Spreadshop Privacy Policy

1. Who is responsible for data processing?

The service provider and party responsible for processing personal data (“controller”) is Spreadshirt, Inc., 231 South Main Street, Suite 412, Greensburg PA 15601 (“Spreadshirt”).

If you have any questions about the collection, processing, or usage of data; if you have requests for information, correction, disabling or deletion of data; or if you want to revoke a previously given consent; or if you want to object to the usage of your information for advertising purposes, please use the settings provided in your account’s user area, or else contact us at one of the following addresses:

Email: info@spreadshirt.com
Fax: 1-877-202-0251
Postal Mail: 231 South Main Street, Suite 412, Greensburg PA 15601

2. To what extent is personal data processed?

3. What are my rights?

You have the following rights with respect to your personal data:

• The right to be informed.
• The right of access.
• The right to rectification.
• The right to erasure.
• The right to restrict processing.
• The right to data portability.
• The right to object.

As described in the relevant sections, we sometimes use external service providers to process your data. These have been carefully selected and commissioned by us, are bound by our instructions and are regularly checked.

We have indicated in the applicable section where these external service providers are located outside of the European Union.

To the extent the EU-Commission has determined that the respective country does not have an adequate level of data protection, data transfers (for example into the USA) take place based on appropriate guarantees, in particular, standard contractual clauses which ensure the same level of protection as in the European Union.

The personal data processed by us is generally erased or blocked as soon as the purpose of storage ceases to apply. Data may be stored for a longer period if this has been provided for by laws or other rules to which we as the controller are subject. The data will also be blocked or erased once a storage period prescribed by the aforementioned standards expires, unless there is a need for further storage of the data for the conclusion or performance of a contract.

Further processing operations may be required for contests and other promotional campaigns. In such cases we will inform you in the context of the respective promotional campaign.

4. Is My Information Secure?

We use reasonable measures to secure our website and any private information you submit to us against loss, tampering, unauthorized access, and other malicious acts. For example, we use SSL connections when possible to protect your data while it is in transit (for example login data and customer orders). However, no data transmission over the Internet is completely secure, so we cannot completely guarantee the security of any data. You use our services at your own risk, and are responsible for taking reasonable measures to secure your password, information, and account.

5. Do-Not-Track (“DNT”) Requests

Due to lack of technical standards across browsers, we do not respond to DNT signals.

6. Privacy Statement for California Residents

1. The California Consumer Privacy Act

   This privacy statement supplements the information contained above and applies solely to “consumers” (as defined in the California Consumer Privacy Act (“CCPA”)). All terms defined in the CCPA have the same meaning when used in this section. For example, “consumer” means a California resident, and “personal information” means “information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device” but does not include “publicly available,” “de-identified,” or “aggregated” information. In this section, “you” refers only to California residents.

2. Consumer Rights

   Consumers have the following rights under the CCPA:

   • The right to request that a business disclose the categories of personal information it collects, uses, discloses, and sells about the consumer.
   • The right to request the deletion of personal information collected or maintained by a business.
   • The right to request that a business disclose the categories of sources for personal information collection.
   • The right to request that a business disclose the business or commercial purpose for collecting personal information
   • The right to request that a business disclose the categories of third parties with whom the business shares personal information.
   • The right to request that a business disclose to the consumer the specific pieces of personal information it collects, uses, discloses, and sells about that consumer (or any member of the consumer’s household).
   • If a business discloses personal information for a business purpose, the right to request that a business disclose the categories of personal information that the business disclosed about the consumer for a business purpose and the categories of third parties to whom personal information was disclosed for a business purpose.
   • If the business sells personal information for monetary or other valuable consideration, the right to opt-out of the sale of their personal information by a business. This is the so-called “right to opt-out.”
   • The right not to receive discriminatory treatment by a business for the exercise of the privacy rights conferred by the CCPA.
   • The right to make requests under the CCPA by using an authorized agent designated by the consumer.

3. Our Personal Information Collection, Use, and Disclosure

   In the last twelve months, we have collected and disclosed personal information as follows.

