Your Privacy Choices – Badgley Mischka

Cart.com, Inc. is committed to the responsible collection, use and care of the personal data of its customers and website users. This Global Privacy Notice for customers and website users (“Privacy Notice”) provides information on our practices for collecting, using, maintaining, and disclosing information we may collect from you or that you may provide when you use or access our services, including websites, products, mobile applications, or other sites that display this Privacy Notice or otherwise engage with us (the “Services`).

If you are in a jurisdiction that recognizes the concept of a data controller, the data controller is Cart.com, Inc.. If you have a query about how your personal data is being used, you can contact the data controller at DPO@cart.com.

Please read this Privacy Notice carefully. If any term in this Privacy Notice is unacceptable to you, please do not use our Services or provide us with any personal data.

This Privacy Notice does not apply to any products, services, websites, mobile applications, or content (including advertising) offered by third parties or that may be linked to or from the Services. Data collected by these third parties is covered by their own privacy policies.

Information Collection Practices

Personal Data You Disclose to Us

Depending on your relationship with us, we may collect, process, disclose, and maintain your personal data in a number of ways including, but not limited to: when you access or use our Services, such as by visiting our websites, and branded pages and applications; register an account with us and/or purchase products our products; communicate with us including through messaging platforms such as text message, live chat, social media, and email or otherwise provide us with information including via direct marketing campaigns, sweepstakes and competitions; or submit a review regarding our Services.

The categories of personal data we collect may include:

• Basic identifiers and personal details. We may collect certain contact and identifying information, including name, postal and email address, telephone number, business contact information, gender, date of birth, country/state of residence, account credentials including username and password and profile information, and similar identifiers. Where you log in to your account with us using your third-party social media account details, or otherwise interact with us via social media, we may also receive certain profile information about you from your social media provider, such as your profile picture, likes, location, and product preferences. We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal data by your third-party social media provider. We recommend that you review their privacy notice to understand how they collect, use, and share your personal data, and how you can set your privacy preferences on their sites and apps.
• Financial information. Where you make a payment through our Services, we may collect your billing and payment card information, including credit or debit card number, expiration date, CVV code, and/or billing address.
• Commercial information. We may obtain information on the products and services that you have shown an interest in or purchased, including product preferences, purchase details (products, color, size, quantity, price), methods of payment and/or any communications we have received about your order or purchase, as well as any fraud checks or flags raised about your transactions, payment card refusals, suspected crimes, complaints and/or claims.
• Internet or other similar network activity. When you access or use the Services, we may collect certain information about your device and network activity, including, for example, IP address, browsing history, search history, and information regarding your interactions with a website, application, or advertisement. For more information, see “Information Automatically Collected” below.
• Communication data. We may record our communications with you, including phone calls and texts, email, social media, and chat communications, as well as interactions in-person at our stores. We may also collect your communication contact preferences.
• Views and opinions. We may collect any feedback, survey responses, and other information included within your interactions with us or otherwise provided via the Services.
• Geolocation data. We may request access or permission to track location-based information from your device, either continuously or while you are using our Services. How much information we collect depends on the type and settings of the device you use to access the Services. If you wish to change our access or permissions, you may do so in your device’s settings. However, if you choose to opt out of sharing your location with us, you may not be able to use certain aspects of the Services.
• Inferences drawn from other personal data. Depending on how you interact with us, we may collect and develop certain inferences about you, including your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes. We receive these inferences indirectly from you (e.g., from observing your actions on our Services) or from third parties, such as a data analytics provider.
• Sensitive personal data. We limit the circumstances where we collect and process information that may be considered sensitive under applicable law. In some instances, you may have requested services or products that do not directly involve the collection of any sensitive or special categories of data, but may imply or suggest your religion, health or other special categories of data, such as skin concerns and adverse events from you which may include information on your health and or ethnicity. We may also collect information regarding your precise geolocation and/or your racial or ethnic origin. We will only collect, process, disclose, and store such data in accordance with this Privacy Notice and applicable law.

