Please read this privacy policy (“Privacy Policy”) which is part of CAMILLA’s (and the Website’s) terms and conditions (“Terms and Conditions”) carefully. Unless expressly stated to the contrary, any terms defined in the Terms and Conditions shall have the same meaning in this Privacy Policy. This Privacy Policy pertains to your access and use of the Website. The Website is used as part of CAMILLA’s eBoutique which supplies and markets direct to consumer leading high-end fashion and design pieces.

Attention: please read our Privacy Policy carefully before using the Website. Using the Website indicates that you accept and agree to be bound by this Privacy Policy in full. If you do not accept this Privacy Policy, do not use the Website. You acknowledge that (a) you have read and understood this Privacy Policy; and (b) this Privacy Policy shall have the same force and effect as a signed agreement.

YOU ACKNOWLEDGE THAT WE USE SERVICE PROVIDERS AND THIRD-PARTY TECHNOLOGIES, INCLUDING COOKIES, PIXELS, WEB BEACONS, ANALYTICS SERVICES, AND OTHER TECHNOLOGIES THAT TRACK YOUR ACTIVITIES AND COLLECT DATA ABOUT YOU AS YOU NAVIGATE OUR WEBSITE. THESE THIRD PARTIES AND SERVICE PROVIDERS MAY INTERCEPT YOUR COMMUNICATIONS, COLLECT DATA ABOUT YOU, MONITOR YOUR INTERACTIONS WITH THE WEBSITE, TRACK YOUR ACTIVITIES ON OUR WEBSITE AND ACROSS DIFFERENT CHANNELS, AND MAY COLLECT ENOUGH INFORMATION ABOUT YOU AS YOU USE OUR WEBSITE TO BE ABLE TO IDENTIFY YOU ON THEIR OWN PLATFORMS (E.G., SOCIAL MEDIA PIXELS) AND TO DIRECT MARKETING AND ADVERTISEMENTS TO YOU. BY USING THE WEBSITE, YOU SPECIFICALLY CONSENT TO THIS INTERCEPTION, TRACKING AND DATA COLLECTION.

You acknowledge that CAMILLA is a data controller of the personal information (which has the same meaning as ‘personal data’) you provide to us. This means that CAMILLA determines what data and information is collected and how it will be used.

Unless explicitly stated otherwise, any new features that augment or enhance the current Website shall be subject to this Privacy Policy.

Please review this Privacy Policy each time you use the Website. By using the Website, you agree to be bound by the most recent version of the Privacy Policy. If we change or update this Privacy Policy, we will let you know by showing it to you again when you access the Website or you can consult the version references located in the ultimate section of this Privacy Policy to consider whether this Privacy Policy has been updated since your last visit.

INFORMATION WE COLLECT

We and our service providers may collect information from you when you register for or use the Website, purchase and pay for goods or services, contact or interact with us, sign up for our newsletter or other mailing list, fill out a form, apply for a job online, and voluntarily provide us with your comments and other content in connection with using the Website.

When you register for an account on the Website, we and our service providers may collect: your name, your email address, and your password.

When you place an order via the Website, we and our service providers may collect: your name, address, company or business name or identifier, email address, password, telephone number, credit card number, card expiration date, CVV, and other information sufficient for our payment processors to process the transaction and provide fraud screening, information security, and compliance, other account information, and any other information that you provide while registering or placing an order.

When you submit information on our “contact us” form, we and our service providers may collect: your name, email address, telephone number, and any additional information you choose to provide to us as part of your submission.

When you submit a wholesale enquiry, we and our service providers may collect: your name, email address, store name, store number, website and other information about your business.

When you apply for a job through the Website, we may collect: your name, email address, telephone number, and any information you provide through your cover letter, resume or otherwise through the careers section of the Website. If you choose to apply online for a posted job on the Website, please do not include or provide any sensitive or unique identifying details known only to you (such as your GovID identifier, social security number, credit card or bank account numbers, and non-work related personal information such as eye color, marital status, etc.).

When you book a styling appointment, we and our service providers may collect: your name, email address, telephone number, postal code, and any other information you provide in your request.

When you access and use the Website, we and our service providers may automatically collect information regarding you and your device, including your device’s internet protocol address, the domain name of your internet service provider, your location, the URL through which you reached the Website, the Website features you use and the time of your use, your browsing and search history, your mobile device information (e.g. device model and operating system version), information about the products or services that you purchase or consider, information about your product preferences and purchasing trends, geolocation data about you, and aggregated information that cannot be used to specifically identify you. Additional information collected is described in the analytics and cookies sections below.

We may collect information about you from third-party sources. If you apply for a job through the Website, we and our service providers may collect personal information in connection with a background check or employment references. The Website provides connections with Facebook, Instagram, X (formerly Twitter), YouTube, Pinterest and other similar platforms. Through Facebook contests, we and our service providers may collect your name, country and email address.

