PRIVACY POLICY

Last updated January 01, 2025

This Privacy Policy explains how and why Kearla Jewellery ('we,' 'us,' or 'our') accesses, collects, uses, stores, and shares your personal information when you engage with our services (the 'Services'), which include:

• Visiting our website at kearlajewellery.com or any related website that links to this policy.
• Participating in activities such as purchases, marketing campaigns, or events we organise.

If you have any questions or concerns about this policy or how we handle your data, please contact us at support@kearlajewellery.com. By using our Services, you agree to the terms outlined in this policy. If you disagree, please refrain from using our Services.

TABLE OF CONTENTS

1. Information We Collect
2. How We Use Your Information
3. Legal Bases for Processing Your Personal Information
4. Sharing Your Personal Information
5. Use of Cookies and Other Tracking Technologies
6. Social Logins and Information Sharing
7. Your Information and International Transfers
8. Retention of Your Information
9. Protecting Your Information
10. Collection of Data From Minors
11. Your Privacy Rights
12. Controls for Do-Not-Track Features
13. United States Resident's Privacy Rights
14. Privacy Rights in Other Regions
15. Litespeed Cache Usage
16. Updates to This Notice
17. Contacting Us About This Notice
18. Review, Update, or Delete Your Data

1. Information We Collect

Personal Information You Disclose to Us

We collect personal information that you voluntarily provide, such as when you create an account, make a purchase, or communicate with us. This includes:

• Contact details: name, email address, phone number, and mailing address.
• Account details: username and password.
• Payment details: billing address and payment card information.
• Preferences: contact preferences and authentication details.

Sensitive Information: Sensitive information is not collected or processed.

Payment Data: Payment information is collected to process transactions, such as your payment instrument number and associated security code. All payment data is securely managed by our payment processor, Stripe. You can review their privacy policy here.

Social Media Login Data: If you choose to register through social media platforms like Facebook or X, we may collect personal information such as your name and email address, as described in the section called 'Social Logins and Information Sharing'

All personal information you provide must be true, accurate, complete, and up to date, and you must notify us promptly of any changes.

Information Collected Automatically

We gather certain data automatically when you access, use, or navigate our services. This data does not directly identify you (e.g., by name or contact information) but may include technical and usage details such as your IP address, browser type, operating system, language preferences, referring URLs, device type, geographic location, information about your activity within our services, and other technical information. This information is primarily needed to maintain security, optimise functionality, and support analytics and reporting needs.

Like many businesses, we utilise cookies and related technologies to enhance your experience. For further details, refer to our Cookie Policy.

Types of data collected includes:

• Log and Usage Data: This includes service-related, diagnostic, usage and performance details, such as your IP address, device information, browser type, activity logs, timestamps, and device events (e.g., error reports or system activity) recorded by our servers.
• Device Data: This may include information about your device, such as its type, operating system, hardware model, Internet service provider, and unique identifiers like IP addresses or proxy server details.
• Location Data: Depending on your device's settings, we may collect information about your location. This could include using GPS technologies and your IP address to collect geolocation that tells us your general location. You can disable location sharing via your device settings or by refusing access to the information, though you may not be able to use certain aspects of the Services if you do so.

Information from Other Sources

We may obtain limited personal information from public records, marketing affiliates, social media platforms, and other third parties. This data can include mailing addresses, IP addresses, contact details, demographic insights, and social media profiles to improve our records, provide targeted marketing and support promotional campaigns.

If you connect with us through social media, we may receive your account data (e.g., name, email address) as permitted by your social platform's privacy settings. You are encouraged to review and adjust these settings as needed. You have the right to withdraw your consent for the processing of your personal information. Please note that your interaction with social media platforms is governed by their privacy policies, not ours.

Google API Usage

We comply with Google API Services User Data Policy, including adhering to Limited Use requirements, ensuring that any information obtained through Google APIs is used responsibly and securely.

2. How We Use Your Information

We handle your personal data for the following purposes:

• Account Creation and Management: To enable registration, authentication, and the maintenance of your user account.
• Service Delivery: To provide the services you request, process transactions, and respond to inquiries or support needs.
• Order Fulfillment: To manage orders, payments, returns, and exchanges for purchases made via our services.
• User Communication: To facilitate communication between users when utilising features that enable direct interactions.
• Feedback and Improvement: To gather feedback and refine our offerings based on usage trends and user suggestions.
• Marketing and Promotions: To send promotional communications in line with your preferences. You can opt out at any time.
• Security Measures: To protect our services from fraudulent or unauthorised activities and maintain operational integrity.
• Advertising Personalisation: To deliver tailored content and ads based on your preferences and geographic location. For details, refer to our Cookie Policy.
• Usage Analysis: To identify trends in how our services are used and gain insights that help us enhance and improve them.
• Marketing Effectiveness: To assess the impact of our marketing and promotional campaigns, ensuring they remain relevant and aligned with your interests.
• Protection of Vital Interests: To take necessary actions to safeguard an individual’s vital interests, such as preventing harm or addressing emergencies.
• Legal Compliance: To adhere to applicable legal obligations and regulatory requirements.

