Global Privacy Notice

Cart.com, Inc. is committed to the responsible collection, use and care of the personal data of its customers and website users. This Global Privacy Notice for customers and website users (“Privacy Notice”) provides information on our practices for collecting, using, maintaining, and disclosing information we may collect from you or that you may provide when you use or access our services, including websites, products, mobile applications, or other sites that display this Privacy Notice or otherwise engage with us (the “Services”).

If you are in a jurisdiction that recognizes the concept of a data controller, the data controller is Cart.com, Inc.. If you have a query about how your personal data is being used, you can contact the data controller at DPO@cart.com.

Please read this Privacy Notice carefully. If any term in this Privacy Notice is unacceptable to you, please do not use our Services or provide us with any personal data.

This Privacy Notice does not apply to any products, services, websites, mobile applications, or content (including advertising) offered by third parties or that may be linked to or from the Services. Data collected by these third parties is covered by their own privacy policies.

Information Collection Practices

Personal Data You Disclose to Us

Depending on your relationship with us, we may collect, process, disclose, and maintain your personal data in a number of ways including, but not limited to: when you access or use our Services, such as by visiting our websites, and branded pages and applications; register an account with us and/or purchase products our products; communicate with us including through messaging platforms such as text message, live chat, social media, and email or otherwise provide us with information including via direct marketing campaigns, sweepstakes and competitions; or submit a review regarding our Services.

The categories of personal data we collect may include:

• Basic identifiers and personal details. We may collect certain contact and identifying information, including name, postal and email address, telephone number, business contact information, gender, date of birth, country/state of residence, account credentials including username and password and profile information, and similar identifiers. Where you log in to your account with us using your third-party social media account details, or otherwise interact with us via social media, we may also receive certain profile information about you from your social media provider, such as your profile picture, likes, location, and product preferences. We will use the information we receive only for the purposes that are described in this Privacy Notice or that are otherwise made clear to you on the relevant Services. Please note that we do not control, and are not responsible for, other uses of your personal data by your third-party social media provider.
• Financial information. Where you make a payment through our Services, we may collect your billing and payment card information, including credit or debit card number, expiration date, CVV code, and/or billing address.
• Commercial information. We may obtain information on the products and services that you have shown an interest in or purchased, including product preferences, purchase details (products, color, size, quantity, price), methods of payment and/or any communications we have received about your order or purchase, as well as any fraud checks or flags raised about your transactions, payment card refusals, suspected crimes, complaints and/or claims.
• Internet or other similar network activity. When you access or use the Services, we may collect certain information about your device and network activity, including, for example, IP address, browsing history, search history, and information regarding your interactions with a website, application, or advertisement.
• Communication data. We may record our communications with you, including phone calls and texts, email, social media, and chat communications, as well as interactions in-person at our stores. We may also collect your communication contact preferences.
• Views and opinions. We may collect any feedback, survey responses, and other information included within your interactions with us or otherwise provided via the Services.
• Geolocation data. We may request access or permission to track location-based information from your device, either continuously or while you are using our Services. How much information we collect depends on the type and settings of the device you use to access the Services. If you wish to change our access or permissions, you may do so in your device’s settings. However, if you choose to opt out of sharing your location with us, you may not be able to use certain aspects of the Services.
• Inferences drawn from other personal data. Depending on how you interact with us, we may collect and develop certain inferences about you, including your preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.
• Sensitive personal data. We limit the circumstances where we collect and process information that may be considered sensitive under applicable law. In some instances, you may have requested services or products that do not directly involve the collection of any sensitive or special categories of data, but may imply or suggest your religion, health or other special categories of data, such as skin concerns and adverse events from you which may include information on your health and or ethnicity. We may also collect information regarding your precise geolocation and/or your racial or ethnic origin. We will only collect, process, disclose, and store such data in accordance with this Privacy Notice and applicable law.

Information Automatically Collected

Similar to many companies, when you interact with our Services, including websites and applications, we may use automatic data collection technologies to collect and log certain information about your equipment, browsing actions and patterns, and network activity. Such information may include: your unique device identifier, device model and manufacturer, domain name, browser type and version, browsing history, search history, information about your visit to our website or application (including products viewed, purchased or search for), details of any website which has referred you to our website, application, or advertisement, location and time zone setting, browser plug-types and versions, operating system and platform, page responses times and errors, length of visits to certain pages, page interaction information (such as scrolling, clicks, keystrokes typed, and mouseovers), the amount of time you spend viewing or using our website or application and the pages visited, the number of times you return, or other click-stream or site usage data and mouseovers) and methods used to browse away from the page.

