Last Updated: February 11, 2025
At Petal and Pup, trust is the cornerstone of a great brand and respecting the privacy rights of our customers is an integral part of building that trust. In this privacy policy, the terms “Petal and Pup,” “we,” and “us” refers to Petal and Pup, its parent company a.k.a. Brands Holding Corp., and a.k.a. Brands Holding Corp.’s respective subsidiaries and affiliated companies. This privacy policy explains how we collect and use your personal information to serve you. This policy applies to Petal and Pup’s website and all other websites, mobile sites, applications, platforms and tools where this Privacy Policy appears or is linked, and through the use of our services, as well as communications between you and Petal and Pup including but not limited to SMS, MMS, chat, and instant messaging communications (collectively, the “Website”).
ARBITRATION NOTICE: THIS PRIVACY POLICY CONTAINS A BINDING ARBITRATION PROVISION, A JURY TRIAL WAIVER, AND A CLASS ACTION WAIVER. DETAILS OF THESE PROVISIONS ARE EXPLAINED BELOW.
YOU KNOWINGLY AND VOLUNTARILY AGREE THAT, UNLESS OTHERWISE STATED, ALL DISPUTES BETWEEN YOU AND PETAL AND PUP WILL BE RESOLVED BY MANDATORY BINDING ARBITRATION AND YOU WAIVE THE RIGHT TO ASSERT ANY CLAIM ARISING OUT OF OR RELATING TO THIS POLICY IN ANY COURT, EXCEPT AS EXPRESSLY PROVIDED BELOW. YOU KNOWINGLY AND VOLUNTARILY WAIVE THE RIGHT TO A TRIAL BY JURY OR TO PARTICIPATE IN A CLASS ACTION LAWSUIT OR CLASS-WIDE ARBITRATION. YOU ACKNOWLEDGE THAT YOU ARE AGREEING TO THE TERMS OF THIS PRIVACY POLICY VOLUNTARILY AND NOT IN RELIANCE ON ANY PROMISES OR REPRESENTATIONS EXCEPT THOSE CONTAINED IN THIS PRIVACY POLICY.
By accessing or using this Website, you agree to this privacy policy. If you do not agree to this privacy policy, please discontinue your use of the Website. THIS PRIVACY POLICY MAY CHANGE FROM TIME TO TIME AND YOUR CONTINUED USE OF OUR WEBSITE CONSTITUTES YOUR ACCEPTANCE OF THOSE CHANGES. WE ENCOURAGE YOU TO REVIEW THIS PRIVACY POLICY PERIODICALLY.
TYPES OF INFORMATION WE COLLECT
What information do we collect? We may collect and use the following information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household (“personal information”):
We may need to collect some personal information in order to provide our products and services you request. If you do not provide the information requested, we may not be able to provide you with these products and services.
Unless we request it, we ask that you not send, and you not disclose, any sensitive personal information or any social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background, or trade union membership. If you disclose to us or to our service providers any personal information relating to other people, you represent you have the authority both to disclose and to permit us to use the information in accordance with this Privacy Policy.
HOW WE COLLECT YOUR INFORMATION
In short: We collect information about you in a variety of different ways as you navigate through and interact with our Website.
Information You provide to Us
When you make a purchase from our Website, we may ask you to provide us with information about your purchase such as your name, email address, shipping address, phone number, and payment information.
If you sign up for an online account through our Website, we may ask you to provide your username, password, email address, phone number, payment card information, product preferences. You do not have to create an online account to make a purchase.
If you connect your social media account to your online account, you will share certain personal information from your social media account with us, for example, your name, email address, photo, list of social media contacts, and any other information that may be accessible to us when you connect your social media account to your online account.
If you would like to receive marketing communications from us, you may do so by signing up on our Website. We will ask you to provide your email address or phone number so we can fulfill your request by sending you marketing materials.
When you contact us about a customer service issue, or to make other inquiries, we collect the content of those communications, and any additional information about the method of communication such as phone, SMS, MMS, email, chat, instant messaging, or through social media platforms. For example, if you email us, we will collect your email address, if you send us a text message, we will collect your phone number, and so on.
If you sign up for promotions or a contest, you may need to provide certain information such as your name, email, telephone number, or mailing address.
