1) with each request, indicating your preference not to be tracked.

9.2 Our Response to DNT Signals

PPOIC respects the Do Not Track browser setting. When we detect a DNT signal from your browser:

9.3 How to Enable DNT

Browser	Steps to Enable DNT
Chrome	Settings > Privacy and security > Cookies and other site data > Send a "Do Not Track" request
Firefox	Settings > Privacy & Security > Send websites a "Do Not Track" signal
Safari	Safari no longer supports DNT; use "Prevent Cross-Site Tracking" instead
Edge	Settings > Privacy, search, and services > Send "Do Not Track" requests

9.4 Global Privacy Control (GPC)

In addition to DNT, we also recognize and honor the Global Privacy Control (GPC) signal, which is a newer, legally-backed privacy preference signal. Under CCPA, businesses are required to treat GPC signals as valid opt-out requests for the sale of personal information.

When we detect a GPC signal (Sec-GPC: 1):

• We treat it as a request to opt out of the "sale" of personal information under CCPA
• Marketing and advertising cookies will not be set
• We will not share your information with third parties for cross-context behavioral advertising

10. Updates to This Policy

10.1 Policy Review and Updates

We regularly review and update this Cookie Policy to reflect:

• Changes in the cookies and tracking technologies we use
• Updates to applicable privacy laws and regulations
• Changes in our business practices or service offerings
• Feedback from users, regulators, or privacy advocates
• New third-party services integrated into our platforms
• Industry best practices and standards

10.2 Review Schedule

Review Type	Frequency	Scope
Regular Review	Quarterly	Cookie inventory verification, third-party service review
Annual Review	Annually	Comprehensive policy review, legal compliance check
Triggered Review	As needed	New regulations, significant technology changes, incidents

10.3 Notification of Changes

When we make material changes to this Cookie Policy, we will notify you through one or more of the following methods:

• Website Banner: A prominent notice on our website for at least 30 days
• Cookie Consent Update: Re-prompting you to review and accept the updated policy
• Email Notification: If you have an account with us and have opted in to communications
• Policy Page Update: Updating the "Last Reviewed" date at the top of this policy
• Change Log: Maintaining a summary of changes at the bottom of this policy

10.4 Version History

Version	Date	Summary of Changes
1.0	January 22, 2026	Initial policy creation

11. Contact Information

If you have any questions, concerns, or requests regarding this Cookie Policy or our use of cookies, please contact us using one of the methods below:

11.1 Exercising Your CCPA Rights

California residents may exercise their privacy rights through any of the following methods:

• Online: Visit our Privacy Portal at www.ppoic.com/privacy-request
• Email: Send your request to ccpa@ppoic.com
• Phone: Call our toll-free CCPA hotline at 1-800-555-PRIV (7748)
• Mail: Send a written request to our mailing address above, marked "CCPA Request"

11.2 Authorized Agents

You may designate an authorized agent to submit privacy requests on your behalf. To do so:

• Provide written permission for the agent to act on your behalf
• Verify your identity directly with us
• The agent must be registered with the California Secretary of State (if a business)

11.3 Response Time

We aim to respond to all cookie and privacy inquiries as follows:

Request Type	Response Time
General cookie questions	5 business days
Cookie preference updates	Immediate (automated)
CCPA access/deletion requests	45 calendar days (extendable by 45 days if needed)
Opt-out of sale requests	15 business days
Complaints	10 business days acknowledgment, 30 days resolution

12. Document Approval

This Cookie Policy has been reviewed and approved by the following authorized representatives of Planned Packaging of Illinois Corp:

Role	Name	Signature	Date
Chief Information Security Officer
Chief Privacy Officer
Legal Counsel
Chief Executive Officer

Acknowledgment of Understanding

By using the PPOIC websites and digital services, users acknowledge that they have read and understood this Cookie Policy and agree to the use of cookies as described herein, subject to any preferences they have expressed through our cookie consent mechanisms.

This policy is effective as of January 22, 2026, and supersedes all previous versions of the PPOIC Cookie Policy.