Privacy Policy of www.CharlieBabyCouture.com For information about your personal data collected, the purposes, and the subjects with which the data are shared, contact the Data Controller.

Data Controller
CharlieBaby Inc
18 King Street East
Suite 1400
Toronto, Ontario M5H 1A1
Owner contact email: privacy@CharlieBabyCouture.com

Types of data collected. The Data Controller does not provide a list of types of Personal Data collected. Complete details on each type of data collected are provided in the dedicated sections of this privacy policy or through specific information texts displayed before the data is collected. The user may freely provide Personal Data or, in the case of Usage Data, collected automatically during the use of this application. Unless otherwise specified, all Data requested by this application are mandatory. If the user refuses to communicate, it may be impossible for this application to provide the service. In cases where this application indicates some Data as optional, Users are free to refrain from communicating such data without having any consequence on the availability of the service or its operation. Users who have doubts about which data are mandatory are encouraged to contact the owner.

Any use of Cookies – or other tracking tools – by this application or by the owners of third-party services used by this application, unless otherwise specified, is intended to provide the service requested by the user, in addition to further purposes described in this document and the Cookie Policy, if available.

The user assumes responsibility for the Personal Data of third parties obtained, published, or shared through this application and guarantees to have the right to communicate or disseminate them, freeing the owner from any liability to third parties.

What data do we collect about you?
“Personal data” means any information that identifies you either directly (such as your name) or indirectly (for example, using a unique customer number).

The personal data we collect depends on the point of contact through which you interact with us, as well as the purposes of this interaction as described in this policy, and are also limited to those which are relevant and appropriate for this interaction. For example, visitors to the CharlieBabyCouture.com website who view our products, information, and offers can choose to do so without logging in, and the same is true for point-of-sale search and browsing on social media. Unless you choose to interact with us through these contact points, for example:

• by creating an account and connecting to it,
• by purchasing on our site,
• by subscribing to one of our programs or services,
• by writing to us via the consumer contact forms,
• or by writing us a comment in the free online order fields,

or else, our data collection is limited to the use of “cookies” (visitors) for website visitors whose conditions are defined explicitly by our cookie policy and according to your preferences. Our cookie management policy is separate from this general policy for transparency and clarity. The cookie management policy is accessible from this link.

For one thing, for customers and others who sign up for programs or services, we need to collect certain relevant information from you. The information we collect is related to a given transaction and in the context of our business relationship with you. For example, if you make purchases on CharlieBabyCouture.com or in our points of sale, we must collect information to process (and, if necessary, execute and dispatch) your order, to ensure its tracking and invoicing, be able to respond to any after-sales inquiries you may have. For customers and others who sign up for our programs or services, we generally collect your contact information, contact preferences, and information that allows us to make recommendations to you about our products or services that may be of interest to you. We can centralize information about our customers to organize it in one place, as this helps us manage our relationship with you as well as your choices and preferences. Finally, we collect your email address if you subscribe to our newsletter.

Depending on the data that you communicate to us or that you share with us, personal data may include information concerning:

• Your identity and contact details: surname, first name, postal address, email address, telephone number
• Your interests
• A history of your purchases (online, including your orders, tracking, invoices, amount, and type of purchase) and your repairs
• Your requests via our customer service or our public relations service
• Your size and stylistic preferences
• Your date of birth in order to benefit from the Birthday offers eligible according to your program
• Your satisfaction and comments on our programs, services, and products

Regarding your purchases, payments are made via a secure payment platform, supplemented by control measures, including encryption of contact details, to guarantee the security of purchases made and fight against fraud. Your bank details are therefore not accessible on CharlieBaby’s servers.

We invite you to ensure that your data is regularly updated, either by modifying it directly on our sites or by informing us in writing of any modification by referring to the dedicated section “How to contact us.”

How do we collect or receive your data?
As part of our relationships, the data we collect may be collected through the following contact points:

• Products on CharlieBabyCouture.com
• Events in which you participate
• Relationship with our public relations services
• Contact with Customer Service
• Forms that you fill out
• Digital applications with which you interact
• Loyalty program from which you benefit
• Third-party data providers with whom you share information
• Retailers for whom you agree to receive our communications
• Satisfaction surveys or questionnaires to which you answer

We make sure to identify the personal data essential for the purpose it is collected by indicating it with an asterisk like this ‘(*)’ on each personal data collection form. If you do not fill in these mandatory fields, we will not be able to respond to your requests and/or provide you with the services requested. The other information is optional and allows us to know you better and improve our communications and services to you. Although not mandatory, we recommend you fill them in to enable you to benefit from the best possible experience during our interactions with you.

During your purchase journey, you will be able to choose between:

1. Logging into your existing CharlieBaby account.
2. Creating a new account.
3. Paying as a Guest (or also called Guest Check out).

This previous purchasing experience is thus summarized as follows:

Payment for purchases as a Guest refers to the possibility for any CharlieBaby customer or prospect to make a purchase in our online store without logging into an account. Your information is collected only for the process of payment and delivery of items or for CharlieBaby in order to comply with applicable laws. In accordance with your express consent, the information may be used for analytical purposes by CharlieBaby. Likewise, in accordance with your express consent, your information may also be used by CharlieBaby for communication purposes via its preferred channel (for example: subscribe to a newsletter). For more information on these purposes, please go to the section below, under the “Analysis and personalization purposes” section.

For what purposes is your data used by CharlieBaby?
We are required to use your data for purposes defined according to the nature of our relationships. Thus, depending on the context in which your data is collected, it may be used for one or more of the following purposes:

• Managing your orders
• Management of personalized content and CharlieBaby communications (digital or not)
• Managing your profile
• Managing your requests in connection with CharlieBaby
• The management of events in which you register / participate
• The management of our website and our digital applications
• Management and improvement of our products and services, image, and reputation
• Transaction management (securing online payments, prevention of fraud, incidents related to payments and debts)
• Analysis and personalization purposes: with your explicit consent (when required), we use your personal data to send you personalized communications (newsletters, offers, invitations, and surveys) and analyze your preferences and habits, anticipate your needs from your consumer profile. We can make you benefit from our personalized communications by means of emails, postal letters, SMS, or calls according to the communication preferences that you have indicated to us and your consumer profile (when authorized).

We ensure the legal basis for the processing of your data according to the purpose (s) concerned, which may be, depending on the context in which it is collected:

• Your explicit consent: for example, to manage our personalized commercial offers, manage your browsing via cookies under the conditions defined by our Cookies Policy, or establish your consumer profile in applicable cases;
• The implementation of a contract, for example, for your access to your customer account, the processing and follow-up of your orders …;
• A legal obligation when processing is required by law, for example, keeping purchase invoices to prevent fraud;
• Our legitimate interest: to improve our products and services, defend ourselves or secure our tools.

Who can access your data?
Your data is intended for the services of CharlieBaby concerned by your requests. Therefore, we ensure that only duly authorized persons can access your personal data when this is necessary for the aforementioned purposes.

We do not pass your data on to third parties for commercial purposes. We are only required to communicate your information if necessary, and if possible, in a form that does not allow direct identification to:

• Our trusted third-party providers

For example, we entrust certain services to third parties responsible for delivering a product to you, payment service providers and transaction security against fraud, third parties who assist us in the organization of our events, third parties providing services IT, digital communication, and public relations agencies, third parties who assist us in customer service, third parties who assist us in qualitative surveys of our products, programs or services.

• Our trusted third-party partners assist us in the management of your orders. In particular, we entrust certain services to third parties responsible for delivering a product to you, to payment service providers, and providers ensuring the security of anti-fraud transactions.

