1

Data Controller Details

2

Category 1: Information You Provide Directly

This is information you actively give us when you use our website or contact our team.

• Identity information: Your first and last name, as provided when creating an account or completing a purchase
• Contact information: Email address, which we use to send order confirmations, shipping updates, and to respond to your inquiries
• Delivery address: Your full shipping address, including street address, apartment or unit number, city, state, ZIP code, and country
• Billing address: The billing address associated with your payment method, used for fraud prevention and payment verification
• Account credentials: If you create an account, your chosen username and encrypted password
• Communications: The content of any messages you send us via email, live chat, or contact forms, including your questions, complaints, and feedback
• Reviews and feedback: Any product reviews, ratings, or other content you choose to submit on our website

Category 2: Payment Information

When you make a purchase, your payment details are required. However, we handle this information with strict security protocols.

• Payment card details: Your card number, expiration date, and security code are entered directly into our PCI-DSS compliant payment processor's secure form. We never see, access, or store your complete payment card number on our servers.
• Payment confirmation data: We receive a transaction confirmation reference and the last four digits of your card from the payment processor, solely for order record-keeping purposes
• PayPal or alternative payment accounts: If you pay via PayPal or another third-party payment method, we receive confirmation of payment from that provider but do not receive your full account credentials or payment details

Category 3: Order and Transaction Information

When you place an order, we record the following information as part of your purchase record:

• The items you purchased, including product names, quantities, prices, and applicable sales tax
• Your order number and order date
• The shipping method selected and associated shipping cost
• The total amount charged to your payment method
• Any discount codes or promotional offers applied to your order

Category 4: Technical and Usage Information

When you visit our website, certain technical information is collected automatically by our systems and third-party tools:

• IP address: Your device's internet protocol address, used for fraud detection, security monitoring, and approximate geographic location (state or country level only)
• Browser and device information: The type of browser you are using, your operating system, device type (desktop, mobile, tablet), and screen resolution
• Browsing behavior on our website: The pages you visit, the products you view, the search terms you use on our website, how long you spend on each page, and the links you click
• Referring source: The website or search engine that directed you to eviesdreamland.com, if applicable
• Cookie data: Information stored in cookies and similar tracking technologies placed on your device. See Section 7 for full details on our cookie use.

3

4

Purpose 1: To Process and Fulfill Your Orders

This is the primary reason we collect your information. Specifically, we use your data to:

• Process and confirm your payment
• Prepare and pack your order for shipment
• Arrange delivery with our shipping carriers and provide your delivery address to them
• Send you an order confirmation email immediately after purchase
• Send you a shipping confirmation email with your tracking number once your order is dispatched
• Calculate, collect, and remit applicable sales tax in accordance with New York state and applicable US tax law

Purpose 2: To Provide Customer Service

We use your contact information and order history to:

• Respond to your questions, complaints, and service requests
• Process returns, exchanges, and refunds in accordance with our Refund Policy
• Assist with order cancellations per our Cancellation Policy
• Resolve disputes and investigate complaints fairly and thoroughly

Purpose 3: To Manage Your Account

If you have created an account with us, we use your information to:

• Maintain your account and keep it secure
• Allow you to view your order history
• Save your shipping address for faster checkout on future orders (only if you choose to save it)
• Send password reset instructions if you request them

Purpose 4: To Improve Our Website and Products

We use aggregated, anonymized technical and usage data to:

• Understand which pages and products are most popular
• Identify technical issues and improve website performance
• Improve the layout and navigation of our website
• Make informed decisions about which products to stock and feature

Purpose 5: To Send Marketing Communications (With Your Consent Only)

We send promotional emails — such as information about new products, special offers, and sale events — only to customers who have expressly opted in to receive them. Specifically:

• We will never add you to a marketing email list without your consent
• Every marketing email we send includes a clear, easy-to-use unsubscribe link
• You can opt out of marketing emails at any time by clicking "Unsubscribe" in any email we send, or by emailing support@eviesdreamland.com
• Opting out of marketing emails does not affect transactional emails — you will still receive order confirmations and shipping notifications

Purpose 6: To Prevent Fraud and Ensure Legal Compliance

• We use technical data, including IP addresses and payment information, to detect and prevent fraudulent transactions and unauthorized account access
• We retain order and billing records as required by United States tax law and accounting regulations
• We may use or disclose your information to comply with a valid legal obligation, court order, or government request

5

Processing Activity	Lawful Basis
Processing and fulfilling your orders	Performance of a contract with you
Sending order and shipping confirmations	Performance of a contract with you
Responding to customer service requests	Performance of a contract; legitimate interest
Fraud prevention and security monitoring	Legitimate business interest; legal obligation
Website analytics and performance improvement	Legitimate business interest
Sending marketing and promotional emails	Your explicit consent (opt-in only)
Tax record-keeping and financial compliance	Legal obligation under US tax law
Responding to lawful government or court requests	Legal obligation

6

Payment Processors

We use PCI-DSS compliant payment processors — such as Shopify Payments and PayPal — to handle all financial transactions. We share your billing information and purchase amount with them solely to authorize and complete your payment. These processors do not use your information for any other purpose, and they maintain their own privacy policies and security standards.