3. Legal Bases for Processing Your Personal Information

If You Are Located in the EU or UK

Under the General Data Protection Regulation (GDPR) and UK GDPR, we must explain the legal grounds upon which we process your personal information. The following legal bases may apply:

• Consent: We may process your personal data if you have provided explicit consent for a specific purpose. You have the right to withdraw your consent at any time.
• Performance of a Contract: We may process your personal data when we believe it is necessary to fulfill a contract with you, such as providing our services, or to take steps at your request before entering into a contract.
• Legitimate Interests: We may process your personal data when we believe it is necessary to support our legitimate business interests, provided these interests do not outweigh your interests and your fundamental rights and freedoms. Examples include:
• Sending promotional offers and updates about our products or services.
• Developing and delivering personalised advertisements and content tailored to your interests.
• Analysing service usage to improve functionality and enhance user engagement and retainment.
• Supporting marketing and outreach efforts.
• Diagnosing technical issues or preventing fraudulent activities.
• Understanding user behavior to improve the overall experience.
• Legal Obligations: We may process your personal data where we believe it is necessary for compliance with legal requirements, such as responding to law enforcement requests, meeting regulatory obligations, defending against legal claims, or share your information as evidence in legal proceedings involving us.
• Vital Interests: We may process your personal data to protect your vital interests or those of another individual, such as in emergencies where personal safety is at risk.

If You Are Located in Canada

We process your personal information based on your consent, whether expressed explicitly or implied in certain circumstances. You may withdraw your consent at any time.

In some exceptional cases, we may process your information without consent where permitted by applicable laws, such as:

• When it is clearly in the individual’s interests and consent cannot be obtained promptly.
• For fraud detection, prevention, and investigations.
• During business transactions, provided legal conditions are met.
• When it's contained in a witness statement, and the collection is needed to access, process, or settle insurance claims.
• To identify injured, ill or deceased individuals and to communicate with next of kin.
• Where there is a reasonable belief of financial abuse against an individual.
• When obtaining consent could affect the availability or accuracy of the information, and the collection is necessary for purposes related to investigating a breach of an agreement or a violation of the laws of Canada or any province.
• To comply with legal orders, such as subpoenas, warrants, court orders, or court mandates.
• If the information was produced by an individual in the course of their employment, business, or profession and is consistent to its original purpose of collection.
• Soley for journalistic, artistic, or literary purposes.
• When the information is publicly available as specified by the regulations.

4. Sharing Your Personal Information

Vendors, Consultants, and Third-Party Service Providers

We may share your personal information with third-party vendors, service providers, contractors, or agents ('third parties') who perform services on our behalf or assist us with the operation of our business, and need access to such information to do this. These third parties are only given access to the information necessary to complete their tasks and are bound by agreements that require them to protect your personal data. They are prohibited from using your personal information for any other purpose or sharing it with any organisation apart from us, and they are required to safeguard it in accordance with our instructions.

The types of third parties we may share your information with include:

• Website hosting providers
• Social media platforms
• Payment processors
• Financial and accounting services
• Data analytics providers
• Cloud computing services
• Communication and collaboration tools
• Data storage providers
• Government authorities (as required by law)
• Order fulfillment services
• User account registration and authentication services

Other situations in which we may share your information:

• Business Transfers: In the event of a merger, sale of company assets, financing, or acquisition of all or part of our business, your information may be shared or transferred to the involved parties during negotiations or completion of the transaction.
• Interactions With Other Users: If you share information publicly through our services (e.g., by posting reviews or other contributions), it may be visible to all users and could remain publicly accessible outside of our services indefinitely. If you register or log in using a social network (e.g., Facebook), your social network contacts may see your activity, including your profile name and photo. Other users may also view your activity and interact with you within our services.

5. Use of Cookies and Other Tracking Technologies

We use cookies and similar tracking technologies (such as web beacons and pixels) to collect information about how you interact with our services. These technologies serve several purposes, including ensuring the security of our services, preventing technical issues, saving your preferences, and improving overall functionality.