While it is not ordinary practice for CAMILLA to collect special categories of personal information (also known as sensitive information), if we do collect or process these categories of personal information we will do so for the following reasons:

• Compliance with applicable law - where the processing is required or permitted by applicable law;
• Detection and prevention of crime - where the processing is necessary for the detection or prevention of crime (including the prevention of fraud);
• Establishment, exercise or defence of legal rights - where the processing is necessary for the establishment, exercise or defence of legal rights; or
• Consent - where we have, in accordance with applicable law, obtained your express consent prior to processing your special categories of data or where this has been provided by you during the course of correspondence with us to inform us of any special delivery/assistance requirements or as part of a complaint or grievance procedure or in relation to an accident or incident which has occurred on our premises.

We may combine all of the information we collect from or about you and use it in the manner described in this Privacy Policy.

HOW WE PROCESS PERSONAL INFORMATION AND DATA

What We Use Your Personal Data For	Camilla’s Lawful Basis for Processing	Camilla’s Legitimate Interests
Creating an account	Performance of a contract	n/a
Perform website personalisation	Legitimate Interests	Improving customer experience and interaction with Camilla’s sites
Perform Web Analytics	Legitimate Interests	To improve our understanding of how customers use our website, where we should place different products and what to market to you
Processing your order(s)	Performance of a Contract	n/a
To undertake customer surveys, questionnaires and product reviews or market research	Legitimate Interest	To develop products and services to attract and retain customers
Communicating the status of your order(s)	Legitimate Interest	To review and improve our efficiency in the processing of purchases. To identify improvements to our service. To allow us to notify you about the status of your order.
Changes to our services such as improvements to our website or new services that may be of interest	Legitimate Interest	To improve customer interaction with Camilla’s sites and attract and retain customers. To improve our processes and services.
Marketing and targeted advertisements (including online)	Consent / Legitimate Interest (depending upon the nature of the communication)	To promote our products and services to you. To improve your experience on our site, allow you to transact with our website, and/or to allow targeted advertisements of products and services that may be of interest to you.
Subscriptions (such as to our newsletter)	Consent	n/a
Analytics, Management Information, research, demand planning and forecasting	Legitimate Interest	To help us understand shopping habits and to plan and develop our product ranges. To help us plan our product supply chains and fulfilment of orders. To identify new audiences and campaigns for our products, product development or services.
Providing general customer service (e.g. Dealing with your general enquiries such as product or account or orders, availability of products, returns, replacements, refunds, complaints)	Performance of Contract / Legitimate Interest (depending upon the nature of the communication)	To help us manage your account. To help us improve our customer service processes, products, personal shopping service and to deal with your enquiry. To keep our records up to date.
To fulfil any Data Subject Right Requests (e.g. to correct your data)	Legal compliance	n/a
Marketing communications to provide you with information relating to special offers, promotions or sales.	Consent / Legitimate Interest (depending upon the nature of the communication)	To improve customer interaction with Camilla’s sites and attract and retain customers. To promote our products to you and keep you up to date with exciting news from Camilla.

HOW WE USE YOUR INFORMATION

We use the information that we collect for several purposes, including:

• The purposes for which you provided it;
• To provide information and services to you;
• To process and deliver your orders;
• To provide user verification services;
• To create or add to your registered account;
• To connect with your social media accounts;
• To process and respond to your enquiries and comments;
• To manage our recruiting and hiring process and employment if you are hired by CAMILLA;
• To send you information about your relationship or transactions with us;
• To improve the Website or develop new products and services;
• To personalise and enhance your experience using the Website;
• To send periodic emails. The email address you provide may be used to send you occasional company news, updates, related product or service information, marketing communications etc. Note: if at any time you would like to unsubscribe from receiving future emails, we include detailed unsubscribe instructions at the bottom of each email;
• To generate and review reports and data about our user base and Website usage patterns;
• To analyse the accuracy, effectiveness, usability or popularity of the Website;
• To compile aggregate data for internal and external business purposes;
• To facilitate payment transactions (your information will be used to submit your payment information to our payment processor);
• To display relevant advertising and provide (or enable our service providers to provide) marketing communications;
• To prevent fraud and abuse of the Website and to otherwise protect users and visitors and our business;
• To assist law enforcement and respond to subpoenas;
• To administer, operate and improve the Website and for internal business purposes; and
• To perform other business activities as needed, or as described elsewhere in this Privacy Policy.

As explained elsewhere in this Privacy Policy, personal information we collect may be processed by our partners in providing related services to the Website (such as administration services, marketing and advertising services, technical services relating to the maintenance, servicing, and upgrading of software, hosting services, customer service, credit card processing services, data migration services and analytical services, among others).

HOW YOUR INFORMATION IS DISCLOSED

The information we collect may be disclosed to third parties in accordance with this Privacy Policy. Please note that you may choose not to share certain information as described in your choices regarding your information below.

