PRIVACY AND DATA PROTECTION POLICY
Effective Date: August 19, 2026
Last Updated: August 19, 2026
1. Overview
GAROFANO LLC (“GAROFANO,” “we,” “us,” or “our”) respects your privacy and is committed to handling personal information responsibly and transparently.
This Privacy and Data Protection Policy (“Privacy Policy”) explains how we collect, use, disclose, retain, and otherwise process personal information when you:
• visit or interact with garofano.store or any webpage operated by GAROFANO that links to this Privacy Policy;
• create or use a customer account;
• browse, customize, purchase, return, or inquire about our products;
• use our shopping cart or checkout;
• request samples, swatches, customization, design assistance, quotations, or other services;
• apply for or participate in our Trade Program;
• submit a resale certificate or other business documentation;
• subscribe to email or SMS marketing;
• contact customer service;
• interact with our advertisements;
• interact with us through social media; or
• otherwise communicate or transact with GAROFANO.
Collectively, these activities are referred to as the “Services.”
This Privacy Policy applies to personal information processed by GAROFANO LLC in connection with the Services. It does not apply to information handled solely by an unrelated third party under that third party’s own privacy policy.
For purposes of applicable U.S. privacy laws, GAROFANO LLC is the business, controller, or equivalent entity responsible for determining the purposes and means of processing personal information described in this Privacy Policy.
2. United States Scope
GAROFANO currently offers its ecommerce Services and accepts orders for delivery in the United States.
Our Services are intended primarily for individuals located in the United States and are not directed at consumers outside the United States.
Our website may nevertheless be technically accessible from other countries. If you access the Services from outside the United States, your information may be transferred to and processed in the United States and other jurisdictions in which our service providers operate.
Nothing in this Privacy Policy is intended to limit any privacy rights that apply to an individual under mandatory applicable law.
3. GAROFANO LLC Contact Information
The entity responsible for this Privacy Policy is:
GAROFANO LLC 8 The Green, Ste B Dover, Delaware 19901 United States
Privacy email: info@garofano.store
For privacy requests, please use the subject line “Privacy Request.”
4. What We Mean by Personal Information
“Personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with an identified or identifiable individual or household.
Personal information does not generally include information that has been aggregated, deidentified, or anonymized so that it cannot reasonably be associated with an individual, to the extent applicable law treats such information as outside the definition of personal information.
5. Notice at Collection — Categories of Personal Information We Collect
Depending on how you interact with us, we may collect the following categories of personal information.
A. Identifiers and Contact Information
This may include:
• first and last name;
• email address;
• telephone number;
• billing address;
• shipping address;
• postal address;
• customer or account identifier;
• IP address;
• online identifiers;
• cookie identifiers;
• device identifiers; and
• similar identifiers.
We use this information to process transactions, deliver products, communicate with you, manage accounts, provide customer service, prevent fraud, perform analytics, administer marketing, and operate the Services.
B. Customer Account and Authentication Information
If you create an account, we may process:
• username;
• email address;
• password or password-derived authentication information;
• account preferences;
• saved addresses;
• saved products or wish lists;
• account history;
• order history; and
• authentication or security information.
Passwords are intended to be handled using the security mechanisms provided by our website platform. We do not intentionally disclose account passwords to advertising or analytics providers.
C. Commercial and Transaction Information
We may collect:
• products viewed;
• products placed in a shopping cart;
• products purchased;
• order number;
• quantities;
• prices;
• discounts;
• payment status;
• shipping status;
• purchase history;
• return or refund information;
• warranty information;
• customization selections;
• swatch or sample requests; and
• other transaction-related information.
D. Payment and Financial Information
Payments are principally processed through third-party payment processors, digital wallets, financing providers, or banking providers.
Depending on the payment method selected, providers may include services such as:
• WooPayments or Stripe;
• PayPal;
• Apple Pay;
• Google Pay;
• Affirm;
• Klarna;
• Afterpay;
• ACH or banking providers; and
• other payment methods displayed at checkout.
GAROFANO generally does not need to receive or store your complete payment-card number or card security code.
We may receive limited payment-related information such as:
• payment confirmation;
• transaction identifier;
• payment method;
• billing information;
• last four digits of a payment card where provided by the processor;
• payment status;
• financing status; and
• fraud or risk signals.
Payment providers process information according to their own contractual terms and privacy practices.
