Privacy Policy

Effective Date: February 17, 2025

Please click here for a printable PDF version of this policy.

This Privacy Policy describes how Acosta Inc. (“we” or “Acosta”) collects, uses, shares and protects personal data when you interact with our main website (www.acosta.com), as well as all of our websites where this Privacy Policy is posted, emails we send, social media accounts, and online services (collectively, our “Services”).

Acosta is the data controller of the personal data collected under this Privacy Policy.

This Privacy Policy explains the following:

Please note that this Privacy Policy does not apply to non-Acosta websites or services that state that they are offered under a different privacy policy. Please review the privacy policies on those websites and applications directly to understand their privacy practices.

1. How We Collect Information

We may collect information about you by the following means:

Directly from you, when you provide information to us or interact with us, our clients, or our affiliates’ Services, including the Services of Mosaic Sales Solutions US Operating Co., LLC; Crossmark, Inc.; The CORE Group, Inc.; Premium Retail Services, LLC; ActionLink Services, LLC; and Mosaic Sales Solutions US Operating Co., LLC d/b/a Frontline Marketing;
Automatically from you, when you utilize or interact with our Services;
From service providers who collect information on our behalf in order to provide services to us;
From online advertising companies who may share information about the marketing and advertisements you have seen or clicked on, and from social networks and other sources of publicly available data; and
From other third-party sources that provide consumer data, such as information about your interests, demographic information, consumer behaviors, and marketing inferences.

2. Information We Collect

In order to better provide you with our Services, we may collect the following categories of information:

Contact information and any other information you choose to include when you communicate with us via e-mail, mail, phone or other channels;
Transactional information including payment information and payment history if you engage in transactions through the Services;
Demographic information including postal code or ZIP, preferences, gender, interests and favorites;
Inferences including information about your preferences, interests and purchasing tendencies;
Device information when you utilize our technology platforms, including as model, serial number, device location, usage data, and operating information, including as described below in the “Online User Activity, Cookies and Information Collected by Other Automated Means” section;
Survey information in response to questions we may send you through the Services, including for feedback and research purposes;
User content you may provide to publicly post via the Services (e.g., comments);
Online user activity described in the next section; and
Biographical information when you inquire about or apply for a position with us.
If you provide us with information regarding another individual, you represent that you have that person’s consent to give us their information and to permit us to use the information in accordance with this Privacy Policy.

Online User Activity, Cookies and Information Collected by Other Automated Means

When you interact with the Services, certain information about your use of our Services is automatically collected. This may include the following types of information: your location, computer or device configuration, IP address and URL of referring website, if any, pages viewed, number of visitors, and length of visits.

Like many websites, we collect information when you use our Services through cookies, web beacons, and other similar technologies, which may be operated by our partners who assist us in serving ads or providing other services to you. Please see our Cookie Policy for more information.

With respect to any social media pages that we may use, please see the privacy policies and any cookie policies of the applicable social media providers as to their automated data collection practices.

We currently use Google Analytics to collect and process certain website usage data. To learn more about Googe Analytics and how to opt-out, please visit: Google Analytics Opt-Out Browser Add-On. Also, for more information regarding how to opt out of certain cookies, please visit https://optout.networkadvertising.org/?c=1 or www.aboutad.info/choices.

Also, your browser or device may include “Do Not Track” functionality or send opt-out preference signals. Where required by applicable law, we will recognize and honor opt-out preference signals (or global privacy controls).

3. How We Use Your Information

We use the information we collect from you to:

Provide our Services to you and to send you related important notices;
Respond to your requests, questions and comments and provide customer support;
Evaluate, recruit, and hire personnel; and
Comply with legal requirements and industry standards, detect, investigate, and prevent activities that may violate our policies or be fraudulent or illegal, and protect the rights of Acosta, you, or others.

We may use and share information in an aggregated or de-identified manner at our discretion, including for research, analysis, modeling, marketing, and improvement of our Services. Where we maintain de-identified information, we commit to maintaining and using such information in de-identified form and will not attempt to reidentify such information.

