Effective as of October 2, 2023.

This “Privacy Policy” describes the privacy practices of Paintoutfit (SMC- Private) Limited in connection with the https://www.paintoutfit.com/ website, any other website or mobile application that we own or control and which posts or links to this Privacy Policy (the “Sites”) as well as our retail stores and related services (together with the Sites, the “Service”), and the rights and choices available to individuals with respect to their information.

PERSONAL INFORMATION WE COLLECT

Personal information you provide to us. Personal information you may provide to us through the Service or otherwise includes:

• Contact data, personal or business contact information such as your first and last name, email and mailing addresses, phone number, professional title, and company name.
• Registration data, such as information that you provide to register for an account or sign up for an event, including the day and month of your birth and the event you registered for.
• Data about others for whom you purchase an item or gift, such as name, delivery address, and phone number. Please do not purchase a gift for someone or share their contact information with us unless you have their permission to do so.
• Profile data, such as your username and password that you may set to establish an online account with us and your interests and preferences.
• Communications, such as information you provide when you contact us with questions, feedback, survey responses, or otherwise correspond with us,
• Marketing data, such as the email address or contact details that we use to send marketing communications and your preferences for receiving communications about our activities, events, sweepstakes, and contests.
• Purchase data, including your order history and information needed to process and fulfill your order, including order details, billing address, and delivery address.
• Other information that we may collect which is not specifically listed here, but which we will use in accordance with this Privacy Policy or as otherwise disclosed at the time of collection.

Data from other sources.

We may also collect information about you from:

• Business partners, such as advertising and joint marketing partners.
• Data providers, such as information services and data licensors.
• Public sources, such as blogs, forums or social media platforms.

Information we obtain from third-party platforms.

If you choose to login to the Sites via a third-party platform, such as Google or Facebook or otherwise connect your account on the third-party platform or network to your account through the Sites, we may collect information from that platform or network. You may also have the opportunity to provide us with additional information via the third-party platform or network, such as a list of your friends or connections and your email address. You can read more about your privacy choices in the “Your Choices” section.

Automatic collection. We and our service providers may automatically log information about you, your computer or mobile device, and your activity occurring on or through the Sites, such as:

• Device data, such as your computer or mobile device operating system type and version number, manufacturer and model, browser type, screen resolution, IP address, the website you visited before browsing our site, and general location information such as city, state, or geographic area.
• Online activity data, such as pages or screens you viewed, how long you spent on a page or screen, navigation paths between pages or screens, information about your activity on a page or screen, access times, and duration of access.

Cookies and similar technologies. Some of our automatic data collection is facilitated by cookies and similar technologies. See our Cookie Policy for more information.

Referrals. Users of the Service may have the opportunity to refer friends or other contacts to us. If you are an existing user, you may only submit a referral if you have permission to provide their contact information to us so that we may contact them.

HOW WE USE YOUR PERSONAL INFORMATION

We use your personal information for the following purposes and as otherwise described in this Privacy Policy or at the time of collection:

Service delivery. We may use your personal information to:

• Provide, operate, and improve the Service, such as to enable you to make purchases of clothing and accessories that we have listed on the Sites;
• Establish and maintain your account on the Service;
• communicate with you about the Service, including by sending you announcements, updates, security alerts, and support and administrative messages;
• Provide customer support and maintenance for the Service;
• Facilitate your login to the Sites via third-party platforms, such as Google and Facebook; and
• Enable security features of the Sites, such as by sending you security codes via email or SMS, and remembering devices from which you have previously logged in.

Direct Marketing. If you are an existing customer of Paintoutfit Studio (for example, if you have placed an order with us), we may use the Personal Data you provided to send you marketing communications about Paintoutfit Studio products or services, where permitted by applicable law (unless you have opted out). In other cases, we ask for your consent to send you marketing information. We may use the information that you provide to us, as well as information from other Paintoutfit Studio products or services, such as your use of Paintoutfit Studio’s website and/or apps, to personalize communications and advertisements regarding our products and services that may be of interest to you. For registered users, this may include data collected from your interactions with our website and/or apps that are associated with your account. You will have the ability to opt-out of our marketing and promotional communications as described in the Your Choices section below.

For research and development. We may use your personal information for research and development purposes, including to analyze and improve the Service and our business.

To create anonymous data. We may create aggregated, de-identified or other anonymous data records from your personal information and other individuals whose personal information we collect. We make personal information into anonymous data by excluding information (such as your name) that makes the data personally identifiable to you. We may use this anonymous data and share it with third parties for our lawful business purposes, including to analyze and improve the Service and promote our business.

