PRIVACY POLICY Charlotte & Willow

1 INFORMATION ABOUT THE COLLECTION OF PERSONAL DATA & CONTROLLER CONTACT DETAILS 1.1 We are pleased that you are visiting our website and thank you for your interest. Below we will inform you about the handling of your personal data when using our website. Personal data is any data with which you can be personally identified. 1.2 The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is Charlotte & Willow, reachable at charlotte-willow.com and by email at info@charlotte-willow.com. The controller is the natural or legal person who alone or jointly with others determines the purposes and means of the processing of personal data. 1.3 This website uses SSL or TLS encryption for security reasons and to protect the transmission of personal data and other confidential content (e.g., orders or inquiries to the controller). You can recognize an encrypted connection by the character string “https://” and the lock symbol in your browser bar.

 

2 DATA COLLECTION WHEN VISITING OUR WEBSITE When using our website for informational purposes only — i.e., if you do not register or otherwise transmit information to us — we only collect data that your browser transmits to our server (so-called “server log files”). When you visit our website, we collect the following data, which is technically necessary for us to display the website to you: • The visited website • Date and time of access • Amount of data sent in bytes • Source/referral from which you reached the page • Browser used • Operating system used • IP address used (if applicable: in anonymized form)

 

Processing is carried out in accordance with Art. 6(1)(f) GDPR on the basis of our legitimate interest in improving the stability and functionality of our website. The data will not be passed on or otherwise used. However, we reserve the right to retrospectively check the server log files should there be concrete indications of unlawful use.

3 COOKIES In order to make visiting our website attractive and to enable the use of certain functions, we use so-called cookies on various pages. These are small text files that are stored on your device. Some of the cookies we use are deleted after the end of the browser session, i.e., after you close your browser (session cookies). Other cookies remain on your device and enable us or our partner companies (third-party cookies) to recognize your browser on your next visit (persistent cookies).

When cookies are set, they collect and process certain user information such as browser and location data as well as IP address values to an individual extent. Persistent cookies are automatically deleted after a specified period, which may vary depending on the cookie.

In some cases, cookies are used to simplify the ordering process by saving settings (e.g., remembering the contents of your shopping cart for a later visit to the website). If personal data are also processed by individual cookies we have implemented, the processing takes place in accordance with Art. 6(1)(b) GDPR either for the performance of the contract or in accordance with Art. 6(1)(f) GDPR to safeguard our legitimate interests in the best possible functionality of the website as well as a customer-friendly and effective design of the page visit.

We may work with advertising partners who help us make our website more interesting for you. For this purpose, cookies from partner companies may also be stored on your device when you visit our website (third-party cookies).

Note: You can set your browser to inform you about the setting of cookies and individually decide on their acceptance, or exclude the acceptance of cookies for certain cases or in general. Each browser differs in the way it manages cookie settings. Please note that the functionality of our website may be limited if cookies are not accepted.

Browser Cookie Settings • Chrome: support.google.com/chrome/answer/95647 • Safari: support.apple.com/kb/ph21411 • Firefox: support.mozilla.org/kb/cookies-erlauben-und-ablehnen • Microsoft Edge: support.microsoft.com/microsoft-edge • Opera: help.opera.com/en/latest/web-preferences/#cookies

4 CONTACT When contacting us (e.g., via contact form or email), personal data is collected. Which data is collected in the case of a contact form can be seen from the respective contact form. This data is stored and used exclusively for the purpose of responding to your request or for contacting you and the associated technical administration. The legal basis for the processing of data is our legitimate interest in responding to your request in accordance with Art. 6(1)(f) GDPR. If your contact is aimed at the conclusion of a contract, the additional legal basis for processing is Art. 6(1)(b) GDPR. Your data will be deleted after final processing of your request, provided there are no legal retention obligations to the contrary.

