PRIVACY POLICY

7.2 Your Right to Deletion & Data Portability

You have the right to:

• Request deletion of your Personal Information (subject to legal obligations to retain)

• Receive a copy of your Personal Information in a portable format (GDPR: "right to data portability")

• Correct or update inaccurate information

• Restrict our use of your information

• Request information about our data retention practices

To Exercise These Rights:
Contact us at privacy@inbox.lorilothian.com with a clear request:

• "I request deletion of my account and all associated Personal Information."

• "Please provide a copy of the Personal Information you hold about me."

• "I request to exercise my right to data portability."

Include:

• Your name

• Email address

• Account number (if applicable)

• Specific request details

• Any supporting documentation

The Company will respond within:

• 30 days (GDPR & UK, Canadian, and Australian privacy laws)

• 45 days (CCPA/California - extendable to 90 days)

• 5 business days (Initial acknowledgment; full response within timeframes above)

We may ask you to verify your identity before processing requests.

7.3 Account Deletion

To delete your account:

1. Log into your account

2. Navigate to account settings and select "Delete Account"

3. Confirm the deletion (may require password re-entry)

Upon deletion:

• Your account will be deactivated immediately

• Personal Information will be deleted within 30 days (retention of purchase history for tax purposes continues per Section 7.1 for 7 years)

• You may lose access to digital products (except where you retain offline copies)

• No refunds are issued upon account deletion (except as specified in Terms of Service)

• You will receive a confirmation email of deletion

8. INTERNATIONAL DATA TRANSFERS

8.1 Data Transfers Outside Your Country

The Company and its service providers (Squarespace, PayPal, Google, Meta) are located in the United States. Your Personal Information will be transferred to, stored in, and processed in the United States, which may have different data protection laws than your country of residence.

For EU/UK/Swiss Residents:
The Company relies on the following legal mechanisms to transfer data to the United States:

1. Standard Contractual Clauses (SCC) (as updated by EU Commission on June 4, 2021)

   • Used by Squarespace, PayPal, and other processors

   • Incorporates European Commission's approved model contracts for data transfers

   • Available at: https://squarespace.com/dpa

   • Includes safeguards for data protection

2. Data Privacy Frameworks (DPF)

   • EU-U.S. Data Privacy Framework

   • UK Extension to EU-U.S. Data Privacy Frameworks

   • Swiss-U.S. Data Privacy Frameworks

   • Squarespace Inc. is certified under these frameworks: https://www.dataprivacyframework.gov/

   • Frameworks ensure "adequate level" of data protection

3. UK International Data Transfer Addendum (Addendum)

   • For UK residents, used in conjunction with Squarespace's International Data Transfer Addendum

   • Complies with UK GDPR Chapter 5

4. Adequacy Decisions (where applicable)

   • EU Commission decisions regarding countries with adequate data protection laws

By using the Site, you consent to the transfer of your Personal Information to the United States and other countries.

8.2 Non-EU/UK Residents

For residents of Canada, Australia, and other countries not governed by GDPR:

• Data transfers are authorized under your country's privacy laws (e.g., Canada's PIPEDA allows transfers if "substantially similar" protections exist)

• The Company takes appropriate safeguards to protect your data in transit and storage

• You have the right to request information about international transfers

9. DATA SECURITY

9.1 Security Measures

The Company implements reasonable technical and organizational security measures to protect Personal Information against unauthorized access, alteration, disclosure, and destruction. These include:

Technical Measures:

• Encryption of data in transit (HTTPS/TLS 1.2+)

• Secure socket layer (SSL) for payment processing

• Encrypted storage of sensitive data (AES-256 or similar)

• Firewalls and intrusion detection systems

• Regular security updates and patches

• Automated backups and disaster recovery procedures

• Penetration testing and vulnerability scanning

• Web application firewalls (WAF)

Organizational Measures:

• Limited employee access to Personal Information (need-to-know basis)

• Employee confidentiality and non-disclosure agreements

• Access logging and monitoring

• Regular security audits and vulnerability assessments

• Third-party security certifications (Squarespace's compliance programs)

• Security training for employees

9.2 Payment Security

The Company does NOT store:

• Full credit card numbers

• Card verification codes (CVV)

• Sensitive authentication data (Track 1/Track 2 data)

• Cardholder names or expiration dates

Payment processors (Squarespace Payments/Stripe & PayPal) store and manage:

• Tokenized payment information

• Transaction history and settlement details

• Fraud detection and chargeback data

• Card metadata (last 4 digits, expiration month/year only)

All payment processing complies with the Payment Card Industry Data Security Standard (PCI DSS) Level 1 requirements. The Company is PCI DSS compliant through Squarespace.

