G L O B A L   P R I V A C Y   P O L I C Y

KLOTHING LIMITED

One standard, applied wherever you are in the world

KLOTHING LIMITED respects your privacy. We collect the minimum we need, we tell you what we do with it, we do not sell it, and we give you meaningful control over it. That is the standard, regardless of which country you are in and regardless of whether the law where you live requires it.

PART A — SCOPE AND WHO WE ARE

1. Who we are and how to contact us

1.1 KLOTHING LIMITED (KlōTHiNG, we, us, our) is a company registered in New Zealand under NZBN 9429052132117, with its registered office at Level 1 / 18–26 Amelia Earhart Avenue, Airport Oaks, Auckland 2022, New Zealand. We operate the marketplace at klothing.co.nz.

1.2 For the purposes of the EU and UK General Data Protection Regulation we are the controller of your personal data. Under the New Zealand Privacy Act 2020 we are the agency holding your personal information. Under Australian law we are the APP entity. Under the Indian Digital Personal Data Protection Act 2023 we are the Data Fiduciary. Under South African law we are the responsible party.

1.3 Privacy enquiries, requests and complaints: Privacy Officer, KLOTHING LIMITED, [insert privacy email], or by post to the address in clause 1.1. Please mark correspondence “Privacy Request”.

1.4 Where we are required to appoint a representative, data protection officer or local contact in a jurisdiction into which we expand, their details will be published in Schedule 1 for that jurisdiction before we begin offering goods there.

2. Who this Policy covers and what it applies to

2.1 This Policy applies to personal information we collect from or about: customers and prospective customers; visitors to the Site; recipients of orders placed by someone else; people who contact us; people who subscribe to our communications; partner-brand and supplier contacts; applicants for roles with us; and visitors to our market stalls, pop-ups and events.

2.2 In this Policy, personal information means information about an identified or identifiable individual, and includes what other laws call personal data, personally identifiable information, or personal records. We use the single term throughout.

2.3 This Policy applies wherever you are. We currently sell to customers in New Zealand and Australia and we intend to expand into further markets. Schedule 1 is structured so that additional jurisdictions can be added as we enter them, without changing the global standard in Parts A to J.

2.4 This Policy does not apply to third-party sites, payment providers, buy-now-pay-later providers or carriers, each of which handles your information under its own privacy policy. Clause 10 of our Website Terms of Use applies to third-party links.

PART B — WHAT WE COLLECT

3. Categories of personal information

3.1 We do not seek sensitive information. We do not collect information about your health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, sexual orientation, genetic or biometric data, or criminal history, and we ask that you do not provide it. When you volunteer such information, for example in a message to us, we handle it only to respond to you and delete it when no longer required.

3.2 We do not collect government identifiers such as passport, driver licence, national insurance, social security or tax numbers, except where a customs authority or a law requires it for an international shipment, in which case we collect only what is required and hold it only as long as required.

3.3 We do not store full payment card numbers. Card payments are processed directly by our payment provider under its own security standards.

4. How we collect

4.1 Directly from you, when you create an account, place an order, contact us, subscribe, enter a competition, leave a review, or buy from us in person.

4.2 Automatically, through cookies and similar technologies when you use the Site. See clause 13.

4.3 From third parties, being our payment and buy-now-pay-later providers, carriers, fraud prevention services, and analytics and advertising platforms where you have consented to them.

4.4 From someone else, where a person places an order for delivery to you. If you give us another person's information, you confirm you have their authority to do so and that you have told them about this Policy.

4.5 If you choose not to provide information we need to fulfil an order, we may be unable to accept the order. We will tell you when information is required rather than optional.

PART C — WHY WE USE IT

5. Purposes and legal bases

5.1 We use personal information only for the purposes set out below, or for a purpose directly related to one of them that you would reasonably expect. Where the law where you live requires a legal basis, the basis is shown.

5.2 Where we rely on legitimate interests, we have assessed that our interest does not override your rights and freedoms. You may object to that processing at any time under clause 11.

5.3 Where we rely on consent, you may withdraw it at any time. Withdrawal does not affect processing carried out before withdrawal.

5.4 If we ever need to use your information for a materially different purpose, we will tell you and, where required, obtain your consent first.

6. Marketing and your control over it

6.1 We send marketing only where you have opted in, or where the law where you live permits us to contact an existing customer about similar products with a clear opt-out. We do not buy marketing lists.