Information Automatically Collected

Similar to many companies, when you interact with our Services, including websites and applications, we may use automatic data collection technologies to collect and log certain information about your equipment, browsing actions and patterns, and network activity. Such information may include: your unique device identifier, device model and manufacturer, domain name, browser type and version, browsing history, search history, information about your visit to our website or application (including products viewed, purchased or search for), details of any website which has referred you to our website, application, or advertisement, location and time zone setting, browser plug-types and versions, operating system and platform, page responses times and errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, keystrokes typed, and mouseovers), the amount of time you spend viewing or using the our website or application and the pages visited, the number of times you return, or other click-stream or site usage data and mouseovers) and methods used to browse away from the page. If you are using our mobile application, we may also collect location-based information from your mobile device.

Cookies and Other Automated Technology

The technologies we use for automatic data collection include browser cookies, flash cookies, web beacons, pixels, and software development tools (collectively, “Cookies”). Cookies are small text files that are stored by your web browser when you visit a website. We may store Cookies on your device when you use our Services. These technologies help us speed up your future activities and improve your experience by remembering the information that you have already provided to us. Third parties operating on our behalf may also use these technologies to provide us with information regarding your use of our Services, as well as to help us manage and display advertisements, tailor advertisements to your interests, or send abandoned shopping cart reminders (depending on your communication preferences). You may block or delete these technologies from your device. However, by disabling such technologies, you may not have access to the entire set of features of our Services. For more information about these technologies, including links to web browser instructions for disabling and managing such technologies, visit https://optout.networkadvertising.org/.

Specific information about how we use such technologies and how you can manage our use of certain Cookies is set out in our Cookie Notice.

Please note that where the placement of Cookies involves the processing of personal data, the legal basis for processing personal data in connection with strictly necessary Cookies is our legitimate interest in the functioning of our Services. For the processing of personal data in connection with other Cookies, including performance Cookies and targeting Cookies, we obtain your consent where required by applicable law. You can revoke your consent at any time by visiting our cookie management tool available on our Services and changing your preferences.

Google Analytics

We may share your information with Google Analytics to track and analyze the use of the Services. Access by U.S. authorities to the data stored by Google cannot be ruled out. To opt out of being tracked by Google Analytics across the Services, visit https://tools.google.com/dlpage/gaoptout. You may also manage our use of analytics cookies by visiting our cookie management tool here. For more information on the privacy practices of Google, please visit the Google Privacy & Terms page.

Information Collected From Other Sources

We may receive your personal data from other sources, including our business and promotional partners such as in connection with our loyalty or rewards program, social media platforms, or individuals who purchase goods or services to be delivered to you (such as gifts or gift cards). We also may obtain information you have made publicly available, including from websites and online services you use, consumer research platforms, and/or business contact databases.

How We Use Your Information

We process your personal data for a variety of reasons, depending on how you interact with our Services, including for legitimate business and commercial purposes and in accordance with the legal bases further described in Section 3. In particular, we may use your personal data:

• To provide the Services, including to provide you with any products or services you purchase from us;
• To facilitate account creation and authentication and otherwise manage your accounts with us;
• To fulfill and manage your orders, payments, returns, and exchanges made through the Services, including administrative management of your contract with us, delivery of goods, and payment processing, as well as to arrange for shipping, handling of returns, refunds, and warranties, and maintaining a record of the purchases you make;
• To assist with the registration and provision of any contests or promotions, including to enable you to participate in any campaigns, petitions and similar activities (including our loyalty programs);
• To respond to inquiries, provide customer support, and communicate with you, including to provide service communications related to your account or transactions with us, or otherwise to provide you with information you have requested;
• To notify you of changes to our products or services, or changes to regulatory requirements that may affect our products or services or your use of them;
• To send you marketing and promotional communications and provide you with personalized content, information, brochures, coupons, samples, and offers that may be of interest to you, including copies of our newsletter and information about our products, store launches, partnerships and in-store events;
• To perform our duties in the context of our commercial or business relationship with you;
• To improve and manage our Services and your user experience, including by researching and evaluating our Services, products, and marketing, and understanding your use of our Services including through session replay;
• To comply with our legal obligations, respond to legal requests, and exercise, establish, or defend our legal rights;
• To maintain the safety, security, and integrity of our Services, products and services, databases, other technology assets, and business;
• For any other purpose with your consent.