Third-party service providers and business partners

We may use third-party service providers and business partners to perform functions in connection with the Website, such as credit card and other payment processing, email marketing, logistics, site analytics, customer support, and functions related to analysing and improving the Website’s usefulness, reliability, user experience, operation, advertising, remarketing, storing data, providing users with products and services, accepting and evaluating employment applications, and as otherwise described in this Privacy Policy. We also may share your personal information for their direct marketing and promotional purposes and so they can provide services to you. Any credit card information you provide through the Website may be shared with and may be stored by our credit card processors, Shopify and Stripe, and is subject to their privacy policies, including in the case of data breach (see Shopify, and Stripe for details) and our bank (National Australia Bank) and is subject to its privacy policy, including in the case of data breach (see National Australia Bank).

Some customers may pay through PayPal, Zip Pay, Klarna and Afterpay and their information will be shared with these service providers accordingly. We use remarketing pixels from Facebook and share some of your personal information with it for use in advertising.

You acknowledge and understand that our service providers will be collecting this information about you, and may monitor and intercept your communications and actions on our Website as you browse, interact with or use certain functionality, such as chat features. These service providers may use the information they collect for their own benefit, without any restriction. You specifically agree to this arrangement, and consent to your communications and information being intercepted by our third-party providers.

Some other examples of third-party service providers who we currently use and who may provide services to CAMILLA and, thus, may require us to share your personal information to include (but are not limited to):

• Shopify (eCommerce platform)
• IT service providers (who support our website and business systems)
• NetSuite (an ERP system where all customer data, stock ordering, inventory and sales reporting are stored)
• Australia Post , DHL and Fedex (postal delivery service providers)
• Emarsys (marketing and communication platforms for surveys or electronic marketing messages from us as well as customer relationship management)
• Google Analytics (tracks website traffic, user behaviour, and engagement to provide insights for improving Website performance)
• Google and social media companies including Facebook, Instagram, X (formerly Twitter), YouTube, and Pinterest (for marketing and advertising)
• Hyperspace (provides digital design and development services)
• Starshipit (shipping and order fulfilment platform)
• Lightspeed (POS and payments platform)
• AWS Data Lake (a data storage and analytics service)
• PowerBI (a business analytics tool)

BUSINESS CHANGES

If we become involved in a merger, acquisition, sale of assets, joint venture, securities offering, bankruptcy, reorganisation, liquidation, dissolution, or other transaction or if the ownership of all or substantially all of our business otherwise changes, we may transfer your information to a third party or parties in connection therewith.

AFFILIATES AND AFFILIATE MARKETING

We may also share your information with our affiliates for purposes consistent with this Privacy Policy. Our affiliates will be required to maintain that information in accordance with this Privacy Policy.

We partner with Partnerize who may collect personal information when you interact with our digital property, including IP addresses, digital identifiers, information about your web browsing and how you interact with our properties and ads for a variety of purposes, such as personalisation of offers or advertisements, analytics about how you engage with websites or ads and other commercial purposes. For more information about the collection, use, and sale of your personal data and your rights, please see Partnerize Privacy Statement.

INVESTIGATIONS AND LAW

We may disclose information about you to third parties if we believe that such disclosure is necessary to:

• Comply with the law or guidance and cooperate with government or law enforcement officials or private parties;
• Investigate, prevent or take action regarding suspected illegal activities, suspected fraud, the rights, reputation, safety, and property of us, users or others, or violations of our Terms and Conditions, our policies, or other agreements with us;
• Respond to claims and legal process (for example, subpoenas); and/or
• Protect against legal liability.

AGGREGATED INFORMATION

We may share aggregated information relating to users of the Website with affiliated or unaffiliated third parties. This aggregated information is de-identified and does not contain personal information about any user.

ANALYTICS

We use third-party analytics tools to better understand who is using the Website and how people are using it. These tools may use cookies and other technologies to collect information about your use of the Website and your preferences and activities. These tools collect information sent by your device or the Website and other information that assists us in improving the Website. This information may be used to, among other things, analyse and track data, determine the popularity of certain content, and better understand your online activity. We use Google Analytics to better understand who is using the Website and how people are using it. Google Analytics uses cookies to collect and store information such as Website pages visited, places where users click, time spent on each Website page, internet protocol address, type of operating system used, location-based data, device ID, search history, and phone number. We use this information to improve the Website and as otherwise described in this Privacy Policy. Please see Google Analytics Privacy Policy for information about how Google Analytics uses this information, and visit Google Analytics Opt-Out for information about the Google Analytics opt-out browser add-on. Google may track your activity over time and across websites through remarketing and related services.

