1. WHAT INFORMATION DO WE COLLECT?

Personal information you disclose to us
In Short: We collect the personal information you choose to give us.
We collect personal information that you voluntarily provide when you:

• Request information about us, our products, or our Services
• Make a purchase
• Participate in activities on the Services
• Contact us directly

Personal Information Provided by You
The specific personal information we collect depends on how you interact with us and which Services you use. This may include:

• Names
• Email addresses
• Debit/credit card numbers
• Billing addresses

Sensitive Information
We do not process sensitive personal information (such as information about health, race, sexual orientation, religious beliefs, or other categories considered “sensitive” under certain laws).

Payment Data
When you make purchases, we may collect information necessary to process your payment (such as card number and security code). We do not store full payment card details ourselves.

Payment data is handled by third-party payment processors:

• ThriveCart: https://legal.thrivecart.com/platform/privacy/
• Stripe: https://stripe.com/en-ca/privacy
• PayPal: https://www.paypal.com/us/webapps/mpp/ua/privacy-full

You are responsible for ensuring that the personal information you provide is accurate and up to date, and for notifying us if your details change.

Information automatically collected

In Short: When you use our Services, certain technical and usage information is collected automatically.

When you visit or interact with our Services, we automatically collect certain information, which generally does not identify you by name but may identify your device or your approximate location. This helps us maintain security, ensure functionality, and analyse usage.

This may include:

• IP address
• Browser type and version
• Device type and operating system
• Language preferences
• Referring URLs
• Country and general location
• Pages you visit and the time spent
• Other technical and usage data

We use cookies and similar technologies to collect some of this information.

Log and Usage Data
Our servers may automatically record:

• IP address
• Browser type and settings
• Pages viewed and links clicked
• Date and time of access
• Files accessed and search queries
• System activity, error reports, and hardware settings

Device Data
 We may collect information about the device you use to access the Services, such as:

• Device model and operating system
• Browser type
• IP address (or proxy)
• ISP or mobile carrier
• Application identifiers and system configuration

Location Data
 We may collect location-related information, which may be:

• Precise, using technologies like GPS or IP-based location; or
• Approximate, such as general region or country.

You may be able to control whether location information is shared via your device or browser settings. If you disable location features, some parts of the Services may not function as intended.

3. WHAT LEGAL BASES DO WE RELY ON TO PROCESS YOUR PERSONAL INFORMATION?
In Short: We only process your personal information when we have a lawful basis to do so.

If you are located in the EU or UK
Under the GDPR and UK GDPR, we may rely on one or more of these legal bases:

Consent
When you have clearly agreed to a specific use of your information (for example, receiving marketing emails). You may withdraw consent at any time (see Section 10).

Performance of a contract
When processing is necessary to enter into or perform a contract with you (for example, providing Services you have purchased).

Legitimate interests
When processing is necessary for our legitimate business interests, and those interests are not overridden by your rights and freedoms. This may include:

• Analysing use of the Services to improve them
• Supporting our marketing and promotional activities
• Understanding engagement with our offerings to improve user experience

Legal obligations
When processing is required to comply with laws, regulations, or legal proceedings.

Vital interests
When processing is necessary to protect your vital interests or those of another person.

If you are located in Canada
We may process your information with your express or implied consent, depending on context and applicable law. You can withdraw consent at any time (see Section 10).

In some situations, Canadian law may allow us to process personal information without consent, such as when:

• Processing is clearly in the individual’s interests and consent cannot be obtained in time
• The information is needed for fraud detection, investigation, or legal proceedings
• The information is used in the context of certain business transactions, as allowed by law
• The information is included in a witness statement for insurance claims
• The information is needed to identify or contact next-of-kin
• There are reasonable grounds to believe someone is, has been, or may be a victim of financial abuse
• Seeking consent would compromise availability or accuracy of the information for an investigation
• Disclosure is required by subpoena, warrant, court order, or similar legal process
• The information arises in an employment, business, or professional context and is used consistently with that context
• The information is used solely for journalistic, artistic, or literary purposes
• The information is publicly available as defined by applicable regulations

We may also share de-identified information for research or statistical purposes, subject to appropriate safeguards.