Interest-based advertising. We may contract with third-party advertising companies and social media companies to display ads on our Service and other sites. These companies may use cookies and similar technologies to collect information about you (including the device data, online activity data, and/or geolocation data described above) over time across our Service and other sites and services or your interaction with our emails, and use that information to serve ads that they think will interest you. These ads are known as “interest-based advertisements.” You can learn more about your choices for limiting interest-based advertising, in the Your Choices section below and our Cookie Policy

To comply with laws and regulations. We use your personal information as we believe necessary or appropriate to comply with applicable laws, lawful requests, and legal processes, such as responding to subpoenas or requests from government authorities.

For compliance, fraud prevention, and safety. We may use your personal information and disclose it to law enforcement, government authorities, and private parties as we believe necessary or appropriate to (a) protect our, your or others’ rights, privacy, safety or property (including by making and defending legal claims); (b) audit our internal processes for compliance with legal and contractual requirements; (c) enforce the terms and conditions that govern the Service; and (d) protect, investigate and deter against fraudulent, harmful, unauthorized, unethical or illegal activity, including cyber attacks and identity theft.

With your consent. In some cases, we may specifically ask for your consent to collect, use, or share your personal information, such as when required by law.

HOW WE SHARE YOUR PERSONAL INFORMATION

We may share your personal information with the following third parties and as otherwise described in this Privacy Policy or at the time of collection:

Service providers. Companies and individuals that provide services on our behalf or help us operate the Service or our business (such as order fulfillment, shipping, payment processing, customer support, hosting, analytics, email delivery, marketing, database management services, returns processing, and risk and fraud mitigation).

Advertising partners. Third-party advertising companies that collect information about your activity on the Site and other online services to help us advertise our services, and/or use hashed customer lists that we share with them to deliver ads to them and similar users on their platforms.

Third-party platforms. Social media and other third-party platforms that you connect to the Service, such as when you use options to access the Service by logging into a social media platform. Please note, that we do not control the third party’s use of your personal information.

The public. Other users of the Service and the public, when you disclose personal information for public use. For instance, you may be able to review a product that you purchased, and we will display your name along with the content you submit. We do not control how other users or third parties use any personal information that you make available to them. Please be aware that any information you post publicly can be cached, copied, screen captured, or stored elsewhere by others (e.g., search engines) before you have a chance to edit or remove it.

Professional advisors. Professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services that they render to us.

Authorities and others. Law enforcement, government authorities, and private parties, as we believe in good faith are necessary or appropriate to comply with the law or for the compliance, fraud prevention, and safety purposes described above.

Business transferees. We may sell, transfer, or otherwise share some or all of your personal information in connection with or during the negotiation of any merger, financing, acquisition or dissolution, transaction or proceeding involving sale, transfer, divestiture, or disclosure of all or a portion of our business or assets, or in the event of an insolvency, bankruptcy, or receivership.

YOUR CHOICES

In this section, we describe the rights and choices available to all users.

Access or update your account information. If you have registered for an account with us, you may review and update certain personal information in your account profile by logging into the account.

Opt out of marketing communications. You may opt out of marketing-related emails by following the opt-out or unsubscribe instructions located at the bottom of the email. You may continue to receive service-related and other non-marketing emails. If you receive marketing text messages from us, you may opt out of receiving further marketing text messages from us by replying STOP to our marketing message.

Cookies. Most browsers let you remove and/or stop accepting cookies from the websites you visit. To do this, follow the instructions in your browser’s settings. For more details, see the “Your Choices” section of our Cookie Policy.

Advertising Choices. You may opt out of interest-based advertising. See the “Your Choices” section of our Cookie Policy for more information.

Do Not Track. Some Internet browsers may be configured to send “Do Not Track” signals to the online services that you visit. We currently do not respond to “Do Not Track” or similar signals. To find out more about “Do Not Track,” please visit http://www.allaboutdnt.com.

Privacy settings and location data. Users of our website can disable our access to their device’s precise geolocation in their computer/mobile device settings.

Choosing not to share your personal information. If you do not provide information that we need to provide the service, we may not be able to provide you with the Service or certain features. We will tell you what information you must provide to receive the service when we request it.

Third-party platforms or social media networks. If you choose to create an account through or connect the service with another third-party platform, you may have the ability to limit the information that we may obtain from the third party at the time you log in to the service using the third-party’s authentication service or otherwise connect your account. You may also be able to control your settings through the third-party platform or service after you have connected your accounts.