Legal Basis

We process your personal data on the following legal basis:

• If it is necessary for pursuit of, or to safeguard, the legitimate interests of Cart.com, Inc., provided that these interests are not overridden by your interests or fundamental rights and freedoms.
• If it is necessary to fulfill our contractual obligations. The extent and purpose of our use of your personal data depends on the contract that we have concluded with you.
• If it is required to comply with our legal obligations. These obligations may arise from applicable provisions of national or regional (European) laws or regulations, including regarding commerce, trade, and tax.
• If you consent to our use of your personal data. If you have given us your prior consent, we will use your personal data in a manner consistent with the scope of that consent.

How We Disclose and Share Your Information

We may disclose your personal data as follows and as otherwise described in this Privacy Notice:

• Service Providers and Vendors. We may disclose your personal data to our service providers and vendors that perform services for us, including customer care center operators, providers of technical services, email and chat service providers, payment processors, loyalty or rewards program providers, fraud prevention vendors, analytics providers, advertising partners, and other service providers.
• Affiliates and Subsidiaries. We may share your information with our affiliates, including our parent company and any subsidiaries, joint venture partners, or other companies that we control or that are under common control with us.
• Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
• Legal Purposes. We may disclose your information to third parties, including authorized government agencies, where required by law, court order, or subpoena if we believe disclosure is in accordance with, or required by, applicable law or legal process or where necessary to prevent, detect, or prosecute criminal offenses, or to protect the rights, property, and safety of Cart.com, Inc. or others.
• Business Transfers or Reorganization. We may share or transfer your personal data in the course of any direct or indirect reorganization process including, but not limited to, mergers, acquisitions, divestitures, bankruptcies, and sales of all or part of our business to another company.
• Professional Advisors. We may disclose your information to accountants, auditors, lawyers, and other outside professional advisors, subject to appropriate contractual obligations of confidentiality.
• Your Consent. We may disclose your information to third parties with your consent or at your direction.

We may also process and disclose information to third parties if the information has been de-identified or aggregated in a way so it cannot be used to identify you.

How Long We Store Your Information

We store your personal data processed for the purposes stated in this Privacy Notice and for the duration of our business relationship with you. Once our business relationship with you has ended and your data is no longer required for these purposes, we will delete your data, unless your data is required also for other purposes set out in this Privacy Notice, and/or is necessary to fulfil applicable legal or regulatory obligations. When determining the retention period, we take into account criteria, such as the type of services requested by or provided to you, the nature and length of our relationship with you, use of our Services, and the impact on the functionality of the Services if we delete your personal data.

International Data Transfers

We may also transfer your personal data from your country or jurisdiction to other countries or jurisdictions in accordance with this Privacy Notice and applicable law.

• For international data transfers subject to EEA, UK and Swiss law: We primarily use European Union and/or Swiss Commission Standard Contractual Clauses, and, where necessary, the UK Addendum or the UK International Data Transfer Agreement. Where applicable, we may also rely on the self-certification of service providers or vendors under the EU-U.S. and/or Swiss-U.S. Data Privacy Framework and its UK Extension.
• For international transfers between other jurisdictions: We may rely on other legal mechanisms for international transfers, as appropriate under applicable law.

How We Protect Your Information

We implement appropriate and reasonable technical, physical, and organizational measures designed to protect the security of any personal data we process and comply with applicable law. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure. Although we will do our best to protect your personal data, transmission of personal data to and from our Services is at your own risk. You should only access the Services within a secure environment.

Children

Our Services are designed and intended for adults. However, due to the nature of our Services, we may collect certain information about children under the age of majority in their state or country of residence. In such cases, our collection and processing of information about children will be based on consent from a parent or guardian in accordance with the applicable law. If you learn that a child has, in violation of this Privacy Notice, registered for email newsletters, or otherwise provided their personal data, please report it to us using the contact information provided in Section 13. If we become aware that a child has provided personal data without parental or guardian permission, we will terminate that account and delete all personal data provided by that individual to the extent feasible and as soon as practicable. Depending on the country you are based, we may use your personal data to carry out age verification checks and enforce any such age restrictions.