9.3 No Absolute Security

IMPORTANT: While the Company uses industry-standard security measures, no method of transmission over the internet or electronic storage is 100% secure. The Company cannot guarantee absolute security. By using the Site, you assume the risk that your information may be disclosed due to:

• Unforeseen breaches

• Acts of God or natural disasters

• Factors beyond the Company's reasonable control

• Third-party attacks or vulnerabilities

• Government mandates or legal orders

If the Company becomes aware of a security breach affecting your Personal Information, we will:

• Notify you within 30 days of discovery (or as required by law)

• Describe the nature of the breach

• Identify what information was compromised

• Provide steps you can take to protect yourself

• Notify relevant regulatory authorities where required

10. YOUR PRIVACY RIGHTS BY JURISDICTION

10.1 Canada (PIPEDA & Provincial Laws)

Your rights under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and provincial privacy laws:

• Right to access: Request a copy of your Personal Information

• Right to correction: Request correction of inaccurate data

• Right to delete: Request deletion of your information (subject to legal retention obligations)

• Right to object: Object to certain uses of your data

• Right to withdraw consent: Withdraw consent to marketing communications at any time

• Right to complain: File a complaint with privacy commissioner

To exercise rights: Contact privacy@inbox.lorilothian.com

Response Time: 30 days maximum

Complaint: If you have concerns about the Company's privacy practices, you may file a complaint with:

• Federal Level: Office of the Privacy Commissioner of Canada (https://www.priv.gc.ca)

• Provincial Level: Your province's privacy commissioner (e.g., BC Office of the Information and Privacy Commissioner)

10.2 European Union (GDPR)

Your rights under the General Data Protection Regulation (GDPR) (if you're an EU resident):

• Right of access: Obtain a copy of your data in a portable format

• Right to rectification: Correct inaccurate or incomplete data

• Right to erasure: Request deletion ("right to be forgotten")

• Right to restrict processing: Limit how your data is used

• Right to data portability: Receive data in a portable format (CSV, JSON, etc.)

• Right to object: Object to marketing, profiling, or automated decision-making

• Right not to be subject to automated decision-making: Including profiling or automated decisions

• Right to lodge a complaint: File a complaint with your EU data protection authority

• Right to request DPA: Request Data Processing Agreement details

Data Protection Authority Contact:

• Locate your DPA at https://edpb.ec.europa.eu/about-edpb/board/members_en

• Available in every EU member state

Response Timeframe: 1 calendar month (extendable by 2 months for complex requests)

10.3 United Kingdom

Your rights under the UK GDPR & UK Data Protection Act 2018 (if you're a UK resident):

• Same rights as EU GDPR (above)

• Right to lodge a complaint with the Information Commissioner's Office (ICO): https://ico.org.uk

• Right to request judicial remedy: Seek redress through the courts

Response Timeframe: 1 calendar month (extendable by 2 months for complex requests)

10.4 Australia

Your rights under the Privacy Act 1988 (Cth) & Australian Consumer Law (if you're an Australian resident):

• Right to access: Request your Personal Information

• Right to correct: Request correction of inaccurate data

• Right to complain: Lodge a complaint with the Office of the Australian Information Commissioner (OAIC)

• Right to request complaint investigation: OAIC will investigate privacy complaints

• Goods/services warranties: Australian Consumer Law provides statutory warranties for goods and services

To exercise rights: Contact privacy@inbox.lorilothian.com

Response Time: 30 days maximum

Complaint: Office of the Australian Information Commissioner (https://www.oaic.gov.au)

10.5 California (CCPA)

Your rights under the California Consumer Privacy Act (CCPA) (if you're a California resident):

• Right to know: Request what Personal Information is collected, used, and shared

• Right to delete: Request deletion of your data (with exceptions)

• Right to opt-out: Opt out of "sale" or "sharing" of your data for targeted advertising

• Right to correct: Request correction of inaccurate data

• Right to limit use & disclosure: Limit how your data is used

• Right to non-discrimination: No discrimination for exercising your rights

CCPA Definitions:

• "Sale" = selling Personal Information for monetary value

• "Sharing" = sharing for cross-context behavioral advertising (GA4 + pixels may constitute "sharing")

To opt-out: Contact privacy@inbox.lorilothian.com or click "Do Not Sell or Share My Personal Information" link in the Site footer

Response Timeframe: 45 days (may be extended by 45 additional days for complex requests)

Complaint: California Attorney General (https://oag.ca.gov) or California Consumer Protection Agency

11. MARKETING COMMUNICATIONS & NEWSLETTER

11.1 Newsletter Signup

To subscribe to our newsletter, you must:

• Provide a valid email address

• Consent to receive periodic updates, product announcements, and promotional offers

• Be at least 18 years of age

At checkout, there is an opt-in for newsletter signup. You can uncheck this box to decline.

