Effective Date: 28th October 2024

Last Updated: 28th October 2024

PRIVACY POLICY

This Privacy Policy (“Policy”) describes how EC Design LLC (“EC,” “we,” “us,” or “our”) collect, use, store, process, and share your information in relation to www.erincondren.com (the “Site”). It covers how we comply with the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA)/California Privacy Rights Act (CPRA) and California Civil Code, where they apply. This Policy is part of and incorporated into the Site Terms & Conditions (“Terms”), governing your use of the Site. Parts of the Terms affect this Policy, so be sure to review the Terms prior to using the Site. Capitalized terms not defined herein have the definitions set forth in the Terms.

  • CHANGES TO THIS POLICY. EC reserves the right to revise this Policy from time to time by updating at https://www.erincondren.com/privacy-policy, with the new Policy taking effect on the date of posting. We will directly inform you if any substantial changes take place.

  • APPLICABILITY OF THIS POLICY. This Policy covers our treatment of information that is gathered by the Site, including personally identifiable information or personal data and non-personally identifiable information or non-personal data. In order to access certain features, such as registering for an Account, making a purchase, registering to receive marketing updates from us or interacting with our Live Chat feature, you may be asked to provide personally identifiable information, such as your name, address, phone number, email address, and billing information. This Policy does not apply to information collected by third party Linked Sites, including third party websites or services. We have no control over and no responsibility or liability for any third-party collection, use, disclosure, or retention of your information and that collection, use, disclosure, and retention is not subject to this Policy. Please review the privacy policies of any Linked Sites you may access.

  • INFORMATION COLLECTION AND USE. We collect the following types of personal information from you:

    • Contact Information. We will collect personal information from you if you register to receive our newsletter or contact us. This information may consist of your name, email address, postal address and telephone number. We will use this to send you our newsletter or contact you, such as about products or services that may be of interest to you or that you have requested.

    • Identity Information. We will collect personal information from you if you register on the EC website for an account or make a purchase. This information may consist of your name, email address, postal address and telephone number and demographic information such as age and gender. We will use this for the administration of your account.

    • Account, Login, Purchase and Shipping Information. We will collect personal information from you if you create an account on the Site (“My Account”), which will include Login details, including your username and password. If you make a purchase, you will be asked to provide some information about yourself, including credit card information and potentially the names and addresses to whom purchases are shipped (if applicable). We will use this to fulfil orders to you, and manage and administer your account.

    • Payment Information. Payments information, including bank details and card details, will be handled through PayPal or CyberSource, our third-party payment processor. EC does not access or store your credit card information, although we may maintain a record of your invoice or receipt to fulfil orders to you. PayPal or CyberSource will collect and may retain your credit card information in order to process your payment. We do not control PayPal or CyberSource or their use of your information.

    • Product History, Viewing History and Interests Information. When you make a purchase or save certain products, we will also store information on your orders, any “Wishlist” of products that you create, or products you save as “Favorites.” We will use this information to provide you a more personalized experience and observe interactions and user trends on our e-commerce platform.

    • Product Personalization Information. The Site may allow you to voluntarily submit content created by you in connection with your purchase of personalized products. For example, you may provide text selected by you, or your photos or other images (“User Content”), which we will collect and store. Even if you remove or delete your User Content, copies may remain in cached or archived areas of the Site. We may also collect additional personal information from you if you elect to upload User Content from a third-party website or application (e.g., Facebook, Instagram, or Flickr, etc.). We will use this to observe user activity, trends and interests on our e-commerce platform.

    • Requests and Queries. The Site may provide functionality which allows you to voluntarily submit request or inquiry forms, including, for example, requests for help with the Site or requests for product information. We will use the information in these forms to respond to your queries or requests.

    • Live Chat Information. The Site may allow you to instantly “chat” with an EC agent in your browser in order to answer your questions about the Site or our products. Our third-party live chat software provider (Kustomer) will collect information about you and share it with us. This collection may include your name, email address, postal address, purchase history, Cookie ID, Device ID and IP Address. We may also collect information on the number of chats you have had with us, the pages you have visited on the Site, the time you spend on each page. We will use this information to respond to your queries or requests.

    • Special Category Information. We will not process any personal data on website visitors or customers that includes Sensitive or Special Category Information, within the definition of the GDPR. This includes information that reveals racial or ethnic origin, political opinions, religion or philosophical beliefs, trade union membership, genetic data, data concerning health or data concerning sexual life or criminal convictions.