Your Rights

Promotional Emails

You can unsubscribe from our marketing and promotional communications emails at any time by clicking on the unsubscribe link in the marketing and promotional emails that we send . Please note that if you opt out of marketing communications, we may still contact you with non-promotional communications, such as those about ongoing business relations or administrative messages (e.g., updates on online orders).

Promotional SMS/Text Messages

You can unsubscribe from our marketing and promotional SMS messages by texting “STOP” or similar revocation language as permitted under applicable law to the short code or phone number from which the promotional SMS messages are sent. After you send the SMS opt-out message to us, we will send you an SMS message to confirm that you have been unsubscribed from our promotional SMS messages.

Push Notifications/Alerts

If you have permitted one of our mobile applications to send you push notifications or alerts, you can deactivate these messages at any time in the notification settings on your mobile device.

Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage, no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online.

Third-Party Links/Sites

Our Services may contain content, services, advertising, and materials that link to external websites. We do not endorse and are not responsible for the content of any such external website. Please refer to the terms and conditions and privacy policies of the external website for more information.

Changes to This Privacy Notice

We may update this Privacy Notice periodically and will revise the date at the top of the Privacy Notice to reflect the date when such update occurred. Continued use of the Services after such change constitutes acceptance of the new Privacy Notice. We encourage you to periodically review this page for the latest information on our privacy practices.

How to Contact Us

If you have any questions or comments about this Privacy Notice or our data collection and processing practices more generally, you may contact us at:

morservices@cart.com

1334 Brittmoore Rd., Suite 225

Houston, TX 77043

Notice of Financial Incentives

We may offer you various incentives, including special offers, discounts, rewards, and coupons pursuant to certain rewards and loyalty programs (each, a “Rewards Program”), throughout the year for providing us with your personal information. Categories of personal information that may be collected pursuant to a Rewards Program, include, but are not limited to, identifiers (e.g., name, date of birth, phone number, Rewards Program account information, and a valid email address), financial information (e.g., credit card number or other payment information), commercial information (e.g., payment receipts), internet or other electronic network activity information (e.g., browsing history or search history on the Services), and geolocation data.

We may disclose the personal information collected pursuant to the Rewards Program to the categories of third parties listed in Section 4 “How We Disclose and Share Your Information” including Rewards Program partners such as Yotpo. We do not disclose personal information collected in connection with a Rewards Program to data brokers. We may also sell and/or process and share this information (as those terms are defined by applicable law) with third parties for targeted advertising purposes.

We do not assign a monetary value to the data we collect, but based on a good-faith estimate, we believe the value received from your personal information is reasonably equal to the value of the benefit we offer you pursuant to a Rewards Program. This estimate is not specific to any specific individual who participates in a Rewards Program (a “Member”) and may vary by Member. We have calculated such value by taking into consideration, without limitation, relevant factors related to the estimated value of such information to us, as set forth under California Law.

If eligible, you may opt in to a Rewards Program by following the instructions set forth in a Rewards Program’s terms and conditions and, if applicable, by creating a member account on the Rewards Program’s website. Material terms of participating in a Rewards Program, including all terms and conditions concerning the collection, use, and retention of a Member’s personal information, are set forth in the applicable terms and conditions, this Privacy Notice, and/or our Terms and Conditions and should be carefully reviewed prior to participation in a Rewards Program.

You have the right to cancel your membership and participation in a Rewards Program at any time. To opt out of a Rewards Program, including the receipt of marketing emails provided pursuant to your status as a Member of a Rewards Program, please follow the instructions set forth in the Rewards Program’s applicable terms and conditions or contact us via the methods described in Section 13 “How to Contact Us.” Please note, exercising your right to delete personal information pursuant to applicable law (and as described in this Privacy Notice), may impact our ability to provide you with some or all aspects of a Rewards Program because we will no longer be able to associate you with any points, rewards, or other events, promotions, or offers provided via the Rewards Program.