GDPR Note: For EU residents, newsletter signup requires explicit, affirmative consent. Pre-checked boxes alone do not satisfy GDPR requirements; you must actively check the box to opt in.

11.2 Marketing Emails

Once subscribed, we will send you:

• Product announcements and course offerings

• Promotional discounts and special offers

• Educational content and astrology insights

• Invitations to webinars, workshops, or events

• Customer appreciation messages

• Birthday or anniversary offers

• Seasonal promotions

Frequency: Approximately 1-2 times per week (varies seasonally)

11.3 Unsubscribe

You can unsubscribe from marketing emails at any time by:

• Clicking the "Unsubscribe" link at the bottom of any marketing email

• Contacting support@inbox.lorilothian.com

• Updating your account preferences on the Site

• Replying to an email with "UNSUBSCRIBE"

Unsubscribe requests are processed within 5 business days. Note: You will still receive transactional emails (order confirmations, shipping notifications, password resets, refund notifications) even after unsubscribing from marketing.

11.4 Abandoned Cart Emails

If you add items to your cart but do not complete checkout, we may send you a reminder email to:

• Remind you of items in your cart

• Offer a discount or incentive to complete the purchase

• Provide customer support if you have questions

Frequency: Typically 1-3 reminder emails over 30 days

You can opt out of abandoned cart emails by:

• Unsubscribing (see Section 11.3)

• Contacting support@inbox.lorilothian.com

• Replying "STOP" to an abandoned cart email

12. THIRD-PARTY INTEGRATIONS & LINKS

12.1 Google Analytics

The Site uses Google Analytics to analyze user behavior and site performance. Google Analytics:

• Collects data on page views, traffic sources, user demographics, and interests

• Stores cookies on your device

• May share data with Google's advertising products (Google Ads)

• Is subject to Google's Privacy Policy: https://policies.google.com/privacy

• Data Processing Agreement: https://support.google.com/analytics/answer/3379636

• Sub-processors: Google LLC and subsidiaries

Google Analytics is NOT controlled by the Company. Google is an independent Data Controller. You can opt out of Google Analytics at https://tools.google.com/dlpage/gaoptout

12.2 Meta Pixel

The Site uses Meta Pixel (formerly Facebook Pixel) for conversion tracking and audience creation for Facebook/Instagram advertising. Meta Pixel:

• Tracks conversions (purchases, signups, etc.)

• Creates audience segments for remarketing

• Shares data with Meta (formerly Facebook)

• Is subject to Meta's Data Policy: https://www.facebook.com/policies/cookies/

• Processes data for Meta's advertising purposes

• Sub-processors: Meta subsidiaries and service providers

Meta Pixel is NOT controlled by the Company. Meta is an independent Data Controller. You can manage preferences at https://www.facebook.com/privacy

12.3 External Links

The Site may contain links to third-party websites, services, and applications. The Company is NOT responsible for the privacy practices of third-party sites. When you leave the Site and visit a third-party website:

• Their privacy policy applies (not this Policy)

• We recommend reviewing their privacy policy before providing Personal Information

• We are not liable for third-party practices

• Third-party sites may set cookies or track you independently

13. CHILDREN'S PRIVACY

The Site is NOT intended for children under 18 years of age. The Company does NOT knowingly collect Personal Information from children under 18. If we become aware that we have collected Personal Information from a minor, we will:

• Delete the information promptly

• Take steps to prevent further collection

• Notify the child's parent or guardian if required by law

If you believe we have collected information from a minor, contact privacy@inbox.lorilothian.com immediately.

COPPA Compliance: The Company complies with the Children's Online Privacy Protection Act (COPPA) (15 U.S.C. § 6501 et seq.) and similar children's privacy laws in Canada and other jurisdictions.

14. DIRECT MARKETING & COMMUNICATION PREFERENCES

14.1 Opt-In & Opt-Out

The Company respects your communication preferences. You can:

• Opt in to marketing communications during account creation or checkout

• Opt out by clicking "Unsubscribe" in marketing emails or contacting support@inbox.lorilothian.com

• Manage preferences by logging into your account and updating your settings

• Request Do Not Contact: Email support@inbox.lorilothian.com to request permanent removal

14.2 SMS & Push Notifications

The Site does NOT currently send SMS (text message) or push notifications. If this changes in the future, we will:

• Provide explicit opt-in before sending

• Include clear opt-out instructions in each message

• Obtain separate consent from you

• Comply with applicable regulations (TCPA, CASL, etc.)

15. CONTACT & PRIVACY OFFICER

15.1 Privacy Contact

For questions about this Privacy Policy, to request access to your data, or to exercise your privacy rights, contact: