1

Data Controller Details

2

Category 1: Information You Provide Directly

This is information you actively give us when you use our website or contact our team.

• Identity information: Your first and last name, as provided when creating an account or completing a purchase
• Contact information: Email address, which we use to send order confirmations, shipping updates, and to respond to your inquiries
• Delivery address: Your full shipping address, including street address, apartment or unit number, city, state, ZIP code, and country
• Billing address: The billing address associated with your payment method, used for fraud prevention and payment verification
• Account credentials: If you create an account, your chosen username and encrypted password
• Communications: The content of any messages you send us via email, live chat, or contact forms, including your questions, complaints, and feedback
• Reviews and feedback: Any product reviews, ratings, or other content you choose to submit on our website

Category 2: Payment Information

When you make a purchase, your payment details are required. However, we handle this information with strict security protocols.

• Payment card details: Your card number, expiration date, and security code are entered directly into our PCI-DSS compliant payment processor's secure form. We never see, access, or store your complete payment card number on our servers.
• Payment confirmation data: We receive a transaction confirmation reference and the last four digits of your card from the payment processor, solely for order record-keeping purposes
• PayPal or alternative payment accounts: If you pay via PayPal or another third-party payment method, we receive confirmation of payment from that provider but do not receive your full account credentials or payment details

Category 3: Order and Transaction Information

When you place an order, we record the following information as part of your purchase record:

• The items you purchased, including product names, quantities, prices, and applicable sales tax
• Your order number and order date
• The shipping method selected and associated shipping cost
• The total amount charged to your payment method
• Any discount codes or promotional offers applied to your order

Category 4: Technical and Usage Information

When you visit our website, certain technical information is collected automatically by our systems and third-party tools:

• IP address: Your device's internet protocol address, used for fraud detection, security monitoring, and approximate geographic location (state or country level only)
• Browser and device information: The type of browser you are using, your operating system, device type (desktop, mobile, tablet), and screen resolution
• Browsing behavior on our website: The pages you visit, the products you view, the search terms you use on our website, how long you spend on each page, and the links you click
• Referring source: The website or search engine that directed you to eviesdreamland.com, if applicable
• Cookie data: Information stored in cookies and similar tracking technologies placed on your device. See Section 7 for full details on our cookie use.

3

4

Purpose 1: To Process and Fulfill Your Orders

This is the primary reason we collect your information. Specifically, we use your data to:

• Process and confirm your payment
• Prepare and pack your order for shipment
• Arrange delivery with our shipping carriers and provide your delivery address to them
• Send you an order confirmation email immediately after purchase
• Send you a shipping confirmation email with your tracking number once your order is dispatched
• Calculate, collect, and remit applicable sales tax in accordance with New York state and applicable US tax law

Purpose 2: To Provide Customer Service

We use your contact information and order history to:

• Respond to your questions, complaints, and service requests
• Process returns, exchanges, and refunds in accordance with our Refund Policy
• Assist with order cancellations per our Cancellation Policy
• Resolve disputes and investigate complaints fairly and thoroughly

Purpose 3: To Manage Your Account

If you have created an account with us, we use your information to:

• Maintain your account and keep it secure
• Allow you to view your order history
• Save your shipping address for faster checkout on future orders (only if you choose to save it)
• Send password reset instructions if you request them

Purpose 4: To Improve Our Website and Products

We use aggregated, anonymized technical and usage data to:

• Understand which pages and products are most popular
• Identify technical issues and improve website performance
• Improve the layout and navigation of our website
• Make informed decisions about which products to stock and feature

Purpose 5: To Send Marketing Communications (With Your Consent Only)

We send promotional emails — such as information about new products, special offers, and sale events — only to customers who have expressly opted in to receive them. Specifically:

• We will never add you to a marketing email list without your consent
• Every marketing email we send includes a clear, easy-to-use unsubscribe link
• You can opt out of marketing emails at any time by clicking "Unsubscribe" in any email we send, or by emailing support@eviesdreamland.com
• Opting out of marketing emails does not affect transactional emails — you will still receive order confirmations and shipping notifications

Purpose 6: To Prevent Fraud and Ensure Legal Compliance

• We use technical data, including IP addresses and payment information, to detect and prevent fraudulent transactions and unauthorized account access
• We retain order and billing records as required by United States tax law and accounting regulations
• We may use or disclose your information to comply with a valid legal obligation, court order, or government request

5

6

Payment Processors

We use PCI-DSS compliant payment processors — such as Shopify Payments and PayPal — to handle all financial transactions. We share your billing information and purchase amount with them solely to authorize and complete your payment. These processors do not use your information for any other purpose, and they maintain their own privacy policies and security standards.

