1. IMPORTANT INFORMATION AND WHO WE ARE
2. THE DATA WE COLLECT ABOUT YOU
3. HOW IS YOUR PERSONAL DATA COLLECTED?
4. HOW WE USE COOKIES
5. HOW WE USE YOUR PERSONAL DATA
6. DISCLOSURES OF YOUR PERSONAL DATA
7. INTERNATIONAL TRANSFERS
8. DATA SECURITY
9. DATA RETENTION
10. YOUR LEGAL RIGHTS
11. UNITED STATES SECTION
12. GLOSSARY
13. LIST OF COOKIES WE COLLECT

 

1. IMPORTANT INFORMATION AND WHO WE ARE

PURPOSE OF THIS PRIVACY NOTICE
This privacy notice aims to give you information on how Sunspel collects and processes your personal data through your use of our website, your use of our stores or your participation in an event, including any data you may provide when you sign up to our newsletter, purchase a product or service or take part in a competition.  It applies to your use of the Sunspel’s websites, including sunspel.com, us.sunspel.com, eu.sunspel.com, sunspel.de, sunspel.fr, sunspel.jp, mobile applications, associated subdomains and other online services (“website(s)”).

Before accessing, using, or interacting with the website, you should carefully review the terms and conditions of this privacy policy. Your use of the website(s) is further governed by our Terms of Use, located at Terms of Use, which is also incorporated into your agreement with Sunspel by this reference. If you disagree with this privacy policy, do not access or use our website or interact with any other aspect of our business. 

CONTROLLER
Sunspel Limited is the controller and responsible for your personal data, other than in the United States where Sunspel, US Inc is the controller (both referred to as “Sunspel”, “we”, “us” or “our” in this privacy notice).

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the data privacy manager using the details set out below.

CONTACT DETAILS
You can contact our Data Privacy Manager at:
Post: Sunspel Limited
Cavendish House
Canal Street
Long Eaton
Nottinghamshire
NG10 4HP
FAO: Data Privacy Manager

Email: dataprivacy@sunspel.com

You have the right to make a complaint at any time to your local data protection authority (e.g., in the United Kingdon this is the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk)). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

CHANGES TO THE PRIVACY NOTICE AND YOUR DUTY TO INFORM US OF CHANGES
This version was last updated on September 19, 2025 and historic versions can be obtained by contacting us.  It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes during your relationship with us.

THIRD-PARTY LINKS
This website may include links to third-party websites, plug-ins and applications. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third-party websites and are not responsible for their privacy statements. When you leave our website, we encourage you to read the privacy notice of every website you visit.

 

2. THE DATA WE COLLECT ABOUT YOU

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). We may collect, use, store and transfer different kinds of personal data about you which we have grouped together follows:

• Identity Data includes first name, last name, title, gender.
  
• Contact Data includes billing address, delivery address, email address, telephone numbers.
  
• Financial Data includes bank account details, card number details, PayPal details.
  
• Transaction Data includes details about payments to and from you and other details of products and services you have purchased from us and from which of our stores.
  
• Technical Data includes internet protocol (IP) address, your login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system and platform and other technology on the devices you use to access this website.
  
• Profile Data includes your username and password, purchases or orders made by you, your interests, preferences, clothing sizes, feedback and survey responses.
  
• Usage Data includes information about how you use our website, products and services.
  
• Marketing and Communications Data includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your Usage Data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Google Analytics and other Third Party Analytics Providers: We may use third party web analytic services (such as those of Google Analytics, Meta, etc.), on our website(s) to collect and analyse usage information through cookies and similar tools; engage in auditing, research or reporting, assist with fraud protection and provide certain features to you.

Google Analytics uses cookies to help the website analyse how users use the websites, applications or services. The information generated by the cookie on the use of our content by the users is usually transmitted to a Google server in the USA and stored there. Google will use this information on our behalf to evaluate the use of our website and content by users, to compile reports on the activities within the website, and to provide us with other services related to the use of our website content and Internet usage. Also, pseudonymous usage profiles of the users may be created from the processed data. More information about Google Analytics can be found in the Google Analytics Terms of Use and the Google Analytics Privacy Policy.

Users may prevent the collection by Google of the data generated by the cookies and related to their use of the content and the processing of such data by Google by downloading and installing the browser plug-in available at the following link: https://tools.google.com/dlpage/gaoptout?hl=en  

If your browser does not support the link to the Browser Add-On from Google (e.g. when using our website from your smartphone), you can also opt-out of data collection by Google Analytics by clicking the link below. An opt-out cookie is then stored that prevents the future collection of your data when visiting the website. 