    • Sensitive Personal Information (SPI). We will not process any personal data on website visitors or customers that includes Sensitive Personal Information under the CPRA or CCPA. This includes information that reveals Social Security Numbers and driver’s license numbers, financial account information (credit/debit card numbers in combination with required access codes), precise geolocation, racial or ethnic origin, religious or philosophical beliefs, or union membership, genetic data and biometric information concerning your health or sexual orientation.

    • Technical Information. Similar to other web sites, we may collect some information automatically indirectly from you and store it in log files. We may use Google Analytics or other third-party analytics providers to collect this information about the Site. This collection may include your IP address, referring/exit pages and URLs, other browser history, operating system, cookie information, the pages you requested and viewed and the amount of time spent on particular pages. We collect this Technical Information in order to better understand our customer base and user interests, to more efficiently operate our business, to promote our products and services, and to improve the quality of the Site. Where we collect Technical Information via cookies, this is covered by the Cookies section below.

    • Sale of Information. We do not provide any financial incentives in relation to the collection, deletion and sale of your personal data. Where we share your personal data with service providers, we ensure that this is necessary for our purposes and that such service providers are limited from disclosing or selling such personal data. However, we may share personal data collected through certain cookies with third parties (third party cookies), which is commonly referred to as a ‘sale’ of information under the CCPA/CPRA. You can opt-out to this through the Do Not Sell My Personal Information link through this page or our Cookie Preferences Center.

    • Automated Decision-Making. We do not make automated decisions about you in the course of any of the purposes above.

  • INFORMATION RETENTION.


    We will retain your information for the following stated periods. Reference to the duration of the customer relationship typically relates to as long as you have an active account with Erin Condren:

    Type of Data Retention Period Justification
    Contact Information eg., Name, e-mail address, postal address, telephone number Duration of the customer relationship (existing customer) Two years maximum (newsletter registrants) To keep in contact with our customers and newsletter registrants
    Identity Information eg., Name, e-mail address, postal address, telephone number, age and gender Duration of the customer relationship or two years maximum (whichever is the longer) To ensure the operation of user accounts
    Account, Login, Purchase and Shipping Information eg. username, purchase history Duration of the customer relationship or two years maximum (whichever is the longer) To facilitate customer orders and provide customer service support.
    Payments Info eg. invoice, receipt Duration of the customer relationship or seven years from the last transaction (whichever is the longer) To comply with the contract for the sales of goods and comply with legal obligations around tax and financial law.
    Product History, Viewing History (eg. list of products or wishlists) Duration of the customer relationship or two years maximum (whichever is the longer) To ensure the operation of our website and to keep up to date with users’ interests.
    Product Personalization Information eg. photos, user content, Friends’ email addresses Duration of the customer relationship or two years maximum (whichever is the longer) To ensure the operation of user accounts
    Requests and queries (Name, Email Address, content of query) Duration of the customer relationship To respond to user queries
    Live Chat Information (Name, Email Address, Postal Address, Purchase History, Cookie ID, Device ID, IP Address) Duration of the customer relationship To respond to user queries
    Technical information (Pages visited, activity, time spent on each page, IP Address, Operating system, Cookie ID) Pages visited, activity, time spent on each page, IP Address, Operating system: Duration of the customer relationship or two years maximum (whichever is the longer)

    Cookie ID: See Cookies Policy    		 To ensure the operation of our website and to keep up to date with users’ interests.

  • INFORMATION DISCLOSURE.
    We may share your Personal Data with, or disclose your Personal Data to, the following categories of third parties. We do not sell your personal information to any third parties within the meaning under the CCPA/CPRA other than as described in Section 4 above.

    • Parent companies, subsidiaries, and affiliates. We may share your Personal Data with our parent companies, subsidiaries, and/or affiliates for purposes consistent with this Privacy Policy. Our parent companies, subsidiaries, and affiliates will be bound to maintain that Personal Data in accordance with this Privacy Policy.

    • Contractors and service providers. We may share your Personal Data with our contractors and service providers who process Personal Data on behalf of EC (as our “agents”) to perform certain business-related functions. These companies include:

      • our marketing agencies
      • marketing tools (Kustomer - USA, Mailchimp - USA, Sailthru – USA)
      • e-commerce event tracking providers (North Beam – USA)
      • database service providers (Mailchimp – USA, Oracle - USA)
      • backup and IT service providers (Arsenal Tech – USA, India)
      • email service providers.