What is shared: Your name, billing address, and purchase total. Your complete payment card details are transmitted directly to the processor and are never stored on our systems.

Shipping and Fulfillment Carriers

To deliver your order, we must share your delivery information with our shipping carriers — such as USPS, UPS, or FedEx. This is the only way your package can be physically delivered to you.

What is shared: Your full name and complete delivery address. We do not share your email address or payment information with shipping carriers.

E-Commerce Platform (Shopify)

Our website is built and hosted on the Shopify platform. Shopify processes order data, stores our product catalog, and manages our checkout system. As our platform provider, Shopify has access to the order and customer data that flows through our store. Shopify is bound by strict data processing agreements and complies with applicable privacy laws.

You can review Shopify's privacy practices at www.shopify.com/legal/privacy.

Email Service Provider

What is shared: Your name and email address are shared with our email service provider solely for the purpose of sending you transactional emails (order confirmations, shipping notifications) and, if you have opted in, promotional emails. Our email provider does not use your information for any independent purpose.

Analytics Providers

We use analytics tools such as Google Analytics to collect aggregated, anonymized data about how visitors use our website. These tools do not receive your name or contact information. The data collected is used exclusively to improve our website's performance and usability. You can opt out of Google Analytics tracking by installing the Google Analytics Opt-Out Browser Add-On.

Disclosure Required by Law

In limited circumstances, we may be required to disclose your personal information to comply with a valid legal obligation — such as a court order, subpoena, or government request. We will comply with such obligations as required by law. Where legally permitted to do so, we will attempt to notify you before disclosing your information in response to such a request.

7

Cookie Type	Purpose	Can You Opt Out?
Strictly Necessary	Required for the website to function — enables your shopping cart, secure checkout, and account login	No — required for basic functionality
Functional / Preference	Remembers your language, currency, and other preferences to personalize your experience	Yes — via browser settings
Analytics	Collects anonymized data on how visitors use our website to help us improve performance and usability	Yes — via browser settings or opt-out tools
Marketing / Advertising	Used to display relevant advertisements on other platforms, such as social media, based on your browsing behavior	Yes — via browser settings or opt-out tools

How to Manage Cookies: You can control and delete cookies through your browser settings. Most modern browsers allow you to block all cookies, block only third-party cookies, or delete cookies after each browsing session. Please note that disabling strictly necessary cookies may cause some features of our website — such as your shopping cart or checkout — to stop working correctly. For full guidance, please read our Cookie Policy.

8

How to Unsubscribe from Marketing Emails

You can unsubscribe from our marketing emails at any time by: (1) clicking the "Unsubscribe" link at the bottom of any marketing email we send, or (2) emailing support@eviesdreamland.com with the subject line "UNSUBSCRIBE." We process all unsubscribe requests within 10 business days as required by the CAN-SPAM Act, and typically much sooner.

9

Our Security Measures

• SSL/TLS Encryption: All data transmitted between your browser and our website is encrypted using industry-standard Secure Socket Layer (SSL) / Transport Layer Security (TLS) technology. You will see "https" and a padlock in your browser's address bar at all times on our website.
• PCI-DSS Compliant Payment Processing: All payment card transactions are processed through payment gateways that are certified to Payment Card Industry Data Security Standard (PCI-DSS) Level 1, the highest level of certification. Your full card number is never transmitted to or stored on our servers.
• Access Controls: Personal data stored in our systems is accessible only to authorized team members who require it to perform their specific job functions. We use role-based access controls and unique login credentials for all team members.
• Secure Hosting: Our website is hosted on Shopify's infrastructure, which maintains enterprise-grade physical and network security, including firewalls, intrusion detection, and regular security audits.
• Data Minimization: We collect only the personal information that is strictly necessary for the purposes described in this policy. We do not collect data speculatively.
• Incident Response: We maintain documented procedures for responding to data security incidents. If a breach occurs that is likely to harm your interests, we will notify you as required by applicable law, including state data breach notification laws.

No Method is 100% Secure: While we implement strong security measures, no method of electronic storage or internet transmission is completely secure. We cannot guarantee absolute security. We encourage you to use a strong, unique password for your account and to notify us immediately at support@eviesdreamland.com if you suspect any unauthorized access to your account.