Click here to opt out of Google Analytics measurements.

More information about the third party analytics tools used on this website can be found as follows:

• Google Analytics- https://marketingplatform.google.com/about/analytics/terms/us/ 
• Meta Analytics- https://www.facebook.com/legal/technology_terms
• Ometria- https://ometria.com/terms-of-service-v7-1
• Shopify- https://www.shopify.com/legal/privacy
• Crazy Egg- https://www.crazyegg.com/privacy

IF YOU FAIL TO PROVIDE PERSONAL DATA

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with goods or services). In this case, we may have to cancel a product or service you have with us, but we will notify you if this is the case at the time.

 

3. HOW IS YOUR PERSONAL DATA COLLECTED?

We use different methods to collect data from and about you including through:

1. Direct interactions. You may give us your Identity, Contact and Financial Data by filling in forms or by corresponding with us by post, phone, email or otherwise. This includes personal data you provide when you:

• buy or express an interest in our products or services, in-store or on our website;
• create an account on our website;
• subscribe to our newsletter;
• request that we send marketing materials to you;
• enter a competition, promotion or survey;
• take part in a Sunspel event;
• submit a product review; contact customer services.

2. Automated technologies or interactions. As you interact with our website and emails we send to you, we may automatically collect Technical Data about your equipment, browsing actions and patterns. We collect this personal data by using cookies, server logs and other similar technologies. We may also receive Technical Data about you if you visit other websites employing our cookies. For an exhaustive list of cookies we collect, see the list of cookies we collect section.

 

4. HOW WE USE COOKIES

A cookie is a small file which can be placed on your computer’s hard drive. When you access our website the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes, and dislikes, by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system. The length of time that a cookie remains on your computer or mobile device depends on whether it is a “persistent” or “session” cookie. Session cookies last until you stop browsing and persistent cookies last until they expire or are deleted. Most of the cookies we use are persistent and will expire between 30 minutes and two years from the date they are downloaded to your device.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us. You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer. This may prevent you from taking full advantage of the website.

You can control and manage cookies in various ways. Please keep in mind that removing or blocking cookies can negatively impact your user experience and parts of our website may no longer be fully accessible.

Additionally, please note that blocking cookies may not completely prevent how we share information with third parties, such as our advertising partners. To exercise your rights or opt-out of certain uses of your information by these parties, please go to the Cookies Preference Centre which appears as you enter the website.

Please note that because there is no consistent industry understanding of how to respond to “Do Not Track” signals, we do not alter our data collection and usage practices when we detect such a signal from your browser.

 

5. HOW WE USE YOUR PERSONAL DATA

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

• Where we need to perform the contract that we are about to enter into or have entered into with you.
  
• Where we have your consent.
  
• Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
  
• Where we need to comply with a legal or regulatory obligation.

You have the right to withdraw consent to marketing at any time by unsubscribing via the link provided with each marketing email we send to you or by contacting us on dataprivacy@sunspel.com

PURPOSES FOR WHICH WE WILL USE YOUR PERSONAL DATA

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our legitimate interests are where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground that we are relying on to process your personal data where more than one ground has been set out in the table below.

PURPOSE/ACTIVITY	TYPE OF DATA	LAWFUL BASIS FOR PROCESSING INCLUDING BASIS OF LEGITIMATE INTEREST
To register you as a new customer	(a) Identity (b) Contact	Performance of a contract with you
To process and deliver your order including managing payments, fees and charges	(a) Identity (b) Contact (c) Financial (d) Transaction (e) Marketing and Communications	(a) Performance of a contract with you (b) Legitimate interests (fraud-checking)
To manage our relationship with you which will include: (a) Notifying you about changes to our terms or privacy notice (b) Asking you to leave a review or take a survey	(a) Identity (b) Contact (c) Profile (d) Marketing and Communications	a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated and to study how customers use our products/services)
To enable you to partake in an event, prize draw, competition or complete a survey	(a) Identity (b) Contact (c) Profile( d) Usage (e) Marketing and Communications	(a) Performance of a contract with you (b) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business) (c) Consent
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data)	(a) Identity (b) Contact (c) Technical	a) Necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise) (b) Necessary to comply with a legal obligation
To deliver relevant website content and advertisements to you and measure or understand the effectiveness of the advertising we serve to you	(a) Identity (b) Contact (c) Profile (d) Usage (e) Marketing and Communications (f) Technical	Necessary for our legitimate interests (to study how customers use our products/services, to develop them, to grow our business and to inform our marketing strategy)
To manage our after-sales relationship with you, including:(a) Assisting you with warranty issues(b) Contacting you in relation to a product recall	(a) Identity (b) Contact (c) Profile (d) Transaction	a) Performance of a contract with you (b) Necessary to comply with a legal obligation (c) Necessary for our legitimate interests (to keep our records updated)
To use data analytics to improve our website, products/services, marketing, customer relationships and experiences	(a) Technical (b) Usage	Necessary for our legitimate interests (to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy)
To make suggestions and recommendations to you about goods or services that may be of interest to you	(a) Identity (b) Contact (c) Technical (d) Usage (e) Profile	(a) Necessary for our legitimate interests (to develop our products/services and grow our business); or (b) Consent