      When we engage another company to perform such functions, we may provide them with such Personal Data as your name, contact information, customer demographic profile and interests, purchase history, content of your queries and personalised products and our platform browsing information, in connection with their performance of specific functions. We will only share such Personal Data with these third parties that act as service providers and do not allow our service providers to use your personal data for anything else besides delivering the service they provide to us.


      In order to ensure the compliance of third parties with GDPR and CCPA/CPRA, we require our contractors and service providers to commit to respecting a similar level of the protection of personal data to that under GDPR or CCPA/CPRA in their contracts with us. We make sure that our third parties that are contractors and service providers are subject to confidentiality agreements and are handling your Personal Data solely under our instructions. With our contractors and service providers, we enter into a contract that describes the purpose and requires the recipient to both keep that personal information confidential and not use it for any purpose except for the purposes specified above.

      • We remain liable for the processing of your personal data when transferred onwards to a third party who acts as an agent on our behalf (including our contractors and service providers), including where that agent acts contrary to the GDPR.

    • Business transfers. As we develop our business, we might sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution, or similar event, Personal Data may be part of the transferred assets.

    • Wishlist. If you create a “Wishlist” on the Site, it will be publicly accessible to any other users who enter your account-related email address in the “View Friend’s Wishlist” search box. If you do not want someone to access your Wishlist, do not share your Account-related email address with them.

    • Aggregated or de-identified data. We may disclose aggregated or de-identified information for any purpose. For example, we may share aggregated or de-identified information with prospects or partners for business or research purposes. Once Personal Data is in an aggregated form, for purposes of this Privacy Policy, it is no longer Personal Data.

    • Legal requirements. We may disclose your Personal Data if required to do so by law in order to, for example, respond to a subpoena or request from law enforcement, a court or a government agency (including in response to public authorities to meet national security or law enforcement requirements), or in the good faith belief that such action is necessary to (i) comply with a legal obligation, (ii) protect or defend our rights, interests or property or that of third parties, (iii) prevent or investigate possible wrongdoing in connection with the Sites, (iv) act in urgent circumstances to protect the personal safety of users of the Sites or the public, or (v) protect against legal liability. In these circumstances, the recipients are responsible for the use of your personal data for their own purposes.

    • We will never transfer your personal data to any companies other than those and for the purposes listed in this section.

  • INTERNATIONAL TRANSFERS

    In addition to our local systems, the information that you provide to us may be stored in our secure servers which are located in California (USA), outside the United Kingdom (UK), the European Economic Area (EEA) and Switzerland. In addition:

    • We also use third-party hosting and IT service providers with data centres in the US, which may involve transferring data to these regions
    • We also transfer personal data to our clients, partners and third-party hosting and IT service providers, typically in the US

    For this purpose, where required, we conduct a transfer impact assessment of any dataflows before the transfer takes place, which involves considering the risk of using certain providers or providing access to data to foreign jurisdictions, and what measures we have in place to ensure the security of any personal data we share. On top of this, where we share or transfer the personal data of EU, UK or Swiss citizens, we ensure the following safeguards are in place:

    • We are registered to the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF), as set forth by the U.S. Department of CommercePlease see our EU-U.S. Data Privacy Framework policy here for more information: https://www.erincondren.com/eu-us-data-privacy-policy
    • We rely on other adequacy decisions adopted by the European Commission, the UK Information Commissioner’s Office, and/or the Swiss Federal Data Protection and Information Commissioner (FDPIC).
    • We rely on EU-approved Standard Contractual Clauses (SCCs), UK International Data Transfer Agreements (IDTAs) or clauses approved by the FDPIC between our legal entities and third parties

  • INFORMATION SECURITY MEASURES. We have implemented appropriate organizational, technical, and administrative measures to protect Personal Data within our organization, including security controls to prevent unauthorized access to our systems. We also exercise care in facilitating the transmission of information between your device or computer and the third-party servers that operate and store information for the Site. Where necessary, we also enter into agreements with any third-party providers involved in hosting or storing personal data to ensure they meet similar security standards.

    While we take reasonable steps to secure your Personal Data from loss, misuse, interference and unauthorized access, modification and disclosure, you should be aware no security procedures or protocols are ever guaranteed to be completely secure from intrusion or hacking, and there is therefore always some risk assumed by sharing Personal Data online. If you have reason to believe that your account has been compromised, please contact us at privacy@erincondren.com.

  • CHILDREN’S PRIVACY.

