PRIVACY POLICY

Effective Date: November 28 2023

DISCLAIMER FOR CALIFORNIA USERS.

Your privacy and rights under the California Consumer Privacy Act (CCPA) and the California Online Privacy Protection Act (CalOPPA) are important to us. We offer this document as a resource to view how we collect, manage, store, and use your Personal Information in the day-to-day running of our website. This Privacy Policy, intended for California residents, can be applied to all website users to disclose how we collect, manage, store, and use your Personal Information as defined under CIV 1798.140(v) of the California Consumer Privacy Act (CCPA).

THE BUSINESS.
This Privacy Policy is between you and the following organization:

Company Name: Grace & Co. Boutique
Address: P.O. Box 7578, Columbus, Mississippi, 39705 Phone: (662) 967-1016
E-Mail: grace.and.co8@gmail.com

Website.
Website URL: www.graceandcoms.com

Website Name: Grace & Co. Boutique PERSONAL INFORMATION COLLECTED.

Identifiers. A real name or alias, postal address, signature, home phone number or mobile phone number, bank account number, credit card number, debit card number or other financial information, physical characteristics or description, e-mail address; account name, Social Security Number (SSN), driver's license number or state identification card number, passport number, or other similar identifiers.

Commercial Information. Records of personal property, products or services purchased, obtained, considered, or other purchasing or consuming histories or tendencies.

Inferences Drawn From Other Personal Information. Profile reflecting a person’s preference, characteristics, psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes.

Hereinafter known as “Personal Information.”

Creating a User Profile or Account. We may collect information directly from you or an agent authorized to act on your behalf. For example, if you, or someone acting on your behalf, provides your name and e-mail to create a profile or an account. We also collect information indirectly from you or your authorized agent. This can be done through information we collect from you while providing content, products, or services.

You can set your browser not to accept cookies, and the above website tells you how to remove cookies from your browser. However, in a few cases, some of our website features may not function as a result.

ADVERTISEMENTS.
Our website does not show advertisements to users. This includes affiliate ads or any products and

services offered by 3rd parties.
HOW WE USE PERSONAL INFORMATION.
We may use or disclose your Personal Information for the following purpose:

-Offerings. To provide products, services, and offerings that serve the best-matched advertisements. -Alerts. To provide e-mail alerts and other communications regarding our products, services, and offerings that may be of interest or that you registered to receive.
-Obligations. To carry out any obligations for paid products, services, offerings, or any obligations under our terms and conditions or terms of use.

-Feedback. To get feedback on website improvements and generally provide an overall better experience.
-Testing. For testing, research, and analysis, of user behavior on the website.
-Protection. To protect against fraud, safeguard data, and the general security of the website. -Security. To detect security incidents, verify human users, and avoid being subject to malicious, deceptive, fraudulent, or illegal activity.

-Law Enforcement. To respond to law enforcement requests as required by applicable law, court order, or governmental regulations.
-Intended Purpose. As described for the intended purpose when collecting your personal information. -Assessment. To evaluate or conduct a merger, divestiture, restricting, reorganizing, dissolution, or outright sale, either wholly or partially, of our assets in which your Personal Information becomes a part of such sale.

Our usage of your Personal Information may change over time, and when such changes occur, we will update this Privacy Policy accordingly.

SELLING PERSONAL INFORMATION.
Our policy is that we DO NOT sell your personal information. If this should change, you will be

notified and this Privacy Policy will be updated. SHARING PERSONAL INFORMATION.

We disclose your Personal Information to 3rd parties for business purposes. The general categories of 3rd parties that we share with are as follows:

-Our 3rd party service providers that, without their services, our website would not be able to function in its current manner;

-Affiliated websites and businesses in an effort to bring you and our users improved services, products, and offerings;
-Other companies, affiliate partners, and 3rd parties that help us advertise products, services, and offerings to you, other users, and potential new customers;

-Third (3rd) parties to whom you, or an authorized agent on your behalf, authorized us to disclose your Personal Information;
-Third (3rd) parties or affiliates in connection with a corporate transaction, such as a sale, consolidation, or merger of our financial institution or affiliated business; and

-Other third (3rd) parties to comply with legal requirements or to disclose Personal Information to government authorities per the rule of law.

In the last 12 months, it is recognized that we have disclosed the aforementioned categories of Personal Information for business purposes.

RIGHT AND CHOICES.