 

 

MARKETING

We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. We have a Cookies Preference Centre which appears as you enter the website, where you can view and make certain decisions about your personal data use. You may also click ‘unsubscribe’ in any of the marketing emails we send to you.

PROMOTIONAL OFFERS FROM US

We may use your Identity, Contact, Technical, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (this is “marketing”). You will receive marketing communications from us if you have requested information from us or purchased goods or services from us and, in each case, you have not opted out of receiving that marketing. You will also receive marketing communications from us if you have provided us with your details when you entered a competition or registered for a promotion and gave us your consent as part of that process.

THIRD-PARTY MARKETING

We will get your express opt-in consent before we share your personal data with any other company for marketing purposes.

OPTING OUT

You can ask us or third parties to stop sending you marketing messages at any time by following the opt-out links on any marketing message sent to you or by contacting us. Opting out of marketing messages will not prevent you receiving non-marketing messages from us, for example relating to products ordered from us, responses to customer service queries etc.

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal data without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

 

6. DISCLOSURES OF YOUR PERSONAL DATA

We may have to share your personal data with the parties set out below for the purposes set out in the table in Paragraph 5 above.

• External Third Parties as set out in the Glossary.
• Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

 

7. INTERNATIONAL TRANSFERS

For UK and EU customers, some of our external third parties are based outside the UK and European Economic Area (EEA), including the United States and Canada, so their processing of your personal data will involve a transfer of data outside the EEA.

Whenever we transfer your personal data out of the UK and EEA, we ensure a similar degree of protection is afforded to it by ensuring at least one of the following safeguards is implemented:

• We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK or the European Commission. For further details, see https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en#:~:text=Adequacy%20decisions-,Adequacy%20decisions,adequate%20level%20of%20data%20protection.&text=The%20European%20Commission%20has%20the,adequate%20level%20of%20data%20protection. 
  
• Where we use certain service providers, we may use specific contracts approved by the European Commission which give personal data the same protection it has in Europe. For further details, see https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en.  
• For United States customers, some of our external third parties are based outside the United States, so their processing of your personal data will involve a transfer of data outside the United States. Whenever we transfer your personal data to countries outside of the United States, we ensure appropriate safeguards are in place to help protect your information and maintain a level of protection as required under applicable data laws. We only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the UK or the European Commission, thereby ensuring that personal data is given the same or greater protection it has in the United States. For further details, see https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en#:~:text=Adequacy%20decisions-,Adequacy%20decisions,adequate%20level%20of%20data%20protection.&text=The%20European%20Commission%20has%20the,adequate%20level%20of%20data%20protection.

Please contact us if you want further information on the specific mechanism used by us when transferring your personal data out of the UK, EEA or the United States.

8. DATA SECURITY

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

 

9. DATA RETENTION

HOW LONG WILL YOU USE MY PERSONAL DATA FOR?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our customers (including Contact, Identity, Financial and Transaction Data) for six years after they cease being customers for tax purposes. We also keep this basic information about our customers for a maximum of seven years following your most recent purchase from us, or to enable us to deal efficiently with any after-sales queries that you may have. We keep customer profile information that you have indicated you are happy for us to have in order to keep you up to date regarding our products, services and events, and will keep this information until such time as you indicate you no longer wish us to keep this data, or for seven years following your most recent active interaction with us (e.g. opening or clicking on an email we send you), whichever of these two is shorter.

In some circumstances you can ask us to delete your data: see [Request erasure] below for further information.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

 

10. YOUR LEGAL RIGHTS

Under certain circumstances, you have rights under data protection laws in relation to your personal data:

• Request access to your personal data.
  
• Request correction of your personal data.
  
• Request erasure of your personal data.
  