4. How We Disclose Your Information

Service Providers. We may share your information with service providers that we believe need the information to perform a technology, business, or other professional function for us such as billing and collection, IT services, maintenance and hosting of our Services, payment processors, marketing partners, accounting, auditing, and tax services, and other professional services.
Analytics Partners. We partner with analytics providers, who collect information via tracking technologies on our websites to assist us with measuring visits and traffic on our websites so we can measure and improve the performance of the websites.
Social Media. If you interact with us on social media platforms, the platform may be able to collect information about you and your interaction with us. If you interact with social media objects on our Services (for example, by clicking on a Facebook “like” button), both the platform and your connections on the platform may be able to view that activity.
Affiliates. We share information with other entities in our corporate family, for purposes consistent with this Privacy Policy.
Corporate Event. We reserve the right to transfer to another entity or its affiliates or service providers some or all information about you in connection with, or during negotiations of, any merger, acquisition, sale of assets or any line of business, change in ownership control, or financing transaction. We cannot promise that an acquiring party or the merged entity will have the same privacy practices or treat your information the same as described in this Privacy Policy.
Legal. We share information where necessary to comply with applicable law, to respond to requests from law enforcement agencies or other government authorities or third-parties, as permitted by law and without your consent when it is necessary to protect our customers, employees, or property; in emergency situations; or to enforce our rights under our terms of service and policies.

5. How We Protect and Store Your Information

We use a combination of physical, technical, and administrative safeguards in an effort to protect the information we collect through the Services. While we use these precautions to safeguard your information, we cannot guarantee the security of the Internet, networks, systems, servers, devices, and databases we operate or that are operated on our behalf.

6. Your Email Marketing Options

You may have certain choices when it comes to how we collect and use your information in relation to email marketing: If at any time you no longer wish to receive marketing communications from us, you can click the unsubscribe link at the bottom of any email.

7. Children’s Information

We do not knowingly or intentionally gather personal data about children who are under the age of 18. If a child has provided us with personal data, a parent or guardian of that child may contact us at privacy@acosta.com to have the information deleted from our records. If we learn that we have inadvertently collected the personal data of a child under the minimum age depending on jurisdiction, we will take steps to delete the information as soon as possible and cease the use of that information in accordance with applicable law.

8. Privacy Rights

Certain jurisdictions have specific legal requirements and grant privacy rights with respect to personal data, and we will comply with restrictions and any requests you submit as required by applicable law. If you are a California resident, see the “California Privacy Rights” section below for additional information as to your rights and to how to exercise those rights.

Nevada residents have the right to opt out of the sale of certain pieces of their information to third parties who will license or sell their information to others. However, Acosta does not sell personal data as contemplated by Nevada law.

If you are a resident of one of the U.S. states listed below, you have one or more of the following rights: (1) to request additional information about our data collection, use, disclosure, and sales practices in connection with your personal data; (2) to request the specific personal data collected about you; (3) to request the deletion of the personal data we have about you, with exceptions; (4) to request a restriction on certain processing of personal data; (5) to request correction of inaccurate information; (6) to opt-out of the processing of personal data for the purpose of “profiling” in furtherance of decisions that produce legal or similarly significant effects; and (7) to opt-out of the “selling” and “sharing”/“targeted advertising” of personal data as such terms are defined under U.S. state privacy laws. Please note, Acosta sells personal data and shares personal data/engages in “targeted advertising”. For a description of the categories of personal data that are sold or shared/used for targeted advertising and for a description of the categories of third parties that such personal data is disclosed to, see the chart in the “California Privacy Rights” section below. Acosta does not engage in profiling in furtherance of decisions that produce legal or similarly significant effects. You may also have the right to not be discriminated against for exercising your privacy rights. If you are a resident of one of the following U.S. states, you have one or more of these rights:

COLORADO	CONNECTICUT	DELAWARE	IOWA
MARYLAND (AS OF OCT. 1, 2025)	MINNESOTA (AS OF JULY 31, 2025)	MONTANA	NEBRASKA
NEW HAMPSHIRE	NEW JERSEY	OREGON	TENNESSEE (AS OF JULY 1, 2025)
TEXAS	UTAH	VIRGINIA

If you are located outside these jurisdictions and seek to exercise your rights under the law of another jurisdiction, please contact us by emailing privacy@acosta.com.

You or, depending on your state of residence, your authorized agent may submit a request regarding your personal data by:

Email: privacy@acosta.com
Phone: 1-800-377-2754

To help protect your privacy and maintain security, we will take steps to verify your identity before granting you access to the information. We may need to request specific information from you to help us confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. When you make a request, we may also contact you to ask you for further information in relation to your request to speed up our response and require you to follow procedures so that we can verify your identity (and the applicable jurisdiction). The verification steps we take may differ depending on your jurisdiction and the request. Where possible, we will attempt to match the information that you provide in your request to information we already have on file to verify your identity. If we are able to verify your request, we will process it. If we cannot verify your request, we may ask you for additional information to help us do so.