Information We Collect Through Your Interactions With Us
When you visit one of our Website pages, we may collect your device identifier such as IP address or MAC address, as well as browser and settings information, shopping preferences, and information about how you interact with our Websites and other digital products. We collect this information through our use of cookies or web beacons.
We may collect information about you in connection with investigations into fraudulent or criminal activities on our Websites.
Other Sources
We may also collect information from other sources, including for example, joint marketing partners, data analytics firms, public databases, publicly available social media pages, and other third parties we work with.
Information We Aggregate and Derive
We may aggregate and/or anonymize personal information so that it will no longer be considered personal information. We do so to generate other data for our use, which we may use and disclose for any purpose. For example, we may calculate the percentage of our site users who have a particular telephone area code.
COOKIES AND SIMILAR TECHNOLOGIES
In Short: We may use little bits of computer code stored by the Internet browser on your computer’s hard drive that collect data by tagging along with you while you browse (“cookies”). Cookies allow us to provide you with the best browsing experience possible.
There are a number of different types of cookies our Website uses:
Most websites, including ours, wouldn’t work very well without certain cookies. They allow us to prevent crashes, display information, fix bugs, and ensure the security of our Website (and your account). You have the right to decide whether to accept or reject certain cookies. You can set your browser not to accept cookies. However, in a few cases, some of our Website features may not function as a result. Because Essential cookies are strictly necessary for our Website to work, we don’t provide you with an ability to opt-out of these Essential cookies.
Some cookies provide important services but are not strictly necessary for our Website to work. These cookies use information about your interactions with us so we can suggest clothes and special offers for you. If your shopping is interrupted, they remember where you left off and send you reminders that you truly deserve that new outfit. These reminders might be sent to you in an email, on social media or while you’re browsing another website or on another device. We think these cookies are useful and will make it easier for you to shop with us. But you might disagree. If so, you can tell us not to use certain cookies by using the opt-out tools we have placed on our ecommerce websites.
Turning off cookie options vary by geographic region as explained below:
When accessing the Website in the United States, you can click on the "Do Not Sell My Info" link at the bottom of the Website. You can also visit the Digital Advertising Alliance to learn more about opting out of certain cookies.
When accessing the Website in Canada, you can click on the "Interest Based Ads" link at the bottom of the Website to opt-out of certain cookies on those sites.
When accessing the Website in the EU or the United Kingdom, you can click on the “Cookie Options” link at the bottom of the Website to opt-out of certain cookies on those sites. You can also learn more by visiting the European Union Digital Advertising Alliance.
Third-Party Use of Cookies and Other Tracking Technologies
Some content or applications, including advertisements, on the Website are served by third-parties, including advertisers, ad networks and servers, content providers, and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our Website. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content.
We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about an advertisement or other targeted content, you should contact the responsible provider directly. For information about how you can opt out of receiving targeted advertising from many providers, see the “Your Rights and Choices” Section below.
Petal and Pup use Analytics Remarketing with Google Analytics, and AdWords Remarketing with Google AdWords to advertise online. Third-party vendors, including Google, may show Petal and Pup ads on sites across the Internet. This could mean that we advertise to previous visitors who haven’t completed a task on our Website, for example using the contact form to make an inquiry. This could be in the form of an advertisement on the Google search results page, or a site in the Google Display Network. Third-party vendors, including Google, use cookies to serve ads based on someone’s past visits to the Petal and Pup Website.
Petal and Pup and third party vendors, including Google, use first-party cookies (such as the Google Analytics cookie) and third party cookies (such as the DoubleClick cookie) together to inform, optimize, and serve ads based on someone's past visits to our Website, and to report how our ad impressions, other uses of ad services, and interactions with these ad impressions and ad services are related to visits to our Website.
Any information collected will be used in accordance with this Privacy Policy and Google’s privacy policy.
You can opt-out of Google Analytics for Display Advertising and customize Google Display Network ads HERE.
You can also use this Analytics opt out tool HERE.
Rakuten Advertising may collect personal information when you interact with our Website, including IP addresses, digital identifiers, information about your web browsing and app usage and how you interact with our properties and ads for a variety of purposes, such as personalization of offers or advertisements, analytics about how you engage with websites or ads, and other commercial purposes. For more information about the collection, use, and sale of your personal information and your rights, please use the below links.
https://rakutenadvertising.com/legal-notices/services-privacy-policy/
https://rakutenadvertising.com/legal-notices/services-privacy-rights-request-form/
Do Not Track
Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track ("DNT") feature or Global Privacy Control (GPC) signal setting you can activate to signal your privacy preference not to have data about your online browsing activities sold or shared.
