Last updated: July 22, 2025

Petolly (“Company,” “we,” “us,” or “our”) operates this website, including all related information, content, features, tools, products, and services (the “Services”), to provide you with a curated shopping experience. Petolly’s store is powered by Shopify, which enables us to provide the Services to you. This Privacy Policy describes how we collect, use, disclose, and safeguard your personal information when you visit or use our Services or make a purchase, and explains your rights related to that information. In the event of any conflict between this Privacy Policy and our Terms & Conditions, this Privacy Policy will control regarding matters
of privacy and data handling.

Please read this Privacy Policy carefully. By accessing or using our
Services, you acknowledge that you have read and understood this Privacy Policy
and agree to the collection, use, and disclosure of your information as
described herein. If you do not agree with the terms of this Privacy Policy or
our Terms & Conditions, please do not use or access our Services.

Personal Information We Collect or Process

When we use the term “personal information,” we mean information that
identifies, relates to, or can reasonably be linked to you or another
individual. This does not include data that has been de-identified or
aggregated such that it cannot be linked to you. We may collect or process the
following categories of personal information (including inferences drawn from
this information), depending on how you interact with our Services and as
permitted by law:

• Contact Details: Such as your name, billing and shipping address, telephone number, and email address.
• Financial Information: Such as payment card details (credit/debit card number, expiration date, CVV) or other payment information, billing address, and transaction details.
• Account Information: If you create an account, we collect login credentials (username and password), security question answers, and any preferences or settings associated with your account.
• Order and Transaction Information: Records of products viewed, added to cart, purchased, returned, or exchanged, as well as order numbers and purchase history.
• Customer Communications: Information you provide in correspondence with us, including inquiries, reviews, feedback, or communications with customer support.
• Device and Usage Information: Details about how you access our Services, such as IP address, browser type, device identifiers, operating system, referral URLs, and information about your interaction with our website (e.g. pages viewed, links clicked, time spent, and other usage statistics).
• Cookies and Tracking Data: We (or third parties on our behalf) use cookies, web beacons, and similar tracking technologies to collect information about your browsing activities and preferences over time and across different websites or services. (See our Cookie Policy for more details.)

Personal Information Sources

We collect personal information from various sources:

• Directly from You: We collect information you provide to us directly, for example when you create an account, place an order, fill out a form, subscribe to our newsletter, contact us via email or chat, or otherwise communicate with us.
• Automatically from Your Use of the Services: When you visit our website or use our Services, we automatically collect certain device and usage information through cookies and similar technologies (as described above). This includes technical data and browsing behavior.
• From Service Providers: We may receive personal information from third-party service providers that help us operate our business. For example, our payment processors will provide us with certain transaction details, and our analytics partners may provide information about how you interact with our site.
• From Business Partners or Other Third Parties: We may receive information from marketing partners, advertising networks, or social media platforms (for instance, if you engage with our pages on those platforms or if you choose to integrate your account with a social login feature).

How We Use Your Personal Information

We use personal information for a variety of purposes, depending on how
you interact with our Services. These purposes include:

• Providing and Improving the Services: To process your orders and transactions (including payment processing, order confirmation, fulfillment, shipping, and handling returns or exchanges), to provide you with the products and services you request, and to operate, troubleshoot, and improve our website and Services. This includes using personal information to remember your preferences, maintain your shopping cart, and
  personalize your experience (such as product recommendations).
• Communication: To communicate with you about your account or transactions, send you updates or confirmations, respond to your inquiries, provide customer support, and notify you about changes to our policies or terms.
• Marketing and Advertising: To send you promotional communications about new products, special offers, or other news about Petolly that may interest you. We may also use your information to display targeted advertising on our website or on third-party sites and platforms. For example, we might show you ads for products based on items you have browsed or purchased on our site. (You have choices about these communications and advertisements, as described in the “Your Rights and Choices” section below.)
• Security and Fraud Prevention: To protect our customers, our business, and our platform. For example, we may use personal information to verify accounts and activity, detect and prevent malicious, fraudulent or illegal activity, protect against security risks, and enforce our Terms & Conditions. If you create an account, you are responsible for keeping your login credentials
  secure. Please notify us immediately of any unauthorized use of your account.
• Legal and Compliance: To comply with our legal obligations, such as tax and accounting requirements, and to respond to valid legal processes or law enforcement requests. We may also use or disclose your information as needed to investigate or resolve legal claims, enforce our agreements (including our Terms & Conditions), or to protect our rights, property, or safety, or that of our customers and others.

