Poke Piñata — Privacy Policy

We collect information that you provide directly to us, information generated through your use of the Services, and information received from certain third parties.

The categories of information we may collect include:

When you create or maintain an account, we may collect:

• Name;
• Email address;
• Username or account identifier;
• Password or authentication information;
• Telephone number, if provided;
• Billing and shipping addresses;
• Account preferences;
• Age or date-of-birth information where reasonably necessary to verify eligibility; and
• Other information you voluntarily provide.

When you purchase physical merchandise through the Services, we may collect and retain information relating to the transaction, including:

• Products purchased;
• Purchase date and time;
• Purchase price;
• Order number;
• Payment status;
• Shipping information;
• Product-selection information;
• Product-selection results;
• Returns, refunds, and adjustments;
• Vault activity;
• Buyback activity;
• Store-credit or Wallet activity; and
• Related customer-service communications.

To operate and maintain the Services, we may collect information concerning your activity on the platform, including:

• Product-selection history;
• Products associated with your account;
• Vault records;
• Products purchased, received, transferred, sold, or otherwise processed through the Services;
• Transaction identifiers;
• Dates and times of transactions;
• Technical information associated with product-selection transactions;
• Error reports;
• Fraud-prevention information;
• Security-related activity; and
• Other information reasonably necessary to maintain accurate business and transaction records.

We may maintain records concerning product-selection activity for purposes including transaction fulfillment, customer support, system integrity, dispute resolution, fraud prevention, regulatory compliance, and auditing.

Payments may be processed through third-party payment processors.

Depending on the payment method and processor used, we may receive information such as payment method type, transaction status, payment authorization information, and limited payment-account information.

Unless expressly stated otherwise, Poke Piñata does not need to receive or store your complete credit-card number or other full payment credentials. Such information may be collected and processed directly by our third-party payment processors in accordance with their own privacy policies and security practices.

If you request shipment of physical merchandise, we may collect and use:

• Recipient name;
• Shipping address;
• Telephone number, if provided;
• Shipping method;
• Tracking information; and
• Delivery status.

If you contact us, we may retain the contents of your communications and related information, including customer-service requests, email correspondence, support tickets, and other communications.

When you access the Services, we may automatically collect certain technical information, such as:

• IP address;
• Browser type;
• Operating system;
• Device type;
• Device identifiers;
• Referring and exit pages;
• Pages or features accessed;
• Date and time of access;
• Session information;
• Approximate geographic information derived from technical data; and
• Other diagnostic, performance, and security information.

We may use cookies, pixels, local storage, software development kits, and similar technologies to operate and improve the Services.

These technologies may be used to:

• Keep you signed in;
• Maintain shopping-cart and account functionality;
• Remember preferences;
• Understand how customers use the Services;
• Measure performance;
• Detect fraud or abuse;
• Improve website functionality;
• Analyze traffic; and
• Support other legitimate business purposes.

We may use information we collect for the following purposes:

We use information to:

• Create and maintain customer accounts;
• Process orders;
• Process payments;
• Provide customer support;
• Maintain product and transaction records;
• Fulfill shipping requests;
• Operate Vault services;
• Process eligible Buyback transactions;
• Maintain Wallet or store-credit balances;
• Provide requested features; and
• Otherwise provide the Services.

We use transaction and technical information to operate our product-selection systems and maintain accurate records concerning transactions.

We may use information to monitor system performance, identify errors, investigate technical problems, conduct audits, and maintain the integrity of product-selection systems.

We do not use an individual customer's identity, spending level, profitability, purchasing history, or prior product-selection results for the purpose of intentionally manipulating that individual's product-selection outcome.

This provision does not prevent us from taking reasonable actions to prevent fraud, abuse, automated activity, account compromise, collusion, or other prohibited conduct, or from applying system-wide rules disclosed in our Terms and Conditions.

We may use information to:

• Detect and prevent fraud;
• Detect unauthorized transactions;
• Protect accounts;
• Investigate suspicious activity;
• Prevent abuse of promotions or Services;
• Detect automated or malicious activity;
• Protect our systems;
• Enforce our Terms and Conditions; and
• Protect customers, employees, business partners, and the public.