E. Customer Service and Communications Information
When you communicate with GAROFANO, we may collect:
• emails;
• contact-form submissions;
• customer-service correspondence;
• telephone information;
• questions;
• complaints;
• feedback;
• photographs;
• attachments;
• room measurements;
• dimensions;
• design preferences;
• delivery information;
• access information relevant to delivery;
• customization instructions; and
• other information you choose to provide.
Contact information and form submissions entered through our website may be stored within our WordPress environment and may also be transmitted to GAROFANO personnel by email or other internal communication systems.
F. Trade and Professional Information
If you apply for or participate in our Trade Program, we may collect:
• individual name;
• company name;
• professional or business affiliation;
• business address;
• business telephone number;
• business email address;
• professional role;
• trade status;
• resale certificate;
• tax or business documentation;
• project information; and
• other information reasonably required to establish or administer a trade relationship.
Please do not submit Social Security numbers, personal financial account credentials, or other sensitive information unless GAROFANO specifically requests it and provides an appropriate method for doing so.
G. Internet and Electronic Network Activity
When you use our Services, we and our technology providers may automatically collect information such as:
• IP address;
• browser type;
• operating system;
• device type;
• device identifiers;
• screen resolution;
• language;
• referring webpage;
• pages visited;
• search activity on our website;
• navigation paths;
• links clicked;
• time spent on pages;
• timestamps;
• shopping-cart activity;
• checkout activity;
• interactions with content;
• interactions with advertisements;
• conversion events;
• session information; and
• other information about your interaction with the Services.
H. Approximate Geolocation
We may infer an approximate geographic location, such as city, state, or region, from an IP address or similar technical information.
We do not intentionally collect precise GPS-level geolocation through our website unless expressly disclosed at the time of collection.
I. Marketing and Advertising Information
We may collect or generate:
• newsletter subscription status;
• SMS subscription status;
• marketing consent information;
• email engagement;
• email opens;
• link clicks;
• advertising identifiers;
• advertising impressions;
• advertising interactions;
• attribution data;
• conversion information;
• campaign information;
• audience information; and
• marketing preferences.
J. Inferences
We or our advertising and analytics providers may derive limited inferences from the information described above, such as:
• apparent product interests;
• categories of products viewed;
• likely purchasing interests;
• advertising audiences;
• customer segments; or
• website-use patterns.
We do not use such inferences to make decisions that produce legal or similarly significant effects concerning you.
K. Sensitive Personal Information
Certain U.S. privacy laws define particular information as “sensitive personal information” or “sensitive data.”
In the ordinary operation of our Services, GAROFANO does not seek to collect sensitive information concerning race or ethnicity, religious or philosophical beliefs, health conditions, sexual orientation, biometric identification, citizenship or immigration status, or precise geolocation.
Limited information involved in account authentication, payment processing, or tax/resale documentation may qualify as sensitive information under particular state laws.
We use such information only for purposes reasonably necessary to provide the requested Services, protect accounts, process transactions, comply with law, administer trade relationships, prevent fraud, and perform other legally permitted functions.
We do not use sensitive personal information to infer characteristics about individuals.
6. Sources of Personal Information
We collect personal information from the following categories of sources:
Information You Provide Directly
For example, when you:
• place an order;
• create an account;
• contact us;
• complete a form;
• register for the Trade Program;
• upload a resale certificate;
• request customization;
• subscribe to marketing;
• request a swatch;
• communicate with customer service; or
• otherwise provide information to GAROFANO.
Information Collected Automatically
We collect information automatically through:
• cookies;
• pixels;
• tags;
• local storage;
• server logs;
• analytics tools;
• session replay technologies;
• advertising technologies; and
• similar technologies.
Information From Service Providers and Business Partners
We may receive information from:
• payment processors;
• fraud-prevention providers;
• shipping and delivery companies;
• website hosting providers;
• analytics providers;
• advertising networks;
• social-media platforms;
• email and SMS providers;
• CRM systems;
• customer-support platforms; and
• other service providers.
Information From Advertising and Social Platforms
We may receive campaign, attribution, audience, engagement, conversion, or similar information from platforms through which we advertise or maintain a presence.
7. How We Use Personal Information
We may use personal information for the following purposes.