What is shared: Your name, billing address, and purchase total. Your complete payment card details are transmitted to the applicable payment processor and are not intended to be stored on our systems.

Shipping and Fulfillment Carriers

To deliver your order, we must share your delivery information with our shipping carriers — such as USPS, UPS, or FedEx. This is the only way your package can be physically delivered to you.

What is shared: Your full name and complete delivery address. We do not share your email address or payment information with shipping carriers.

E-Commerce Platform (Shopify)

Our website is built and hosted on the Shopify platform. Shopify processes order data, stores our product catalog, and manages our checkout system. As our platform provider, Shopify has access to the order and customer data that flows through our store. Shopify is bound by strict data processing agreements and complies with applicable privacy laws.

You can review Shopify's privacy practices at www.shopify.com/legal/privacy.

Email Service Provider

What is shared: Your name and email address are shared with our email service provider solely for the purpose of sending you transactional emails (order confirmations, shipping notifications) and, if you have opted in, promotional emails. Our email provider does not use your information for any independent purpose.

Analytics Providers

We use analytics tools such as Google Analytics to collect aggregated, anonymized data about how visitors use our website. Depending on the configuration of our website and the tools in use, analytics and advertising providers may receive device, browsing, or online activity information. We use these tools for analytics, measurement, personalization, and advertising purposes as applicable. You may be able to limit analytics tracking through available browser, device, or provider controls. You can also review Google's available choices using the Google Analytics Opt-Out Browser Add-On.

Disclosure Required by Law

In limited circumstances, we may be required to disclose your personal information to comply with a valid legal obligation — such as a court order, subpoena, or government request. We will comply with such obligations as required by law. Where legally permitted to do so, we will attempt to notify you before disclosing your information in response to such a request.

7

How to Manage Cookies: You can control and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, block only third-party cookies, or delete cookies after each browsing session. Please note that disabling strictly necessary cookies may cause some features of our website — such as your shopping cart or checkout — to stop working correctly. For full guidance, please read our Cookie Policy.

8

How to Unsubscribe from Marketing Emails

You can unsubscribe from our marketing emails at any time by: (1) clicking the "Unsubscribe" link at the bottom of any marketing email we send, or (2) emailing support@eviesdreamland.com with the subject line "UNSUBSCRIBE." We will process unsubscribe requests as required by applicable email-marketing law, generally without unnecessary delay.

9

Our Security Measures

• SSL/TLS Encryption: Our website uses HTTPS and industry-standard transport encryption for data transmitted between your browser and our website. Security indicators such as a padlock may appear in supported browsers.
• PCI-DSS Compliant Payment Processing: Payment card transactions are processed through payment providers that maintain applicable payment-card security standards, including PCI DSS requirements where applicable. Your full card number is never transmitted to or stored on our servers.
• Access Controls: Personal data stored in our systems is accessible only to authorized team members who require it to perform their specific job functions. We use role-based access controls and unique login credentials for all team members.
• Secure Hosting: Our website is hosted on Shopify's infrastructure, which maintains enterprise-grade physical and network security, including firewalls, intrusion detection, and regular security audits.
• Data Minimization: We aim to collect personal information that is reasonably necessary for the purposes described in this policy and applicable business operations.
• Incident Response: We maintain documented procedures for responding to data security incidents. If a breach occurs that is likely to harm your interests, we will notify you as required by applicable law, including state data breach notification laws.

No Method is 100% Secure: While we implement strong security measures, no method of electronic storage or internet transmission is completely secure. We cannot guarantee absolute security. We encourage you to use a strong, unique password for your account and to notify us immediately at support@eviesdreamland.com if you suspect any unauthorized access to your account.