We may use information to:

• Analyze business performance;
• Improve products and Services;
• Develop new features;
• Conduct research and analytics;
• Maintain records;
• Manage customer relationships;
• Communicate with customers;
• Perform accounting and financial reporting;
• Comply with contractual obligations; and
• Conduct other legitimate business activities.

We may use information where reasonably necessary to:

• Comply with applicable law;
• Respond to lawful governmental requests;
• Respond to subpoenas, court orders, or legal processes;
• Establish, exercise, or defend legal claims;
• Protect our rights or property;
• Investigate violations of law or our agreements; and
• Protect the safety and security of individuals or the Services.

We may disclose information to third parties when reasonably necessary to operate the Services or for the purposes described in this Privacy Policy.

Depending on the circumstances, recipients may include:

We may use third-party service providers for services including:

• Payment processing;
• Hosting;
• Cloud storage;
• Website and application infrastructure;
• Shipping and fulfillment;
• Customer support;
• Email delivery;
• Authentication;
• Fraud prevention;
• Security;
• Analytics;
• Accounting;
• Data management; and
• Other business functions.

These providers may receive information necessary to perform services on our behalf.

We may provide necessary information to shipping carriers, fulfillment providers, warehouses, logistics companies, and other parties involved in delivering physical merchandise.

We may use analytics providers to understand how customers interact with the Services and to measure performance.

Analytics information may include device, browser, traffic, feature-use, and session information.

We may disclose information to attorneys, accountants, auditors, insurers, financial advisors, consultants, and other professional advisors where reasonably necessary for legitimate business purposes.

If Poke Piñata is involved in a merger, acquisition, financing, reorganization, sale of assets, bankruptcy, dissolution, or similar transaction, information may be transferred as part of that transaction.

We may disclose information when we reasonably believe disclosure is necessary to comply with law, protect rights or property, investigate misconduct, enforce our agreements, or protect the safety of customers or others.

We may disclose information when you direct us to do so or otherwise provide appropriate consent.

We do not sell customer information for money in the ordinary meaning of the term "sell."

However, certain privacy laws may define "sale," "sharing," "targeted advertising," or similar concepts more broadly than ordinary commercial usage.

Where applicable law gives you a right to opt out of a particular type of data processing, we will provide the applicable choice mechanism.

We use cookies and similar technologies for essential and, where applicable, non-essential purposes.

Certain cookies and similar technologies are necessary to operate the Services, including:

• Authentication;
• Account security;
• Shopping-cart functionality;
• Checkout;
• Fraud prevention;
• Session management; and
• Other essential functions.

Disabling these technologies may prevent portions of the Services from functioning properly.

We may use analytics technologies to understand:

• Which features are used;
• How customers navigate the Services;
• Website and application performance;
• Error rates;
• Traffic patterns; and
• General customer interaction with the Services.

Where required by applicable law, we will provide appropriate choices regarding non-essential cookies or similar technologies.

We may use information to provide product recommendations, improve search results, personalize website content, or make the Services more relevant to customers.

Where personalization is used, it may be based on information such as products viewed, products purchased, account preferences, and interactions with the Services.

Personalization and analytics are not intended to alter the outcome of an individual product-selection transaction based on that customer's spending, profitability, identity, or previous product-selection results.

Because the Services may include randomized product-selection features, we maintain certain transaction and technical records relating to product selections.

These records may include:

• Transaction identification;
• Account identification;
• Date and time;
• Product pool or offering associated with the transaction;
• Applicable product-selection parameters;
• Relevant software or system information;
• Product-selection result;
• Fulfillment information; and
• Other information reasonably necessary to reconstruct or audit a transaction.

These records may be retained for business, security, customer-service, dispute-resolution, accounting, auditing, and legal purposes.

If you use the Vault, we may maintain records concerning physical merchandise associated with your account.

Vault information may include:

• Product description;
• Product identification;
• Quantity;
• Date received;
• Date placed into the Vault;
• Account associated with the product;
• Storage status;
• Shipping requests;
• Buyback requests;
• Fees, where applicable; and
• Other information necessary to administer the Vault.