We also allow third parties and service providers to use tracking technologies on our services for purposes such as analytics and advertising. These technologies may enable them to:

• Deliver advertisements tailored to your interests
• Manage and display ads
• Send reminders for abandoned shopping carts (based on your communication preferences)

If such tracking activities are considered a 'sale' or 'sharing' of personal data under applicable laws in the United States (e.g., for targeted advertising purposes), you have the option to opt out. Details on how to exercise this right are provided in the section titled 'United States Resident's Privacy Rights'

Specific Information on Tracking Technologies:

• Cookie Notice: For more details about how we use cookies and how you can control them, please visit our Cookie Policy.
• Google Analytics: We may use Google Analytics to help us understand how users interact with our services. You can opt out of Google Analytics tracking by visiting https://tools.google.com/dlpage/gaoptout. For more information on how Google handles data, please visit their Privacy & Terms page.

6. Social Logins and Information Sharing

When you use social media accounts (e.g., Facebook or X) to access our Services, we may collect certain personal information, including:

• Email address
• Full name
• Social provider identifier
• Access token

This information is securely stored and used exclusively for authentication, account setup, and providing our Services as outlined in this Privacy Notice. The access token is shared only with the respective social media provider to confirm your identity and securely access relevant data.

We recommend reviewing the privacy settings of your social media accounts to understand how they share information with third parties. Personal data collected through social logins is deleted when you delete your account with us.

Additionally, a cookie is generated during the social login process. This cookie is essential for securing the communication process and ensuring smooth redirection back to your previous location on the site. We do not collect telemetry data or utilise third-party tracking technologies, such as scripts, pixels, or embedded iframes.

7. Your Information and International Transfers

Our servers are located in the United Kingdom. If you are accessing our services from outside this region, please be aware that your information may be transferred to, stored in, and processed at our facilities and by third-party service providers with whom we share your personal information (see the 'Sharing Your Personal Information' section). This includes other regions where our partners operate, such as the US and EU.

If you are a resident of the European Economic Area (EEA), United Kingdom (UK), or Switzerland, please note that some of these countries may not provide data protection laws equivalent to those in your country. Nevertheless, we have implemented measures to ensure your personal information is handled in compliance with this Privacy Policy and applicable laws.

European Commission's Standard Contractual Clauses

To safeguard your information, we utilise the European Commission's Standard Contractual Clauses (SCCs) for data transfers involving our group companies and third-party service providers. These clauses legally obligate recipients to protect your personal information originating from the EEA or UK in line with European data protection laws and regulations. Upon request, we can provide additional details about the SCCs and other safeguards we have in place.

8. Retention of Your Information

We store your personal information for the duration needed to fulfill the purposes described in this Privacy Policy. If you close your account, we will delete your information unless laws or regulations (e.g., for tax, accounting, or compliance reasons) require us to retain it for a longer period.

When there is no ongoing legitimate business need to process your personal information, we will either delete or anonymise it. If deletion or anonymisation is not feasible (e.g., due to backup archives), we will securely store the information and prevent it from being further processed until deletion is possible.

9. Protecting Your Information

We have implemented reasonable and appropriate technical and organisational security measures to safeguard the personal information we process. However, no method of electronic transmission over the Internet or information storage technology is entirely secure. While we strive to protect your information, we cannot promise or guarantee complete security against unauthorised access, cyberattacks, or other breaches that allow hackers, cybercriminals, or other unauthorised third parties to collect, access, steal, or modify your information. Please be aware that transmitting personal information to and from our services is done at your own risk. We recommend accessing our services within a secure environment.

10. Collect of Data From Minors

We do not knowingly collect or solicit personal information from anyone under the age of 18, nor do we intentionally market to or sell such data. By using our services, you confirm that you are at least 18 years old, or you are the parent or legal guardian of a minor and provide consent for their use of our services.

If we discover that we have collected personal information from anyone under 18 without proper consent, we will deactivate their account and take reasonable measures to promptly delete their information from our records. If you believe we may have collected information from a minor under 18, please contact us at support@kearlajewellery.com so we can take appropriate action.

11. Your Privacy Rights

In certain regions (e.g., EEA, UK, Switzerland, and Canada), data protection laws provide rights that may include:

• Accessing and obtaining a copy of your personal information.
• Requesting corrections or deletion of your data.
• Restricting the processing of your personal information.
• Exercising the right to data portability, if applicable.
• Not being subject to automated decision-making processes.

In some circumstances, you may have the right to object to the processing of your personal data. To exercise this right, contact us using the details provided in the 'Contacting Us About This Notice' section. We will review and respond to your request in compliance with applicable data protection laws.