• Object to processing of your personal data.
  
• Request restriction of processing your personal data.
  
• Right to opt-out of automated profiling of your personal data.
  
• Request transfer of your personal data.
  
• Right to withdraw consent.

To find out more about these rights, please see the section on "Your Legal Rights" at Paragraph 12 below.

If you wish to exercise any of the rights set out above, please contact us as dataprivacy@sunspel.com.

NO FEE USUALLY REQUIRED

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we may refuse to comply with your request in these circumstances.

WHAT WE MAY NEED FROM YOU

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

TIME LIMIT TO RESPOND

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

 

11. UNITED STATES SECTION

If you are a citizen of the United States accessing this website, in addition to the information referenced above in the privacy policy, please review this United States Privacy Section (“US Privacy Section”). As a reminder, by accessing, interacting with and/or using this website, you agree to all the terms of this policy, including this US Privacy Section. If you are a United States Citizen (“US Citizen”), Paragraph 10 of the privacy policy is not applicable to your use and or/rights concerning your data and this website except as specified below.

If you are a resident of California, please also see our Supplemental California Privacy Notice at Subparagraph F of this Section below.

A. DATA WE COLLECT ABOUT UNITED STATES CITIZENS

Sunspel collects the same personal information about United States Citizens as citizens of other jurisdictions. For more information, see Paragraph 2 above.

B.  HOW IS YOUR PERSONAL DATA COLLECTED?

Sunspel uses the same technology to collect personal information about United States Citizens as citizens of other jurisdictions, including automated technologies. For more information, see Paragraph 3 and 10.

C. HOW DOES SUNSPEL USE UNITED STATES CITIZEN’S PERSONAL DATA?

In addition to those purposes set out in Paragraph 5, We may use your personal data for the following purposes:

• To fulfil any other purpose for which you provide it.
  
• To carry out our obligations and enforce our rights arising from any contracts entered into between you and us, including for billing and collection.
  
• To allow you to participate in interactive features on our website.
  
• To strengthen the customer relationship, which may include marketing and direct mail.
  
• Detect, prevent and otherwise address fraud, abuse, security or technical issues with our website
  
• Maintain and improve the integrity of our computing systems and protect users’ data.
  
• Enforce legal claims, including investigation of potential violations of the applicable Terms of Use.
  
• In any other way we may describe when you provide the information.
  
• For any other purpose with your consent.

PROMOTIONAL COMMUNICATIONS

United States Citizens may opt-out of promotional and marketing communications in the same manner as described in Paragraph 4. This includes emailing dataprivacy@sunspel.com or customerservice@sunspel.com, or clicking ‘unsubscribe’ in any of the marketing emails we send to you.

Opting out of marketing messages will not prevent you from receiving non-marketing messages from us, for example, relating to products ordered from us, responses to customer service queries etc.

DISCLOSURE OF YOUR INFORMATION FOR THIRD-PARTY ADVERTISING (INCLUDING ONLINE BEHAVIORAL ADVERTISING):

Sunspel collects data for online behavioural advertising purposes. Sunspel then discloses this information to third parties for advertising purposes. We may work with third parties, such as network advertisers and ad exchanges that use tracking technologies on our websites in order to provide tailored advertisements on our behalf and/or on behalf of other advertisers across the Internet and we may use third party analytics providers to evaluate and provide us and/or third parties with information about the use of these ads on third party sites and viewing of ads and of our content. Network advertisers are third parties that display advertisements, which may be based on your activities (including past visits to our websites) across the Internet and mobile media ("Targeted Advertising").  Targeted Advertising (also known as Behavioural Ads) uses information collected on an individual's web browsing behaviour on one website (such as the pages they have visited or the searches they have made) in order to target advertising to that individual on another website. Targeting called Cross Device Tracking can also take place across devices such as tablets, smartphones, laptops and smart televisions. Third parties collect this information by placing or accessing cookies, or other tracking technologies, in your browser when you visit this, or other, websites. 

Statements regarding our practices do not apply to the methods for collecting information used by these third parties or the use of the information that such third parties collect. We make no representations regarding the policies or practices of third-party advertisers or advertising networks or exchanges or related third parties. 

While sites use a variety of companies to serve advertisements, you may wish to visit https://thenai.org/how-to-opt-out/ which provides information regarding this practice by Network Advertising Initiative ("NAI") members, and your choices regarding having this information used by these companies, including the "opt-out" procedures of NAI members. Opting out of one or more NAI members only means that those NAI members will no longer receive any targeted content and/or ads.  You may also opt-out of sharing your personal data with unaffiliated or non-agent third parties by logging into our website and adjusting your preferences in your account profile, by (i) calling us on +1 (866) 330-1950; (ii) sending us an email with your request to dataprivacy@sunspel.com; or (iii) by following this link to the Digital Advertising Alliance’s (DAA) WebChoices Tool.