How We Disclose Personal Information

We do not sell your personal information to third parties. However, in certain circumstances we may share or disclose your personal information to third parties, as described below, for legitimate business or legal purposes and in accordance with this Privacy Policy:

• Service Providers: We share personal information with third-party service providers who perform services and functions on our behalf to support our business operations. For example, this includes companies that provide website hosting, e-commerce platform support (such as Shopify), payment processing, order fulfillment and shipping, data analysis, customer support, email delivery, or marketing services. These service providers are given access to information as needed to perform their functions, but are not permitted to use it for other purposes.
• Business and Marketing Partners: In some cases, we may share limited personal information with partners that we collaborate with for business or marketing initiatives, including advertising networks or analytics providers. For instance, because our store is hosted on Shopify, Shopify may facilitate the collection of information about your browsing activities on our site (in
  combination with other sites) to enable personalized advertising services.
  Any such partners will use your information in accordance with their own
  privacy policies. Depending on where you reside, you may have the right
  to direct us not to share your personal information for targeted
  advertising purposes. You can exercise your rights to opt out of
  targeted advertising uses of your information by using the opt-out
  mechanism provided on our Services (for example, via a “Do Not Sell or
  Share My Personal Information” link, if available, or through your account
  preferences).
• When You Direct Us or Consent: We may share information when you specifically request or direct us to do so. For example, if you use social media widgets or plugins on our site (such as a social “share” button), the widget may share information with the social media platform (according to its own privacy policies). If we offer an option to log in via a third-party account (like Google or Facebook), and you choose to use it, we will share information with and receive information from that third party to facilitate the login.
  Similarly, if you ask us to ship a gift directly to a recipient, we will
  use the provided recipient information to fulfill that request.
• Affiliates: We may share your information with our parent company, subsidiaries, joint ventures, or other companies under common control with us (collectively, “affiliates”) in which case we will require those recipients to honor this Privacy Policy.
• Business Transfers: If we consider or undergo a business transaction, such as a merger, acquisition, financing due diligence, reorganization, bankruptcy,
  receivership, or sale of company assets, your personal information may be
  disclosed or transferred to another entity (either as part of the
  transaction or during negotiations) subject to appropriate confidentiality
  measures.
• Legal Requirements and Protection of Rights: We may disclose personal
  information if required to do so by law or legal process, or if we have a
  good-faith belief that such action is necessary to (i) comply with
  applicable laws, regulations, legal proceedings, or government requests
  (such as subpoenas or court orders); (ii) enforce our Terms &
  Conditions or other agreements; (iii) investigate and defend ourselves
  against any third-party claims or allegations; (iv) protect against fraud,
  security, or technical issues; or (v) protect the rights, property, or
  safety of Petolly, our customers, or the public. This may include
  exchanging information with other companies and organizations for fraud
  protection and credit risk reduction.

Relationship with Shopify

Petolly’s online store is hosted by Shopify Inc. (“Shopify”),
which provides us with the e-commerce platform that allows us to sell our
products and services to you. As a result, Shopify collects, uses, and
processes certain personal information about you and your use of our Services,
independent of Petolly’s own data practices. For example, Shopify may handle
your payment information, maintain our website infrastructure, and collect data
regarding your interactions with this store and other merchants on the Shopify
platform.