COOKIES AND OTHER TRACKING TECHNOLOGIES

We, along with third parties, use cookies, other storage, web beacons and other technologies. These technologies are used for tracking, analytics, remarketing, serving advertisements, and personalisation and optimisation of the Website. Cookies are small files that are transferred to and stored on your computer through your web browser (if you allow it) that enable the Website’s or service provider’s system to recognise your browser and capture and remember certain information. You can instruct your browser to stop accepting cookies. But if you do not accept cookies, you may not be able to use all portions of all functionalities of the Website. By accepting cookies, you acknowledge that:

• Persistent cookies remain on your computer even after the browser has been closed;
• Session cookies exist only during your online session and disappear from your computer when you close the browser software;
• We may deliver advertisements to you. We may work with third-party advertising companies that help deliver these advertisements to you. To learn more about third-party online advertising and to opt out of certain types of advertising, please see NAI Opt-Out. Note that clearing cookies from your browser will remove the above opt-outs because they are stored in cookies;
• Flash cookies (also known as local stored objects) are data files that can be created on your computer by the websites you visit and are a way for websites to store information for later use. Flash cookies are stored in different parts of your computer from ordinary browser cookies. You can disable the storage of flash cookies. For additional information about managing and disabling flash cookies, please visit Adobe Flash Player Settings;
• Web beacons are small strings of code that provide a method for delivering a graphic image on a web page or in an email message for the purpose of transferring data. You can disable the ability of web beacons to capture information by blocking cookies;
• We use cookies and other tracking technologies on the Website to help us understand and save your preferences and interests so we can personalise your future visits and compile aggregate data about Website traffic and Website interaction so that we can offer a better Website experience and tools in the future; and
• Some of our business partners, such as our analytics providers, remarketing providers, advertising networks, and social media connections, also use cookies, web beacons, and other tracking technologies on the Website, some of which may track users across websites and over time.

SECURITY

We implement a variety of security measures intended to protect the safety of your personal information when you enter, submit, or access your personal information. Please keep your account password secure to help ensure the safety of your personal information. Credit card information you provide through the Website is transmitted to our credit card processor, Shopify Payments, and tokenised so we do not retain your complete credit card number.

While we take measures to protect the information you submit via the Website against loss, theft, and unauthorised use, disclosure, or modification, we cannot guarantee its absolute security. Email or other messages sent through the Website may not be secure. You should use caution whenever submitting information through the Website and take special care in deciding which information you provide us.

We cannot guarantee that transmissions of your credit or debit card or personal information will be fully secure and that third parties will never be able to defeat our security measures or the security measures of our payment processors. We assume no liability for disclosure of your information due to transmission errors, third-party access or causes beyond our control.

Any information collected through the Website is stored and processed in Australia and the United States of America. If you use our Website outside of Australia and/or the United States of America, you consent to have your data transferred to the United States and/or Australia (as may be applicable).

DATA RETENTION POLICY, MANAGING YOUR INFORMATION

If we collect your personal information, the length of time we keep it depends on a number of factors including the purpose for which we use that personal information and our legal obligations.

As a minimum, we will store your information for as long as is reasonably necessary to provide you with the goods and services that you have requested from us, but in most cases we will retain your personal data or personal information for seven years, after the date it is no longer needed by us for any of the purposes detailed in this Privacy Policy because we may need your personal information to establish, bring or defend legal claims. The exceptions to this are where:

• The law requires us to hold your personal information for a longer period, or delete it sooner;
• You exercise your right to have your personal information erased (where it applies) and we do not need to hold it in connection with any of the reasons permitted or required under the law;
• We bring or defend a legal claim or other proceedings during the period we retain your personal information, in which case we will retain your personal information until those proceedings have concluded and no further appeals are possible; or
• In limited cases, existing or future law or a court or regulator requires us to keep your personal information for a longer or shorter period.

At the end of the retention period, your information will either be deleted or de-identified/anonymised (so that it can no longer identify you), for example by aggregation with other information or data so that it can be used in a non-identifiable way for research or statistical purposes and business planning, in which case we may use this information indefinitely without further notice to you as it will not be personal data or personal information.

As discussed in this Privacy Policy, third parties may collect, use, and retain your personal information and we have no responsibility for or control over how long such parties may retain your information.

LINKS TO OTHER WEBSITES OR APPLICATIONS

This Privacy Policy applies only to the Website. The Website may contain links to other websites or apps or may forward users to other websites or apps that we may not own or operate and to which this Privacy Policy does not apply. The links from the Website do not imply that we endorse or have reviewed these websites or apps. The policies and procedures we describe here do not apply to these websites or apps. We neither can control nor are responsible for the privacy practices or content of these websites or apps. We suggest contacting these websites or app providers directly for information on their privacy policies. Nonetheless, we seek to protect the integrity of the Website, and welcome any feedback about these linked websites and mobile applications.

YOUR CHOICES REGARDING YOUR INFORMATION

You have choices regarding the use of information by the Website.

Changing your information

To change your information, you may login to your account’s control panel and go to the dashboard page. If you are unable to log into your account, please contact us at online@camilla.com.au.

Closing your account

You may close your account by contacting us at online@camilla.com.au. If the email account associated with your email address is not active, we may close your account without notice.