OTHER SITES, MOBILE APPLICATIONS AND SERVICES

The Paintoufit’s website may contain links to other websites and online services operated by third parties. These links are not an endorsement of or representation that we are affiliated with, any third party. In addition, our content may be included on web pages or online services that are not associated with us. We do not control third-party websites or online services, and we are not responsible for their actions. Other websites and services follow different rules regarding the collection, use, and sharing of your personal information. We encourage you to read the privacy policies of the other websites and online services you use.

SECURITY PRACTICES

The security of your personal information is important to us. We employ a number of organizational, technical, and physical safeguards designed to protect the personal information we collect. However, security risk is inherent in all internet and information technologies and we cannot guarantee the security of your personal information.

INTERNATIONAL DATA TRANSFERS

The Paintoutfit is headquartered in the Khyber Pakhtunkhwa province of Pakistan and may have service providers in other countries. Your personal information may be transferred to the state of Pakistan or other locations outside of your state, province, country, or other governmental jurisdiction where privacy laws may not be as protective as those in your jurisdiction.

CHILDREN

The Service is not intended for use by children under 18 years of age, and we do not knowingly collect information about children under age 18 through the Service. If we learn that we have collected personal information of a child without the consent of the child’s parent or guardian as required by law, we will delete it immediately.

CHANGES TO THIS PRIVACY POLICY

We reserve the right to modify this Privacy Policy at any time. If we make material changes to this Privacy Policy, we will notify you by updating the date of this Privacy Policy and posting it on our site. If required by law we will also provide notification of changes in another way that we believe is reasonably likely to reach you, such as via e-mail or another manner through the Service.

Any modifications to this Privacy Policy will be effective upon our posting the modified version (or as otherwise indicated at the time of posting). In all cases, your continued use of the Service after the posting of any modified Privacy Policy indicates your acceptance of the terms of the modified Privacy Policy.

HOW TO CONTACT US

Please direct any questions or comments about this Policy or privacy practices to [email protected].

NOTICE TO CALIFORNIA RESIDENTS

Section effective as of: January 1, 2020

We are required by the California Consumer Privacy Act of 2018 (“CCPA”) to provide California residents an explanation of how we collect, use, and share their Personal Information, and of the rights and choices we offer to California residents with respect to that Personal Information. For purposes of this section, “Personal Information” has the meaning given in the California Consumer Privacy Act of 2018 (“CCPA”).

Personal information that we collect, use, and share. We do not sell personal information. As we explain in this Privacy Policy, we use cookies and other tracking tools to analyze website traffic and facilitate advertising. We also work with third-party advertising and social media companies like Google and Facebook that collect your device data and online activity data from individuals who visit our website to help deliver interest-based ads to you, Please refer to the Interest-based advertising section above and our Cookie Policy for more information.

The chart below summarizes how we collect, use, and share Personal Information by reference to the categories specified in the CCPA, and describes our practices during the 12 months preceding the effective date of this Privacy Policy.

Your Business partners Data providers Public sources Automatic collection	PI we collect in this category (See Personal Information We Collect above for a full description of each category of PI)	Source of PI (See Personal Information We Collect above for a full description of each category of PI)
Identifiers	Contact data Registration data Data about others Profile data Communications Marketing data Purchase data	You Business partners Data providers Public sources third-party platforms
Commercial Information	Contact data Registration data Purchase data Communications Marketing data Device data Online activity data	Your Business partners
Financial Information	Purchase data	Your Business partners Data providers Public sources third-party platforms
Online Identifiers	Device data Online activity data	Automatic collection
Internet or Network Information	Device data Online activity data	Automatic collection
Inferences	May be derived from your: Device data Online activity data
Protected Classification Characteristics	We do not intentionally collect this information but it may be revealed in profile data or other information we collect.
Sensory Information	Security data, such as security camera footage collected at our retail stores and office locations	Automatic collection

The business and commercial purposes for which we collect this information are described in the section above entitled How We Use Your Personal Information. The categories of third parties to whom we disclose this information are described in the section above entitled How We Share Your Personal Information.

Your California privacy rights. The CCPA grants California residents the following rights. However, these rights are not absolute, and in certain cases, we may decline your request as permitted by law.

• Information. You can request information about how we have collected, used, and shared and used your Personal Information during the past 12 months.
  • The categories of Personal Information that we have collected.
  • The categories of sources from which we collected Personal Information.
  • The business or commercial purpose for collecting and/or selling Personal Information.
  • The categories of third parties with whom we share Personal Information.
  • Whether we have disclosed your Personal Information for a business purpose, and if so, the categories of Personal Information received by each category of third party recipient.
  • Whether we’ve sold your Personal Information, and if so, the categories of Personal Information received by each category of third party recipient.
• Access. You can request a copy of the Personal Information that we have collected about you during the past 12 months.
• Deletion. You can ask us to delete the Personal Information that we have collected from you.