We will respond to your request within the time period required by applicable law. However, we may not always be able or required to comply with your request, in whole or in part, and we will notify you in that event.

9. Our Retention of Your Information

We retain your personal data for as long as necessary for the purpose for which it was initially collected, to carry out legitimate business interests, as well as on the basis of applicable legal requirements (such as applicable statutes of limitation). After expiry of the applicable retention periods, your personal data will be deleted. If there is any data that we are unable, for technical reasons, to delete entirely from our systems, we will put in place appropriate measures to prevent any further use of such data.

The criteria we use to determine the retention period is as follows:

whether there are contractual or legal obligations that exist that require us to retain the data for a period of time;
whether there is an ongoing legal claim that relates to any business (or otherwise) relationship you have with us, or that is otherwise related to your relationship with us;
whether any applicable law, statute, or regulation allows for a specific retention period; and
whether the personal data is considered to be sensitive personal data, in which case a shorter retention period generally would be applied.

These criteria may also mean we adjust the period of time we retain the categories of personal data detailed above.

10. International Transfers

If you use our Services outside of the United States, you understand that we may collect, process, and store your personal data in the United States and other countries. The laws in the United States regarding personal data may be different from the laws of your state or country. Any such transfers will comply with safeguards as required by applicable law. By using the Services, you consent to the collection, international transfer, storage, and processing of your data.

11. Jurisdiction-Specific Notices

California Residents

California’s “Shine the Light” law permits customers in California to request certain details about how certain types of their information are shared with third parties for those third parties’ own direct marketing purposes. Acosta does not disclose personal data to third parties for such third parties’ own direct marketing purposes.

California Consumer Privacy Act

The California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), provides California residents with certain rights related to our collection, use, sharing or disclosure of their personal data. If you are a resident of California, you have the right: (1) to know what personal data has been collected about you, and to access that information, (2) to request deletion of your personal data, though exceptions under the CCPA may apply, (3) to request correction of inaccurate personal data, (4) to request to limit the disclosure and use of any of your sensitive personal data, (5) to opt-out of the processing of personal data for the purpose of “profiling” in furtherance of decisions that produce legal or similarly significant effects, and (6) to opt-out of the selling or sharing of personal data, as defined by the CCPA. You have the right to be free from discrimination based on your exercise of your CCPA rights.

We have collected the following categories of personal data from consumers. Please see our Cookie Policy for information about the collection and use of personal data by third-parties who process information collected by cookies and related technologies that we permit them to use on the Services. Except as indicated in the “California Job Applicants” section below, we do not seek to collect any other “sensitive personal information” (as defined in the CCPA).

The sources of this personal data are described in the “Information We Collect” section above. We collect this personal data for the purposes described in the “How We Use Your Information” section above.

Category	Examples	Sold or shared	Criteria used to determine retention periods	Disclosed to
Personal Identifiers	name, email address, phone number, and contact address, username, social media handle and basic account information, unique identifiers (such as those assigned in cookies)	Certain information may be sold or shared, including to advertising and marketing partners and analytics providers	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers, affiliates, advertising and marketing partners, analytics providers
Personal data categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))	name, signature, address, telephone number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers and affiliates
Commercial information	transaction information, billing records, payment records, order history	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers and affiliates
Biometric Information	Not collected	Not collected	Not collected	Not collected
Internet or other similar network activity	unique numerical identifier, cookie or tracking pixel information, device ID, browsing history, search history, IP address, interaction with a website, interaction with an application, or interaction with advertisement	Sold and shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers, affiliates, advertising and marketing partners, and analytics providers
Geolocation information	Location information (e.g., ZIP code, city, region, IP address), device location	Certain information may be sold or shared, including to advertising and marketing partners and analytics providers	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers, affiliates, advertising and marketing partners, and analytics providers
Audio, electronic, visual, thermal, olfactory, or similar information	call recording (e.g., customer service calls)	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers and affiliates
Inferences drawn from other personal data	Interests, preferences	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers and affiliates

California Job Applicants

When you apply for a job with Acosta, information may be collected about you in multiple ways: you may provide it to us in connection with your application; we may make observations in the application process or collect information from public information sources; or you may authorize us to collect information from other sources, such as a former employer or reference.

The following table describes our practices with regard to information submitted in the job application process. If you use our website in the job application process, additional information may be automatically collected, as described above.

