Privacy Policy

SMS/MMS MOBILE MESSAGING MARKETING PROGRAM We respect your privacy. We will only use information you provide through the Program to transmit your mobile messages and respond to you, if necessary. This includes, but is not limited to, sharing information with platform providers, phone companies, and other vendors who assist us in the delivery of mobile messages.  WE DO NOT SELL, RENT, LOAN, TRADE, LEASE, OR OTHERWISE TRANSFER FOR PROFIT ANY PHONE NUMBERS OR CUSTOMER INFORMATION COLLECTED THROUGH THE PROGRAM TO ANY THIRD PARTY. Nonetheless, We reserve the right at all times to disclose any information as necessary to satisfy any law, regulation or governmental request, to avoid liability, or to protect Our rights or property. When you complete forms online or otherwise provide Us information in connection with the Program, you agree to provide accurate, complete, and true information. You agree not to use a false or misleading name or a name that you are not authorized to use. If, in Our sole discretion, We believe that any such information is untrue, inaccurate, or incomplete, or you have opted into the Program for an ulterior purpose, We may refuse you access to the Program and pursue any appropriate legal remedies. California Civil Code Section 1798.83 permits Users of the Program that are California residents to request certain information regarding our disclosure of the information you provide through the Program to third parties for their direct marketing purposes.  To make such a request, please contact us at the following address: [email protected]  This Privacy Policy is strictly limited to the Program and has no effect on any other privacy policy(ies) that may govern the relationship between you and Us in other contexts.

Storing Your Information

We will store and process your personal data in the United States and in your country if you are located outside of the United States for the purposes set out above. How long we retain personal data depends on the purpose for which we collected it. In all cases, we retain data for as long as necessary to fulfill the purpose for which we collected it. We will then delete the personal data unless we are required by law to retain it or we need to retain it to comply with our legal obligations.

Sharing Your Information with Our Team

We may disclose the information you provide to us to any member of our group, which means our subsidiaries, our ultimate holding company and subsidiaries of our holding company, which may be located outside the UK and the European Economic Area, including in countries that do not ensure an adequate level of data protection, for the purposes set out above.

Sharing Your Information with Third Parties

We may disclose the information you provide to us to our service providers for the purposes set out above. We or they may also need to disclose your personal data if required by applicable law, rule or regulation. Any service providers we engage will only have access to your personal data to the extent necessary to enable them to perform these services on our behalf and are required to appropriately protect the privacy and security of your personal data.

Applicants in the UK and EEA

a. Transfer of Data Outside the UK and EEA Your personal data may be transferred to countries outside the UK and EEA, such as the United States, which do not ensure an adequate level of data protection. We will therefore ensure that (where necessary) all appropriate safeguards are in place and comply with all applicable laws and regulations in relation to such transfers. You may request information about the safeguards we have in place regarding such transfers by contacting us as set out in the “Privacy Questions” section below.

b. Your Rights Subject to applicable law, you may (1) request access to the personal data we hold about you; (2) request that we update, correct, amend or delete your personal data; or (3) request restrictions on our use of your personal data. You may also object to the use of your personal data at any time on grounds relating to your particular situation, provided that we are using it based on our legitimate interests as set out above.

If you wish to exercise any of these rights, please contact us as specified in the “Privacy Questions” section below. For more information on your privacy rights, please contact your local data protection supervisory authority or consumer protection authority. If you are not satisfied with our response, you may lodge a complaint with the data protection supervisory authority in your country.

Information Security

Our Digital Site Compliance team regularly conducts reviews of various compliance features of the company’s website and digital experiences. This includes our privacy policy language, consent collection, email collection, opt-out procedures, and subject access request procedures. All components of these reviews are conducted on a rolling basis, but are completed at least annually.

We consider cybersecurity to be an enterprise risk, which is reflected in its 10-K filings and reported to senior management multiple times a year through the enterprise risk management process, the Audit Committee, and the Board of Directors. We conduct an average of 20 external information risk assessments each year, including formal audits through PCI and SOX obligations. The results of these assessments are shared with the various groups mentioned above.

Privacy Training and Information Security Team

We value the privacy of our customers, and we are committed to protecting their personal information. We continuously train our global headquarters, store, and distribution center employees on customer data handling and privacy best practices. The company provides additional training on privacy compliance best practices and emerging risks to individual teams as needed. Targeted training is conducted frequently throughout the year, and regular training includes the Marketing, Data Analytics, and User Experience teams. In addition, the Information Security team provides ongoing company-wide training on email phishing.

The Privacy and Information Security team conducts a risk assessment on each new third-party vendor that handles customer information. These third-party vendors are then contractually required to handle customer information in a compliant and careful manner.

Privacy Questions

If you have any questions, comments or concerns about our privacy practices or legal compliance, please email us at [email protected].