10

11

Our Website Is Not Directed at Children

Evie's Dreamland is a women's fashion and lifestyle store and is not directed at children under 13. We do not knowingly collect personal information from children under 13 through the website.

12

Your Rights at a Glance

How to Exercise Your Rights

To submit a privacy rights request, please email us at support@eviesdreamland.com with the subject line "PRIVACY RIGHTS REQUEST" and include the following:

• Your full name
• The email address associated with your account or orders
• The specific right you are exercising (e.g., access, correction, deletion)
• Any relevant details that will help us locate your records

For requests subject to California privacy law, we will acknowledge receipt within 10 business days and generally respond within 45 calendar days. Where permitted, an additional 45 calendar days may be used when we provide the notice required by law. Other requests will be handled within the timeframe required by the applicable law. We may need to verify your identity before processing your request to protect your privacy and prevent unauthorized access to your data.

13

Categories of Personal Information We Collect (CCPA Disclosure)

In the preceding 12 months, we have collected the following categories of personal information as defined under the CCPA:

• Identifiers: Name, email address, IP address, account username
• Commercial information: Purchase history, products viewed, and transaction records
• Internet or network activity information: Browsing history on our website, pages visited, search queries on our site
• Geolocation data: Approximate geographic location derived from your IP address (state or country level only)
• Financial information: The last four digits of your payment card and billing address (your full card number is not stored by us)
• Inferences: Preferences inferred from your browsing and purchase history, used to personalize your experience

We Do Not Sell Your Personal Information

We do not sell personal information for monetary consideration. Certain disclosures of online activity information for cross-context behavioral advertising may constitute "sharing" under the CCPA even when they do not constitute a sale.

Where required by applicable law, we provide a mechanism to opt out of sale or sharing. To submit a "Do Not Sell or Share My Personal Information" request, please visit our dedicated Do Not Sell My Personal Information page.

Your CCPA / CPRA Rights as a California Resident

• Right to Know: You may request that we disclose the specific pieces and categories of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties we share it with.
• Right to Delete: You may request deletion of personal information we have collected about you, subject to certain exceptions permitted by law.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing: Where applicable, you may opt out of the sale or sharing of your personal information. Submit your request at our Do Not Sell My Personal Information page.
• Right to Limit Use of Sensitive Information: You may request that we limit the use and disclosure of any sensitive personal information to only what is necessary to perform our services.
• Right to Non-Discrimination: We will not discriminate against you in any way for exercising your CCPA/CPRA rights.

Authorized Agent Requests

California residents may designate an authorized agent to submit a CCPA rights request on their behalf. To do so, the authorized agent must provide written proof of their authorization, and we may verify the identity of both the agent and the consumer before processing the request. Please submit authorized agent requests to support@eviesdreamland.com with the subject line "CCPA AUTHORIZED AGENT REQUEST."

14

This Privacy Policy Does Not Apply to External Websites

We have no control over the content, privacy practices, or data collection activities of any external website, even if we link to it. Once you leave our website, your interactions with that external site are governed by that site's own privacy policy and terms of service. We strongly recommend reviewing the privacy policy of any external website before providing personal information. We are not responsible for the privacy practices of any third-party website.

15

How We Notify You of Changes

Date stamp: The "Last Updated" date at the top of this policy is always updated when we make any change. Check this date to confirm you are reading the most current version.

Material changes: For material changes, we may provide a prominent notice on our website or other notice required by applicable law. If advance notice is legally required, we will provide it in the manner and timeframe required.

Minor changes: Typographical corrections and minor clarifications that do not affect the substance of our privacy practices will be updated without advance notice, but the "Last Updated" date will be revised.

Reviewing Updates: We encourage you to review this Privacy Policy periodically. Your continued use of the website after an updated policy is posted does not waive any privacy rights that cannot lawfully be waived. If you have questions about an update, please contact us.

16

Privacy Contact Information

Additional Privacy Resources

• Cookie Policy — How we use cookies and how to manage your cookie preferences
• California Privacy Disclosure — Full CCPA/CPRA disclosure and opt-out form for California residents
• Do Not Sell My Personal Information — Submit a formal opt-out request
• Terms of Service — The terms governing your use of our website
• Legal Notice — Complete business identity and legal disclosures