This Section describes your rights and choices regarding how we collect, share, use, and protect your Personal Information, how to exercise those rights, and limits and exceptions to your rights and choices.

a.) Exceptions. The rights and choices in this Section do not apply to you if the information being collected is:
-Aggregate consumer information;
-Deidentified Personal Information; and

-Publicly available information.

b.) Access to Information. If the above exceptions do not apply, and you have not made this request more than twice in a 12-month period, you have the right to request that we disclose certain information to you about our collection and use of your Personal Information over the past 12 months from the date we receive your request. Once we receive and confirm your request on your behalf, we will disclose it to you or your representative:

-The categories of Personal Information we collect;
-The categories of sources for the Personal Information we collect;
-Our business or commercial purpose for collecting or selling such Personal Information;
-The categories of third parties to whom we sold or disclosed the category of Personal Information for a business or commercial purpose;
-The business or commercial purpose for which we sold or disclosed the category of Personal Information; and
-The specific pieces of Personal Information we collected about you in a form that you can take with you (also called a “Data Portability Request”).

c.) Deletion (Erasure) Request Rights. You have the right to request that we delete any of your Personal Information that we collect from you and retain, subject to certain exceptions. Once we receive and verify your request, we will delete and direct our service providers to delete your Personal Information from our records unless an exception applies. We may deny your deletion request if retaining the Personal Information is necessary for us or our service providers to:

-Complete the transaction for which we collected the Personal Information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relationship with you, or otherwise perform our contract with you;
-Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those for such activity;

-Debug to identify and repair errors that impair existing intended functionality;
-Exercise free speech, or exercise another right provided by law;
-Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws when the businesses' deletion of the Personal Information is likely to render impossible or seriously impair the achievement of such research if you previously provided informed consent.
-Enable solely internal and lawful uses of such Personal Information that are compatible with the context in which you provided it.

d.) Exercising Access, Data Portability, and Deletion Rights. To exercise the access, data portability, deletion rights, or any other rights mentioned herein, a consumer or a consumer's authorized agent may submit a verifiable request to us by using the contact details mentioned herein.

e.) Requests. You may only make a verifiable consumer request for access or data portability in relation to this Section. We cannot respond to your request or provide you with Personal Information if we cannot verify your identity or authority to make the request and confirm the Personal Information is related to you.

Making a verifiable consumer request does not require you to create an account with us. We will only use Personal Information provided via a verifiable consumer request to verify the requestor's identity or authority to make the request.

f.) Authorized Agent. An authorized agent is any person or legal entity registered with the Secretary of State or similar office that you have authorized to act on your behalf. If a request is made by an authorized agent acting on your behalf, we may require the following:

-Submission of evidence by you with your permission for the authorized agent to submit a verifiable request on your behalf;
-For you to directly acknowledge, via electronic communication, that the authorized agent is allowed to act on your behalf;

-Require the authorized agent to verify their identity; or
-For a power of attorney document to be submitted that is signed in accordance with state law.

We reserve the right to deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf and cannot verify their own identity to us.

g.) Response Timing and Format. As required under privacy laws, we agree to respond to any verifiable consumer request within 45 days of its receipt. If we require more time, with a maximum of 90 days, we will inform you, in writing, of the reason. Such notification will be by e-mail unless there is another preferred communication method provided.

If applicable, the response we provide will also explain the reasons we cannot comply with a request. For data portability requests, we will select a format to provide your Personal Information that is

readily useable and should allow you to transmit the Personal Information from one entity to another entity without hindrance.

No fee will be charged to process or respond to your verifiable consumer request.

h.) Right of Non-Discrimination. We do not discriminate against you for exercising any of your rights in this Privacy Policy and under applicable laws. Unless permitted by law, we will not:

-Deny you goods or services;
-Charge you different prices or rates for goods, services, and offerings, including through granting discounts or other benefits, imposing penalties; or
-Provide you with a different level of quality of goods or services.

CHANGES AND AMENDMENTS.

We reserve the right to amend this Privacy Policy at our discretion and at any time. When we make changes to this Privacy Policy, we agree to notify you by e-mail or other preferred communication methods.

LINKING TO 3RD PARTIES.

We may provide links to 3rd party sources such as websites, applications, content, or software (“3rd Parties”). When you use a link online to visit 3rd Parties, you will be subject to their privacy policy and the jurisdiction of governing law. It is recommended to familiarize yourself with its terms and disclosures regarding your Personal Information. We are not responsible for the handling of your Personal Information when using, accessing, or visiting 3rd Parties.

SECURITY & PROTECTION.

We use reasonable physical, electronic, and procedural safeguards that comply with federal standards to protect and limit access to Personal Information. This includes device safeguards used in accordance with industry standards.
It is understood by you that the Personal Information you submit to us electronically may not be secure when it is transmitted to us. Specifically, we recommend that you do not use unsecured or public channels to communicate sensitive or confidential information.

CONTACT.

If you have any questions or comments about this Privacy Policy, the ways in which we collect and use your Personal Information, your choices, or your rights regarding such use, or wish to exercise your rights, please do not hesitate to contact us by using the details mentioned in this Privacy Policy.