Vault records may be retained for as long as reasonably necessary to administer the service and satisfy applicable legal, accounting, contractual, security, and business requirements.

If you use an optional Buyback service, we may collect information relating to the transaction, including:

• Product submitted;
• Product condition;
• Authentication or inspection information;
• Offer amount;
• Customer acceptance or rejection;
• Payment information;
• Shipping information;
• Communications; and
• Transaction records.

We may retain Buyback records for accounting, fraud prevention, dispute resolution, legal compliance, and other legitimate business purposes.

You are responsible for maintaining the confidentiality of your account credentials and for promptly notifying us if you believe your account has been compromised.

We may use technical and administrative information to detect unauthorized access, account takeover, suspicious activity, or other security concerns.

We may require additional verification before permitting certain account actions.

We maintain reasonable administrative, technical, and physical safeguards designed to protect information against unauthorized access, loss, misuse, alteration, or disclosure.

Security measures may include encryption, access controls, authentication requirements, monitoring, backups, logging, and other safeguards appropriate to the nature of the information and the Services.

However, no website, application, database, electronic transmission, or storage system can be guaranteed to be completely secure.

Accordingly, we cannot guarantee that information will never be accessed, disclosed, altered, or destroyed through circumstances beyond our reasonable control.

We retain information for as long as reasonably necessary for the purposes described in this Privacy Policy, including:

• Providing the Services;
• Maintaining customer accounts;
• Completing transactions;
• Maintaining financial and business records;
• Resolving disputes;
• Preventing fraud;
• Enforcing agreements;
• Maintaining product-selection and transaction records;
• Complying with legal obligations; and
• Protecting our rights and property.

Different categories of information may be retained for different periods.

When information is no longer reasonably necessary, we may delete, de-identify, aggregate, or otherwise dispose of it in accordance with our applicable policies and legal obligations.

You may request deletion of your account by contacting us through the contact information provided below.

Account deletion does not necessarily result in immediate deletion of all information.

We may retain certain information when reasonably necessary or legally required for purposes including:

• Fraud prevention;
• Security;
• Accounting;
• Tax reporting;
• Legal compliance;
• Dispute resolution;
• Enforcement of agreements;
• Transaction records; and
• Protection of our legal rights.

Where appropriate, retained information may be de-identified or otherwise separated from active account information.

Depending on your location and applicable law, you may have rights concerning personal information we maintain about you.

These may include the right to:

• Request access to personal information;
• Request correction of inaccurate information;
• Request deletion of personal information;
• Request a copy of certain information;
• Request data portability;
• Opt out of certain forms of processing;
• Withdraw consent where processing is based on consent; and
• Appeal certain decisions concerning privacy requests.

These rights are subject to applicable legal limitations and exceptions.

To submit a privacy request, contact us using the information in the "Contact Us" section.

We may need to verify your identity before completing certain requests.

The verification process may require information reasonably necessary to confirm that the person making the request is authorized to make it.

We will not request unnecessary sensitive information for verification.

Where applicable law permits you to use an authorized agent to submit a privacy request on your behalf, we may require reasonable documentation establishing the agent's authority.

We may also independently verify the request as permitted by applicable law.

We will not unlawfully discriminate against you for exercising privacy rights granted to you by applicable law.

However, certain Services or features may require information necessary to provide those Services, and certain differences in service availability, pricing, or functionality may be permitted by applicable law.

Privacy rights vary by jurisdiction.

Residents of certain U.S. states may have additional rights under applicable comprehensive state privacy laws.

Where such laws apply to Poke Piñata and provide rights beyond those described generally in this Privacy Policy, we will process qualifying requests in accordance with applicable law.

Nothing in this Privacy Policy is intended to limit rights that cannot lawfully be waived.

If California privacy law applies to you, you may have additional rights concerning your personal information.

Depending on the circumstances, these may include rights to:

• Know or access certain personal information;
• Delete certain personal information;
• Correct inaccurate personal information;
• Obtain certain information in a portable format;
• Opt out of certain sales or sharing of personal information;
• Opt out of certain targeted advertising or profiling where applicable; and
• Limit certain uses of sensitive personal information where required by law.