6.2 Every marketing message contains a working unsubscribe link. You may also change your preferences in your account or by contacting us. We unsubscribe promptly and in any event within the period required by law.

6.3 Unsubscribing from marketing does not stop transactional messages such as order confirmations, dispatch notifications and returns correspondence, which are part of fulfilling your order.

6.4 We comply with the New Zealand Unsolicited Electronic Messages Act 2007, the Australian Spam Act 2003, and equivalent electronic marketing rules in every market we operate in, including the requirement to identify the sender and provide a functional unsubscribe facility.

PART D — WHO WE SHARE IT WITH

7. Disclosure

7.1 We disclose personal information only as set out in this clause. We share the minimum necessary and we require every recipient to protect it.

7.2 We do not sell your personal information. We do not, and will not, sell, rent or trade personal information for money or other valuable consideration, in any market, to any party. This applies whether or not the law where you live prohibits it.

7.3 We do not share your personal information for cross-context behavioural advertising or targeted advertising except where you have given consent through our cookie controls, and you may withdraw that consent at any time.

7.4 Every processor and service provider we engage is bound by a written agreement requiring them to act only on our instructions, apply appropriate security, assist with your rights requests, and delete or return the information at the end of the engagement.

PART E — INTERNATIONAL TRANSFERS

8. Sending information across borders

8.1 We are based in New Zealand. Our service providers are located in a number of countries. Your personal information will therefore be transferred to, stored in and accessed from countries other than the one you live in.

8.2 Before transferring personal information outside the country in which it was collected, we satisfy ourselves that it will be protected by comparable safeguards. Depending on the jurisdiction, we rely on one or more of: a finding of adequacy by the relevant authority; Standard Contractual Clauses approved by the European Commission or the UK International Data Transfer Agreement; the New Zealand Privacy Act 2020 Information Privacy Principle 12 comparable-safeguards test; Australian Privacy Principle 8 arrangements; binding contractual commitments imposing our global standard; and, where required, your explicit consent.

8.3 New Zealand holds a European Commission adequacy decision, which supports transfers from the EEA to us.

8.4 We conduct a transfer risk assessment where required and apply supplementary technical and organisational measures, including encryption in transit and at rest, where a destination country's laws warrant them.

8.5 You may request details of the safeguards applying to a particular transfer by contacting our Privacy Officer.

PART F — RETENTION, SECURITY AND BREACHES

9. How long we keep it

9.1 We keep personal information only for as long as we need it for the purpose we collected it for, or for as long as a law requires.

9.2 When information is no longer required we securely delete it or irreversibly de-identify it. Aggregated and de-identified information that cannot reasonably identify you may be retained indefinitely.

10. Security and privacy breaches

10.1 We apply technical and organisational measures appropriate to the risk, including encryption in transit and at rest, access controls on a need-to-know basis, multi-factor authentication on administrative accounts, vetted service providers, logging, and staff training.

10.2 No system is perfectly secure. You are responsible for keeping your account password confidential and for using a strong, unique password.

10.3 If a privacy breach occurs that is likely to cause serious harm, or that meets the notification threshold in a relevant jurisdiction, we will notify the affected individuals and the relevant regulator within the timeframe that jurisdiction requires. This includes the Office of the Privacy Commissioner in New Zealand, the OAIC in Australia, the relevant supervisory authority in the EU and the ICO in the UK within 72 hours, and the equivalent authority in any other market.

10.4 We maintain a breach register and an incident response process, and we review both annually.

PART G — YOUR RIGHTS

11. The rights we give everyone, everywhere

11.1 We extend the following rights to every individual, in every country, regardless of whether the law where you live requires it:

11.2 To exercise a right, contact our Privacy Officer using the details in clause 1.3. We may need to verify your identity before acting, and we will only ask for what is necessary to do so.

11.3 We respond free of charge and within 30 days, or sooner where the law where you live requires it. If a request is complex we may extend by a further 30 days and will tell you why within the original period. We may decline a request that is manifestly unfounded or excessive, and we will explain why and how to challenge that decision.

11.4 Some rights are qualified. We may need to retain information to complete an order, meet a tax or legal obligation, prevent fraud, or establish or defend a legal claim. Where we decline a request in whole or in part, we will tell you which exception applies.

11.5 You may use an authorised agent to make a request on your behalf where the law where you live permits it. We will ask for evidence of that authority.