Cookies and Other Automated Technology

The technologies we use for automatic data collection include browser cookies, flash cookies, web beacons, pixels, and software development tools (collectively, “Cookies”). Cookies are small text files that are stored by your web browser when you visit a website. We may store Cookies on your device when you use our Services. These technologies help us speed up your future activities and improve your experience by remembering the information that you have already provided to us. Third parties operating on our behalf may also use these technologies to provide us with information regarding your use of our Services, as well as to help us manage and display advertisements.

For more information about these technologies, including links to web browser instructions for disabling and managing such technologies, visit Opt-Out.

Google Analytics

We may share your information with Google Analytics to track and analyze the use of the Services. Access by U.S. authorities to the data stored by Google cannot be ruled out.

Information Collected From Other Sources

We may receive your personal data from other sources, including our business and promotional partners such as in connection with our loyalty or rewards program, social media platforms, or individuals who purchase goods or services to be delivered to you (such as gifts or gift cards). We also may obtain information you have made publicly available, including from websites and online services you use, consumer research platforms, and/or business contact databases.

How We Use Your Information

We process your personal data for a variety of reasons, depending on how you interact with our Services, including for legitimate business and commercial purposes and in accordance with the legal bases further described in Section 3. In particular, we may use your personal data:

• To provide the Services, including to provide you with any products or services you purchase from us;
• To facilitate account creation and authentication and otherwise manage your accounts with us;
• To fulfill and manage your orders, payments, returns, and exchanges made through the Services;
• To assist with the registration and provision of any contests or promotions;
• To respond to inquiries, provide customer support, and communicate with you;
• To notify you of changes to our products or services, or changes to regulatory requirements that may affect our products or services or your use of them;
• To send you marketing and promotional communications and provide you with personalized content;
• To improve and manage our Services and your user experience;
• To comply with our legal obligations;
• To maintain the safety, security, and integrity of our Services and business;
• For any other purpose with your consent.

Legal Basis

We process your personal data on the following legal basis:

• If it is necessary for a legitimate interest of Cart.com, Inc., provided that these interests are not overridden by your interests or fundamental rights and freedoms.
• If it is necessary to fulfill our contractual obligations.
• If it is required to comply with our legal obligations.
• If you consent to our use of your personal data.

How We Disclose and Share Your Information

We may disclose your personal data as follows:

• Service Providers and Vendors. We may disclose your personal data to our service providers and vendors for performing services for us.
• Affiliates and Subsidiaries. We may share your information with our affiliates.
• Business Partners. We may share your information with our business partners to offer you certain products, services, or promotions.
• Legal Purposes. We may disclose your information to third parties when required by law.
• Business Transfers or Reorganization. We may share or transfer your personal data during a reorganization process.
• Professional Advisors. We may disclose your information to outside professional advisors.

How Long We Store Your Information

We store your personal data processed for the purposes stated in this Privacy Notice and for the duration of our business relationship with you. Once our business relationship has ended, we will delete your data unless required for other purposes.

International Data Transfers

We may transfer your personal data from your country to other jurisdictions in accordance with this Privacy Notice and applicable law.

How We Protect Your Information

We implement appropriate and reasonable measures designed to protect the security of any personal data we process. However, we cannot guarantee 100% security.

Children

Our Services are designed for adults. We may collect certain information about children under the age of majority based on consent from a parent or guardian.

Your Rights

Promotional Emails

You can unsubscribe from our marketing and promotional communications emails at any time.

Promotional SMS/Text Messages

You can unsubscribe from our marketing and promotional SMS messages by texting “STOP” or similar revocation language.

Push Notifications/Alerts

You can deactivate these messages in your device's notification settings.

Controls for Do-Not-Track Features

Most web browsers include a Do-Not-Track feature that you can activate. At this stage, no standard for recognizing and implementing DNT signals has been finalized.

Third-Party Links/Sites

Our Services may contain links to external websites. We do not endorse the content of those websites.

Changes to This Privacy Notice

We may update this Privacy Notice periodically. Continued use of the Services after such change constitutes acceptance of the new Privacy Notice.

How to Contact Us

If you have any questions about this Privacy Notice or our data practices, you may contact us at:

DPO@cart.com

1334 Brittmoore Rd., Suite 225

Houston, TX 77043