Information collected from other websites and mobile applications and Do Not Track policy

Your browser or device may offer you a “do not track” option, which allows you to signal to operators of websites, web applications, mobile applications and services (including behavioural advertising services) that you do not wish such operators to track certain aspects of your online activities over time and/or across different websites or applications.

Our Website is configured to honor “do not track” signals as of the date we posted this policy. However, please note that this technology is not well established and browser functionality changes from time to time, and is therefore not foolproof.

CHILDREN

The Website is not intended for use by children (being, individuals who are under the age of 13).

We do not knowingly collect personal information from an individual under age 13. If you are under the age of 13, please do not submit any personal information through the Website. If you have reason to believe that we may have accidentally received personal information from an individual under age 13, please contact us immediately at online@camilla.com.au.

TERMS & CONDITIONS

Please also visit the CAMILLA Website Terms & Conditions which state the terms, disclaimers, and limitations of liability governing your use of the Website.

USA MAINLAND USERS

If you are located in California when you access the Website, please refer to the California-specific section of this Privacy Policy.

UK & EUROPEAN MAINLAND USERS

If you are:

• A resident of the UK, Switzerland or the European Economic Area (EEA) accessing the Website in Australia; or
• Accessing the Website from within the UK, Switzerland or the EEA,

then in addition to our obligations set out in the balance of this Privacy Policy, CAMILLA is required to comply with the applicable provisions of the UK Privacy and Electronic Communications Regulations (PECR), the UK Data Protection Act 2018 (DPA), the Swiss Federal Act on Data Protection (FADP), and the General Data Protection Regulation (GDPR) (as each of those may apply to you).

Pursuant to the PECR, we are permitted to promote our products using electronic marketing messages (e.g., email) to our existing customers and/or those in negotiations with CAMILLA for a sale or service, unless you have asked us not to. If you are not an existing customer, you may consent to us sending you marketing communications by email. You can do this by opting-in or by ‘joining our tribe’ and providing appropriate consent to receive marketing communications.

You will be permitted to opt-out at any time or otherwise ask us not to send you these emails when we first collect your contact details. Note, however, that opting-out or asking us not to send marketing communications will not stop our service communications, such as order updates.

You may withdraw your consent, unsubscribe or object (depending on the lawful basis of processing) to stop receiving these emails at any time.

As discussed in this Privacy Policy, third parties may collect, use, and retain your personal information, including for our and their own marketing and advertising purposes. We neither can control nor are responsible for the privacy practices of these third parties. Please consult such third parties’ privacy policies for more information.

Note, that any reference to ‘personal information’ in this Privacy Policy is also a reference to ‘Personal Data’, as that term is defined in the GDPR and its European equivalents.

Further, you may withdraw your consent to our collection, storage and use of cookies on the Website at any time. The use of cookies on the Website is outlined above in this Privacy Policy for your information. To withdraw your consent to our collection and use of cookies in connection with your use of the Website, please follow the prompts on the Website under the “Do Not Allow Cookies” section.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to make changes to this Privacy Policy from time to time. Any changes to the Privacy Policy will be published on our Website. We encourage you to periodically review the Privacy Policy for the latest information on our privacy practices. This Privacy Policy was last amended in July 2023.

YOUR CALIFORNIA PRIVACY RIGHTS

This section of the Privacy Policy applies solely to California residents.

We adopt this section of the Privacy Policy in order to comply with the California Consumer Privacy Act of 2018 ("CCPA") as amended by the California Privacy Rights Act of 2020 ("CPRA") and thereafter.

Please note that certain terms used in this California-specific section of the Privacy Policy, such as "Personal Information," "Sale," "Share" and "Sensitive Personal Information" have the meanings given to such terms in the CCPA/CPRA, and not the common meanings of these terms in conversational English.

Shine the Light

Section 1798.83 of the California Civil Code permits California residents to request from a business, with whom the California resident has an established business relationship, certain information about the types of personal information the business has shared with third parties for those third parties’ direct marketing purposes and the names and addresses of the third parties with whom the business has shared such information during the immediately preceding calendar year. You may make one request each year by emailing us at online@camilla.com.au or writing to us at CAMILLA, 13 Bowden Street, Alexandria, NSW 2015 Australia.

Do Not Track

Please see “do not track” disclosure set forth in the main body of this Privacy Policy.

Global Privacy Controls

If you choose not to be tracked while visiting our Website, you can visit your browser privacy settings to make the selection, and specifically turn on a “do not track” or activate global privacy control extension to your browser, if available. This will send signals that you wish not to have your information collected as you browse. But note that not all browsers have GPC extensions at this time. Please visit the website for the company that offers your browser to see if they have a GPC extension and to learn how to download it. For example, Mozilla explains how to enable their experimental GPC control here.

Notice of Financial Incentives

As permitted by the CCPA/CPRA, we may offer you certain financial incentives and benefits if you sign up for an account with us. The information that we collect for enrollment in the program allows us to tailor our communications and product suggestions for you. In turn, this helps us establish a stronger relationship with our customers – something we highly value.