At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signal.
How We Use Your Information
In short: We use the information that we collect to conduct our business and to provide you with the best possible products, services, and experiences. Which result in a combination of any or all of the information that we collect or obtain.
Under data protection law, we can only use your personal information if we have a proper reason for doing so, for example:
A legitimate interest is when we have a business reason to use your information, so long as this is not overridden by your own rights and interests.
Below are our uses of your personal information and our reasons for doing so:
HOW WE SHARE INFORMATION
In Short: We may share your information with our affiliated companies and brands, with third parties who provide services to you or us, with promotional partners, with social media companies, or with other third parties as needed to carry out our business or comply with a legal obligation.
Non-Personal Information. We may disclose aggregated information or other information that does not identify any individual without restriction.
Personal Information. We may disclose personal information that we collect, or you provide with:
We may also need to share some personal information with other parties to the extent we believe it is necessary or appropriate to (1) protect our operations and those of our affiliates and subsidiaries; (2) investigate and prevent against fraud and other illegal activity; (3) protect our rights, privacy, safety, property, and/or those of others; or (4) allow us to pursue available remedies or limit damages that we may sustain.
We may disclose your personal information for other reasons described at the time of information collection or prior to disclosing your information. Additionally, we may disclose your personal information with your consent or when you direct us to do so.
Except as set forth above, we will not share your personal information with any other third party.
YOUR RIGHTS AND CHOICES
In Short: We want you to be comfortable with the information we collect and use, therefore, we strive to provide you with choices regarding the personal information you provide to us. We have created mechanisms to provide you with the following control over your information: You have the right to make requests regarding your personal information. While these rights may vary based on your residency, we strive to allow you to control how your personal information is used.
Under certain circumstances, you may be able to:
In addition to the rights you may be provided above:
Unless specified otherwise, personal information requested when using the Website is voluntary, which means that it is not a statutory or contractual requirement, or a requirement necessary to enter into a contract. Users are free not to provide such personal information without consequences to the availability or the functioning of the Website. Where the provision of personal information is mandatory, such a requirement is stated. In that case, failure to provide such personal information may make it impossible for the Website to work properly or for us to provide any services to you.
Some of these rights may vary depending on where you reside. But we will make reasonable efforts to honor your request, even if your country or state does not require us to do so. If you ask us to delete or stop using your personal information, we may not be able to honor that request if the information is required to process your payments or returns, fulfill your order, or comply with tax, audit or regulatory requirements. If you are located in the European Economic Area, the UK, or you reside in Australia, Canada or the State of California, Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia please go to our Privacy Notice Addendum to learn about additional rights you may have under applicable data protection laws.
Petal and Pup does not conduct any automated decision making through or for the Platforms or Services, including profiling.
HOW WE STORE AND SECURE YOUR INFORMATION
In Short: We have implemented measures designed to secure your personal information from accidental loss and from unauthorized access, use, alteration, and disclosure, however, no system can be completely secure and transmissions over the internet are never entirely secure. Therefore, although we take steps to secure your information, we cannot guarantee your information, searches, or other communications will always remain secure. Any such transmission of information by you is at your own risk.
We do our best to provide you with a safe and convenient shopping experience. We have put in place a wide variety of technical and organizational security measures to help protect you and the personal information we collect about you.
We use reasonable and appropriate physical, technical, and administrative safeguards designed to protect your information from unauthorized use, access, loss, misuse, alteration, or destruction. We endeavor to protect the personal information we receive, gather and store, by such means as password protection, firewalls and other means. We limit access to your personal information to those who have a genuine business need to access it. Those processing your information will do so only in an authorized manner and are subject to a duty of confidentiality. We also require that third party service providers acting on our behalf or with whom we share your information also provide appropriate security measures in accordance with industry standards. We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.
Please note that we will never email you asking for account information like your username, date of birth, credit card information, or other personal information. Finally, we will never email you with attachments that can be opened. If you received a suspicious email that appears to be from us, please contact us.