By exercising your right to choose, your choice will stop the collection and transfer of data from the browser from which the choice is exercised, and on any browsers or devices associated with that browser.  Please note, if your browsers are configured to reject cookies when you visit an opt-out page, or you subsequently erase your cookies, use multiple devices or change web browsers, your opt-out may not, or may no longer, be effective. We are not responsible for effectiveness of or compliance with any third parties' opt-out options or programs. Additional options for opting out of target advertising include, without limitation:

• Facebook - https://www.facebook.com/settings/?tab=ads
  
• Twitter/X - https://help.twitter.com/en/safety-and-security/privacy-controls-for-tailored-ads  
  
• Google - https://www.google.com/settings/ads/anonymous  
  
• Bing - https://advertise.bingads.microsoft.com/en-us/resources/policies/personalized-ads  
  
• Digital Advertising Alliance - http://optout.aboutads.info/ 
  
• Digital Advertising Alliance’s Canadian page: https://youradchoices.ca/en/tools  
  
• iPhone, iPad or Android mobile devices - You may have the ability to change your device settings to control whether you see online interest-based ads. 

Sunspel adheres to the DAA Principles concerning consumers’ right to opt-out of online behavioral advertising.

NEVADA RESIDENTS:

Nevada residents who wish to exercise their sale opt-out rights under Nevada Revised Statutes Chapter 603A may submit a request to this designated address: dataprivacy@sunspel.com.

CALIFORNIA RESIDENTS:

California residents may have additional personal data rights and choices. Please see Paragraph F: California Privacy Rights Section for more information.

D. WHY WE COLLECT YOUR PERSONAL DATA

As outlined above, most of the personal data we collect is provided to us directly by you so that we can bring our services and products to you. Your personal data is collected for our legitimate business interests or those of our service providers as outlined below:

• To allow the performance of services we provide throughout our platforms.
• To make sure we can keep in touch with you to provide these services.
  
• To allow us to be efficient so that we can deliver the best services possible.
  
• To prevent and detect criminal and/or fraudulent activity that would be damaging to you and/or us.
  
• To promote our business to new and existing customers.

We (and our service providers) may share your personal data in the following situations:

• With website providers: We may share your personal data with website providers to monitor and analyze the use of our website.
  
• With service providers: We may share your personal data with service providers to help us deliver our services to you.
  
• For business transfers: We may share or transfer your personal data in connection with, or during negotiations of, any merger, sale of our company assets, financing, or acquisition of all or a portion of our business by another company.
  
• With affiliates:  We may share your personal data with our affiliates. 
  
• With business partners:  We may share your personal data with our business partners to offer you certain products, websites, or promotions.
  
• With third party vendors:  We may share your personal data with third party vendors to provide behavioral remarketing or advertising services.

E. DISCLOSURE OF YOUR PERSONAL DATA

We may have to share your personal data with parties as set out in the Glossary and as below:

LAW ENFORCEMENT

We may disclose your personal data if we are required by law to do so or in response to legitimate requests of public authorities (e.g., a court or government agency).

DISCLOSURE THROUGH BUSINESS TRANSFERS

We may buy, merge, or partner with another company or business, and in doing so acquire or transfer personal data.  Personal data collected through the websites may be among the transferred business assets.  In the event of an acquisition or merger, your personal data may be transferred so that we may continue to sell products to you.  In the course of such a transaction your personal data would likely be considered a business asset, and, notwithstanding limitations imposed by applicable data privacy legislation, you hereby agree to such a transfer.

OTHER REASONS FOR DISCLOSURE

We may disclose your personal data in the good faith belief that such action is necessary to:

• Comply with a legal obligation.
  
• Protect and defend the rights of Sunspel.
  
• Prevent or investigate possible wrongdoing in connection with the services.
  
• Protect the personal safety of users of the services or the public.
  
• Protect against legal liability.

THIRD-PARTY SERVICE PROVIDERS

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. In general, the third-party providers used by us will only collect, use and disclose your personal data to the extent necessary to allow them to perform the services they provide to us or in accordance with our agreement. The following are some examples of our use of third-party service providers:

• Service providers, including Shopify, acting as processors who provide IT and system administration services.
  