We will honor applicable California rights to the extent required by law.

If Virginia privacy law applies to you, you may have rights provided by the Virginia Consumer Data Protection Act or successor legislation, subject to applicable thresholds, exemptions, and exceptions.

These rights may include access, correction, deletion, portability, and certain opt-out rights.

We will process qualifying requests in accordance with applicable Virginia law.

The Services are intended for individuals 18 years of age or older.

We do not knowingly direct the Services to children under 13 and do not knowingly collect personal information from children under 13 through the Services.

If we learn that we have collected personal information from a child under 13 without legally appropriate authorization, we will take reasonable steps to delete that information.

If you believe a child has provided personal information to us, please contact us.

The Services may contain links to websites, applications, payment processors, shipping providers, social-media services, or other third-party services.

We do not control the privacy practices of third parties.

Your use of a third-party service may be governed by that third party's privacy policy and terms.

We encourage you to review the privacy policies of third parties before providing them with personal information.

Payment transactions may be processed by third-party payment providers.

Those providers may independently collect and process payment information in accordance with their own privacy policies and terms.

Poke Piñata is not responsible for the privacy or security practices of independent third-party payment providers except to the extent required by applicable law.

We may use your email address or other contact information to send:

• Order confirmations;
• Shipping updates;
• Account notices;
• Security notifications;
• Customer-service communications;
• Changes to the Services;
• Changes to legal terms;
• Transaction-related notices; and
• Other administrative communications.

You may opt out of certain promotional communications.

You generally cannot opt out of essential transactional, security, or legally required communications.

If you receive promotional communications from us, you may unsubscribe using the mechanism included in the communication or by contacting us.

Unsubscribing from promotional communications does not necessarily stop transactional or service-related communications.

Some browsers offer "Do Not Track" settings.

Because there is not currently a universally accepted technical standard for responding to all Do Not Track signals, our Services may not respond to every browser-based Do Not Track signal.

Where required by applicable law, we will honor legally recognized privacy preference signals.

Information may be processed and stored in the United States or other locations where Poke Piñata or its service providers operate.

If you access the Services from outside the United States, your information may therefore be transferred to and processed in the United States.

Where applicable law requires additional protections for international transfers, we will take reasonable steps to comply with those requirements.

We may create aggregated, statistical, or de-identified information from information collected through the Services.

We may use and disclose such information for legitimate business purposes to the extent permitted by applicable law.

Where information has been de-identified, we will not attempt to re-identify it except where permitted or required by law.

Poke Piñata may maintain business records concerning customer transactions and use of the Services.

These records may include information necessary to:

• Verify transactions;
• Resolve disputes;
• Investigate fraud;
• Maintain accounting records;
• Audit product-selection systems;
• Comply with legal obligations;
• Establish or defend legal claims; and
• Protect the integrity of the Services.

Deletion of an account does not necessarily require deletion of these records.

We may update this Privacy Policy from time to time.

When we make changes, we may update the "Last Updated" date at the beginning of the policy.

If we make material changes, we may provide additional notice where required by applicable law.

Your continued use of the Services after the effective date of an updated Privacy Policy constitutes acknowledgment of the updated policy to the extent permitted by law.

This Privacy Policy should be read together with the Poke Piñata Terms and Conditions of Sale and Use.

If there is a conflict between this Privacy Policy and a mandatory requirement of applicable privacy law, the applicable law controls.

Nothing in this Privacy Policy is intended to create rights or obligations beyond those required by applicable law or expressly provided by our agreements.

Although we take reasonable measures to protect information, you acknowledge that no security system is completely secure.

We cannot guarantee absolute security of information transmitted to or stored by the Services.

You should use reasonable precautions when creating and maintaining your account, including using a strong, unique password and protecting your account credentials.

By using the Services, you acknowledge that you have had an opportunity to review this Privacy Policy.

Nothing in this Privacy Policy limits any privacy rights or consumer protections that cannot lawfully be waived.