Providing Products and Services
We use information to:
• process and fulfill orders;
• process payments;
• confirm purchases;
• arrange shipping and delivery;
• provide white-glove delivery where applicable;
• process returns and refunds;
• provide warranty support;
• provide product information;
• provide swatches or samples;
• administer customization;
• provide design assistance;
• manage customer accounts; and
• otherwise perform our obligations to customers.
Trade Program Administration
We use information to:
• evaluate Trade Program applications;
• verify trade eligibility;
• maintain trade accounts;
• process resale certificates;
• administer trade pricing or benefits;
• communicate regarding professional projects; and
• comply with tax, accounting, and regulatory obligations.
Customer Service and Communications
We use information to:
• respond to questions;
• provide customer support;
• resolve complaints;
• communicate about orders;
• provide shipping or delivery updates;
• communicate about customization;
• communicate about warranties, returns, or claims; and
• send administrative or service-related communications.
Website Operation and Improvement
We use information to:
• operate our website;
• maintain shopping-cart and checkout functions;
• analyze website performance;
• diagnose errors;
• understand navigation patterns;
• improve usability;
• identify abandoned or problematic customer journeys;
• test website changes;
• improve content;
• improve product presentation; and
• optimize conversion and customer experience.
Analytics and Measurement
We use information to:
• understand website traffic;
• measure user engagement;
• analyze visitor behavior;
• understand product interest;
• measure advertising performance;
• perform attribution analysis;
• evaluate marketing campaigns;
• generate reports; and
• improve business performance.
Marketing and Advertising
Subject to applicable law and your privacy choices, we may use information to:
• send newsletters;
• send promotional emails;
• send SMS marketing communications where you have provided the required consent;
• create advertising audiences;
• personalize advertising;
• conduct retargeting;
• measure advertising conversions;
• suppress existing customers from particular campaigns;
• determine campaign effectiveness; and
• advertise GAROFANO products on third-party platforms.
Security, Fraud Prevention, and Abuse Prevention
We may use information to:
• authenticate users;
• prevent unauthorized account access;
• identify suspicious transactions;
• prevent fraud;
• investigate security events;
• protect our website;
• enforce our terms;
• protect GAROFANO, our customers, and other persons; and
• maintain the integrity of our Services.
Legal, Tax, Accounting, and Compliance Purposes
We may use information to:
• comply with applicable law;
• comply with tax and accounting obligations;
• retain business records;
• respond to lawful government requests;
• establish, exercise, or defend legal claims;
• enforce contractual rights;
• conduct audits; and
• manage regulatory or legal obligations.
Corporate Transactions
We may process or disclose information in connection with a proposed or completed:
• merger;
• acquisition;
• financing;
• investment;
• corporate restructuring;
• sale of assets;
• bankruptcy;
• insolvency; or
• similar transaction.
8. Session Replay, Heatmaps, and Behavioral Analytics — Lucky Orange
GAROFANO uses Lucky Orange LLC (“Lucky Orange”) for behavioral analytics, heatmaps, visitor analytics, and session replay.
What Session Replay Means
Session replay technology records data concerning how a visitor interacts with our website and uses that data to generate a video-like reconstruction of the visitor’s interaction with the website.
A session replay is not a conventional video recording made using your device’s camera or microphone, and GAROFANO does not use Lucky Orange to record activity occurring outside the GAROFANO website.
Session replay may enable us to review how a visitor navigated our website, including interactions such as:
• pages visited;
• navigation paths;
• mouse movements;
• clicks;
• scrolling;
• interactions with buttons or website elements;
• shopping-cart interactions;
• timing and duration;
• referring pages;
• device and browser characteristics;
• screen resolution;
• IP address;
• approximate location derived from IP address; and
• website HTML or other information required to reconstruct the interaction.
We use this information to understand how visitors use our website, identify technical or usability problems, diagnose errors, understand customer journeys, improve navigation, optimize product pages and checkout, and improve the overall customer experience.
No Keystroke Logging
GAROFANO does not intentionally enable Lucky Orange’s keystroke-logging functionality.
We configure session replay to avoid intentionally collecting text that users type into sensitive input fields.
Sensitive Information and Masking
We intend to configure Lucky Orange and our website so that sensitive fields and content are masked, suppressed, or excluded from session recordings where appropriate.
This includes, in particular, fields relating to:
• payment-card information;
• passwords;
• login credentials;
• sensitive authentication information;
• Social Security numbers;
• sensitive government identifiers; and
• other information that should not be captured through behavioral analytics.
We also seek to mask or exclude sensitive content on checkout, account, contact, and Trade Program forms as appropriate.
You should nevertheless avoid entering unnecessary sensitive personal information into any free-text field on our website.
Lucky Orange’s Role
Lucky Orange processes website-interaction information on GAROFANO’s behalf as a service provider or processor for behavioral analytics and related purposes.
Lucky Orange may use subprocessors in connection with providing its services.
Consent and Opt-Out
Where applicable law requires consent before session replay or similar monitoring technology is activated, we will seek the legally required consent before activating the relevant technology.
You may exercise applicable privacy choices through the “Your Privacy Choices” mechanism made available through our website.
Where technically available, we may also provide access to privacy or opt-out mechanisms made available by Lucky Orange.
Retention of Session Replay Information
GAROFANO intends to retain identifiable Lucky Orange session-replay and behavioral-analytics information for no longer than 12 months, unless a shorter retention period is configured or a longer period is reasonably necessary for security, fraud investigation, litigation, or another legal obligation.
9. Cookies, Pixels, Tags, and Similar Technologies
We use cookies, pixels, tags, local storage, scripts, and similar technologies to operate, secure, analyze, and market the Services.
These technologies may be placed or accessed by GAROFANO or by third parties providing services to us.
Strictly Necessary Technologies
These technologies support functions such as:
• shopping-cart functionality;
• checkout;
• payment processing;
• account authentication;
• website security;
• load balancing;
• fraud prevention;
• user preferences; and
• core website functionality.
Blocking strictly necessary technologies may prevent portions of the Services from functioning correctly.
Analytics and Performance Technologies
These technologies help us understand how visitors interact with the Services and improve performance.
They may include technologies associated with:
• Google Analytics 4;
• Google Tag Manager;
• Lucky Orange; and
• other analytics and performance providers.
Advertising and Retargeting Technologies
We use advertising technologies to measure advertising effectiveness, perform attribution, build audiences, and, where permitted, deliver advertising based on interactions with our Services.
These technologies may include:
• Google Ads and related Google advertising technologies;
• Meta/Facebook Pixel and Meta advertising technologies;
• Instagram/Meta advertising technologies;
• TikTok Pixel and TikTok advertising technologies;
• Pinterest advertising technologies; and
• other advertising and measurement technologies we may use.
Marketing and CRM Technologies
Our marketing and customer-relationship systems may include:
• Mailchimp;
• HubSpot;
• Klaviyo;
• SMS messaging providers; and
• other customer-relationship or marketing service providers.
Not every provider necessarily receives every category of personal information.
10. Google Analytics, Google Ads, and Google Tag Manager
We use Google technologies that may include Google Analytics 4, Google Ads, conversion measurement, remarketing, and Google Tag Manager.
These technologies may collect or receive information concerning:
• browser or device;
• IP address;
• online identifiers;
• pages viewed;
• website interactions;
• referral information;
• advertising interactions;
• purchase or conversion events; and
• related usage information.
Google Tag Manager may be used to manage deployment of analytics, advertising, and other website tags.
Depending on configuration and applicable law, certain disclosures of personal information to Google for advertising may constitute “sharing,” targeted advertising, or another regulated disclosure even if GAROFANO receives no money in exchange.
11. Meta and Instagram Advertising
We use Meta advertising technologies, which may include the Meta/Facebook Pixel and related measurement, advertising, audience, and conversion tools.
Information concerning visits or actions on the GAROFANO website may be transmitted to Meta for purposes that may include:
• advertising measurement;
• conversion attribution;
• audience creation;
• retargeting;
• campaign optimization; and
• advertising delivery.
Depending on applicable law and configuration, these activities may constitute “sharing” of personal information or processing for targeted advertising.
12. TikTok and Pinterest Advertising
We may use TikTok Pixel, Pinterest advertising technologies, and related measurement or conversion tools.
These tools may process online identifiers and information concerning interactions with the GAROFANO website for advertising, measurement, attribution, audience, and retargeting purposes.
Depending on applicable law, these activities may constitute targeted advertising, sharing, or another regulated disclosure.
13. Email Marketing — Mailchimp
GAROFANO uses Mailchimp for newsletter and email-marketing activities.
If you subscribe to marketing emails, information such as your email address, name where provided, subscription status, preferences, and engagement information may be processed through Mailchimp.