Please note that these partners may act as data controllers; in this case, they have their own privacy policies. We illustrate some examples in the list below:

DHL orders and deliveries (delivery)

• Payments and transaction security.
• Third parties wishing to know your interests so that they can build similar audiences and target prospects corresponding to your profile. In this specific processing, we are not the data controller relating to prospecting. Therefore, you will not be the subject of prospecting; your data is only used to constitute profiles similar to yours.
• Third Parties in the event of a change of control or status or company name, for legal reasons, or with your prior consent

You can also disclose your personal data to our partners, advertisers, and affiliates by following a link to and from their websites. Please note that these websites apply their own privacy policy.

We may also offer you the possibility of using your social media connection data. Please note that you are sharing your profile information with us in this case. The personal data shared depends on the configuration of the social network platform. Please note that these social networks apply their own privacy policy.

How do we protect and ensure the confidentiality of your data?
We take all the necessary precautions to guarantee the confidentiality and security of your data and to prevent it from being distorted, damaged, destroyed, or from unauthorized third parties having access to it.

We ask our partners and group companies to maintain a level of protection similar to ours concerning your personal data. The security measures put in place are evaluated and updated to face new threats and new challenges, as well as new legal requirements in the countries where we operate.

Method and place of processing of the collected data

Processing methods
The Data Controller adopts the appropriate security measures to prevent unauthorized access, disclosure, modification, or destruction of Personal Data.

The processing is carried out using IT and/or telematic tools, with organizational methods and logic strictly related to the purposes indicated. In addition to the Data Controller, in some cases, other subjects are involved in the organization of this Application (administrative, commercial, marketing, legal, system administrators) or external subjects (such as suppliers of third-party technical services, postal couriers) may have access to the data hosting providers, IT companies, and communication agencies) also appointed, if necessary, as Data Processors by the Data Controller. The updated list of Managers can always be requested from the Data Controller.

Legal basis of the processing
The Data Controller processes Personal Data relating to the user if one of the following conditions exists:

• The user has given consent for one or more specific purposes; Note. In some jurisdictions, the Data Controller may be authorized to process Personal Data without the user’s consent or the legal bases specified below, as long as the user does not object (“opt-out”) to such treatment. However, this is not applicable if the processing of Personal Data is governed by European legislation on the protection of Personal Data;
• The processing is necessary for the execution of a contract with the user and/or for the execution of pre-contractual measures;
• The processing is necessary to fulfill a legal obligation to which the Data Controller is subject;
• The processing is necessary for the execution of a task of public interest or the exercise of public authority vested in the Data Controller;
• The processing is necessary to pursue the Data Controller’s legitimate interest or third parties.

However, it is always possible to ask the Data Controller to clarify the concrete legal basis of each treatment and, in particular, to specify whether the treatment is based on the law, provided for by a contract, or necessary to conclude a contract.

Place
The data is processed at the Data Controller’s operating offices and in any other place where the parties involved in the processing are located. For more information, don’t hesitate to get in touch with the Data Controller.

The User’s Personal Data may be transferred to a country other than the user’s location. To obtain further information on the place of processing, the user can refer to the section relating to the details on the processing of Personal Data.

The user has the right to obtain information regarding the legal basis for the transfer of Data outside the European Union or to any international organization governed by public international law or consisting of two or more countries, such as the UN, as well as regarding the security measures adopted by the Data Controller to protect the data.

The user can check if one of the transfers described above takes place by examining the section of this document relating to the details on the processing of Personal Data or requesting information from the Data Controller by contacting him at the details indicated in the opening.

Retention period
The Data are processed and stored for the time required by the purposes for which they were collected. Therefore:

• Personal Data collected for purposes related to the execution of a contract between the owner, and the user will be retained until this contract is executed.
• Personal Data collected for purposes related to the Data Controller’s legitimate interest will be retained until this interest is satisfied. The user can obtain further information regarding the legitimate interest pursued by the Data Controller in the relevant sections of this document or by contacting the Data Controller.

When the processing is based on the user’s consent, the Data Controller may keep the Personal Data longer until such consent is revoked. Furthermore, the Data Controller may be obliged to retain Personal Data for a more extended period in compliance with a legal obligation or by order of an authority.