If you live in the EEA or UK and believe your data is being unlawfully processed, you can file a complaint with your Member State data protection authority or UK data protection authority. If you live in Switzerland, you may contact the Federal Data Protection and Information Commissioner.

Withdrawing Your Consent

If you have provided consent for us to process your personal data—whether explicit or implied, depending on the applicable law—you can withdraw it at any time by contacting us (see the 'Contacting Us About This Notice' section). Please note, withdrawing consent will not affect the legality of any processing conducted prior to your withdrawal or processing done on lawful grounds other than consent.

Opting Out of Marketing Communications

You can unsubscribe from marketing emails by clicking the unsubscribe link in our emails, replying 'STOP' or 'UNSUBSCRIBE' to our SMS messages, or contacting us directly (see the 'Contacting Us About This Notice' section). While you will be removed from our marketing list, we may still send you important service-related communications, service request responses, or other non-marketing communications.

Managing Your Account

To review, update, or delete your account, contact us using the information provided (see the 'Contacting Us About This Notice' section). Upon request, we will deactivate or delete your account and its data from our active databases. Some data may be retained to comply with legal obligations, troubleshoot problems, assist with investigations, enforce our legal terms, prevent fraud, and/or resolve disputes.

Cookies and Tracking Technologies

Most web browsers accept cookies by default. You can adjust your browser settings to reject or remove cookies, but this may impact the functionality of our services. For more information, see our Cookie Policy.

For additional questions about your privacy rights, you may email us at support@kearlajewellery.com.

12. Controls for Do-Not-Track Features

Most web browsers and some mobile operating systems and mobile applications include a 'Do-Not-Track' (DNT) option to indicate a preference not to have your online browsing activities monitored and collected. Currently, there is no industry-standard method for recognising and implementing DNT signals. Therefore, we do not currently respond to them or any other method that automatically indicates your preference not to be tracked online.

If a standardised tracking technology is adopted in the future, we will update this Privacy Policy to reflect any changes.

California law requires us to disclose how we respond to DNT signals. As there is no accepted standard for recognising or honouring these signals, we do not respond to them at this time.

13. United States Resident's Privacy Rights

States with Specific Privacy Rights

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah, and Virginia may exercise specific rights over their personal information, as outlined by their state laws.

Categories of Personal Information We Collect

The table below summarises the categories of personal information we have collected in the past 12 months, including examples and whether the category has been collected:

We may also collect personal information outside of these categories when you:

• Interact with our customer support.
• Participate in surveys or contests.
• Use our services or contact us directly.

Use and Retention of Personal Information

• Category A and B: Retained as long as you have an account with us.
• Category G and K: Retained for 26 months.

Sources of Personal Information

Learn more about the sources of personal information we collect in 'Information We Collect'

How We Use and Share Personal Information

Learn more about how we use your personal information in the section, 'How We Use Your Information'

Sharing Information with Others

We may share your personal information with our service providers under written agreements between us and each provider. For more details, refer to the section titled 'Sharing Your Personal Information'

We may also use your personal information for our own business purposes, such as for conducting research for technological development and demonstration. This is not considered to be 'selling' of your personal information.

In the last twelve (12) months, we have disclosed the following categories of personal information to third parties for business or commercial purposes:

• Category A. Identifiers
• Category B. Personal Information
• Category G. Geolocation Data
• Category K. Inferences

The categories of third parties to whom this information was disclosed are detailed in the section titled 'Sharing Your Personal Information'

In the last twelve (12) months, the categories of third parties to whom we shared personal information are:

• Data Analytics Services
• Social Media Networks
• User Account Registration & Authentication Services

Your Rights

Under certain state data protection laws in the U.S., you have specific rights regarding your personal information. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law. These rights may include:

• The right to know whether or not we process your personal data
• The right to access your personal data
• The right to correct inaccuracies in your personal data
• The right to request the deletion of your personal data
• The right to obtain a copy of the personal data you provided to us
• The right to opt out of the processing of your personal data for targeted advertising, data sales, or profiling that results in legal or similarly significant effects
• The right to non-discrimination for exercising your data protection rights

Depending on your state of residence, you may also have additional rights, such as:

• The right to access the categories of personal data processed (e.g., under Minnesota’s privacy laws)
• The right to receive a list of the categories of third parties to whom we disclosed data (e.g., under California or Delaware law)
• The right to receive a list of the specific third parties to whom personal data was disclosed (e.g., under Minnesota or Oregon law)
• The right to review, understand, question, and correct how your personal data has been profiled (e.g., under Minnesota law)
• The right to limit the use and disclosure of sensitive data (e.g., under California law)
• The right to opt out of sensitive data collection and personal data collected through the operation of a voice or facial recognition features (e.g., under Florida law)