10

Type of Data	Retention Period	Reason
Order and transaction records	7 years	Required by US federal and state tax law
Customer account information	Duration of account + 2 years after deletion	Customer service and legal compliance
Customer service communications	3 years	Dispute resolution and quality assurance
Marketing email opt-in records	Until opt-out + 3 years	Proof of consent as required by CAN-SPAM
Website analytics data	26 months (anonymized)	Website improvement and trend analysis
Fraud prevention logs	5 years	Security monitoring and legal compliance

11

Our Website Is Not Directed at Children Under 13

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal information from children under the age of 13. Our website is not directed at, designed for, or intended to attract children under 13 years of age.

12

Your Rights at a Glance

How to Exercise Your Rights

To submit a privacy rights request, please email us at support@eviesdreamland.com with the subject line "PRIVACY RIGHTS REQUEST" and include the following:

• Your full name
• The email address associated with your account or orders
• The specific right you are exercising (e.g., access, correction, deletion)
• Any relevant details that will help us locate your records

We will acknowledge your request within 10 business days and provide a substantive response within 45 days as required by applicable law. If we need additional time, we will notify you. We may need to verify your identity before processing your request to protect your privacy and prevent unauthorized access to your data.

13

Categories of Personal Information We Collect (CCPA Disclosure)

In the preceding 12 months, we have collected the following categories of personal information as defined under the CCPA:

• Identifiers: Name, email address, IP address, account username
• Commercial information: Purchase history, products viewed, and transaction records
• Internet or network activity information: Browsing history on our website, pages visited, search queries on our site
• Geolocation data: Approximate geographic location derived from your IP address (state or country level only)
• Financial information: The last four digits of your payment card and billing address (your full card number is not stored by us)
• Inferences: Preferences inferred from your browsing and purchase history, used to personalize your experience

We Do Not Sell Your Personal Information

We do not sell your personal information to third parties as defined under the CCPA. We do not sell personal information for monetary consideration, nor do we disclose it to third parties for targeted advertising purposes in ways that would constitute a "sale" under California law.

However, we provide a formal opt-out mechanism as required by law. To submit a "Do Not Sell or Share My Personal Information" request, please visit our dedicated Do Not Sell My Personal Information page.

Your CCPA / CPRA Rights as a California Resident

• Right to Know: You may request that we disclose the specific pieces and categories of personal information we have collected about you, the sources of that information, our business purposes for collecting it, and the categories of third parties we share it with.
• Right to Delete: You may request deletion of personal information we have collected about you, subject to certain exceptions permitted by law.
• Right to Correct: You may request correction of inaccurate personal information we maintain about you.
• Right to Opt Out of Sale/Sharing: You may opt out of the sale or sharing of your personal information. Submit your request at our Do Not Sell My Personal Information page.
• Right to Limit Use of Sensitive Information: You may request that we limit the use and disclosure of any sensitive personal information to only what is necessary to perform our services.
• Right to Non-Discrimination: We will not discriminate against you in any way for exercising your CCPA/CPRA rights.

Authorized Agent Requests

California residents may designate an authorized agent to submit a CCPA rights request on their behalf. To do so, the authorized agent must provide written proof of their authorization, and we may verify the identity of both the agent and the consumer before processing the request. Please submit authorized agent requests to support@eviesdreamland.com with the subject line "CCPA AUTHORIZED AGENT REQUEST."

14

This Privacy Policy Does Not Apply to External Websites

We have no control over the content, privacy practices, or data collection activities of any external website, even if we link to it. Once you leave our website, your interactions with that external site are governed by that site's own privacy policy and terms of service. We strongly recommend reviewing the privacy policy of any external website before providing personal information. We are not responsible for the privacy practices of any third-party website.

15

How We Notify You of Changes

Date stamp: The "Last Updated" date at the top of this policy is always updated when we make any change. Check this date to confirm you are reading the most current version.

Material changes: For significant changes that affect how we collect or use your personal information, we will post a prominent notice on our website homepage and send an email notification to all registered customers and marketing subscribers. We will provide at least 14 days' notice before material changes take effect.

Minor changes: Typographical corrections and minor clarifications that do not affect the substance of our privacy practices will be updated without advance notice, but the "Last Updated" date will be revised.

Your Continued Use Means Acceptance: By continuing to use our website after any change to this Privacy Policy takes effect, you confirm that you have read and accepted the updated policy. If you do not agree with any change, please stop using our website and contact us to close your account and request deletion of your data.

16

Privacy Contact Information

Additional Privacy Resources

• Cookie Policy — How we use cookies and how to manage your cookie preferences
• California Privacy Disclosure — Full CCPA/CPRA disclosure and opt-out form for California residents
• Do Not Sell My Personal Information — Submit a formal opt-out request
• Terms of Service — The terms governing your use of our website
• Legal Notice — Complete business identity and legal disclosures