4. WHEN AND WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?
In Short: We share information only when necessary, and with specific third parties that help us run our business.
We may share your personal information with:

Vendors, consultants, and service providers
We may work with third parties who perform services on our behalf and require access to personal information to do their work, such as:

• Data analytics providers
• Payment processors
• Sales and email marketing platforms
• Cloud and hosting providers
• Website performance and monitoring tools

We require these third parties, by contract, to:

• Use your personal information only as instructed by us
• Protect your personal information in line with applicable laws
• Refrain from selling or using your information for their own independent purposes

Business transfers

If we are involved in a merger, sale of assets, financing, restructuring, acquisition, or similar transaction, your information may be transferred as part of that process, where allowed by law. We will take appropriate steps to protect your information.

5. DO WE USE COOKIES AND OTHER TRACKING TECHNOLOGIES?

In Short: Yes, we may use cookies and similar technologies for security, analytics, and marketing purposes.
We may use:

• Cookies
• Web beacons
• Pixels
• Tags
• Other similar technologies

These help us:

• Secure and maintain performance of the Services
• Remember preferences
• Analyse traffic and usage
• Support marketing and advertising (including retargeting or cart reminders, where applicable)

Third-party providers may also use these technologies on our website for analytics and advertising, and may use information to show you more relevant ads.

In some US states, certain uses of tracking technologies can be considered a “sale” or “sharing” of personal information for targeted advertising. Where applicable, you may have the right to opt out (see Section 12).

If we maintain a separate Cookie Notice on our website, it will provide additional detail about specific cookies and your options for managing them.

Google Analytics
We may use Google Analytics to understand how visitors use the Services. For more information or to opt out:

Opt-out add-on: https://tools.google.com/dlpage/gaoptout
Google Privacy Policy: https://policies.google.com/privacy

7. HOW LONG DO WE KEEP YOUR INFORMATION?

In Short: We keep your information only as long as needed or required by law.
We retain personal information for as long as:

• It is needed to provide the Services; or
• It is required for legitimate business purposes (for example, accounting or legal obligations); or
• It is required or permitted by applicable law.

When we no longer have a legitimate need to process your information, we will delete or anonymise it. If that is not immediately possible (for example, in backup systems), we will securely store and isolate it until deletion is feasible.

10. WHAT ARE YOUR PRIVACY RIGHTS?
In Short: Depending on where you live, you may have rights to access, correct, delete, or restrict the use of your personal information, and to object to some processing.

In certain regions (including the EEA, UK, Switzerland, and Canada), you may have rights such as:

• The right to request access to your personal information and receive a copy
• The right to request correction (rectification) of inaccurate or incomplete information
• The right to request deletion (erasure) in certain circumstances
• The right to restrict processing in specific situations
• The right to data portability, where applicable
• The right not to be subject to automated decision-making, including profiling, where it has legal or similarly significant effects

If we ever rely solely on automated decision-making in a way that has significant effects on you, we will explain the logic involved and provide a way to request human review.

You may also have the right to object to some processing, especially where it is based on our legitimate interests or used for direct marketing.

We will respond to your request in line with applicable laws.

Complaints to authorities
If you believe we are processing your personal information unlawfully, you may lodge a complaint with your local supervisory authority:

EU authorities: https://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm
UK ICO: https://ico.org.uk/make-a-complaint/data-protection-complaints/data-protection-complaints/
Switzerland (FDPIC): https://www.edoeb.admin.ch/edoeb/en/home.html

Withdrawing your consent
When we rely on consent to process your information, you can withdraw that consent at any time by contacting us (see Section 14). This does not affect the lawfulness of processing that took place before withdrawal.

Opting out of marketing communications
You can opt out of marketing emails by:

• Clicking “unsubscribe” in any marketing email; or
• Contacting us at hello@simplysandrayvonne.ca.

We may still send non-marketing emails, such as purchase confirmations or important updates.
Cookies and similar technologies

Most browsers accept cookies by default. You can usually remove or reject cookies through your browser settings. If you choose to disable cookies, some features of the Services may not work as expected.

If you have questions about your rights, email hello@simplysandrayvonne.ca.