Marketing emails may contain technologies that allow us to determine information such as whether an email was delivered, opened, or clicked.
You may unsubscribe from promotional email communications at any time using the unsubscribe mechanism included in our marketing emails.
Unsubscribing from promotional emails will not prevent us from sending non-promotional communications that are necessary to complete transactions or administer an existing customer relationship, such as order confirmations, delivery information, account security messages, or warranty communications.
We may retain limited suppression information after an unsubscribe request so that we can continue to honor your preference.
14. SMS Communications
Where GAROFANO offers SMS marketing, we may collect your telephone number, consent information, messaging preferences, message interaction information, and related records.
Marketing SMS messages are sent only where we have the authorization required by applicable law.
You may opt out of marketing SMS messages by following the opt-out instructions contained in the messages, including replying STOP where supported.
Opting out of marketing SMS does not necessarily affect transactional or service communications that are otherwise permitted by law.
15. WordPress and WooCommerce
Our website operates using WordPress and WooCommerce.
These systems and associated plugins, hosting services, security services, payment extensions, and other integrations may process information necessary to operate:
• customer accounts;
• website forms;
• product pages;
• shopping carts;
• checkout;
• order management;
• customer records;
• website security; and
• other ecommerce functions.
Information submitted through a GAROFANO website form may be stored in our WordPress environment and may be forwarded to authorized GAROFANO personnel.
16. How We Disclose Personal Information
We may disclose personal information to the following categories of recipients.
Website, Hosting, and Technology Providers
We may use providers that support:
• hosting;
• cloud infrastructure;
• databases;
• website development;
• ecommerce functionality;
• security;
• content delivery;
• backups;
• monitoring; and
• technical support.
Analytics and Behavioral-Analytics Providers
These may include Google Analytics and Lucky Orange.
Advertising and Social-Media Partners
These may include Google, Meta, TikTok, Pinterest, and other advertising or social-media platforms.
Some advertising partners may process information independently under their own privacy policies in addition to processing information on our behalf.
Payment, Financing, and Fraud-Prevention Providers
These may include payment processors, digital-wallet providers, installment-financing providers, banks, and fraud-detection providers associated with the payment methods available at checkout.
Marketing, Email, SMS, and CRM Providers
These may include Mailchimp, HubSpot, Klaviyo, SMS providers, and similar providers.
Manufacturers, Fulfillment Providers, and Logistics Providers
Because GAROFANO sells physical products, we may disclose information reasonably necessary to manufacturers, warehouses, freight forwarders, shipping providers, white-glove delivery providers, installers, customs or logistics professionals, and similar service providers.
For example, delivery providers may need your name, telephone number, address, order information, and delivery instructions to deliver your purchase.
Professional Advisers
We may disclose information where reasonably necessary to:
• attorneys;
• accountants;
• auditors;
• insurers;
• financial advisers;
• tax professionals;
• consultants; and
• other professional advisers.
Government Authorities and Legal Recipients
We may disclose information:
• when required by law;
• in response to a valid subpoena, court order, warrant, or governmental request;
• to establish, exercise, or defend legal rights;
• to enforce contractual terms;
• to investigate suspected misconduct;
• to prevent fraud or security incidents; or
• where disclosure is otherwise permitted or required by law.
Corporate Transactions
Personal information may be disclosed or transferred in connection with an actual or proposed merger, acquisition, investment, financing, restructuring, bankruptcy, sale of assets, or similar corporate transaction.
17. Sale, Sharing, and Targeted Advertising
GAROFANO does not sell personal information in exchange for money.
However, certain U.S. privacy laws define “sale,” “sharing,” or “targeted advertising” broadly.
Our use of advertising pixels, tags, cookies, and similar technologies may involve disclosing personal information to advertising platforms for purposes such as audience creation, retargeting, advertising measurement, attribution, campaign optimization, or cross-context behavioral advertising.
Accordingly, depending on your state and the applicable legal definition, some of our advertising activities may be considered:
• “sharing” of personal information;
• processing for “targeted advertising”; or
• potentially a “sale” under a state law whose definition extends beyond transfers for money.
Information potentially involved may include:
• cookie identifiers;
• device identifiers;
• IP addresses;
• online identifiers;
• internet or network activity;
• pages viewed;
• advertising interactions;
• purchase or conversion events;
• approximate location;
• commercial information; and
• inferences regarding product interests.