At the end of the retention period, the Personal Data will be deleted. Therefore, at the end of this term, the right of access, cancellation, rectification, and the right to data portability can no longer be exercised.

Information on how to opt-out of interest-based advertising
In addition to any opt-out function provided by any of the services listed in this document, Users may make use of information on YourOnlineChoices (EU), The Network Advertising Initiative (USA) and Digital Advertising Alliance (USA), DAAC (Canada ), DDAI (Japan) or other similar services. With these services, it is possible to manage the tracking preferences of most advertising tools. The owner, therefore, advises Users to use these resources in addition to the information provided in this document. App Choices which helps Users control behavioral advertising on mobile applications.

Users may also disable certain advertising features through their device settings, such as device advertising settings for mobile phones or ad settings in general.

Rights of the User
Users can exercise certain rights with reference to the Data the Controller processed. In particular, the user has the right to:

• Withdraw consent at any time. The user can revoke the consent to processing their Personal Data previously expressed.
• Oppose the processing of their data. The user can oppose the processing of their data when it occurs on a legal basis other than consent. Further details on the right to object are indicated in the section below.
• Access their data. The user has the right to obtain information on specific aspects of the processing and receive a copy of the data processed by the Data Controller.
• Verify and request rectification. The user can verify the correctness of their data and request its updating or correction.
• Obtain the limitation of the treatment. When certain conditions are met, the user can request the limitation of the processing of their data. In this case, the Data Controller will not process the Data for any other purpose than their conservation.
• Obtain the cancellation or removal of their Personal Data. When certain conditions are met, the user can request the cancellation of their Data by the owner.
• Receive their data or have them transferred to another owner. The user has the right to receive their data in a structured format, commonly used and readable by an automatic device and, where technically feasible, to obtain the transfer without obstacles to another owner. This provision is applicable when the data is processed with automated tools, and the processing is based on the user’s consent, on a contract to which the user is a party, or on contractual measures connected to it.
• Propose a complaint. The user can lodge a complaint with the competent personal data protection supervisory authority or act in court.

Details on the right to object
When Personal Data are processed in the public interest, in the exercise of public authority vested in the Data Controller, or to pursue a legitimate interest of the Data Controller, Users have the right to oppose the processing for reasons connected to their particular situation.

Users are reminded that if their data are processed for direct marketing purposes, they can oppose it without providing any reasons. To find out if the Data Controller processes data for direct marketing purposes, Users can refer to the respective sections of this document.

How to exercise your rights
To exercise the user’s rights, Users can direct a request to the contact details of the owner indicated in this document. Requests are filed free of charge and processed by the Data Controller as soon as possible, in any case within one month.

Further information on the treatment:

Defense in court
The User’s Personal Data may be used by the owner in court or the preparatory stages for its eventual establishment for the defense against abuse in the use of this Application or related Services by the user. The user declares to be aware that the owner may be obliged to disclose the Data by order of the public authorities.

Specific information
At the request of the user, in addition to the information contained in this privacy policy, this application may provide the user with additional and contextual information regarding specific Services or the collection and processing of Personal Data.

System log and maintenance
For needs related to operation and maintenance, this application and any third-party services it uses may collect system logs, i.e., files that record the interactions and which may also contain Personal Data, such as the User IP address.

Information not contained in this policy
Further information in relation to the processing of Personal Data may be requested at any time from the Data Controller using the contact details.

Response to “Do Not Track” requests.
This application does not support “Do Not Track” requests. The user is invited to consult the respective privacy policies to determine if any third-party services support them.

Changes to this privacy policy
The Data Controller reserves the right to make changes to this privacy policy at any time by notifying Users on this page and, if possible, on this application as well as, if technically and legally feasible, by sending a notification to Users through one of the extremes of contact he has. Please, therefore, consult this page frequently, referring to the date of the last modification indicated at the bottom.

If the changes concern treatments whose legal basis is consent, the Data Controller will collect the user’s consent again, if necessary.

Definitions and legal references

Personal Data (or Data)
Any information that, directly or indirectly, also in connection with any other information, including a personal identification number, makes a natural person identified or identifiable constitutes personal data.

Usage Data
This is information collected automatically through this application (including from third-party applications integrated into this application), including IP addresses or domain names of the computers used by the user who connects with this application, addresses in URI notation ( Uniform Resource Identifier), the time of the request, the method used to forward the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (successful, error, etc.) country of origin, the characteristics of the browser and operating system used by the visitor, the various temporal connotations of the visit (for example the time spent on each page) and the details of the itinerary followed within the application, with particular reference to the sequence of the pages consulted, to the parameters relating to the operating system and the IT environment of the user.

User
The individual using this application who, unless otherwise specified, coincides with the Data Subject.

Interested
The natural person to whom the Personal Data refers.

Data Processor (or Manager)
The natural person, legal person, public administration, and any other body that processes personal data on behalf of the Data Controller, as set out in this privacy policy.

Data Controller (or Owner)
The natural or legal person, public authority, service, or other body which, individually or together with others, determines the purposes and means of processing personal data and the tools adopted, including the security measures relating to the operation and use of this application. Unless otherwise specified, the Data Controller is this application’s owner.

This Application
The hardware or software tool through which the Personal Data of Users are collected and processed.

Service
The service provided by this application as defined in the relative terms (if available) on this site/application.

European Union (or EU)
Unless otherwise specified, any reference to the European Union contained in this document is intended to be extended to all current member states of the European Union and the European Economic Area.

Legal references
This privacy statement is drawn up based on multiple legislative systems, including articles. 13 and 14 of Regulation (EU) 2016/679. Unless otherwise specified, this privacy statement only concerns this application.

NOTICE ABOUT COOKIE MANAGEMENT
This Notice about cookies applies when visiting the website available at CharlieBabyCouture.com (hereinafter the “Website(s)”), which belongs to CharlieBaby Inc. This cookie policy aims to inform you of the source and use of browsing information collected during your visit to the website and the tools provided to allow you to express your choices about cookies.

What is a cookie?
Subject to your choices, when visiting the website, a text file may be placed on your device (computer, smartphone, tablet), courtesy of your web browser. This text file is a cookie. During its validity or registration period, it will allow the sender to identify your device on future visits. Some cookies are essential for website use; others optimize and personalize the contents displayed.

Who sends the cookies on our website?
Cookies that may be saved to your device when you visit the Website pages are issued by CharlieBaby and/or third parties. Therefore, only the cookie issuer is likely to read or modify the information. Cookies sent by CharlieBaby are mainly related to the operation of the website. The others are third-party cookies sent by our partners or advertising agencies via the advertisements shown on our website. CharlieBaby makes every effort to ensure that third-party cookies are issued and used in compliance with the applicable regulations.

What is the purpose of the cookies issued via the website?
Subject to your choices, various cookies may be installed on your device for the following purposes. For the sake of transparency and in as much depth as possible, we inform you of the purposes of the third-party cookies that we are aware of and how you can make choices about these cookies. In addition, all cookies may be cross-referenced with your customer data to personalize your experience, limit commercial interaction, ensure the proper functioning of your loyalty benefits, improve our services and guarantee your satisfaction.

• Essential cookies for Website operations

“Essential” cookies are necessary for Website browsing and allow you to use the website’s main features.

For example, these cookies are intended mainly for:
– saving your choices or desire not to make a choice about tracker cookies;
– service authentication;
– saving the contents of a shopping cart;
– customizing the interface.

Removing them may make it hard to browse the website or may make it impossible to place an order. CharlieBaby or its service providers may install these cookies on your device.

These cookies enable or facilitate digital communications and/or may be strictly necessary for the provision of an online communication service at your express request. As a result, they do not require your prior consent. Saving or reading such cookies is necessary for the provision of the service and will be based on CharlieBaby’s legitimate interest in implementing such processing for the proper use of its website.