Because Shopify is an independent service provider and platform, any
personal information processed by Shopify is also subject to Shopify’s own
privacy policy. By using our Services, you acknowledge that Shopify may
receive and process your personal information as described above. Petolly
is responsible for the personal information it collects directly from you and
uses for its own purposes; however, for certain data that Shopify collects or
processes in order to provide and improve its platform and services (including
data from multiple merchants for analytics and advertising features), Shopify
will determine the purposes and means of processing that data and will be
responsible for handling it in accordance with applicable law.

To learn more about how Shopify handles your personal information and the
privacy choices it offers, you can refer to Shopify’s Consumer Privacy Policy
available on Shopify’s website. Depending on your jurisdiction, you may have
certain privacy rights in relation to information that Shopify processes (for
example, regarding targeted advertising or “sale” of personal data under some
laws). You can exercise those rights through Shopify’s privacy tools or Privacy
Portal on Shopify’s website (as applicable). Please note that any purchases
you make through our store are transactions between you and Petolly (not
Shopify), but Shopify assists in facilitating those transactions.

Third-Party Websites and Links

Our Services may contain links to third-party websites or integrate with
services and content provided by third parties that are not owned or controlled
by Petolly. Examples may include payment processors, embedded video players, or
social media features. If you click on a third-party link or otherwise leave
our site to interact with a third-party service, be aware that you are subject
to the privacy policy and terms of that third party, not Petolly’s. We are not
responsible for the content, privacy practices, or security of any websites or
services that are run by third parties. We encourage you to review the privacy
policies and terms of use of any third-party sites or services before providing
any information to them. Your use of third-party websites is at your own risk,
and you expressly relieve Petolly from any liability arising from your use of
such third-party websites or services.

Children’s Data

Our Services are not directed to children and we do not knowingly
collect personal information from individuals under the age of majority
(typically 18 or older, depending on your jurisdiction). We do not sell
products for purchase by children. If you are under the age of majority in your
region, you may use our Services only with the involvement of a parent or
guardian. If we learn that we have inadvertently collected personal data from a
child without proper consent, we will take steps to delete that information as
soon as possible. If you are a parent or guardian and believe that a minor has
provided us with personal information, please contact us so that we can delete
the information. (As of the effective date of this Privacy Policy, we do not
have actual knowledge of selling or sharing personal information of consumers
under 16 years of age.)

Security and Retention of Your Information

We take reasonable measures to protect the personal information we
collect from loss, theft, misuse, unauthorized access, disclosure, alteration,
or destruction. These measures are designed to provide a level of security
appropriate to the risk of processing your personal information. However,
please understand that no security system is impenetrable and we cannot
guarantee absolute security of your data. Transmission of information via
the internet is not completely secure, and any information you send to us
electronically is transmitted at your own risk. We encourage you to use caution
when sharing sensitive information via email or online.

We retain personal information for as long as necessary to fulfill the
purposes we collected it for, as outlined in this Privacy Policy, and for other
legitimate business purposes. This may include retaining your information to
comply with legal obligations, resolve disputes, enforce our agreements, or as
otherwise permitted by law. The exact period of retention will depend on
factors such as the type of data, the nature of our relationship with you, and
any regulatory or legal requirements. When we no longer have a lawful reason to
keep your personal information, we will delete it or anonymize it in accordance
with applicable laws.

Your Rights and Choices

Depending on the laws that apply in your country or state of residence,
you may have certain rights regarding your personal information. These rights
can include:

• Right to Access/Know: You may have the right to request access to the personal information we hold about you, and to receive an explanation of how we use it and who we share it with.
• Right to Delete: You may have the right to request that we delete personal
  information that we have collected from you, subject to certain exceptions
  (for example, we might retain information to complete a transaction you
  requested or as required by law).
• Right to Correct: If you believe that any personal information we are maintaining about you is inaccurate or incomplete, you may have the right to request that we correct or update it.
• Right to Data Portability: In some cases, you may have the right to request a copy of personal information you have provided to us in a portable and usable format, and to transfer it to another entity.
• Right to Opt Out of “Sale” or “Sharing” / Targeted Advertising: Some privacy laws (such as the California Consumer Privacy Act, as amended) provide the
  right to opt out of the “sale” of personal information or the sharing of
  personal information for cross-context behavioral advertising (targeted
  advertising). Petolly does not sell personal information for
  monetary compensation. However, we may share certain information with
  third parties for advertising purposes as described in this Privacy Policy
  (see “How We Disclose Personal Information”). If you wish to opt out of such
  sharing for targeted advertising, you can do so by utilizing the opt-out
  mechanisms on our site (for example, by clicking a “Do Not Sell or Share
  My Personal Information” link, if available, or adjusting your cookie
  preferences). If you have enabled the Global Privacy Control (GPC) in your
  browser, we will treat that as a valid opt-out request in jurisdictions
  where such signals are recognized by law. If we are able to associate a
  GPC signal with your account, we will also apply it to your account preferences. Aside from honoring GPC signals as required by applicable law, we do not respond to other Do Not Track browser signals at this time.
• Right to Opt Out of Marketing Communications: You can opt out of receiving promotional emails or newsletters from us at any time by clicking the “unsubscribe” link in the email or by contacting us directly. Please note
  that even if you opt out of marketing messages, we may still send you
  transactional or service-related communications (such as order
  confirmations, shipping notifications, or responses to your inquiries) as
  these are not promotional in nature.

To exercise any of your applicable privacy rights (access, deletion,
correction, etc.), please contact us using the contact information provided in
the “Contact” section below. We may need to verify your identity before
processing certain requests, which may include asking you to provide additional
information or confirmation (this is to help protect your information from
unauthorized access). In certain cases, we may decline your request if an
exemption applies, or we might only grant it in a limited manner (for example,
if fulfilling a deletion request would interfere with our legal obligations).
We will inform you of the outcome of your request in accordance with applicable
law. You will not receive discriminatory treatment for exercising any of your
rights.

If you have an authorized agent submit a request on your behalf (where
permitted by law), we will require proof that the agent is acting with your
authority. For example, we may require the agent to present your signed
permission, confirmation of identity, or other documentation.

Complaints

We are committed to resolving any concerns about our privacy practices.
If you have a concern or complaint regarding how we handle your personal
information, please contact us using the details below and we will do our best
to address it. You also have the right to escalate your complaint to a data
protection authority or other regulatory body, particularly if you are a
resident of a jurisdiction with comprehensive data protection laws (such as the
EU or UK). Depending on where you live, you may have the right to appeal our
decisions regarding your privacy requests by contacting us and providing
details of your appeal. You also may lodge a complaint with your local
supervisory authority if you believe we have not adequately addressed your
concerns.

International Transfers

Petolly is based in the United States (although we may have operational
presence in other jurisdictions), and the personal information we collect from
you will likely be transferred to, stored in, and processed in the United
States or other jurisdictions. This means that your information may be governed
by privacy laws that are different from those in your home country. By using
our Services or providing us with your information, you acknowledge that your
information may be transferred to and processed in jurisdictions outside of
your own.

If you are located in the European Economic Area (EEA), United Kingdom
(UK), or another region with laws governing data collection and use that differ
from U.S. law, we will take steps to ensure that your personal information
receives an adequate level of protection in the jurisdictions in which it is
processed. For example, when we transfer personal data from individuals in the
EEA or UK to the United States, we rely on appropriate legal mechanisms such as
the European Commission’s Standard Contractual Clauses (SCCs) or other
equivalents approved by relevant authorities, unless the transfer is to a
country that has been officially recognized as providing an adequate level of
data protection.

Changes to This Privacy Policy

We may update or revise this Privacy Policy from time to time to reflect
changes in our practices, technologies, legal requirements, or for other
operational reasons. If we make material changes to this Privacy Policy, we
will notify you by updating the “Last updated” date at the top of this policy
and, if required by law, by providing another prominent notice (such as on our
website or via email). We encourage you to review this Privacy Policy
periodically to stay informed about our data practices and any updates. Your
continued use of our Services after we post any changes to this Privacy Policy
signifies your acceptance of those changes.