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
  
• Regulators and other authorities acting as processors or joint controllers who require reporting of processing activities in certain circumstances.
  
• Customer service call, email, webchat, display advertising and website behavioural service providers, acting as processors.
  
• Payment gateways and other payment transaction processors.
  
• E-marketing firms that assist us with the administration of our website, promotional newsletters and emails, which helps us understand what our customers want and need from our service, including analysis of the results of particular surveys we may perform.
  
• Outside shipping companies to deliver your product orders.
  
• Third party advertising services.
  
• Data aggregators.

However, some third-party service providers have their own privacy policies with respect to the information we are required to provide to them for your purchase-related transactions.  For these providers, we recommend that you read their privacy policies to learn about the manner in which your personal data will be handled by these providers.

In particular, remember that certain providers may be located in or have facilities that are located in a different jurisdiction than either you or us.  If you elect to proceed with a transaction that involves the services of a third-party service provider, your personal data may become subject to the laws of the jurisdiction(s) in which that service provider or its facilities are located.

Once you leave our website and are redirected to a third-party website or application, including through the use of links as described below, you are no longer governed by this privacy policy or our Terms & Conditions.  Sunspel is not responsible for, and expressly disclaims all liability of any kind whatsoever arising out of, in connection with, related to and/or resulting from any products, services, or information offered or provided by third-party service providers, or any of the activities of third-party service providers.  Sunspel makes no warranty, express or implied, or guarantee regarding any third-party service providers, or any products, services or information offered or provided by third-party service providers, or any activities of third-party service providers.

AGE OF CONSENT

This website is not intended for use by those under the age of 18, nor is it targeted to those under the age of 18. If you use the website, you hereby represent and warrant that you are at least 18 years of age. No one under the age of 18 may provide any information to or on the website. We do not knowingly collect personal data from those under the age of 18, nor do we knowingly sell or otherwise disclose the personal data of those under the age of 18. If you are under the age of 18, do not (i) use or provide any information on the website or through any of its features, (ii) use any of the interactive or fillable features of the website, or (iii) provide any information about yourself to us, including your name, address, telephone address, e-mail address or any other information that could be used to identify you. In compliance with the Children’s Online Privacy Protection Act, any information we receive from users we believe to be under the age of 18 will be purged from our database.

F.  CALIFORNIA PRIVACY RIGHTS SECTION

If you are a California resident, you have certain data protection rights. This Addendum supplements the information contained in the United States Privacy Policy above, and applies solely to all visitors, users, and others who reside in the state of California. Under the California Consumer Privacy Act of 2018 (CCPA) and California Civil Code § 1798.83, you have the right to exercise the certain rights outlines below.  

1.    INFORMATION WE COLLECT
Our website has collected the following categories of personal information from consumers within the last twelve months.

Category	We Collected such Personal Information for the Following Purpose
Identifiers such as name, mailing address, phone number, IP address, email address, and account name	We may use this information for any of the purposes described in Paragraph 5 above
Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)) including name, address, telephone number and credit card number	We may use this information for any of the purposes described in Paragraph 5 above
Protected classification characteristics under California or federal law including gender identity	We may use this information for any of the purposes described in Paragraph 5 above
Commercial information including records of products purchased	We may use this information for any of the purposes described in Paragraph 5 above and to optimize your shipping experience with us
Biometric information.	No
Internet or other similar network activity including browsing history, how you use our website, information collected by cookies and your preferences	We use this information for any of the purposes described in Paragraph 5 above and to support reporting and marketing purposes
Geolocation data	We use this to determine your IP-based location.
Sensory data	No
Professional or employment-related information	No
Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	No
Inferences drawn from other personal information	Some of our tools (e.g., Ometria, Meta Pixel, Google Analytics) build inferred profiles for targeting and personalisation.

 

Over the past twelve months, we may have disclosed the categories of Personal Information listed above as necessary to fulfil our business purposes. Such disclosures include sharing such information with payment gateways and other payment transaction processors, outside shipping companies, and e-marketing and advertising services.

We may also share your Personal Information, including the categories of information in the chart above, by ‘sharing’ / ‘selling’ it with/to third parties as defined under CCPA, subject to your right to opt-out. Sharing Personal Information does not include information about individuals we know are under the age of 16. In the preceding twelve months, Sunspel has not sold any Personal Information about California residents. However, moving forward, Sunspel may share / sell the above categories of Personal Information to the following types of third parties:

• Internet Cookie Data Recipients: We work with one or more third party that may place cookies on your computer to receive information about traffic to our website, browsing and purchasing activity on our online services. These third parties may collect information about individuals’ internet or other similar network activity and browsing patterns, IP address, page interaction and information obtained via cookies with these third parties and may retain rights to use some of this information for their own purposes.  You may opt-out of the sharing of your personal information with third parties pursuant to Section 11(c) above.
• Data Aggregators: We work with one or more third parties to administer and analyze the effectiveness of our advertising or promotional campaigns, to reach out to new customers, to improve our marketing and grow our business.  You may opt out of the sharing of your personal information with third parties pursuant to Section 11(c) above.

If you would like to opt-out of the sale of your Personal Information, please see Paragraph 2(a)below.

2.    CCPA RIGHTS
California residents have the following rights:

a)    Right to Opt-Out of the Sale of Personal Information and Opt-In Rights: 
If you are age 16 or older, you have the right to direct us to not sell your Personal Information at any time (the "right to opt-out"). We do not sell the Personal Information of consumers we actually know are less than 16 years old, unless we receive affirmative authorization (the "right to opt-in") from either the consumer who is between 13 and 15 years old, or the parent or guardian of a consumer less than 13 years old. Consumers who opt-in to Personal Information sales may opt-out of future sales at any time.

To exercise the right to opt-out, you (or your authorized representative) may submit a request to us emailing us at dataprivacy@sunspel.com or calling +1 (866) 330-1950.

Once you make an opt-out request, we will wait at least twelve months before asking you to reauthorize Personal Information sales. However, you may change your mind and opt back into Personal Information sales at any time by emailing us at dataprivacy@sunspel.com or calling +1 (866) 330-1950.

You do not need to create an account with us to exercise your opt-out rights. We will only use Personal Information provided in an opt-out request to review and comply with the request.

b)    Right to Know and Data Portability:
You have the right to request that we disclose certain information to you about our collection and use of your personal data over the past twelve months (the "right to know"). Once we receive your request and confirm your identity, we will disclose to you:

• The categories of Personal Information we collected about you.
  
• The categories of sources for the Personal Information we collected about you.
  
• Our business or commercial purpose for collecting or selling that Personal Information.
  
• The categories of third parties with whom we share that Personal Information.
  
• If we sold or disclosed your Personal Information for a business purpose, two separate lists disclosing:
  • sales, identifying the Personal Information categories that each category of recipient purchased; and
    
  • disclosures for a business purpose, identifying the Personal Information categories that each category of recipient obtained.
    
• The specific pieces of Personal Information we collected about you (also called a data portability request).

c)    Right to Delete:
Subject to certain exceptions set out below, upon receipt of a verifiable request from you, we will:

• Delete or deidentify your Personal Information from our records; and
  
• Direct any service providers to delete your Personal Information from their records.

Please note that we may not delete your Personal Information if it is necessary to:

• Complete the transaction for which your Personal Information was collected, fulfill the terms of a written warranty or product recall conducted in accordance with federal law, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between us and you.
  
• Detect and protect against security incidents, fraudulent or illegal activity, or for prosecuting those responsible for such activity.
  
• Debug, identify, or repair errors that impair existing functionality.
  
• Exercise free speech.
  
• Comply with the California Electronic Communications Privacy Act.
  
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all applicable ethics and privacy laws.
  
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
  
• Comply with an existing legal obligation.
  
• Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

If we deny your request, you may appeal our decision by contacting us via this form. If you have concerns about the results of an appeal, you may contact the attorney general in the state where you reside.

d)    Right to Not be Discriminated Against:
You have the right not to be discriminated against by us because you exercised any of your rights under the CCPA.  This means we cannot:

• Deny goods or services to you; or
  
• Provide a different level or quality of services to you.

Please note that we may charge a different price or rate to you if that difference is reasonably related to the value provided to us by your Personal Information.

e)    Exercising Your Rights:
To exercise your rights to under CCPA, please submit a request by either:
Calling us at +1 (866) 330-1950
Emailing us at dataprivacy@sunspel.com

You may only submit a request to know twice within a 12-month period. Your request under CCPA must:

• provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information or an authorized representative.
  
• Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

We may ask you to provide certain information to verify your identity. We will only use Personal Information provided in the request to verify the requestor's identity or authority to make it. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information relates to you.

If you have an account with us, we will deliver our written response to that account. If you do not have an account with us, we will deliver our written response by mail or electronically, at your option.