   Category of Personal Information	Examples	Collected	Categories of Sources of Personal Information	Is Personal Information Disclosed to third parties for a Business Purpose?	Categories of Third Parties with Whom Personal Information is Shared
   A. Identifiers.	A real name, alias, postal address, unique personal identifier, online identifier, Internet Protocol address, email address, account name, or other similar identifiers.	Yes	Directly provided by Consumers Automatically collected from web browsers via log files Cookies Analytics Providers	Yes	Payment Processors Analytics Providers Marketing Partners
   B. Personal information categories listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e)).	A name, address, telephone number, credit card number, debit card number, or any other financial information. Some personal information included in this category may overlap with other categories.	Yes	Directly provided by Consumers	Yes	Tax Authorities, (for compliance purposes) Payment Processors
   C. Protected classification characteristics under California or federal law.	Age (40 years or older), race, color, ancestry, national origin, citizenship, religion or creed, marital status, medical condition, physical or mental disability, sex, sexual orientation, veteran or military status, genetic information (including familial genetic information).	No	N/A	N/A	N/A
   D. Commercial information.	Records of personal property, products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.	Yes	Directly provided by Consumers Cookies	Yes	Marketing Partners Analytics Providers
   E. Biometric information.	Genetic, physiological, behavioral, and biological characteristics, or activity patterns used to extract a template or other identifier or identifying information, such as, fingerprints, faceprints, and voiceprints, iris or retina scans, keystroke, gait, or other physical patterns, and sleep, health, or exercise data.	No	No	N/A	N/A
   F. Internet or other similar network activity.	Browsing history, search history, information on a consumer's interaction with a website, application, or advertisement.	Yes	Directly provided by Consumers Cookies Analytics Providers	No	N/A
   G. Geolocation data.	Precise physical location or movements.	No	N/A	N/A	N/A
   H. Sensory data.	Audio, electronic, visual, thermal, olfactory, or similar information.	No	N/A	N/A	N/A
   I. Professional or employment-related information.	Current or past job history or performance evaluations.	No	N/A	N/A	N/A
   J. Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R. Part 99)).	Education records directly related to a student maintained by an educational institution or party acting on its behalf, such as grades, transcripts, class lists, student schedules, student identification codes, student financial information, or student disciplinary records.	No	N/A	N/A	N/A
   K. Inferences drawn from other personal information.	Profile reflecting a person's preferences, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.	Yes	Directly provided by consumers Cookies	No	N/A

   We collect and disclose personal information for the following business purposes.

   • Auditing related to a current interaction with the consumer and concurrent transactions, including, but not limited to, counting ad impressions to unique visitors, verifying positioning and quality of ad impressions, and auditing compliance with this specification and other standards. Personal Information Categories: A (Identifiers), F (Internet and Network Activity)
   • Detecting security incidents, protecting against malicious, deceptive, fraudulent, or illegal activity, and prosecuting those responsible for that activity. Personal Information Categories: A (Identifiers), F (Internet and Network Activity)
   • Debugging to identify and repair errors that impair existing intended functionality. Personal Information Categories: F (Internet and Network Activity)
   • Short-term, transient use, provided that the personal information that is not disclosed to another third party and is not used to build a profile about a consumer or otherwise alter an individual consumer's experience outside the current interaction, including, but not limited to, the contextual customization of ads shown as part of the same interaction. Personal Information Categories: A (Identifiers), D (Commercial Information), F (Internet and Network Activity)
   • Performing services on behalf of the business or service provider, including maintaining or servicing accounts, providing customer service, processing or fulfilling orders and transactions, verifying customer information, processing payments, providing financing, providing advertising or marketing services, providing analytic services, or providing similar services on behalf of the business or service provider. Personal Information Categories: A (Identifiers), B (Personal Information as defined by CA Customer Records Law), D (Commercial Information)
   • Undertaking internal research for technological development and demonstration. Personal Information Categories: A (Identifiers), D (Commercial Information), F (Internet and Network Activity)
   • Undertaking activities to verify or maintain the quality or safety of a service or device that is owned, manufactured, manufactured for, or controlled by the business, and to improve, upgrade, or enhance the service or device that is owned, manufactured, manufactured for, or controlled by the business. Personal Information Categories: A (Identifiers), D (Commercial Information), F (Internet and Network Activity)

   We collect and disclose personal information for the following commercial purposes.