    • This Site is not intended for use by Children. EC is committed to protecting the privacy and safety of children. This Site is a general audience site and children under the age of 16 are prohibited from using or registering for an Account on the Site. We will not knowingly collect any information from children; nor will we send any email correspondence to them. We may ask for your birth date during the registration process in order to verify your age. If we learn that we have collected information from a child under the age of 16, we will remove that information immediately and delete it from our servers. Children under the age of 16 should always ask their parents or guardians before providing their information online. If you believe information from a child has been submitted to the Site, please notify us at: privacy@erincondren.com.

    • California Minors. We may provide Site users the ability to publicly post information, for example by submitting user testimonials or other User Content. If you are a California resident under age 18 and you are unable to remove publicly-available User Content that you have submitted to us, you may request removal by contacting us at: privacy@erincondren.com. When requesting removal, you must be specific about the information or User Content you want removed and provide us with specific information, such as the URL for each page where the information is located, so that we can find it. We are not required to remove any User Content or information that: (1) federal or state law requires us or a third party to maintain; (2) the User Content or information was not posted by you; (3) we anonymize the User Content or information so that you cannot be identified; (4) you don’t follow our instructions for removing or requesting removal; or (5) you received compensation or other consideration for providing the User Content or information. Removal of your user content or information from this Site does not ensure complete or comprehensive removal from our systems or those of our service providers. We are not required to delete the User Content or information posted by you; our obligations under California law are satisfied so long as we anonymize the User Content or information or render it invisible to other users and the public.

  • EU/UK/SWISS RIGHTS. Under certain circumstances (for EU, UK and Swiss citizens) under the UK or EU GDPR or the Swiss Federal Act on Data Protection (FADP), you have the following rights in relation to your personal data:

    • Request access to your personal data - This enables you to receive a copy of the personal data we process about you and to check that we are lawfully processing it.

    • Request correction of your personal data - This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide to us.

    • Request erasure of your personal data - This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it.

    • Object or opt-out to processing of your personal data, including where it is no longer necessary for the original processing purpose or it is to be used for a purpose that is materially different from the purpose(s) for which it was originally collected, as specified above.

    • Request restriction of processing your personal data - This enables you to ask us to suspend the processing of your personal data in specific circumstances, for example, when you challenge the accuracy of the data we hold.

    • Request transfer of your personal data to you or to a third party - This enables you to ask us to provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format.

    • Your right to withdraw consent - This enables you to ask us to stop using your data, if we collected it with consent. However, please note we may have processed your data up to the point where you withdrew your consent.

    • Your right to challenge, express your view, or have a human review any automated decisions we make. This happens when these decisions may have a big impact on you. We do not make such decisions in the course of our activities.

    You can exercise your rights by contacting us at privacy@erincondren.com.

    We will make good faith efforts to resolve requests to correct inaccurate information except where the request is unreasonable, requires disproportionate technical effort or expense, jeopardizes the privacy of others, or would be impractical. We may not be able to provide you with all of your information if your account is closed or terminated for any reason. We may not accommodate a request to change information if we believe the change would violate any law or legal requirement or cause the information to be incorrect. Additionally, we may not be able to delete your Personal Data except by also deleting your user account.

  • CCPA/CPRA RIGHTS. If you are a Californian resident, under the CCPA or CPRA, you have the following rights in relation to your personal information:

    • Request information about the processing of your personal data and access it – This enables you to receive information on the processing of your personal data and a copy of personal information we hold about you in a commonly used format. This applies to information we have processed over the last 12 months.

    • Request rectification of your personal information – This enables you to correct and rectify inaccurate data that may be held about you. You can also request Erin Condren to complete any incomplete data, or to record a supplementary statement.

    • Request deletion of your personal information – This enables you to ask us to delete personal data where there is no good reason for us to keep it, unless the law allows us to. This applies to information we have processed over the last 12 months.

    • Request information about the processing of your personal data in relation to our data selling and disclosure practices - This enables you to receive information on the personal data we have collected about you and shared with our service providers. You are also entitled to know which of your personal information has been sold and to whom, however, please note that we do not engage into selling any of your personal information to other companies.

    • Request information on the disclosure of personal data for direct marketing purposes - This enables you to receive information on the third parties to whom we have disclosed your information and the categories of disclosed personal data, which has been shared for direct marketing purposes.

    • Request to opt-out of sharing your sharing personal information whether or not money or service is exchanged as a result of you sharing this information – This enables you to exercise opt-out requests specifically to email direct marketing. We must fulfil these within ten business days of receiving the request, as per the CAN-SPAM Act.