WHERE YOUR PERSONAL INFORMATION IS HELD
Petal and Pup is a global company with a global footprint, but the majority of the Personal Information that we collect is stored in the United States. Your personal information may be subject to the laws of the countries in which it is stored or used. By providing us with any personal information, you understand that your information may be transferred, processed, or stored outside of your country of residence, including the United States, which may have a different data protection regime from the country in which you reside, as further described in the Data Transfers Outside the United States Section below. In certain circumstances, courts, law enforcement agencies, regulatory agencies, or security authorities in those other countries may be entitled to access your personal information. Non-United States based customers can read more about this topic below.
DATA TRANSFERS OUTSIDE OF THE UNITED STAES
Petal and Pup is headquartered in the United States and operates globally and utilizes service providers both in the United States and throughout the world. As such, Petal and Pup and our service providers may transfer your personal information to, or access it in, jurisdictions that may not provide equivalent levels of data protection as your home jurisdiction. To bring you our Website, it is sometimes necessary for us to share your personal information outside the country where we originally collected your personal information, for example:
These transfers may be subject to special rules under local data protection law.
These outside countries do not have the same data protection laws as the country where we originally collected the personal information. In particular, you are advised that the United States uses a sectoral model of privacy protection that relies on a mix of legislation, governmental regulation, and self-regulation. We will, however, ensure the transfer complies with data protection law and all personal information will be secure. If you are located outside the United States, we will only transfer your personal information if:
Where the laws of your country allow you to do so, by using the Website or our products or services, you consent and authorize Petal and Pup and its service providers to transfer, store, and use all such information in the United States and any other country where we operate which may not offer an equivalent level of protection to that required in the country where you reside and to the processing of that information by us and our service providers on our and their servers located in the United States and any other country where we operate as described in this Privacy Policy. If you do not want your personal information transferred to the United States or any other country where we operate, please do not submit any information to us or use our Website or our products or services.
If you would like further information, please contact us (see the “Contact Information” Section below).
Information Retention
We will retain your personal information for as long as needed to provide the service to you (for example, as long as you have an online account with us) or as needed to fulfill our own obligations, such as preventing fraud, meeting legal or other regulatory requirements, resolving disputes, improving our services or maintaining security, and in each case, as consistent with applicable law.
Different retention periods apply for different types of personal information. To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of personal information; the potential risk from unauthorized use or disclosure of the personal information; the purpose(s) for which we use or may use the personal information; whether we can achieve the purpose(s) through other means; and the applicable legal requirements.
When it is no longer necessary to retain your personal information, we will delete it or we may anonymize it. If we anonymize or de-identify information, we will maintain and use the information in anonymized or de-identified form and not attempt to re-identify the information except as required or permitted by law. We may retain non-personal information that has been sufficiently aggregated or anonymized for a longer period.
Third Party Services
We are not responsible for, and this Privacy Policy does not address, the privacy practices of other third parties, such as Facebook, Apple, Google, Microsoft, or any other app developers, social media platforms, operating system providers, wireless or telecommunications service providers, or device manufacturers. If, in your interactions with the Website, you are linked or directed to, or click on, a third party website, we cannot control what information you may provide to that party or on that website, and we are not responsible for how that party may use or disclose any information you may provide to them. This is not as an endorsement by us of any third party website, content that may be offered on such third party website, or of any products or services provided by such third party. We do not control, nor are we responsible for, such third party websites, product or service offerings. As such, we urge that you exercise caution before providing them with your personal information and to review the third party’s privacy policy for information on its data processing practice.
You should contact the site administrator for such third party website if you have any complaints, claims, concerns or questions regarding such third party website or its privacy practices.
Third Party Payment Service
We make certain third party payment service processors available to you such as PayPal or Apple Pay. If you wish to use one of these services, your personal information will be collected by such a third party and will be subject to the third party’s privacy policy. We have no control over, and are not responsible for this third party’s collection, use, and disclosure of your personal information.
CHILDREN AND OUR SITE
Our Website is not directed to children, and you may not use our Website if you are under the age of 16. If you are under 16, do not use our services, access the Website, or provide any information about yourself including, without limitation, your name, address, email address or any screen name or username you may use.
If we learn that we have collected or received personal information from a child under 13 without verification of parental consent, in compliance with the Children’s Online Privacy Protection Act, we will purge such information from our database and cancel the corresponding accounts. If you believe we may have any information from or about a child under 13, please see our “Contact Information” Section below. Please visit the FTC’s website at www.ftc.gov for tips on protecting children’s privacy online.