You are entitled to exercise the rights described above free from discrimination in the form of legally prohibited increases in the price or decreases in the quality of our Service.

We have provided additional information about how you can opt-out of the use of your information for interest-based advertising in the “Your Choices” section of our Cookie Policy.

How to exercise your California rights. You may exercise your California privacy rights described above as follows:

• Right to information, access and deletion. You can request to exercise your information, access and deletion rights by by emailing [email protected]. We reserve the right to confirm your California residence to process your requests and will need to confirm your identity to process your requests to exercise your information, access or deletion rights. As part of this process, government identification may be required. Consistent with California law, you may designate an authorized agent to make a request on your behalf. In order to designate an authorized agent to make a request on your behalf, you must provide a valid power of attorney, the requester’s valid government-issued identification, and the authorized agent’s valid government issued identification. We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.
• Request a list of third party marketers. California’s “Shine the Light” law (California Civil Code § 1798.83) allows California residents to ask companies with whom they have formed a business relationship primarily for personal, family or household purposes to provide certain information about the companies’ sharing of certain personal information with third parties for their direct marketing purposes during the preceding year (if any). You can submit such a request by sending an email to [email protected] with “Shine the Light” in the subject line. The request must include your current name, street address, city, state, and zip code and attest to the fact that you are a California resident.

We cannot process your request if you do not provide us with sufficient detail to allow us to understand and respond to it.

NOTICE TO EUROPEAN USERS

The information provided in this “Notice to European Users” section applies only to individuals in the European Union, the European Economic Area or the United Kingdom (collectively, “Europe”).

Personal information. Except as otherwise specified, references to “personal information” in this Privacy Policy are equivalent to “personal data” governed by European data protection legislation.

Controller. The controller of your personal information covered by this Privacy Policy for purposes of European data protection legislation is Fashion Nova, LLC., 2801 East 46th Street, Vernon, CA 90058.

Legal bases for processing. The legal bases of our processing of your personal information as described in this Privacy Policy will depend on the type of personal information and the specific context in which we process it. However, the legal bases we typically rely on are set out in the table below. We rely on our legitimate interests as our legal basis only where those interests are not overridden by the impact on you (unless we have your consent or our processing is otherwise required or permitted by law). If you have questions about the legal basis of how we process your personal information, contact us at [email protected].

Processing purpose (click link for details regarding processing purposes)	Legal basis
Service delivery	Processing is necessary to perform the contract governing our operation of the Sites or the provision of the Service, or to take steps that you request prior to engaging our services. Where we cannot process your personal data as required to operate the Service on the grounds of contractual necessity, we process your personal information for this purpose based on our legitimate interest in providing you with the products or services you access and request.
Marketing Internet-based advertising	For research and development To create anonymous data For compliance, fraud prevention, and safety
For research and development To create anonymous data For compliance, fraud prevention and safety	These activities constitute our legitimate interests.
To comply with laws and regulations	Processing is necessary to comply with our legal obligations.
With your consent	Processing is based on your consent. Where we rely on your consent you have the right to withdraw it any time in the manner indicated when you consent or in the Service.

Use for new purposes. We may use your personal information for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal information for an unrelated purpose, we will notify you and explain the applicable legal basis.

Sensitive personal information. Unless we specifically request it, we ask that you not provide us with any sensitive personal information (e.g., information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through the Service, or otherwise to us.

Retention. We retain personal information for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes. When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize it or, if this is not possible (for example, because your personal information has been stored in backup archives), then we will securely store your personal information and isolate it from any further processing until deletion is possible.

Your rights. European data protection laws give you certain rights regarding your personal information. You may ask us to take the following actions in relation to your personal information that we hold:

• Access. Provide you with information about our processing of your personal information and give you access to your personal information.
• Correct. Update or correct inaccuracies in your personal information.
• Delete. Delete your personal information.
• Transfer. Transfer a machine-readable copy of your personal information to you or a third party of your choice.
• Restrict. Restrict the processing of your personal information.
• Object. Object to our reliance on our legitimate interests as the basis of our processing of your personal information that impacts your rights.

You may submit these requests by email to [email protected] or our postal address provided above. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions. If you would like to submit a complaint about our use of your personal information or our response to your requests regarding your personal information, you may contact us or submit a complaint to the data protection regulator in your jurisdiction. You can find your data protection regulator here.

Cross-Border Data Transfer. If we transfer your personal information out of Europe to a country outside of Europe such that we are required to apply additional safeguards to your personal information under European data protection laws, we will do so. Please contact us at [email protected] for further information about any such transfers or the specific safeguards applied.