5 DATA PROCESSING WHEN OPENING A CUSTOMER ACCOUNT & CONTRACT PROCESSING In accordance with Art. 6(1)(b) GDPR, personal data will continue to be collected and processed when you provide it to us for the performance of a contract or when opening a customer account. Which data is collected can be seen from the respective input forms. Deletion of your customer account is possible at any time and can be done by sending a message to info@charlotte-willow.com. We store and use the data you provide for contract processing. After complete processing of the contract or deletion of your customer account, your data will be blocked with regard to tax and commercial law retention periods and deleted after expiry of these periods, unless you have expressly consented to further use of your data.

6 USE OF YOUR DATA FOR DIRECT ADVERTISING 6.1 — Email Newsletter Registration If you register for our email newsletter, we will regularly send you information about our offers. The only mandatory information for sending the newsletter is your email address. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an email newsletter once you have expressly confirmed that you consent to receiving newsletters. By activating the confirmation link, you give us your consent for the use of your personal data in accordance with Art. 6(1)(a) GDPR. When you register for the newsletter, we store your IP address as well as the date and time of registration. You can unsubscribe from the newsletter at any time via the link provided in the newsletter. After unsubscribing, your email address will be immediately deleted from our newsletter distribution list.

6.2 — Email Newsletter to Existing Customers If you have provided us with your email address when purchasing goods or services, we reserve the right to regularly send you offers for similar goods or services from our range by email. We do not need to obtain separate consent from you for this. Data processing is carried out solely on the basis of our legitimate interest in personalized direct advertising pursuant to Art. 6(1)(f) GDPR. You are entitled to object to the use of your email address for advertising purposes at any time with effect for the future.

7 DATA PROCESSING FOR ORDER FULFILLMENT 7.1 The personal data we collect will be passed on to the transport company commissioned with the delivery as part of contract processing, insofar as this is necessary for the delivery of the goods. We will pass on your payment data to the commissioned payment provider as part of payment processing, insofar as this is necessary for payment processing. The legal basis for the transfer of data is Art. 6(1)(b) GDPR.

7.2 — Payment Service Providers Shopify Payments: Our store is built on Shopify, and payments are processed via Shopify Payments, provided by Shopify Inc., 151 O'Connor Street, Ottawa, ON K2P 2L8, Canada (and its applicable EU affiliate for customers in the EEA). At checkout you may also pay using the digital wallets Shop Pay, Apple Pay, and Google Pay, which route your payment data through Shopify Payments together with the relevant wallet provider (Apple Inc. or Google LLC). The transfer of this data takes place in accordance with Art. 6(1)(b) GDPR and only insofar as it is necessary for processing your payment.

8 REVIEW REMINDER We use your email address for a one-time reminder to submit a review of your order, provided you have given us your express consent in accordance with Art. 6(1)(a) GDPR during or after your order. You can revoke your consent at any time by sending a message to info@charlotte-willow.com.

9 USE OF SOCIAL MEDIA: SOCIAL PLUGINS 9.1 — Facebook Plugins (Shariff Solution) Our website may use social plugins of the social network Facebook, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (for users in the EEA: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). To increase the protection of your data when visiting our website, these buttons are not integrated as unrestricted plugins but only using an HTML link (“Shariff” solution). This ensures that no connection is established with Meta's servers when you access a page on our website that contains such buttons. When you click the button, a new browser window opens and calls up the Facebook page where you can interact with the plugin.

9.2 — Instagram Plugin (Shariff Solution) Our website may use social plugins of the online service Instagram, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (for users in the EEA: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). The same Shariff HTML-link solution applies, ensuring no connection to Instagram's servers is established until you actively click the button.

10 ONLINE MARKETING 10.1 — Google Ads Display Advertising This website may use Google's online marketing tools (Google Ads / Google Marketing Platform) provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. These tools use cookies to display relevant ads to users, improve campaign performance reporting, and prevent a user from seeing the same ad too many times. Processing is carried out on the basis of our legitimate interest in the optimal marketing of our website pursuant to Art. 6(1)(f) GDPR, or on the basis of your consent where required. According to Google, these cookies do not contain personal information.