Category (may constitute “sensitive information” under the ccpa)	Examples	Sold or shared	Criteria used to determine retention periods	Disclosed to
Personal Identifiers*	name, email address, phone number, and contact address, username, social media handle, Social Security number	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers
Personal Classifications*	gender, race and ethnicity, date of birth	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers
Geolocation Information	Location information (e.g., ZIP code, IP address)	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers
Professional or employment-related information	employer’s name, employer’s address	Not sold or shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers
Education Information	institutions attended, degrees and certifications attained	Not sold and shared	The duration of our relationship with you; the length of time necessary to complete a transaction; whether your personal data is a sensitive type; whether you specifically consented to retain the data; and our legal, contractual or similar obligations to retain or delete the data.	Service providers

In certain circumstances, you may submit your application for employment through a third-party service that displays our job posting. We do not control the privacy practices of these third-party services. Please review their privacy policies carefully prior to submitting your application materials.

Exercising Your Rights as a California Resident

You may submit a request to exercise your rights under CCPA through one of two means:

By emailing us at privacy@acosta.com
By calling us at 1-800-377-2754

To opt-out of selling and sharing, please use the “Do Not Sell or Share My Personal Information” link at the bottom of the homepage on www.acosta.com.

Upon submission of your request, we will contact you (via the email address provided in your request) with instructions on how to verify the request and your identity, after which we will check our records for matching information, and aim to complete requests as soon as reasonably practicable and consistent with any applicable laws. You may authorize another individual or a business, called an authorized agent, to make requests on your behalf through these means. We may have a reason under the law why we do not have to comply with your request, or why we may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

EEA, Switzerland, or UK Residents

If you are located in the EEA, Switzerland, or the UK, you are entitled to certain rights, subject to applicable exceptions, under the GDPR, Swiss, and UK data protection laws. Please note that, in order to verify your identity, we may require you to provide us with information prior to accessing any records containing information about you.

We typically will process your information pursuant to the following legal bases: (1) with your consent; (2) as necessary to perform our agreement to provide Services to you; or (3) as necessary for our legitimate interests in providing the Services where those interests do not override your fundamental rights and freedoms related to data privacy. We also may process your information where it is necessary to comply with a legal obligation to which we are subject.

Right of Access: You have the right to obtain confirmation as to whether we are processing personal data about you, and if so, request a copy of the personal data. If you would like a copy of the personal data that we hold about you, please send a description of the personal data you would like a copy of and proof of your identity to our email as set forth below.
Right to Correction: You have the right to correct any inaccuracies in the personal data that we hold about you and, where applicable, to complete any incomplete personal data that we hold.
Right to Erasure: You have the right to request that we erase the personal data that we hold about you if one of the conditions in Article 17 of the GDPR applies. The right to erasure does not apply in certain circumstances, including where the processing is necessary for the establishment, exercise, or defense of legal claims.
Right to Restriction of Processing: You have the right to restrict our processing of your personal data if one of the conditions in Article 18 of the GDPR applies.
Right to Data Portability: You have the right to receive personal data concerning you in a structured, common, and machine-readable format or request transmission of the data to a third-party, if the conditions in Article 20 of the GDPR are met.
Right to Object: You have the right to object to the processing of your personal data based on our legitimate interests at any time. We will no longer process the data, unless there are compelling legitimate grounds for our processing that override the interests, rights, and freedoms of the data subject, or the processing serves the purpose of asserting, exercising, or defending legal claims. You also have the right to object at any time to the use of your data for direct marketing.
Right to Withdraw Consent: If we are processing your personal data based on your consent, you have the right to withdraw your consent at any time.

To submit a request to exercise your rights, please email us at privacy@acosta.com or call us at 1-800-377-2754. We may have a reason under the law why we do not have to comply with your request, or may comply with it in a more limited way than you anticipated. If we do, we will explain that to you in our response.

Lodging a Complaint

Users that reside in the EEA, Switzerland, or the UK have the right to lodge a complaint about our data collection and processing actions with the supervisory authority concerned. Contact details for data protection authorities are available here.

12. Updates To This Privacy Policy

We may make changes to this Privacy Policy from time to time. The “Effective Date” at the top of this page indicates when this Privacy Policy was last revised. If we make any material changes, we will provide notice of such changes on the pertinent website for a reasonable period of time. We may also notify you in other ways from time to time about the collection, use, and disclosure of your personal data described in this Privacy Policy. We encourage you to review this Privacy Policy periodically, especially if you don’t use the Services regularly.

13. Contact Information

For questions about our privacy practices, you may contact us via email at privacy@acosta.com or write to us at the following address:

Acosta Inc.

Attn: Data Privacy Officer

6600 Corporate Center Parkway

Jacksonville, Florida 32216