12. Automated decision-making and profiling

12.1 We do not make decisions producing legal or similarly significant effects about you based solely on automated processing.

12.2 We use limited automated processing for fraud screening of orders and for personalising product recommendations and marketing. Where an automated fraud screen results in an order being declined, you may ask for human review by contacting us, and we will provide it.

12.3 We do not engage in profiling of children, and we do not use personal information to infer sensitive characteristics.

PART H — COOKIES, CHILDREN AND CHANGES

13. Cookies and similar technologies

13.1 We use cookies, pixels, local storage and similar technologies. Strictly necessary cookies keep the Site and your cart working and cannot be switched off. Functional, analytics and advertising technologies are used only where you consent, in every market, whether or not consent is legally required there.

13.2 You can manage your preferences at any time through the cookie control on the Site, and through your browser settings. We honour recognised opt-out signals, including Global Privacy Control, where your browser sends them.

13.3 Blocking strictly necessary cookies will prevent parts of the Site from working.

14. Children

14.1 The Site is not directed at children. You must be at least 18 to create an account or place an order, as set out in clause 4.4 of our Website Terms of Use.

14.2 We do not knowingly collect personal information from anyone under 18. Where a jurisdiction sets a lower digital-consent age, we still apply 18 for account creation and purchasing.

14.3 If you believe a child has provided us with personal information, contact our Privacy Officer and we will delete it promptly.

15. Changes to this Policy

15.1 We may update this Policy. The current version is always published at klothing.co.nz and the version and effective date are shown at the end of this document.

15.2 Where a change materially affects how we use your personal information, we will notify you by email or by a prominent notice on the Site before it takes effect, and where the law requires it we will obtain your consent.

15.3 As we enter new markets we will add the relevant jurisdiction to Schedule 1 before we begin offering goods there. Adding a jurisdiction does not reduce the global standard in Parts A to J.

16. Complaints

16.1 If you are unhappy with how we have handled your personal information, contact our Privacy Officer first. We will acknowledge within 5 working days and respond substantively within 20 working days.

16.2 If you are not satisfied with our response, you may complain to the data protection authority for your country. The authorities for our current and anticipated markets are listed in Schedule 1.

16.3 You may complain to your authority at any time. You do not have to come to us first.

SCHEDULE 1 — JURISDICTION-SPECIFIC TERMS

This Schedule adds to the global standard in Parts A to J. Where it gives you more than the global standard, this Schedule prevails. Where a jurisdiction is not yet listed, the global standard applies in full and the jurisdiction will be added before we begin offering goods there.

A. New Zealand

A.1 We comply with the Privacy Act 2020 and the 13 Information Privacy Principles. We are an agency for the purposes of that Act.

A.2 You have the right to access and correct your personal information under IPP 6 and IPP 7. Where we decline, we will tell you the reason and your right to complain.

A.3 Cross-border disclosures are made in accordance with IPP 12, on the basis that the recipient is subject to comparable safeguards.

A.4 Notifiable privacy breaches are reported to the Office of the Privacy Commissioner and to affected individuals as soon as practicable.

A.5 Regulator: Office of the Privacy Commissioner, privacy.org.nz.

B. Australia

B.1 We comply with the Privacy Act 1988 (Cth) and the 13 Australian Privacy Principles.

B.2 APP 8 applies to cross-border disclosure. We take reasonable steps to ensure overseas recipients handle your information in accordance with the APPs.

B.3 You may deal with us anonymously or under a pseudonym where it is lawful and practicable, although we cannot deliver an order without a name and address.

B.4 Eligible data breaches are notified under the Notifiable Data Breaches scheme.

B.5 Regulator: Office of the Australian Information Commissioner, oaic.gov.au.

C. European Economic Area and United Kingdom

C.1 We comply with the EU GDPR and, for the UK, the UK GDPR and Data Protection Act 2018. We are the controller.

C.2 Your rights include access, rectification, erasure, restriction, portability, objection, withdrawal of consent, and the right not to be subject to solely automated decision-making with legal or similarly significant effects.

C.3 Legal bases are stated in the table at clause 5.1. Where we rely on legitimate interests you may request our balancing assessment.

C.4 Transfers out of the EEA and UK rely on adequacy, Standard Contractual Clauses or the UK International Data Transfer Agreement, together with a transfer risk assessment where required.

C.5 New Zealand benefits from a European Commission adequacy decision.

C.6 Where required, we will appoint an Article 27 representative in the EU and the UK before offering goods or services there, and publish their details here.

C.7 Breaches are notified to the supervisory authority within 72 hours where the threshold is met.

C.8 Regulators: your national supervisory authority in the EEA; the Information Commissioner's Office, ico.org.uk, in the UK.

D. United States

D.1 We comply with applicable state privacy laws, including the California Consumer Privacy Act as amended by the CPRA, and the comprehensive privacy laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana and other states as they take effect.

D.2 Notice at collection. The categories of personal information we collect, the purposes, the categories of recipients and our retention periods are set out in clauses 3, 5, 7 and 9.

D.3 We do not sell personal information and we do not share it for cross-context behavioural advertising other than with your consent through our cookie control. We have not sold or shared the personal information of consumers under 16.

D.4 We do not collect sensitive personal information for the purpose of inferring characteristics, so no right to limit its use arises.

D.5 Your rights include the right to know, access, correct, delete, obtain a portable copy, opt out of sale, sharing and targeted advertising, and not to be discriminated against for exercising them. You may use an authorised agent.

D.6 We honour Global Privacy Control signals as a valid opt-out request.

D.7 We do not offer financial incentives in exchange for personal information.

D.8 Regulators: the California Privacy Protection Agency and the California Attorney General; your State Attorney General elsewhere.

E. Canada

E.1 We comply with the Personal Information Protection and Electronic Documents Act and, for Quebec residents, the Act respecting the protection of personal information in the private sector as amended by Law 25.

E.2 We obtain meaningful consent, which may be expressed or implied depending on sensitivity, and you may withdraw consent subject to legal and contractual restrictions.

E.3 Quebec residents additionally have rights to data portability and to be informed of automated decision-making, and we will inform you before a transfer outside Quebec following a privacy impact assessment.

E.4 Regulators: Office of the Privacy Commissioner of Canada; Commission d'accès à l'information du Québec.

F. Asia

F.1 India. We comply with the Digital Personal Data Protection Act 2023. We are the Data Fiduciary and you are the Data Principal. You have rights of access, correction, erasure, grievance redressal and nomination. Consent notices are provided in English and, on request, in any language in the Eighth Schedule to the Constitution. Regulator: Data Protection Board of India.

F.2 Singapore. We comply with the Personal Data Protection Act 2012, including the Do Not Call provisions. Our Privacy Officer is the data protection officer for these purposes. Regulator: Personal Data Protection Commission.

F.3 Japan. We comply with the Act on the Protection of Personal Information. You may request disclosure, correction, cessation of use and cessation of third-party provision. Regulator: Personal Information Protection Commission.

F.4 South Korea. We comply with the Personal Information Protection Act, including separate consent for distinct purposes and for cross-border transfer. Regulator: Personal Information Protection Commission.

F.5 Other Asian markets. Where we enter a market governed by another framework, including Malaysia, Indonesia, Thailand, the Philippines, Vietnam, Hong Kong SAR or the United Arab Emirates, we will comply with it and add it to this Schedule before offering goods there.

G. Africa

G.1 South Africa. We comply with the Protection of Personal Information Act 2013. We are the responsible party and our service providers are operators. You have rights of access, correction, deletion and objection. Regulator: Information Regulator (South Africa).

G.2 Nigeria. We comply with the Nigeria Data Protection Act 2023. Regulator: Nigeria Data Protection Commission.

G.3 Kenya. We comply with the Data Protection Act 2019. Regulator: Office of the Data Protection Commissioner.

G.4 Other African markets. When we enter a market governed by another framework, including Egypt, Ghana, Morocco, Rwanda, Uganda or Zambia, we will comply with it and add it to this Schedule before offering goods there.

H. Latin America and other regions

H1 Brazil. We comply with the Lei Geral de Proteção de Dados. Regulator: Autoridade Nacional de Proteção de Dados.

H.2 Other markets. When we enter any other market, we will comply with its data protection framework, publish the applicable rights and regulator in this Schedule, and appoint any local representative required, before offering goods there.

I. Where a conflict arises

I.1 If this Policy conflicts with a mandatory requirement of the law where you live, that law prevails to the extent of the conflict, and the rest of this Policy continues to apply.

I.2 Where two frameworks both apply to you, we apply whichever gives you the greater protection.