• Personalization cookies

Personalization cookies allow us to personalize and improve your user experience, for example, by making your searches easier and optimizing your shopping experience. They also allow us to adapt the website’s look to your device display during your visits.

These Cookies are issued by CharlieBaby and/or by our service providers. The issue and use of cookies by third parties on our website may also be subject to the privacy protection policies of these third parties.

Such cookies are saved or read, subject to your prior consent. If you refuse these cookies, you will not be able to benefit from the functionalities described in this paragraph.

• Analytical cookies

Analytical cookies make it possible to gauge the audience for various Website content and establish visitor statistics and volumes to evaluate and improve our service ergonomics. These cookies include those used to create similar profiles that will be prospected according to your information.

These Cookies are issued by CharlieBaby and/or by our service providers. The issue and use of cookies by third parties on our website may also be subject to the privacy protection policies of these third parties.

The information communicated to technical service providers is transmitted through aggregated statistics and traffic volumes, excluding personal information. These statistics are reconciled with the traffic statistics of other websites and your customer data.

Such cookies are saved or read, subject to your prior consent. Refusing the implementation of or deleting such cookies does not affect your website browsing but is likely to prevent us from ensuring the best quality of service we wish to offer our visitors.

• Sharing cookies (social links)

Our website may include third-party computer applications that allow you to share Website content with others or to publish your visit or opinion of Website content to these other persons. This is notably the case for “Share” and “Like” buttons on social networks such as Facebook, Twitter, Instagram, Pinterest, etc.

The social network providing such application buttons is likely to identify you through this button, if you use the button, and even if you have not used this button but are signed in to the social network when you consult the website (open session during your browsing). In addition, share buttons will allow you to connect the contents consulted to your user account.

We have no control over the process social networks use to collect information about your Website browsing and associated with the personal data at their disposal. Therefore, we invite you to consult the privacy protection policies of these social networks.

• Advertising cookies

Advertising cookies are not essential for browsing but allow you to see more relevant advertisements personalized to your interests on the website and other websites you may browse. As such, advertising cookies allow, for example, the display of advertising, capping the display (not presenting the same advertising to a user in a repetitive manner), combatting click fraud, billing the display service, the measurement of targets more interested in the advertising to better understand the audience, etc.

Advertising content personalization can also be achieved by using our partner’s technology to associate your device’s Website browsing information with the data you provided us when you registered.

Saving or reading such cookies is subject to your prior consent. Refusing these advertising cookies has no impact on your use of the website, nor will it stop advertising on the website. However, we will be unable to offer you advertising that considers your interests.

How long are the cookies kept?
Cookies saved on your device have a maximum lifespan of six (6) months. At the end of this period, personal data collected through the cookies will be deleted.

HOW TO MANAGE COOKIES SAVED ON YOUR DEVICE
Cookies saved on your device result from the settings you have chosen during your visit, which can be modified at any time under the conditions detailed in this cookie policy.

There are various ways to manage the implementation of cookies, as presented below.

Suppose your device is used by more than one person and operates more than one browser. In that case, we cannot be certain that the services and advertisements sent to your device are appropriate for your personal use rather than another user. Therefore, if you share your device and browser cookie settings with others, you are responsible for doing so at your own discretion.

• Your browser settings

You can also configure your browser to accept and save cookies on your device or to reject them.

Each browser has different settings. These are usually described in your browser help menu. We, therefore, recommend reading it. This will show you how to change your cookie preferences.

• For Internet Explorer: https://support.microsoft.com/en-gb/help/17442/windows-internet-explorer-delete-manage-cookies
• For Safari: https://support.apple.com/en-euro/guide/safari/sfri11471/mac
• For Chrome: https://support.google.com/chrome/answer/95647?hl=en&hlrm=en
• For Firefox: https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer
• For Opera: https://help.opera.com/en/latest/web-preferences/#cookies

Please note: any choices in your browser settings concerning the acceptance or refusal of cookies will likely modify your Internet browsing experience and your access to the website and certain services requiring the use of these same cookies.