Exercising Your Rights

To exercise these rights, you can:

• Submit a data access request by emailing us at support@kearlajewellery.com
• Visit https://kearlajewellery.com/contact/
• Use the contact information provided in the 'Contacting Us About This Notice' section

To opt out of the sale or sharing of your data for targeted advertising or profiling, disable cookies in Cookie Preference Settings. We will honour your opt-out preferences if you enable the Global Privacy Control (GPC) signal on your browser.

If permitted by certain US state data protection laws, you may appoint an authorised agent to submit a request on your behalf. However, we may reject requests if the agent does not provide sufficient proof of their valid authorisation, as required by applicable laws.

Request Verification

Upon receiving your request, we will need to verify your identity to ensure that the request relates to the correct individual. We will only use the information provided in your request to confirm your identity or authority to make the request. If we cannot verify your identity using existing information, we may request additional details for verification and fraud prevention.

If a request is submitted by an authorised agent, we may require additional proof of authorisation before processing the request and a signed statement from you permitting the agent to act on your behalf.

Appeals

Under certain US state data protection laws, if we decline to act on your request, you may appeal our decision by emailing support@kearlajewellery.com. We will provide a written explanation of any action taken or not taken. If your appeal is denied, you can file a complaint with your state attorney general.

California 'Shine The Light' Law

Under California Civil Code Section 1798.83, also known as the 'Shine The Light' law, residents of California may request and obtain from us, once a year and at no cost, information about the categories of personal data (if any) we have shared with third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. To make this request, please contact us using the details provided in the 'Contacting Us About This Notice' section.

14. Privacy Rights in Other Regions

Australia and New Zealand

We comply with Australia’s Privacy Act 1988 and New Zealand’s Privacy Act 2020, which outline our responsibilities for collecting, using, and sharing personal information.

This Privacy Notice meets the notice requirements set out in both Privacy Acts, specifically outlining the personal information we collect from you, the sources of this information, the purposes for which it is used, and any other recipients of your personal information.

Please note that declining to provide required personal information may limit our ability to:

• Offer requested products or services.
• Respond to your inquiries.
• Manage your account.
• Verify your identity and protect your account.

You can request access to or correction of your personal information by contacting us by using the contact details provided in the 'Review, Update, or Delete Your Data' section.

If you believe we are unlawfully processing your personal information, you may submit a complaint about the breach of:

• the Australian Privacy Principles to the Office of the Australian Information Commissioner.
• New Zealand's Privacy Principles to the Office of the New Zealand Privacy Commissioner.

Republic of South Africa

You can request access to or correct your personal information at any time by contacting us (see 'Review, Update, or Delete Your Data').

If you are dissatisfied with how we address privacy-related complaints, you may contact:

The Information Regulator (South Africa)

General inquiries: enquiries@inforegulator.org.za

Complaints: PAIAComplaints@inforegulator.org.za or POPIAComplaints@inforegulator.org.za

15. Litespeed Cache Usage

We use caching to improve website performance and provide a better user experience. Cached files are temporary duplicates of web pages displayed on this site. These files are temporary and never shared with third parties, except when technical support is required from the cache plugin provider.

Cache files are stored temporarily and expire according to schedules set by the site administrator. They can also be manually cleared if necessary. We may use QUIC.cloud services to process and temporarily process and cache your data. For more information, see the QUIC.cloud Privacy Policy.

16. Updates to This Notice

We may revise this Privacy Notice periodically. The updated version will be identified by a 'Last updated' date at the top. If there are significant changes, we may notify you either through a prominent notice on our site or by direct communication.

We recommend reviewing this Privacy Notice regularly to stay informed about how we protect your information.

17. Contacting Us About This Notice

If you have any questions or feedback regarding this notice, feel free to email us at: support@kearlajewellery.com. Alternatively, you can fill in the contact form here.

18. Review, Update, or Delete Your Data

Depending on the applicable laws of your country or state of residence in the US, you may have rights to:

• Request access the personal information we have collected from you.
• Request access to details about how your information has been processed.
• Correct any inaccuracies in your personal data.
• Request deletion of your personal information.
• Withdraw your consent to our processing of your data.

These rights may be subject to legal limitations in some circumstances. To request to review, update, or delete your personal data, please fill out and submit a data subject access request via our contact form.