WALNUTEDGE DATA PROTECTION

GDPR Privacy Policy

Personal Data Protection, Transparency & Your Rights

Information about how personal data is handled in connection with WALNUTEDGE and the rights available under the General Data Protection Regulation where applicable.

INTRODUCTION

Our Approach to Personal Data Protection

WALNUTEDGE recognizes the importance of protecting personal information and providing clear information about how customer data is collected, used, shared, and retained.

This GDPR Privacy Policy explains our approach to personal data processing in connection with our online shopping services and describes the rights that individuals may have under Regulation (EU) 2016/679, commonly known as the General Data Protection Regulation or GDPR.

WALNUTEDGE offers a range of home and lifestyle products, including furniture and storage, bedding and linens, garden and outdoor living products, home decor and rugs, travel bags and luggage, and arts, crafts, and games.

This policy applies to personal data processing activities that fall within the scope of the GDPR. It supplements our general Privacy Policy and other relevant website policies.

01 · SCOPE

When the GDPR Applies

The GDPR establishes rules for the processing of personal data within its territorial and material scope.

It may apply to organizations established in the European Union or European Economic Area, as well as certain organizations outside those regions when their activities involve offering goods or services to individuals in the EU or monitoring their behavior within the EU.

The applicability of the GDPR depends on the circumstances of the relevant processing activity and applicable law.

Where the GDPR applies to WALNUTEDGE's processing of personal data, we are required to comply with its applicable obligations and respect the rights it provides to individuals.

02 · DATA CONTROLLER

Who Is Responsible for Your Personal Data?

For personal data processing activities in which WALNUTEDGE determines the purposes and means of processing, WALNUTEDGE acts as a data controller under applicable data protection law.

The business contact details for privacy inquiries are provided below.

Where another organization independently determines the purposes and means of processing, that organization may act as a separate controller. Certain service providers may instead process information on our behalf as processors.

03 · PERSONAL DATA

Categories of Personal Data

Depending on how you interact with our website, the personal data processed may include the following categories.

The precise categories processed depend on the services used and the information necessary for the relevant activity.

04 · DATA SOURCES

How Personal Data Is Collected

Personal data may be obtained through different interactions with our online store.

• Information you provide when placing an order.
• Details submitted through customer support communications.
• Information provided when requesting a return or refund.
• Technical information generated when accessing website services.
• Information received from payment or transaction service providers where necessary.
• Information received from other service providers involved in fulfilling a requested service.

Where personal data is obtained from a source other than the individual, applicable transparency requirements will be observed.

05 · PROCESSING PURPOSES

Why We Process Personal Data

Personal data may be processed for legitimate and specified business purposes connected with providing online shopping services.

• Receiving, processing, and managing customer orders.
• Facilitating payments and transaction verification.
• Arranging delivery of purchased products.
• Providing order updates and customer support.
• Handling returns, refunds, and product-related inquiries.
• Maintaining website security and preventing fraud.
• Meeting applicable accounting, tax, and legal obligations.
• Maintaining records needed to address disputes or legal claims.
• Improving website functionality where permitted.
• Providing marketing communications where legally permitted and applicable.

Personal data should be used only for specified, explicit, and legitimate purposes, subject to applicable legal requirements governing any further processing.

06 · LEGAL BASES

Lawful Bases for Processing

Where the GDPR applies, personal data must be processed on an appropriate lawful basis under Article 6.

The lawful basis must be determined for each specific processing purpose. Consent is not automatically the basis for all personal data processing.

07 · DATA PROTECTION PRINCIPLES

Core GDPR Principles

Where applicable, the GDPR requires personal data processing to follow important principles.

08 · ORDER PROCESSING

Personal Data Used for Purchases

When a customer places an order, certain information is ordinarily necessary to complete the purchase and provide related services.

• Identifying the customer or intended recipient.
• Processing the selected products and order details.
• Facilitating payment and transaction confirmation.
• Arranging delivery to the specified address.
• Communicating relevant order information.
• Responding to return, refund, or delivery concerns.

Where required information is not provided, WALNUTEDGE may be unable to complete the requested transaction or provide the relevant service.

The information required depends on the transaction and should be limited to what is reasonably necessary.

09 · DATA RECIPIENTS

Sharing Personal Data with Service Providers

Personal data may need to be disclosed to relevant service providers or other recipients to operate an online store and fulfill customer requests.

Depending on the services used, recipient categories may include:

• E-commerce platform and website infrastructure providers.
• Payment processing and fraud prevention providers.
• Delivery and order fulfillment service providers.
• Customer support and communications service providers.
• Technical security and maintenance providers.
• Professional advisers where reasonably necessary.
• Public authorities where disclosure is legally required.

Where a service provider acts as a processor under the GDPR, an appropriate data processing arrangement must be in place where required by Article 28.

This list identifies potential categories of recipients rather than confirming the identity or use of every possible provider.

10 · INTERNATIONAL TRANSFERS

Transfers Outside the EEA

Depending on where relevant service providers operate, personal data may be processed or accessed outside the European Economic Area.

Where the GDPR applies and a restricted international transfer takes place, appropriate transfer mechanisms and safeguards must be used as required by Chapter V of the GDPR.

Depending on the circumstances, these may include:

• An applicable European Commission adequacy decision.
• Approved Standard Contractual Clauses where appropriate.
• Additional safeguards required by the circumstances of the transfer.
• Other transfer mechanisms recognized under applicable law.

The relevant mechanism depends on the destination, recipient, and processing arrangement. Individuals may request information about applicable safeguards where required by law.

11 · DATA RETENTION

How Long Personal Data Is Retained

Personal data should be retained only for as long as necessary to fulfill the purposes for which it was collected, unless a longer retention period is required or permitted by law.

Retention considerations may include:

• The time required to complete an order or provide a requested service.
• Applicable accounting and tax recordkeeping obligations.
• Periods relevant to returns, refunds, or contractual claims.
• The need to investigate security incidents or prevent fraud.
• Applicable limitation periods for legal claims.
• Withdrawal of consent or other relevant privacy requests.

Different categories of personal data may have different retention requirements. No single retention period applies to all information.

12 · SECURITY MEASURES

Protecting Personal Data

Where the GDPR applies, appropriate technical and organizational security measures are required in light of the risks associated with personal data processing.

Depending on the nature of the systems and processing, relevant safeguards may include:

• Appropriate access controls.
• Secure handling of account and transaction information.
• Measures to prevent unauthorized disclosure or alteration.
• Technical monitoring and vulnerability management.
• Procedures for responding to security incidents.
• Appropriate safeguards when using external service providers.

No security measure can eliminate every possible risk. The measures required depend on the nature, scope, context, and purposes of processing.

13 · YOUR GDPR RIGHTS

Your Rights as a Data Subject

Where the GDPR applies, individuals have rights regarding the processing of their personal data, subject to applicable conditions and exceptions.

These rights are not absolute in every circumstance. Requests will be assessed in accordance with applicable law.

14 · AUTOMATED DECISIONS

Automated Decision-Making and Profiling

Article 22 of the GDPR provides protections concerning certain decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects.

If processing of this kind is carried out and falls within Article 22, applicable requirements concerning transparency, lawful grounds, and safeguards must be observed.

This policy does not represent that WALNUTEDGE currently uses automated decision-making of this kind. Customers may contact us to ask whether such processing is relevant to their personal data.

15 · EXERCISING YOUR RIGHTS

How to Submit a Data Protection Request

Where the GDPR applies, you may contact WALNUTEDGE to exercise applicable data protection rights.

To help us identify and understand your request, you may provide:

• Your name and preferred contact details.
• A description of the right you wish to exercise.
• Relevant order information, if your request concerns a purchase.
• Information reasonably necessary to locate the relevant personal data.

We may request additional information where reasonably necessary to confirm identity and prevent unauthorized disclosure of personal data.

We will not require more identity information than is necessary for appropriate verification.

16 · RESPONSE TIMEFRAMES

Responding to GDPR Requests

Where Article 12 of the GDPR applies, a controller must generally provide information on action taken in response to a data subject request without undue delay and, in any event, within one month of receiving the request.

That period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. The individual must be informed of an extension within the initial one-month period, together with the reasons for the delay.

If no action is taken on a request, the controller must provide the relevant explanation and information about available remedies within the applicable timeframe.

Requests are generally handled without charge, subject to the limited circumstances in which the GDPR permits a reasonable fee or refusal.

17 · COOKIES

Cookies and Online Tracking

Cookies and similar technologies may support essential shopping functions, security, preferences, analytics, or advertising, depending on the website configuration.

Where cookie identifiers or related information constitute personal data, applicable GDPR requirements must be observed.

Separate electronic privacy rules may also govern the storing of information on, or accessing information from, a visitor's device.

Where required, optional tracking technologies must be subject to valid consent or other applicable privacy controls.

For more information about cookie categories and browser preferences, please review our Cookie Policy.

18 · DIRECT MARKETING

Marketing Communications and Your Choices

Where WALNUTEDGE provides promotional communications, the collection and use of personal data for those purposes must comply with applicable data protection and electronic marketing laws.

Consent may be required for certain marketing activities, depending on the communication method and relevant jurisdiction.

Where personal data is processed for direct marketing, individuals have the right to object at any time under Article 21 of the GDPR.

An objection to direct marketing must be respected for the processing covered by that objection. Customers may contact WALNUTEDGE regarding applicable marketing preferences.

19 · DATA BREACHES

Personal Data Breach Responsibilities

Where the GDPR applies, personal data breaches must be assessed in accordance with the relevant legal requirements.

Under Article 33, notification to the competent supervisory authority may be required without undue delay and, where feasible, within 72 hours after becoming aware of a personal data breach, unless the breach is unlikely to result in a risk to individuals' rights and freedoms.

Under Article 34, affected individuals must generally be informed without undue delay where a breach is likely to result in a high risk to their rights and freedoms, subject to applicable exceptions.

The specific response depends on the nature of the incident and the legal obligations involved.

20 · CHILDREN'S DATA

Protection of Children's Personal Data

Children's personal data requires particular care under applicable data protection law.