   • To observe how our website is used. Personal Information Categories: A (Identifiers), D (Commercial Information), F (Internet and Network Activity)
   • To evaluate the website, optimize it, and make it more user-friendly. Personal Information Categories: D (Commercial Information), F (Internet and Network Activity)
   • To comply with various legal obligations, for example tax reporting laws. Personal Information Categories: A (Identifiers), B (Personal Information as Defined by CA Customer Records Law), D (Commercial Information)

4. Other Information Sale Disclosures

   Do Not Sell My Personal Information. Click the link to the left to learn how to opt out of the “sale” of your personal information as defined in the CCPA.
   
   We have no actual knowledge that the personal information we sell belongs to minors under 16 years of age.

5. How to Submit Verified Requests

   To submit a request for information or deletion, please e-mail info@spreadshirt.com or call 1-800-381-0815.

   Your request will be processed only if we can verify that you are the person whose personal information is the subject of the request. If we cannot verify your identity, we will ask you to provide corrected verification information, or we will deny the request to the extent necessary.

   If you request a deletion of your personal information, you will be required to confirm this deletion separately via e-mail.

   All requests must be verified, meaning that we must determine that the consumer making the request is the same consumer whose personal information is the subject of the request. Verification methods will vary depending on the request, the sensitivity of the personal information that is the subject of the request, and our ability to associate the provided verification information with information in our records.

   If you request disclosure of categories of personal information collected, used, and disclosed, then we will need to verify your identity by reference to at least two independent pieces of evidence describing different pieces of personal information that match the personal information in our records that is the subject of the request.

   If you request disclosure of specific pieces of personal information, then we will need to verify your identity by reference to at least three independent pieces of evidence describing different pieces of personal information that match the personal information in our records that is the subject of the request.

   If you request deletion of all or some personal information, then we will need to verify your identity by reference to at least two or three independent pieces of evidence describing different pieces of personal information that match the personal information in our records that is the subject of the request. The specific number and type of pieces of evidence will vary depending on the sensitivity of the personal information to be deleted.

   If you do not have an account with us or have not made a purchase with us, it is possible that we will not be able to verify your request no matter what evidence you provide because we do not have enough information in our records to ensure that the information in our records is yours. This is because some of the personal information we gather is not identifiable with a specific individual (for example, a cookie which only stores which products you have previously viewed on our website so that these are shown to you at your next visit).

6. Authorized Agents

   If an authorized agent will make a request on your behalf under this section, your agent must provide evidence of authorization to act on your behalf, along with the same level of verification on the part of both the authorized agent and yourself which would be required of an individual acting on his or her own behalf.

7. Contacting us With Questions or Concerns About our Privacy Policies and Practices

   If you have any questions or comments about the collection, processing, or usage of personal information; if you have requests for information, correction, disabling or deletion of data, please use the settings provided in your account’s user area, or else contact us using the information found at the beginning of this privacy policy.

8. Privacy Policy Last Updated

9. Online Eraser Law (CA Business and Professions Code §§ 22581)

   To the extent it is technically feasible and provided for and allowed by applicable law, California residents under the age of 18 may email info@spreadshirt.com anytime to ask for access to information held about you in order to have it corrected, disabled, or deleted, when possible.

   Note that removal or deletion of your information does not ensure complete or comprehensive removal of the content or information posted on our website and service, or on the internet generally.

10. “Shine the Light” Law (California Civil Code Section § 1798.83)

    California residents who use our website may request certain information about our disclosure of personal information to third parties for their direct marketing purposes. To make such a request, please email us at info@spreadshirt.com.

7. Children’s Online Privacy Protection

Our website is not intended or directed at individuals under the age of 13. We do not knowingly collect or keep any information of children under the age of 13. If we discover it, we will delete it as soon as possible.

8. Effective Date and Changes

This policy is effective as of October 12, 2020. Any material changes to this Privacy Policy will be announced to you on the website and/or via email.

Thank you for reading this privacy policy in its entirety!