When you sign up for an account with us, you provide your email address. We will use your email address to send you communications, promotions, discounts, and suggestions that we think might be of interest to you. This, in turn, may help us generate revenue over time.

We may also monitor your purchases with us, and may, in our discretion, and if you reach certain thresholds, add you as a member of our “VIP Program”. If you are entered into the VIP Program, we will send you an email notifying you that you have achieved this milestone. As a member of the VIP Program, you may receive certain discounts or other incentives from us from time to time. We reserve the right to modify the program or cancel it in our discretion at any time.

Data Collection

We have collected the following categories of Personal Information for the following purposes within the last twelve (12) months:

Category of Personal Information	Categories of Sources of Collection	Business or Commercial Purpose for Collection
A. Identifiers, including: name, email address, postal address, IP address, account name and password, telephone number, and—for employees and job applicants—Social Security number, driver’s license number, passport number, or other similar identifiers.	Business partners, including retailers and distributors Our service providers Our Employees/job applicants Our contractors, including stylists Website users Customers	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel To comply with law To understand our Website traffic, and for Website analytics, functionality and security
B. Personal information categories listed in the California Customer Records statute	Business partners, including retailers and distributors Our service providers Our Employees/job applicants Our contractors, including stylists Website users Customers	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel To comply with law To understand our Website traffic, and for Website analytics, functionality and security
C. Protected classification characteristics under California or federal law.	Employees Job applicants	To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel
D. Commercial information, including: products purchased, obtained, or considered, or other purchasing or consuming histories or tendencies	Customers Prospective customers Business partners, including retailers and distributors	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
E. Biometric information	None	None
F. Internet or other similar network activity	Customers Website users	To provide our products and services and manage our business To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
G. Geolocation data	Customers Prospective customers Website users Employees Job applicants	To provide our products and services and manage our business To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
H. Sensory data	None	None
I. Professional or employment-related information	Business partners Employees Job applicants	To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel
J. Non-public education information	Employees Job applicants	To provide employment opportunities, and administer employee benefits, and for background checks
K. Inferences drawn from other Personal Information	Customers Website users	To provide our products and services and manage our business To improve our products and services To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law
L. Sensitive Personal Information	Customers Employees Job applicants	To provide our products and services and manage our business To offer our Website For security and anti-fraud purposes To provide employment opportunities, and administer employee benefits, and for background checks

We do not knowingly collect any Personal Information of persons under the age of 16.

We allow our service providers, including the following vendors, to control the collection of Personal Information as part of analytics and other services they provide to us. These third parties may use such Personal Information for their own purposes, and we do not control this. Please see the Third-party service providers and business partners section of this Privacy Policy for more information.

California Consumer Rights Pursuant to the CCPA/CPRA

Except where any such disclosures would require us to reveal a trade secret, as a California consumer, you have specific rights regarding how your Personal Information is collected and used:

• You have the right to request that we disclose to you or your authorized agent acting on your behalf the following information covering the past twelve (12) months:
• Categories of Personal Information collected.
• Specific pieces of Personal Information that we have collected.
• Categories of sources from which Personal Information is collected.
• Categories of Personal Information Sold (as this term is defined in the CCPA/CPRA), Shared for cross context behavioral advertising, or disclosed for a business purpose.
• Categories of third parties to whom we Sold, or with whom we Shared or disclosed the Personal Information for a business purpose.
• Our business purpose for collecting (or Selling or Sharing) Personal Information.
• The categories of Sensitive Personal Information to be collected and the purposes for which the categories of Sensitive Personal Information are collected or used and whether such information is Sold or Shared, except for such information that is collected or processed without the purpose of inferring characteristics about you.
• You have the right to request correction of any inaccurate Personal Information that we maintain about you.
• You have the right to request deletion of your Personal Information (with exceptions noted by law – more on this below).
• You have the right to request that your Personal Information not be Sold to or Shared with third parties.
• You have the right not to be discriminated or retaliated against because you exercised these rights.
• You have the right to request that we limit our use and disclosure of your Sensitive Personal Information such that we use such information solely to provide you our services or process your transactions.

Data Deletion

As permitted by the CCPA/CPRA, in the event you request deletion of Personal Information that we have collected about you, we, our service providers, and our contractors may be unable to comply with such a request if your Personal Information is necessary to:

• Complete the transaction for which the Personal Information was collected, provide a good or service requested by you, or reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform a contract between us and you.
• Prevent, detect, and investigate security incidents, protect against malicious deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
• Debug to identify and repair errors that impair existing intended functionality.
• Exercise free speech, ensure the right of another Consumer to exercise his or her right of free speech, or exercise another right provided for by law.
• Comply with the California Electronic Communications Privacy Act pursuant to Chapter 3.6 (commencing with section 1546) of Title 12 of Part 2 of the Penal Code.
• Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when our deletion of that information is likely to render impossible or seriously impair the achievement to such research, if you have provided informed consent.
• Enable solely internal uses that are reasonably aligned with your expectations based on your relationship with us.
• Comply with a legal obligation.
• Otherwise use your Personal Information, internally, in a lawful manner that is compatible with the context in which you provided the information.