CHANGES TO OUR PRIVACY POLICY
This Privacy Policy was published on the date “Last Updated” above.
We may change this Privacy Policy from time to time. We will post updates to our Privacy Policy on our Website. Please check our Privacy Policy periodically for changes. We will post the date our Privacy Policy was last updated at the top of the Privacy Policy.
CONTACT INFORMATION
To ask questions or comment about this Privacy Policy and our privacy practices, contact us at:
Attention: Privacy Officer
Petal and Pup
100 Montgomery Street, Suite 2270
San Francisco, CA 94104
Email: privacy@petalandpup.com
Please note that the legal department of Petal and Pup also receives a copy of your message via this email address.
PRIVACY NOTICE ADDENDUM
This Privacy Notice Addendum (“Notice”) supplements the information contained in the Petal and Pup Privacy Policy and applies solely to all visitors, users, and others located in the European Economic Area, the UK, or who reside in Australia, Canada or the State of California, Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia, ("consumers" or "you").
We adopt this Notice to comply with the Australian Privacy Act 1988 and the Australian Privacy Principles, the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA), General Data Protection Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), the UK version of the GDPR California Shine the Lights law, the California Consumer Privacy Act of 2018 (CCPA), the California Privacy Rights Act of 2020 (CPRA), the Colorado Privacy Act of 2021, the Connecticut Data Privacy Act of 2022, the Iowa Consumer Data Protection Act of 2023, the Montana Consumer Data Privacy Act of 2024, the Oregon Consumer Privacy Act of 2024, the Texas Data Privacy and Security Act of 2024, the Utah Consumer Privacy Act of 2022, the Virginia Consumer Data Protection Act of 2023, and certain other privacy and data protection laws, as applicable (collectively, the "Statutes"). Any terms defined in the Statutes will have the same meaning when used in this Notice. Any terms used in this Notice but undefined herein shall have the meaning provided in the Privacy Policy.
As further set forth in our Privacy Policy, we may collect certain information that is (i) linked or reasonably linkable to an identified or identifiable individual or natural person, or (ii) that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a consumer or household, or (iii) as further defined in the Statutes as “Personal Data” or “Personal Information,” as further described in our Privacy Policy.
TYPES OF INFORMATION WE COLLECT
Categories of Personal Information | Examples Personal Information | Collected |
Category A - Identifiers | A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, social security number, driver’s license number, passport number, or other similar identifiers. | Yes (name, postal address, IP address, email address) |
Category B - Customer records information (i.e. Information that identifies, relates to, describes, or is capable of being associated with, a particular individual) | Name, signature, social security number, physical characteristics or description, address, telephone number, passport number, driver’s license or state identification card number, insurance policy number, education, employment, employment history, bank account number, credit card number, debit card number, or any other financial information, medical information, or health insurance information. | Yes (name, address, telephone number, credit card number, bank account number) |
Category C - Characteristics of protected classifications under state or federal law | Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex (including gender, gender identity, gender expression, pregnancy or childbirth and related medical conditions), sexual orientation, veteran or military status, genetic information (including familial genetic information). | Yes (age) |
Category D - Commercial information | Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies. | Yes (order and refund history and sizing) |
Category E - Biometric information | Retina or iris scan, fingerprint, voiceprint, or scan of hand or face geometry. | No |
Category F - Internet or other electronic network activity information | Browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement. | Yes (browsing history, search history, and information regarding a consumer’s interaction with an Internet website, application, or advertisement) |
Category G – Geolocation data | Physical location or movements. | Yes (physical location) |
Category H - Sensory data | Audio, electronic, visual, thermal, olfactory, or similar information. | No |
Category I - Professional or employment-related information. | Place of employment, position, job history, salary, resume, and other related data. | Yes (occupation, estimated income) |
Category J - Education information, defined as information that is not publicly available personally identifiable information as defined in the Family Educational Rights and Privacy Act (FERPA) | Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records. | No |
Category K - Sensitive personal information | (1) personal information that reveals:A person’s social security, driver’s license, state identification card, or passport number;A person’s account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to an account;A person’s precise geolocation;A person’s racial or ethnic origin, religious or philosophical beliefs, or union membership;The contents of a person’s mail, email, and text messages unless the business is the intended recipient of the communication; orA person’s genetic data.(2) the processing of biometric information for the purpose of uniquely identifying a consumer;(3) personal information collected and analyzed concerning a consumer’s health, or a personal information collected and analyzed concerning a consumer’s sex life or sexual orientation. | No |
Category L - Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. | An inference is essentially a characteristic deduced about a consumer (such as ‘married,’ ‘homeowner,’ ‘online shopper,’ or ‘likely voter’) that is based on other information a business has collected. | Yes |
Shine the Light Law
California Civil Code Section 1798.83, also known as the “Shine The Light” law permits individuals who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please contact us in accordance with the “How to Exercise Your Rights” Section below.