12. DO UNITED STATES RESIDENTS HAVE SPECIFIC PRIVACY RIGHTS?
In Short: Certain US states provide additional rights regarding personal information.

Residents of some US states (including California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia) may have specific rights, such as:

• The right to know whether we process your personal data
• The right to access and receive a copy of your personal data
• The right to correct inaccuracies
• The right to request deletion
• The right to withdraw consent, where applicable
• The right to opt out of:
• Targeted advertising or “sharing”
• The sale of personal data
• Certain profiling activities

These rights may be subject to exceptions and limitations under state law.

Categories of Personal Information We Collect
In the past twelve (12) months, we have collected the following categories of personal information (examples are illustrative):

• Category A – Identifiers

 Examples: Name, postal address, IP address, email address, account identifiers
 Collected: YES

• Category B – Personal information under California Customer Records statute

 Examples: Name, address, payment information
 Collected: YES

• Category C – Protected classification characteristics

 Examples: Age, gender, demographic data
 Collected: YES

• Category D – Commercial information

 Examples: Transaction and purchase history
 Collected: YES

• Category E – Biometric information

 Collected: NO

• Category F – Internet or network activity

 Examples: Browsing history, interactions with sites and apps
 Collected: NO

• Category G – Geolocation data

 Examples: Device location
 Collected: YES

• Category H – Audio, electronic, visual, or similar information

 Collected: NO

• Category I – Professional or employment information

 Examples: Job title, business contact details
 Collected: YES

• Category J – Education information

 Collected: NO

• Category K – Inferences

 Collected: NO

1. Category L – Sensitive personal information

 Collected: NO

We may also collect additional information when you:

• Use customer support channels
• Participate in surveys, promotions, or contests
• Interact with the Services beyond basic browsing

We retain personal information for as long as necessary to provide the Services or as otherwise outlined in Section 7.
We may use technologies such as beacons, pixels, and tags, but we do not sell or share personal information for monetary value. We have not sold or shared personal information with third parties for a commercial purpose in the past 12 months.

We have disclosed Category A – Identifiers to third parties for business purposes, as described in Section 4.

Your Rights as a US Resident
Under some state laws, you may have the rights to:

• Know if we process your personal data
• Access your personal data
• Correct inaccuracies
• Request deletion
• Obtain a copy of data you have provided
• Be free from discrimination for exercising your privacy rights
• Opt out of targeted advertising, sale of personal data, and certain profiling

Some states provide additional rights, such as:

• Accessing categories of data processed
• Obtaining lists of categories or specific third parties who received your data
• Reviewing and challenging profiling practices
• Limiting use of sensitive data
• Opting out of certain automated collection practices (for example, through voice or facial recognition)

How to Exercise Your Rights
You can exercise your rights by:
Emailing us at hello@simplysandrayvonne.ca; or
Using the contact details in Section 14.

You may also authorise an agent to act on your behalf where permitted by law. We may request proof of the agent’s authority and take steps to verify your identity.

Request Verification
We may request information necessary to verify your identity before acting on your request. Any additional information provided will be used only for verification and security purposes.
If we cannot verify your identity, we may be unable to fulfil your request.

Appeals
If we decline your request, you may have the right to appeal our decision under certain state laws. To appeal, email us at hello@simplysandrayvonne.ca. We will respond with an explanation and, where applicable, details about how to contact your state attorney general.

California “Shine The Light” Law
California residents may request information once per year, free of charge, regarding:

• Categories of personal information (if any) disclosed to third parties for their direct marketing purposes; and
• Names and addresses of such third parties in the previous calendar year.

If you wish to make this request, please contact us using the details in Section 14.

15. HOW CAN YOU REVIEW, UPDATE, OR DELETE THE DATA WE COLLECT FROM YOU?
Depending on where you live, you may have rights to:

• Request access to the personal information we hold about you
• Receive information about how that data has been processed
• Correct inaccuracies in your personal information
• Request deletion of your personal information
• Withdraw consent where consent is the legal basis for processing

These rights may be subject to limitations under applicable law.
To exercise these rights, please email hello@simplysandrayvonne.ca with the subject line “Data Request” and a clear description of what you are requesting.