Privacy Policy

1. What information do we collect?

In short: we collect personal information that you provide to us, and some information automatically when you visit our Website.

We collect personal information that you voluntarily provide to us when you register on the Website, express an interest in obtaining information about us or our products and Services, participate in activities on the Website, or otherwise contact us. The personal information we collect depends on the context of your interactions with us and the Website, the choices you make, and the products and features you use.

Personal information provided by you. We have collected the following categories of personal information from individuals in the past twelve (12) months:

• Identifiers, such as name, email address, Internet Protocol address, account name, postal address, and similar identifiers.
• Personal information categories listed in the California Customer Records statute, such as name, postal address, telephone number, and payment card information.
• Protected classification characteristics under state or federal law, such as gender and age.
• Commercial information, such as products or Services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies.
• Internet or other similar network activity, such as browsing history, search history, and information regarding your interaction with our website, application, or advertisements.
• Inferences drawn from the above categories of personal information.

Sensitive personal information. Additionally, we have collected the following sensitive personal information in the past twelve (12) months: account log-in, financial account, debit card, or credit card number in combination with any required security or access code, password, or credentials allowing access to the account.

Payment data. We may collect data necessary to process your payment if you make purchases, such as your payment instrument number and the associated security code. All payment data is stored and processed by our e-commerce platform, Shopify, and, for subscriptions, our subscription platform, Recharge. You can review Shopify’s privacy policy at shopify.com/legal/privacy. All personal information that you provide to us must be true, complete, and accurate, and you must notify us of any changes to such personal information.

Information automatically collected. We automatically collect certain information when you visit, use, or navigate the Website. This information does not reveal your specific identity (like your name or contact information) but may include device and usage information, such as your IP address, browser and device characteristics, operating system, language preferences, referring URLs, device name, country, location, information about how and when you use our Website, and other technical information. This information is primarily needed to maintain the security and operation of our Website and for our internal analytics and reporting purposes. Like many businesses, we also collect information through cookies and similar technologies; see Section 4 below. The information we collect includes:

• Log and usage data: service-related, diagnostic, usage, and performance information our servers automatically collect when you access or use our Website, such as date/time stamps, pages and files viewed, searches, other actions you take, and device event information.
• Device data: information about your computer, phone, tablet, or other device you use to access the Website, such as IP address (or proxy server), device and application identification numbers, location, browser type, hardware model, Internet service provider and/or mobile carrier, and operating system configuration information.

2. How do we use your information?

In short: we process your information for purposes based on legitimate business interests, the fulfillment of our contract with you, compliance with our legal obligations, and/or your consent. We use the information we collect or receive:

• To fulfill and manage your orders, payments, returns, and exchanges made through the Website, including subscriptions.
• To facilitate account creation and logon.
• To manage user accounts and keep them in working order.
• To send administrative information to you, such as order updates and information about changes to our terms, conditions, and policies.
• To respond to inquiries and offer support.
• To request feedback and contact you about your use of our Website.
• To post testimonials and reviews. We post testimonials on our Website that may contain personal information. Prior to posting a testimonial, we will obtain your consent to use your name and its content. To update or delete your testimonial, contact us at help@biocandy.com.
• To send marketing and promotional communications, in accordance with your marketing preferences. You can opt out of our marketing emails at any time.
• Text marketing: where offered and where you have opted in, we may send text messages about our store, new products, and other updates, including checkout and cart reminders. The Website uses webhooks and cookies (with your consent) to help track items in your shopping cart, including abandoned carts, to determine when to send reminder messages. See the Mobile Message Program terms in our Terms of Service.
• To deliver targeted advertising, developing and displaying personalized content and advertising (and working with third parties who do so) tailored to your interests and/or location, and measuring its effectiveness.
• To protect our Services, including fraud monitoring and prevention.
• To enforce our terms, conditions, and policies, to comply with legal and regulatory requirements, and in connection with our contract.
• To respond to legal requests and prevent harm. If we receive a subpoena or other legal request, we may need to inspect the data we hold to determine how to respond.
• To administer prize draws and competitions when you elect to participate.

3. Will your information be shared with anyone?

In short: we only share information with your consent, to comply with laws, to provide you with Services, to protect your rights, or to fulfill business obligations. We may need to process your data or share your personal information in the following situations:

• Vendors, consultants, and other third-party service providers. We may share your data with third-party vendors, service providers, contractors, or agents who perform services for us or on our behalf and require access to such information to do that work. Examples include payment processing, order fulfillment, data analysis, email and SMS delivery, hosting services, customer service, and marketing efforts. We may allow selected third parties to use tracking technology on the Website to collect data on our behalf about how you interact with our Website over time. Unless described in this notice, we do not share, sell, rent, or trade any of your information with third parties for their promotional purposes.
• Business transfers. We may share or transfer your information in connection with, or during negotiations of, any merger, sale of company assets, financing, or acquisition of all or a portion of our business to another company.
• Business partners. We may share your information with our business partners to offer you certain products, services, or promotions.
• Disclosures required by law. We may be required to disclose your information in response to lawful requests by public authorities, including to meet law enforcement requirements, to comply with a legal obligation, to enforce our terms and agreements, or to protect the rights, property, or safety of BioCandy or others, including exchanging information with other companies and organizations for fraud protection.
• Mobile message opt-in data. If you opt in to our mobile messaging service, we will not share, sell, rent, or trade your mobile phone number, opt-in data, or consent status with any third parties for their own marketing or promotional purposes. We will only share such information with third parties who facilitate the mobile messaging service on our behalf or as otherwise required by law.