Recipients may include advertising and social-media platforms such as Google, Meta, TikTok, and Pinterest.
18. Your Privacy Choices
Where required by applicable law, you may opt out of certain uses or disclosures of personal information for:
• sale;
• sharing;
• targeted advertising; and
• certain forms of profiling.
You may exercise applicable online tracking choices using the “Your Privacy Choices” control available through our website.
Where required by applicable law, we also process qualifying browser-based universal opt-out preference signals, including the Global Privacy Control (“GPC”), as requests to opt out of covered sale, sharing, or targeted-advertising activity for the browser or device from which the signal is received.
If we can reasonably associate the signal with a known customer account as required by applicable law, we will apply it as required by that law.
Because some tracking technologies depend on browser cookies, device identifiers, or similar technology, submitting an email request alone may not always disable device-specific advertising technology. Where available, use our online Privacy Choices mechanism or a recognized browser-based opt-out preference signal.
19. Do Not Track Signals
Some browsers offer a “Do Not Track” or “DNT” setting.
Because there has historically been no single universally adopted standard governing all responses to traditional DNT signals, GAROFANO does not treat traditional DNT signals as a universal substitute for the privacy-choice mechanisms described above unless applicable law requires otherwise.
Certain service providers may independently recognize DNT settings.
Where applicable law requires us to recognize a qualifying universal opt-out preference signal, such as GPC, we will process that signal as described above.
20. U.S. State Privacy Rights
Depending on the state in which you reside, the nature of our processing, and whether the applicable statutory thresholds are satisfied, you may have one or more privacy rights.
These rights may include the right to:
• confirm whether we process your personal information;
• access personal information we maintain about you;
• obtain information about categories of personal information collected;
• obtain information regarding the purposes for processing;
• obtain information regarding categories of recipients;
• obtain a copy of certain personal information in a portable format;
• correct inaccurate personal information;
• delete personal information, subject to exceptions;
• opt out of the sale of personal information;
• opt out of sharing of personal information;
• opt out of targeted advertising;
• opt out of certain profiling producing legal or similarly significant effects;
• withdraw consent to certain processing of sensitive data where applicable;
• limit certain uses of sensitive personal information where applicable;
• obtain a list of specific third parties to which personal data has been disclosed where required by applicable law;
• appeal certain decisions concerning privacy requests where applicable; and
• receive equal service and not be unlawfully discriminated against for exercising privacy rights.
The precise rights, definitions, exceptions, and procedures vary by state.
GAROFANO may voluntarily honor a request even where a particular statutory right does not technically apply, but doing so does not constitute an admission that GAROFANO is subject to a particular privacy statute.
21. California Privacy Disclosures
This section supplements the remainder of this Privacy Policy for California residents.
Categories Collected
During the preceding 12 months, GAROFANO may have collected the following categories of personal information described under California law:
• identifiers;
• personal information described in California customer-record statutes;
• commercial information;
• internet or other electronic network activity;
• approximate geolocation information;
• professional or employment-related information in connection with Trade Program applications;
• inferences derived from other information; and
• limited sensitive personal information associated with authentication, payment processing, or documentation where applicable.
GAROFANO does not intentionally collect biometric identifiers, precise geolocation, health information, racial or ethnic information, religious information, sexual-orientation information, or similar sensitive characteristics through the ordinary operation of our ecommerce website.
Business or Commercial Purposes
We use these categories for the purposes described throughout this Privacy Policy, including:
• providing products and Services;
• processing transactions;
• customer service;
• fulfillment and delivery;
• account administration;
• Trade Program administration;
• personalization;
• analytics;
• behavioral analytics;
• session replay;
• website improvement;
• security;
• fraud prevention;
• advertising;
• marketing;
• legal compliance; and
• internal business administration.
Categories Disclosed for Business Purposes
We may disclose personal information for business purposes to the service-provider and recipient categories described in Section 16.
Sale and Sharing
GAROFANO does not sell personal information for monetary consideration.
To the extent the use of advertising technologies constitutes “sharing” for cross-context behavioral advertising under California law, GAROFANO may share the following categories:
• identifiers and online identifiers;
• commercial information;
• internet or electronic network activity;
• approximate geolocation; and
• inferences regarding interests.
Those disclosures may be made to advertising and social-media partners such as Google, Meta, TikTok, and Pinterest.
California residents may exercise applicable opt-out rights using the “Your Privacy Choices” mechanism available through our website or through a qualifying GPC signal.