Where processing relies on consent in relation to information society services offered directly to children, Article 8 of the GDPR may impose additional requirements, including parental authorization below the relevant age threshold.

The applicable age threshold may differ between EU Member States within the limits permitted by the GDPR.

If you believe that personal data relating to a child has been processed inappropriately, please contact WALNUTEDGE with details of the concern.

21 · COMPLAINTS

Your Right to Lodge a Complaint

Where the GDPR applies, individuals have the right to lodge a complaint with a competent data protection supervisory authority if they believe the processing of their personal data infringes the GDPR.

In particular, Article 77 recognizes the right to lodge a complaint in the Member State of habitual residence, place of work, or place of the alleged infringement.

You may also contact WALNUTEDGE directly to raise a privacy concern or request clarification.

Contacting WALNUTEDGE first is not a mandatory condition for exercising the right to lodge a complaint with a competent authority.

22 · EU REPRESENTATIVE

EU Representative and Data Protection Officer

Under certain circumstances, an organization established outside the European Union that falls within the GDPR's territorial scope may be required to designate a representative in the Union under Article 27.

Separately, Article 37 requires the designation of a data protection officer in specified circumstances.

These obligations depend on the nature and scope of the relevant processing activities and the exceptions provided by law.

This policy does not identify an appointed EU representative or data protection officer. If either appointment is legally required, the relevant contact information must be made available in accordance with applicable requirements.

23 · POLICY UPDATES

Changes to This GDPR Privacy Policy

WALNUTEDGE may revise this policy to reflect changes in applicable law, data processing activities, website services, or privacy practices.

Where changes materially affect the processing of personal data, appropriate information will be provided in accordance with applicable transparency requirements.

Where a change requires new consent or another legal condition, that requirement must be satisfied before the relevant processing takes place.

This policy does not override mandatory data protection rights or obligations.

24 · FREQUENTLY ASKED QUESTIONS

GDPR Frequently Asked Questions

What is the GDPR?

The GDPR is an EU regulation governing the processing of personal data and providing rights to individuals within its scope.

Does the GDPR apply to every online store?

No. Its applicability depends on factors including establishment, the offering of goods or services to individuals in the EU, and certain monitoring activities.

What is personal data?

Personal data is information relating to an identified or identifiable natural person.

Why is my address needed for an order?

A delivery address is generally necessary to arrange shipment of purchased products.

Can I request access to my personal data?

Yes, where the GDPR applies and the relevant conditions are met, you may exercise the right of access.

Can I ask for incorrect information to be corrected?

Yes. The GDPR provides a right to rectification of inaccurate personal data, subject to applicable conditions.

Can I request deletion of my data?

You may request erasure where the relevant legal conditions are met. Certain information may need to be retained to comply with legal obligations or establish, exercise, or defend legal claims.

Can I object to direct marketing?

Yes. Where the GDPR applies, you may object at any time to processing of your personal data for direct marketing purposes.

Can I withdraw my consent?

Yes. Where processing relies on consent, you may withdraw it at any time.

How long does a GDPR request take?

Under Article 12, controllers must generally respond without undue delay and within one month, subject to permitted extensions.

Will I have to pay to exercise my rights?

Requests are generally handled without charge, subject to limited exceptions under the GDPR.

Can my data be transferred outside Europe?

International transfers may occur where applicable, but restricted transfers must comply with relevant GDPR requirements.

Can I complain to a data protection authority?

Yes. Article 77 provides a right to lodge a complaint with a competent supervisory authority.

How do I submit a privacy request?

Contact WALNUTEDGE using the email address listed below and describe the right you wish to exercise.

25 · PRIVACY REQUEST CHECKLIST

Preparing Your GDPR Request

If you wish to exercise an applicable GDPR right, the following checklist may help you prepare your inquiry.

You are not required to use this checklist or any particular wording to make a valid request under applicable law.

THE WALNUTEDGE APPROACH

Transparency, Respect & Responsible Data Handling

Personal information plays an important role in providing a reliable online shopping experience.

WALNUTEDGE recognizes the importance of clear privacy information, appropriate safeguards, and the ability of individuals to exercise the rights available to them under applicable data protection law.

26 · LEGAL INFORMATION

Relationship to Applicable Data Protection Law

This GDPR Privacy Policy is intended to provide information about relevant personal data processing principles and rights.

Its application depends on the actual processing activities carried out and the legal requirements applicable to those activities.

General descriptions of possible processing activities do not establish that every described technology, recipient, or processing operation is currently used by WALNUTEDGE.

Where the GDPR requires additional information, specific disclosures, designated representatives, technical safeguards, or operational procedures, those obligations must be fulfilled separately.

Nothing in this policy restricts statutory data protection rights or removes obligations imposed by applicable law.

PRIVACY CONTACT

Contact WALNUTEDGE

If you have questions about this GDPR Privacy Policy, wish to make a privacy request, or would like information about the processing of your personal data, please contact us.

Please describe your privacy concern or request clearly. Do not send account passwords, authentication codes, or complete payment card information through ordinary email.

WALNUTEDGE

Thoughtful Living, Everyday Comfort.

Data Protection · Privacy Rights · Transparency