Non-Discrimination

We will not discriminate against you or retaliate for exercising any of your CCPA/CPRA rights. Specifically, we will not do any of the following unless permitted by the CCPA/CPRA:

• Deny you goods or services.
• Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties.
• Provide you a different level or quality of goods or services.
• Engage in any retaliatory employment practices.
• Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

However, we may offer you certain financial incentives permitted by the CCPA/CPRA that can result in different prices, rates, or quality levels. Any CCPA/CPRA-permitted financial incentive we offer will reasonably relate to your Personal Information’s value. Participation in a financial incentive program requires your prior opt-in consent, which you may revoke at any time.

Do Not Sell or Share My Personal Information

We use cookies and analytics providers, which may be considered “Sales” under the CCPA/CPRA, but not in exchange for monetary compensation. We also Share Personal Information for cross context behavioral advertising purposes.

As a California consumer, you have the right to opt out of the sale or Sharing of your Personal Information to third parties.

In the twelve (12) months prior to the posting of this Privacy Policy, we have Sold to or Shared with third parties the categories of Personal Information about California residents set forth below, and for the purposes set forth below:

Categories of Personal Information Sold or Shared	Categories of Third Party to Which Personal Information Was Sold	Reason for Selling	Categories of Third Party with Whom Personal Information Was Shared	Reason for Sharing
A. Identifiers, including: name, postal address, phone number, IP address, email address, account name	Our service providers, including: cookies and analytics, marketing partners, and shipping/delivery vendors	To market our products and services To understand our Website traffic, and for Website analytics, functionality and security To improve our products and services To ship and deliver our products	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), including: name, postal address, phone number, IP address, and email address	Our service providers, including: cookies and analytics, marketing partners, and shipping/delivery vendors	To market our products and services To understand our Website traffic, and for Website analytics, functionality and security To improve our products and services To ship and deliver our products	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services
C. Protected classification characteristics under California or federal law	None	N/A	None	N/A
D. Commercial information, including: products purchased, obtained, or considered, or other purchasing or consuming histories or tendencies	Our service providers, including: cookies and analytics, marketing partners, and shipping/delivery vendors	To market our products and services To understand our Website traffic, and for Website analytics, functionality and security To improve our products and services To ship and deliver our products	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services
E. Biometric information	None	N/A	None	N/A
F. Internet or other similar network activity, including: browsing history, search history, information on a user’s interaction with the Website or advertisements, and IP address	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services To understand our Website traffic, and for Website analytics, functionality and security To improve our products and services To ship and deliver our products	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services
G. Geolocation data	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services To understand our Website traffic, and for Website analytics, functionality and security To improve our products and services To ship and deliver our products	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services
H. Sensory data	None	N/A	None	N/A
I. Professional or employment-related information	None	N/A	None	N/A
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99))	None	N/A	None	N/A
K. Inferences drawn from other Personal Information, including: product preferences and purchasing trends	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services To understand our Website traffic, and for Website analytics, functionality and security To improve our products and services To ship and deliver our products	Our service providers, including: cookies and analytics, and marketing partners	To market our products and services
L. Sensitive Personal Information	None	N/A	None	N/A

We do not knowingly Sell or Share any Personal Information of children under the age of 16.

Data Disclosure

In the twelve (12) months prior to the posting of this Privacy Policy, we have disclosed for a business purpose the categories of Personal Information about California residents set forth below, for the reasons set forth below:

Category of Personal Information Disclosed for a Business Purpose	Category of Persons to Whom Personal Information Was Disclosed	Purpose for Disclosing for a Business Purpose
A. Identifiers, including: name, email address, postal address, IP address, account name and password, telephone number and—for employees and job applicants— Social Security number and driver’s license number, passport number, or other similar identifiers.	Our service providers, including: cookies and analytics, marketing partners, shipping/delivery vendors, and support/maintenance Our affiliates and subsidiaries Our business partners, including retailers and distributors Our insurance providers	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel To comply with law To understand our Website traffic, and for Website analytics, functionality and security
B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)), including: name, email address, phone number, postal address, IP address, and—for employees and job applicants— Social Security number and driver’s license number, passport number, or other similar identifiers.	Our service providers, including: cookies and analytics, marketing partners, shipping/delivery vendors, and support/maintenance service providers Our affiliates and subsidiaries Our business partners, including retailers and distributors Our insurance providers	To provide our products and services and manage our business, including to process payments and ship/deliver our products To market our products and services To improve our products and services For research and development To offer employment, to provide insurance and benefits, for background checks To maintain business relationships To understand our Website traffic, and for Website analytics, functionality and security
C. Protected classification characteristics under California or federal law, including: including age, marital status, citizenship, immigration status, and gender.	Our service providers	To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel
D. Commercial information, including: products purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Our service providers, including: cookies and analytics, marketing partners, shipping/delivery vendors, and support/maintenance service providers Our affiliates and subsidiaries Our business partners, including retailers and distributors	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
E. Biometric information.	None	None
F. Internet or other similar network activity, including: browsing history, search history, information on a user’s interaction with the Website or advertisements, and IP address.	Our service providers, including: cookies and analytics, marketing partners, and support/maintenance service providers	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
G. Geolocation data.	Our service providers, including: cookies and analytics, marketing partners, and support/maintenance service providers	To provide our products and services and manage our business, including to process payments and ship/deliver our products To improve our products and services To make our Website available to users To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
H. Sensory data.	None	None
I. Professional or employment-related information, including: —for employees and job applicants—current or past job history.	Our benefits and payroll service providers and partners	To offer employment, to provide insurance and benefits, for background checks, provide training, educational opportunities to our personnel
J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)), including: —for employees and job applicants—educational records, grades, and transcripts.	Our benefits and payroll service providers and partners	To provide employment opportunities, and administer employee benefits, and for background checks
K. Inferences drawn from other Personal Information, including: product preferences and purchasing trends.	Our service providers, including: cookies and analytics and marketing partners Our affiliates and subsidiaries	To provide our products and services and manage our business, including to ship/deliver our products To improve our products and services To identify potential clients To market our products and services For security and anti-fraud purposes To comply with law To understand our Website traffic, and for Website analytics, functionality and security
L. Sensitive Personal Information, including: customer’s login credentials; and —for employees and job applicants—Social Security number, driver’s license number, passport number, or other similar identifiers, citizenship, and immigration status.	Our service providers and partners	To provide our products and services and manage our business To offer our Website For security and anti-fraud purposes To provide employment opportunities, and administer employee benefits, and for background checks

Sensitive Personal Information

As a part of our services, we may collect, Sell and Share Sensitive Personal Information, as set forth above, and use it or Sell/Share it for the purposes described above. You have the right to request that we limit our use and disclosure of your Sensitive Personal Information such that we use such information solely to provide you our services or process your transactions. To exercise this right contact us at online@camilla.com.au.

Data Retention

Please see the “Data Retention Policy, Managing Your Information” disclosure set forth in the main body of this Privacy Policy for more information.

How to Exercise Your CCPA/CPRA Rights

You can exercise all of your rights granted to you pursuant to the CCPA/CPRA by clicking here or contacting us at +1 833 492 9111 or online@camilla.com.au.

California law requires us to verify your identity before processing your request. In order to make a request pursuant to the CCPA/CPRA, you must provide us with your first and last name, email address associated with your account with us, and a transaction number and order details for a recent purchase that you made from us (if applicable). If you are requesting specific pieces of Personal Information that we have collected about you, you will also be required to email us at online@camilla.com.au a signed declaration under penalty of perjury that you are a California resident and that you are the consumer whose Personal Information is the subject of the request. Note that we will not process your request to disclose specific pieces of information we have about you until we receive this signed declaration, and your request will not be considered timely submitted until we have this document in our possession.

We will review the information you have provided against the information in our databases, and attempt to verify your identity. However, please note that under certain circumstances, we may require you to provide additional information in order to allow us to confirm your identity and your residency before we can process your requests. Also note that you are only entitled to make a Personal Information request up to twice in a 12-month period.

If you submit your CCPA/CPRA request by email, please include “California Privacy Rights” as the subject line. If you make a request to exercise your rights under the CCPA/CPRA by telephone, we may ask you to provide the request in writing so that we may verify your identity.

We will acknowledge your request within 10 days and respond to your request within 45 days or let you know if we need additional time or information to verify your identity (and if so, why).

Using an Authorized Agent

A California resident may use an authorized agent to submit a right to know request, a request to delete, a request to correct, a request for us to limit our processing of Sensitive Personal Information, or a request to opt-out of the Sale or Sharing of Personal Information by clicking here. To use an authorized agent for these purposes, both the California resident and their agent will be required to verify their identities with us. For this purpose, the agent will be required to submit a request with their own first and last name, company name, email address, phone number, and their company’s website URL, in addition to the following information about the consumer on whose behalf they are making the request: first and last name, email address associated with your account with us, and a transaction number and order details for a recent purchase that you made from us (if applicable). In addition, the agent will be required to provide via email written authorization from the consumer to act on their behalf in making these requests. If we cannot authenticate the identity of the agent making the request, we may also require that the consumer confirm directly with us that they have in fact authorized their agent to act on their behalf. We may deny a request from an agent who cannot meet these requirements. If the agent has provided us with a validly executed power of attorney pursuant to Cal. Prob. Code Sections 4121 to 4130, then a separate verification that the consumer has authorized the agent to act on their behalf will not be necessary.