PAINTOUFIT STUDIO COOKIE POLICY

This Cookie Policy explains how Paintoutfit (SMC-PRIVATE) Limited uses cookies and similar technologies in connection with the www.paintoutfit.com website and any other website that we own or control and which posts or links to this Cookie Policy (collectively, the “Sites”), along with any other mobile applications that we own or control and which posts or links to this Cookie Policy (collectively, the “Apps”).

What are cookies?

Cookies are small data files that are placed on your computer or mobile device when you visit a website. Cookies serve different purposes, like helping us understand how a site is being used, letting you navigate between pages efficiently, remembering your preferences, and generally improving your browsing experience. 

We use two broad categories of cookies: (1) first-party cookies, served directly by us to your computer or mobile device, which we use to recognize your computer or mobile device when it revisits our Sites; and (2) third-party cookies, which are served by service providers or business partners on our Sites, and can be used by these parties to recognize your computer or mobile device when it visits other websites. Third-party cookies can be used for a variety of purposes, including site analytics, advertising, and social media features.

What types of cookies and similar tracking technologies does Fashion Nova use on the Sites?

On the Sites, we use cookies and other tracking technologies in the following categories described in the table below.

Type	Description	Who serves the cookies	How to control them
Advertising	These cookies are used by advertising companies to collect information about how you use our Sites and other websites over time. These companies use this information to show you ads they believe will be relevant to you within our Service and elsewhere, and to measure how the ads perform.	Google Facebook Sailthru Horizon Criteo Bounce Exchange Klaviyo	See ‘your choices’ below.
Analytics	These cookies help us understand how our Service is performing and being used. These cookies may work with web beacons included in emails we send to track which emails are opened and which links are clicked by recipients.	Google Analytics Signifyd Flow.io	Google Analytics uses its own cookies. You can find out more information about Google Analytics cookies here and about how Google protects your data here. You can prevent the use of Google Analytics relating to your use of our Sites by downloading and installing a browser plugin available here. See ‘your choices’ below.
Essential	These cookies are necessary to allow the technical operation of our Service (e.g., they enable you to move around on a website and to use its features).	Google Tag Manager	See ‘your choices’ below.
Functionality/ Performance	Enhance the performance and functionality of our Sites.	ThreatMetrix	See ‘your choices’ below.

Other technologies

In addition to cookies, our Sites may use other technologies, such as Flash technology and pixel tags to collect information automatically.

Web Beacons

We may also use web beacons (which are also known as pixel tags and clear GIFs) on our Sites and in our HTML-formatted emails to track the actions of users on our Sites and interactions with our emails. Unlike cookies, which are stored on the hard drive of your computer or mobile device by a website, pixel tags are embedded invisibly on webpages or within HTML-formatted emails. Pixel tags are used to demonstrate that a webpage was accessed or that certain content was viewed, typically to measure the success of our marketing campaigns or engagement with our emails and to compile statistics about usage of the Sites, so that we can manage our content more effectively.

YOUR CHOICES

Like many companies online, we use services provided by Google, Facebook, and other companies that use tracking technology. Your choices for opting out of these companies’ use of your personal information for interest-based advertising include:

• Blocking cookies in your browser. Most browsers let you remove or reject cookies, including cookies used for interest-based advertising. To do this, follow the instructions in your browser settings. Many browsers accept cookies by default until you change your settings. For more information about cookies, including how to see what cookies have been set on your device and how to manage and delete them, visit allaboutcookies.org.
• Blocking advertising ID use in your mobile settings. Your mobile device settings may provide functionality to limit the use of the advertising ID associated with your mobile device for interest-based advertising purposes.
• Using privacy plug-ins or browsers. You can block our websites from setting cookies used for interest-based ads by using a browser with privacy features, like Brave, or installing browser plugins like Privacy Badger, Ghostery, or uBlock Origin, and configuring them to block third-party cookies/trackers.
• Platform opt-outs. The following advertising partners offer opt-out features that let you opt-out of use of your information for interest-based advertising:
  • Google: https://adssettings.google.com
  • Facebook: https://www.facebook.com/about/ads

If you choose to opt out of targeted advertisements, you will still see advertisements online but they may not be relevant to you. Even if you do choose to opt-out, not all companies that serve online behavioral advertising are included in this list, so you may still receive some cookies and tailored advertisements from companies that are not listed.

For more information about how we collect, use, and share your information, see our Privacy Policy.

CHANGES

Information about the cookies we use may be updated from time to time, so please check back on a regular basis for any changes.