Any disclosures we provide will only cover the 12-month period preceding our receipt of your request. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your Personal Information that is readily useable and should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

If you reside in California, you can designate an authorized agent to submit an access, deletion, or correction request on your behalf. We may ask authorized agents to submit proof of their authority to make a request, such as a valid power of attorney or proof that they have signed permission from the consumer who is the subject of the request. In some cases, we may be required to contact the individual who is the subject of the request to verify his or her own identity or confirm the authorized agent has permission to submit the request. If you are an authorized agent seeking to make an access, correction, or deletion request on behalf of a California resident, please fill out this form.

CALIFORNIA’S SHINE THE LIGHT LAW

In addition to CCPA, California Civil Code § 1798.83 permits users that are residents of California to request the following information regarding our disclosure of your Personal Information to third parties for those third parties’ direct marketing purposes: (i) a list of certain categories of Personal Information that we have disclosed to certain third parties for their direct marketing purposes during the immediately preceding calendar year; (ii) the identity of certain third parties that received Personal Information from us for their direct marketing purposes during that calendar year; and (iii) where the nature of the third parties’ business is not reasonably determinable, examples of the products or services marketed (if we have that information). If you are a California resident and would like to make such a request, please email us at dataprivacy@sunspel.com.

“DO NOT TRACK” POLICY AS REQUIRED BY CALIFORNIA ONLINE PRIVACY PROTECTION ACT (CALOPPA)

The Services does not respond to, or support Do Not Track (“DNT”) signals.

Do Not Track is a preference you can set in your web browser to inform websites you do not want to be tracked.  You can enable or disable DNT by visiting the preferences or settings page of your web browser.

CHANGES TO OUR CALIFORNIA ADDENDUM

We reserve the right to amend this California Addendum at our discretion and at any time. When we make changes to this privacy policy, we will post the updated notice on the website and update the notice's effective date. Your continued use of our website following the posting of changes constitutes your acceptance of such changes.

If you would like to access, correct, amend or delete any Personal Information we have about you, register a complaint, or simply want more information, please contact our Privacy Compliance Officer at the below:

Email: dataprivacy@sunspel.com
Phone: +1 (866) 330-1950.

 

12. GLOSSARY 

LAWFUL BASIS

Legitimate Interest means the interest of our business in conducting and managing our business to enable us to give you the best service/product and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. We do not use your personal data for activities where our interests are overridden by the impact on you (unless we have your consent or are otherwise required or permitted to by law). You can obtain further information about how we assess our legitimate interests against any potential impact on you in respect of specific activities by contacting us.

Performance of Contract means processing your data where it is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into such a contract.

Comply with a legal or regulatory obligation means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.

Consent means you have explicitly given us permission to process your personal data. In such circumstances we will have asked you a specific question and you will have entered information or ticked a tick-box to indicate your consent.

EXTERNAL THIRD PARTIES

• Service providers, including Shopify, acting as processors who provide IT and system administration services.
  
• Professional advisers acting as processors or joint controllers including lawyers, bankers, auditors and insurers who provide consultancy, banking, legal, insurance and accounting services.
  
• HM Revenue & Customs, regulators and other authorities acting as processors or joint controllers who require reporting of processing activities in certain circumstances.
  
• Customer service call, email, webchat, display advertising and website behavioural service providers, acting as processors.

YOUR LEGAL RIGHTS

You have the right to:

• Request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.
  
• Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.
  
• Request erasure of your personal data. This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal data where you have successfully exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law. Note, however, that we may not always be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
  
• Object to processing of your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. You also have the right to object where we are processing your personal data for direct marketing purposes. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
  
• Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data in the following scenarios: (a) if you want us to establish the data’s accuracy; (b) where our use of the data is unlawful but you do not want us to erase it; (c) where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. In such circumstances we may reserve the right to delete your personal data rather than hold it but restrict processing, where our processes are not set up to enable a restriction.
  
• Request the transfer of your personal data to you or to a third party. We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you.
  
• Request to opt out of automated profiling of your personal data. You have the legal right to opt-out of any automated profiling of your personal data that could have a legal consequence for you, and have a human being involved in the processing decision rather than it being automated. We undertake this type of profiling in our marketing activities, in which we tailor our marketing communications to your transactional history and product preferences. Additionally, our processor Shopify uses limited automated decision-making to prevent fraud that does not have a legal or otherwise significant effect on you. If you wish to opt-out of this automated profiling please contact us, though please be aware that our systems are not configured to send un-tailored marketing communications to you, so in practice opting out of automated profiling will result in you being opted out of receiving marketing communications from us.
  
• Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.