Sensitive Personal Information
GAROFANO does not use or disclose sensitive personal information for the purpose of inferring characteristics about consumers.
We use limited sensitive information only for purposes reasonably necessary to provide requested products and Services, process transactions, maintain accounts, protect security, prevent fraud, administer business relationships, or comply with law, except as otherwise disclosed.
Minors
GAROFANO does not knowingly sell or share personal information of consumers under 16 years of age.
22. How to Exercise Privacy Rights
To exercise a privacy right, you may email:
info@garofano.store
Use the subject line:
Privacy Request
Please identify the nature of your request and the state in which you reside.
For example, you may state that you are requesting:
• access;
• correction;
• deletion;
• portability;
• opt-out;
• information concerning disclosures; or
• another applicable privacy right.
We may need to verify your identity before fulfilling certain requests.
Verification may involve comparing information you provide with information already maintained by GAROFANO, such as:
• name;
• email address;
• order information;
• shipping address;
• account information; or
• other information reasonably necessary to verify the request.
We will not intentionally request sensitive personal information solely for verification if a less intrusive method is reasonably available.
We may deny or limit a request where permitted by law, including where we cannot reasonably verify identity, where an exception applies, or where fulfilling the request would conflict with legal obligations.
We will respond within the period required by applicable law and may extend the response period where legally permitted.
23. Authorized Agents
Where applicable law permits an authorized agent to make a privacy request on your behalf, we may require:
• proof that you authorized the agent;
• verification of the agent’s identity;
• verification of your identity directly with GAROFANO; or
• other evidence permitted by applicable law.
We may decline requests from agents who cannot demonstrate valid authority.
24. Appeals
Residents of states that provide a right to appeal a privacy-request decision may appeal an applicable denial.
To appeal, email:
info@garofano.store
with the subject line:
Privacy Appeal
Please identify the original privacy request and explain why you believe the decision should be reconsidered.
We will process the appeal as required by applicable law and will provide information concerning additional complaint rights where legally required.
25. Non-Discrimination
We will not unlawfully discriminate against you because you exercise an applicable privacy right.
For example, subject to applicable law, we will not unlawfully:
• deny products or Services;
• charge a different price;
• provide a different quality of Service; or
• retaliate against you
solely because you exercised an applicable privacy right.
This does not prevent us from offering bona fide commercial programs or pricing differences that are permitted by law and not based on unlawful discrimination.
26. Automated Decision-Making and Profiling
GAROFANO may use analytics, advertising, audience segmentation, fraud-detection, and similar technologies.
We do not currently use personal information to make decisions based solely on automated processing that produce legal or similarly significant effects concerning consumers, such as decisions concerning employment, housing, credit, education, insurance, or access to essential services.
If our practices materially change, we will update our disclosures and provide any rights required by applicable law.
27. Data Retention
We retain personal information for no longer than reasonably necessary and proportionate to the purposes for which it was collected, subject to legal, contractual, tax, accounting, security, warranty, dispute-resolution, and recordkeeping requirements.
Our intended general retention periods are as follows.
Orders, Transactions, Payments, and Tax Records
Generally retained for up to seven years after the relevant transaction, or longer where required by tax, accounting, litigation, warranty, contractual, or other legal obligations.
Customer Account Information
Generally retained while the account remains active and for up to three years after account closure or material inactivity, except where information must be retained longer because it forms part of an order, transaction, tax, security, warranty, or legal record.
Trade Program and Resale Documentation
Generally retained for the duration of the trade relationship and for up to seven years afterward where reasonably necessary for tax, accounting, contractual, audit, or legal purposes.
Customer Service, Design, and Inquiry Information
Generally retained for up to three years after the last substantive interaction, unless the information relates to an order, warranty, dispute, customization, continuing project, or other matter requiring longer retention.
Marketing Information
Marketing subscription information is generally retained while you remain subscribed.
If you unsubscribe, we may retain limited suppression or consent records for as long as reasonably necessary to demonstrate and honor your preference and comply with applicable law.
Website Analytics and Advertising Information
Information maintained directly under our control for analytics or advertising purposes is generally retained for no longer than 26 months where technically configurable, unless a shorter period is sufficient or longer retention is reasonably necessary for security, fraud prevention, legal compliance, or aggregated analysis.
Third-party platforms may apply their own retention periods to information they process independently.