10.2 — Google Ads Conversion Tracking This website may use the online advertising program Google Ads and its conversion tracking feature. We use Google Ads to draw attention to our offers on external websites. The conversion tracking cookie is set when a user clicks on a Google Ads advertisement. These cookies usually expire after 30 days and are not used for personal identification. Processing takes place on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, or on the basis of your consent where required.

11 WEB ANALYTICS SERVICES Google Analytics 4 (GA4) This website may use Google Analytics 4 (GA4), a web analytics service provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. Google Analytics uses cookies and similar technologies that enable analysis of your use of the website. GA4 applies IP masking by default and does not store your full IP address. Google will use this information on our behalf to evaluate your use of the website, compile reports on website activity, and provide other services related to website and internet usage. If Google Signals is enabled, this website may also carry out cross-device analysis of visitor flows using a Google-assigned identifier, but only for users who have enabled ad personalization in their Google Account. You can object to data collection by Google Analytics at any time with effect for the future, including via the Google Analytics opt-out browser add-on.

12 RETARGETING / REMARKETING / RECOMMENDATION ADVERTISING Meta Pixel This website may use the “Meta Pixel” of Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA (for users in the EEA: Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland). Where express consent is given, user behavior can be tracked after a visitor has seen or clicked on a Meta (Facebook/Instagram) ad. This procedure serves to evaluate the effectiveness of Meta ads for statistical and market research purposes. The collected data is anonymous to us; however, the data is stored and processed by Meta. Processing only takes place upon your express consent pursuant to Art. 6(1)(a) GDPR. Consent to the use of the Meta Pixel may only be given by users aged 13 or over.

Google Ads Remarketing Our website may use Google Ads Remarketing functions. Google sets a cookie in the browser of your device, which automatically enables interest-based advertising using a pseudonymous cookie ID based on the pages you have visited. Processing takes place on the basis of our legitimate interest pursuant to Art. 6(1)(f) GDPR, or on the basis of your consent where required. Further data processing only takes place if you have agreed that your internet and app browsing history may be linked by Google with your Google account.

13 RIGHTS OF THE DATA SUBJECT 13.1 Applicable data protection law grants you comprehensive data subject rights (rights of access and intervention) vis-à-vis the controller with regard to the processing of your personal data: • Right of access (Art. 15 GDPR): Right to information about your processed personal data, processing purposes, categories, recipients, planned storage period, and more. • Right to rectification (Art. 16 GDPR): Right to immediate rectification of inaccurate data and/or completion of incomplete data stored by us. • Right to erasure (Art. 17 GDPR): Right to request deletion of your personal data where the conditions of Art. 17(1) GDPR are met. • Right to restriction of processing (Art. 18 GDPR): Right to request restriction of the processing of your personal data. • Right to notification (Art. 19 GDPR): Right to be informed about all recipients to whom personal data has been disclosed. • Right to data portability (Art. 20 GDPR): Right to receive your personal data in a structured, commonly used and machine-readable format. • Right to withdraw consent (Art. 7(3) GDPR): Right to withdraw consent at any time with effect for the future. • Right to lodge a complaint (Art. 77 GDPR): Right to lodge a complaint with a supervisory authority.

13.2 — Right to Object Right to Object: If we process your personal data on the basis of our overriding legitimate interest within the framework of a balancing of interests, you have the right at any time to object to this processing with effect for the future for reasons arising from your particular situation. If you exercise your right to object, we will stop processing the data concerned. However, further processing remains reserved if we can demonstrate compelling legitimate grounds that outweigh your interests, fundamental rights and freedoms, or if the processing serves the assertion, exercise or defense of legal claims. Direct Advertising: If your personal data is processed by us for the purpose of direct advertising, you have the right to object at any time to the processing of personal data concerning you for the purpose of such advertising. If you exercise your right to object, we will stop processing the data concerned for direct advertising purposes.

14 DURATION OF STORAGE OF PERSONAL DATA The duration of the storage of personal data is based on the respective legal retention period (e.g., commercial and tax retention periods). After expiry of the period, the corresponding data is routinely deleted, provided it is no longer required for the fulfillment or initiation of a contract and/or there is no longer any legitimate interest on our part in continued storage.