    • Request to opt-out from the sale of personal data to other companies – This enables you to cease any selling of your personal information, which covers when we share cookie data with third party cookie providers. You can opt-out of this “sale” of your personal data through the Do Not Sell My Personal Information link within the footer of any web page. You can also use the Cookie Preferences Center to opt-out of any sale of your personal data through cookies without detriment or preventing you from accessing Erin Condren website content.

    • Request not to be subject to decisions based solely on automated processing (including profiling) – This applies if the decision produces legal effects concerning you or similarly significantly affects you. Erin Condren shall make all attempts not to conduct automated decision-making. However, if such automated decision making occurs, you will be allowed to opt out in accordance with the CCPA/CPRA.

    • Not to be discriminated as our consumer when you exercise any of the aforementioned rights - This means that, in an event of any of your request to us, we will not engage in or suggest any discrimination against you, in particular, we will not deny our services to you, we will not charge you differently, and we will not provide different level or quality of services to you, unless such difference is reasonably related to the value provided to you or you have agreed to enter into a financial incentives programme with us.

    To exercise your CCPA/CPRA rights as described above, you have the right to make a verifiable request twice within a 12-month period. You may submit a verifiable consumer request to us by mailing us at: privacy@erincondren.com.

    Only you, or a person registered with the California Secretary of State that you authorise to act on your behalf, may make a verifiable consumer request related to your personal information. You may also make a verifiable consumer request on behalf of your minor child.

    Your verifiable consumer request must:

    • Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative.
    • Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.

    Making a verifiable consumer request does not require you to create an account with us. However, we do consider requests made through your Erin Condren account where the request relates to personal information associated with that account.

    We cannot respond to your request or provide you with personal information if we cannot verify your identity or authority to make the request and confirm the personal information relates to you. We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

  • OPT-OUT FROM OUR NEWSLETTER: We may send you marketing emails, surveys, or newsletters to notify you about products or services that may be of interest to you. If you would like to stop receiving marketing emails from us, please click on the unsubscribe link at the bottom of any marketing email you receive. You may also opt-out by contacting us at privacy@erincondren.com.

    If you opt-out, you will continue to receive service-related emails. Any non-service related email you receive from us will include an unsubscribe link that will allow you to opt-out of receiving future emails. Please note that it may take up to forty-eight (48) hours for us to process an unsubscribe request. Even after you opt out of all electronic communications, we will retain your Personal Data in accordance with this Privacy Policy, although we will no longer use it to contact you. Opt-out requests specifically to email direct marketing will be fulfilled within ten business days of receiving the request as, per the CAN-SPAM Act.

  • OPT-OUT OF COOKIES. If you want to avoid this Site placing Cookies on your browser, you can revisit our Cookie Preferences Center and opt-out from the relevant Cookies. You may set your browser settings to attempt to reject cookies or manually delete the Cookies using your browser settings and may still use the Site.

    If you would like to opt out of Google Analytics tracking, please visit the following link: Google Analytics Opt-out Browser Add-on.

  • “DO NOT TRACK” SETTINGS. Do Not Track is a privacy preference that users can set in their web browsers. When a user turns on the Do Not Track signal, the browser sends a message to websites requesting them not to track the user. At this time, EC does not respond to Do Not Track browser settings or signals. In addition, we deploy cookies on our Sites. Cookies may be used by us to collect information about you and your Internet activity, even if you have turned on the Do Not Track signal. As such, the only way to completely “opt out” of the collection of any information through cookies or other tracking technology is to actively manage the settings on your browser to delete and disable cookies and other tracking/recording tools.

  • EU REPRESENTATIVE. The General Data Protection Regulation (GDPR) requires organisations that are not established in the European Union (EU) to designate a representative in the EU if they are subject to the GDPR for example offering products or services to EU citizens. Erin Condren may undertake processing activities to which the GDPR applies, for this reason we have appointed a representative to act on our behalf.

    Erin Condren does not have an establishment in the European Union, therefore we have appointed a local representative based in Ireland who you may address any issues and/or queries you may have relating to our processing of your personal data and/or this Privacy Notice more generally. Our EU representative will also deal with data subject rights requests for EU citizens and enquiries by EU supervisory authorities on Erin Condren’s behalf.

    Our EU representative is Gemserv Ireland. Our EU representative can be contacted directly by emailing them at the following address eurepresentative@gemserv.com .

  • CONTACT DETAILS. If you have any questions, requests, concerns, or suggestions regarding this privacy policy and your rights, please contact us at:

    If we fail to respond to or address your request, you have the right to complain to your local data protection authority.