Lucky Orange Session Replay and Behavioral Analytics
Identifiable Lucky Orange session-replay and behavioral-analytics information is intended to be retained for no longer than 12 months, subject to shorter configuration settings or legal/security exceptions.
Security and Fraud Information
Security information may be retained for as long as reasonably necessary to prevent, detect, investigate, document, or respond to fraud, abuse, security incidents, or legal claims.
Legal Holds
Any otherwise applicable deletion schedule may be suspended when information is subject to a litigation hold, investigation, regulatory matter, dispute, subpoena, or other legal preservation requirement.
After applicable retention periods expire, information may be deleted, anonymized, deidentified, or securely archived where permitted by law.
28. Data Security
GAROFANO uses administrative, organizational, contractual, and technical safeguards designed to protect personal information against unauthorized access, loss, misuse, alteration, disclosure, or destruction.
Our security approach may include, as appropriate:
• access restrictions;
• account authentication;
• payment-data minimization;
• use of established payment processors;
• website and hosting security controls;
• software updates;
• security monitoring;
• vendor management;
• personnel access limitations; and
• other measures appropriate to the nature of the information processed.
No internet transmission, database, website, or information-security system can be guaranteed to be completely secure.
Accordingly, although we take reasonable measures designed to protect personal information, we cannot guarantee absolute security.
29. Children’s Privacy
GAROFANO’s Services are intended for adults and are not directed to children under 13.
We do not knowingly collect personal information online from a child under 13 in circumstances subject to the Children’s Online Privacy Protection Act without the legally required parental authorization.
We also do not knowingly sell or share personal information of individuals under 16.
If you are a parent or guardian and believe that a child has provided personal information to GAROFANO improperly, please contact:
info@garofano.store
We will investigate and take appropriate action, including deletion where required by law.
30. Third-Party Websites and Services
Our Services may link to or interact with third-party websites, applications, payment services, social-media platforms, delivery services, financing providers, or other services.
Those third parties may collect information directly from you and may have their own privacy policies and terms.
This Privacy Policy does not govern personal information processed independently by those third parties.
We encourage you to review their privacy practices before providing information to them.
31. Social Media
GAROFANO may maintain pages or accounts on third-party social-media platforms.
If you interact with GAROFANO through a social-media service, the platform may provide us with information concerning your interaction, subject to your settings and the platform’s policies.
The social-media platform may separately process information for its own purposes.
32. Business Transfers
If GAROFANO is involved in a merger, acquisition, investment, financing, reorganization, bankruptcy, sale of assets, or similar transaction, personal information may be reviewed, disclosed, or transferred as part of that transaction.
Any successor entity may continue to process personal information subject to applicable law and the commitments applicable to the transferred information.
33. Deidentified and Aggregated Information
We may create aggregated, statistical, anonymized, or deidentified information from personal information.
Where required by applicable law, we will take reasonable measures to prevent deidentified information from being associated with an identifiable individual and will not attempt to reidentify information that applicable law requires us to maintain in deidentified form.
We may use aggregated or deidentified information for legitimate business purposes, including analytics, research, website improvement, product development, business intelligence, and performance measurement.
34. International Processing
Although GAROFANO currently sells to the United States, some service providers or their personnel, systems, or subprocessors may operate in jurisdictions outside your state or outside the United States.
Accordingly, personal information may be processed in jurisdictions whose privacy laws differ from those of your state.
Where mandatory applicable law imposes specific requirements concerning such processing or transfers, we will take the measures required by that law.
35. Changes to This Privacy Policy
We may update this Privacy Policy periodically to reflect:
• changes in our Services;
• changes in our technology;
• new service providers;
• changes to our data practices;
• changes in applicable law; or
• other operational or legal developments.
When we update the Privacy Policy, we will revise the “Last Updated” date at the top.
If a change materially affects how we process personal information, we may provide additional notice where required by applicable law.
We will not use previously collected personal information for a materially different, unrelated, or incompatible purpose without providing any notice or consent required by applicable law.
36. Contact GAROFANO
Questions concerning this Privacy Policy or GAROFANO’s privacy practices may be directed to:
GAROFANO LLC 8 The Green, Ste B Dover, Delaware 19901 United States
Email: info@garofano.store
For privacy-rights requests, please use:
Subject: Privacy Request
For appeals of privacy-request decisions where applicable:
Subject: Privacy Appeal