Personal Information We Sold or Disclosed for a Business Purpose
In the preceding 12 months, we have sold to one or more third parties the following categories of personal information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household:
In the preceding 12 months, we have disclosed for a business purpose to one or more third parties the following categories of personal information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household:
Your Rights Under the CCPA
You may have the right under the CCPA, the CPRA, and certain other privacy and data protection laws, as applicable, to exercise free of charge:
Disclosure of Personal Information We Collect About You | You have the right to know:
|
Personal Information Sold, Shared, Disclosed, or Used for a Business Purpose | In connection with any personal information we may sell or disclose to a third party for a business purpose, you have the right to know:
|
Right to Limit Use and Disclosure of Sensitive Personal Information. | You have the right to opt-out of the use and disclosure of your sensitive personal information for anything other than supplying requested goods or services.We do not collect sensitive personal information. |
Right to Correction | You have the right to request correction of inaccurate personal information maintained by us about you. Upon receipt of a verifiable request from you, we will use commercially reasonable efforts to correct the inaccurate personal information. |
Right to Deletion | Subject to certain exceptions set out below, on receipt of a verifiable request from you, we will:
|
Protection Against Discrimination | You have the right to not be discriminated against by us because you exercised any of your rights under the CCPA. This means we cannot, among other things:
|
Your Rights Under Other State Privacy Laws
Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia, also provide consumers who are residents of these states with certain rights regarding their personal data. This Section describes the rights you may have under these state privacy laws, under certain circumstances and subject to certain exceptions. Please contact us in accordance with the “How to Exercise Your Rights” Section below.
Consumer Right | Explanation | Applies to Residents of: |
The Right to Opt-Out | You may have the right to opt out of the processing of personal data concerning you for the purposes of:Targeted Advertising;The Sale of personal data; orProfiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer. | Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia |
The Right of Access | You may have the right to confirm whether we are processing personal data concerning you and to access your personal data.Please note, there may be restrictions on how often you may exercise this right. | Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia |
The Right to Correction | You may have the right to correct inaccuracies in your personal data, taking into account the nature of the personal data and the purposes of the processing of your personal data. | Colorado, Connecticut, Montana, Oregon, Texas, Virginia |
The Right to Deletion | You may have the right to delete personal data concerning you or to request that we delete personal data provided by, or obtained about, you. | Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia |
The Right to Data Portability | You may have the right to obtain a copy of your personal data in a portable, and to the extent technically feasible, readily usable format that allows you to transmit the data to another entity without hindrance.Please note, there may be restrictions on how often you may exercise this right. | Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Utah, Virginia |
The Right to Appeal | We hope that we can resolve any query or concern you raise about our use of your personal data. However, if we do not take action on your request to exercise any of your rights, we will inform you without undue delay after the receipt of the request for not taking action. You may appeal any decision we have made about your request by following the instructions in the communication you receive from us notifying you of our decision. | Colorado, Connecticut, Iowa, Montana, Oregon, Texas, Virginia |
Your Rights under the Privacy Act 1988 and the Australian Privacy Principles
In Australia, you have certain rights under applicable data protection laws:
If you would like to exercise your right to access or correct your personal information, please contact us in accordance with the “How to Exercise Your Rights” Section below.
If you think we have breached applicable privacy law, or you wish to make a complaint about the way we have handled your personal information, you can contact us using the details in the “Contact Information” Section of our Privacy Policy. You should include your name, email address, and/or telephone number and clearly describe your complaint. We will acknowledge your complaint and respond to you regarding your complaint within a reasonable period of time. If you are unhappy with our response to your complaint, please let us know and we will provide you with information about the further steps you can take.
If you are a resident of Australia and are not satisfied with our response, you may also lodge a complaint with the Office of the Australian Information Commissioner by telephone: 1300.363.992 or email: enquiries@oaic.gov.au.
Your Rights Under the GDPR and the UK GDPR
In some regions (like the European Economic Area and the UK), you have certain rights under applicable data protection laws.
Right to Access | The right to be provided with a copy of your personal data (the right of access). |
Right to Rectification | The right to require us to correct any mistakes in your personal data. |
Right to be Forgotten | The right to require us to delete your personal data —in certain situations.At your request, we will delete your personal data promptly if:
|
Right to Restriction of Processing | The right to require us to restrict processing of your personal data —in certain circumstances, e.g. if you contest the accuracy of the data, if your personal data was processed unlawfully and you request a limitation on processing, rather than the deletion of your personal data, we no longer need to process your persona data, but you require your personal data in connection with a legal claim, or you object to the processing pending verification as to whether an overriding legitimate ground for such processing exists.We may continue to store your European Personal Data to the extent required to ensure that your request to limit the processing is respected in the future. |
Right to Data Portability | The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations. At your request, we will provide you free of charge with your European Personal Data in a structured, commonly used and machine-readable format, if:
|
Right to Object | The right to object:
|
Right Not to be Subject to Automated Individual Decision-Making | The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you, unless you have given us your explicit consent or where they are necessary for a contract with us. |
Right to withdraw consent | You have the right to withdraw any consent you may have previously given us at any time. |
For further information on each of those rights, including the circumstances in which they apply, see the guidance from the UK Information Commissioner's Office (ICO) on individual rights under the General Data Protection Regulation.
While we hope that we can resolve any query or concern you raise about our use of your information, the GDPR also gives you right to lodge a complaint with a supervisory authority, in the European Union (or European Economic Area) state where you work, normally live, or where any alleged infringement of data protection laws occurred. The current list of supervisory authorities who may be contacted are provided HERE.
Canada’s Personal Information Protection and Electronic Documents Act
The Personal Information Protection and Electronic Documents Act (PIPEDA) provides consumers who are Canadian residents with specific rights regarding their personal information. This section describes your rights under PIPEDA and explains how to exercise those rights.
We maintain procedures for addressing and responding to all inquiries or complaints from you about our handling of personal information. We will inform individuals who make inquiries or lodge complaints of the existence of relevant complaint procedures. We may seek external advice where appropriate before providing a final response to individual complaints. We shall investigate all complaints. If a complaint is found to be justified, we will take appropriate measures, including, if necessary, amending our policies and procedures.
How to Exercise Your Rights
If you would like to exercise any of your rights as described in the Privacy Policy or this Notice, please:
Please note that you may be restricted on the number of data access or data portability disclosures you may make within a 12-month period.
If you choose to contact us to exercise any of your rights as described in the Privacy Policy or this Notice, we will take steps to verify your identity before granting you access to your personal information or complying with your request. In order to help protect your privacy and maintain security, you will need to provide us with:
In addition, if you ask us to provide you with specific pieces of personal information, we may require you to sign a declaration under penalty of perjury that you are the individual whose personal information is the subject of the request.
You may use a representative, called an "authorized agent," to submit a request to us.
In some states, an authorized agent must be a natural person, or a business entity registered with the appropriate Secretary of State, that you have authorized to act on your behalf.
In order to protect your privacy, Petal and Pup requires you to confirm that you have provided the authorized agent permission to submit the request and you must provide the authorized agent with signed permission. "Signed" means that the written attestation, declaration, or permission has either been physically signed or provided electronically pursuant to the Uniform Electronic Transactions Act. In California, an authorized agent that has power of attorney pursuant to California Probate Code section 4121 to 4130 must submit proof of statutory power of attorney, but in such cases, consumer verification will not be required.
Petal and Pup may deny a request from an authorized agent that does not submit proof that they have been authorized to act on your behalf. Requests submitted by an authorized agent will still require verification of the person who is the subject of the request in accordance with the process described above.
We are not obligated to make a data access or data portability disclosure if we cannot verify that the person making the request is the person about whom we collected information or is someone authorized to act on such person’s behalf.
Any personal information we collect from you to verify your identity in connection with your request will be used solely for the purposes of verification.