Categories of third parties we may share information with include: our e-commerce platform (Shopify), our subscription platform (Recharge), payment processors, order fulfillment providers, email and SMS marketing platforms (such as Klaviyo), reviews platforms (such as Yotpo), ad networks and retargeting platforms (such as Meta and TikTok), data analytics services, finance and accounting tools, communication and collaboration tools, and data storage service providers.

We may also aggregate or otherwise strip information of all personally identifying characteristics and may share that aggregated, anonymized data with third parties or publish it. We reserve the right to make use of any such aggregated data as we see fit.

4. Do we use cookies and other tracking technologies?

In short: yes. A cookie is a small text file that a website saves on your computer or mobile device when you visit the site. It enables the website to remember your actions and preferences (such as login, shopping cart, or other preferences) over a period of time, so you do not have to keep re-entering them whenever you come back to the site or browse from one page to another.

Analytics and site functionality. We use analytics provided by our e-commerce platform, Shopify, to understand how visitors use our store and to improve the Website. We use Klaviyo to manage email (and, where offered, SMS) marketing, and Yotpo to collect and display product reviews.

Targeted advertising. We use advertising cookies and pixels, such as the Meta (Facebook) Pixel and the TikTok Pixel, to deliver and measure tailored advertising on our Website and on other platforms you may visit. You can learn more about how to control advertising cookies by visiting the Network Advertising Initiative’s opt-out page or the Digital Advertising Alliance’s opt-out page for browsers, or the DAA’s AppChoices for mobile devices. Opting out will not stop advertising from appearing in your browser or applications; it may make the ads you see less relevant to your interests.

Cookie settings. You may wish to restrict the use of cookies. Please be aware that some features of our Website may not function correctly if you disable cookies. Most modern browsers allow you to change your cookie settings in their options or preferences menu:

• Cookie settings in Chrome
• Cookie settings in Firefox
• Cookie settings in Microsoft Edge
• Cookie settings in Safari and iOS

SMS abandoned cart reminders. We may use cookies and similar tracking technologies (such as those deployed by Shopify) to track your cart activity. If you have opted in to our mobile messaging program and have added items to your cart without completing a purchase, this information may be used by our SMS provider to send you reminders. You can opt out of these messages at any time by following the instructions in the messages or in our Terms of Service.

5. How long do we keep your information?

In short: we keep your information for as long as necessary to fulfill the purposes outlined in this privacy policy unless a longer retention period is required or permitted by law (such as tax, accounting, or other legal requirements). When we have no ongoing legitimate business need to process your personal information, we will either delete or anonymize such information or, if this is not possible (for example, because your personal information has been stored in backup archives), we will securely store your personal information and isolate it from any further processing until deletion is possible.

6. How do we keep your information safe?

In short: we aim to protect your personal information through a system of organizational and technical security measures. However, despite our safeguards and efforts to secure your information, no electronic transmission over the Internet or information storage technology can be guaranteed to be 100% secure, so we cannot promise or guarantee that hackers, cybercriminals, or other unauthorized third parties will not be able to defeat our security and improperly collect, access, steal, or modify your information. Transmission of personal information to and from our Website is at your own risk. You should only access the Website within a secure environment.

7. What are your privacy rights?

In short: you may review, change, or terminate your account at any time. If you have questions or comments about your privacy rights, email us at help@biocandy.com.

Account information. If you would at any time like to review or change the information in your account or terminate your account, you can log in to your account settings and update your user account, or contact us using the contact information provided. Upon your request to terminate your account, we will deactivate or delete your account and information from our active databases. However, we may retain some information in our files to prevent fraud, troubleshoot problems, assist with any investigations, enforce our Terms of Service, and/or comply with applicable legal requirements.

Cookies and similar technologies. Most web browsers are set to accept cookies by default. If you prefer, you can usually set your browser to remove or reject cookies; this could affect certain features of our Website. To opt out of interest-based advertising by advertisers on our Website, visit aboutads.info/choices.

Opting out of email marketing. You can unsubscribe from our marketing email list at any time by clicking the unsubscribe link in the emails we send or by contacting us. You will then be removed from the marketing email list; however, we may still communicate with you for non-marketing purposes, for example to send service-related emails necessary for the administration and use of your account or to respond to service requests.

8. Marketing preferences

We would like to send you information about our products and services that we think you might like. We may send you direct marketing communications, product information, and promotional offers:

• If you have consented to receiving such communications
• If we have an existing business relationship with you and can rely on your implied consent
• If you are from a country where the laws permit us to send such communications based on our legitimate interests, you have bought a product or service from us, and you have not opted out (for example, the EEA or UK)

The marketing communications we send will be in relation to our own products or services. Your personal data will not be used for third-party direct marketing unless separate explicit consent has been collected for that or you are from a country where the laws permit such processing.

Managing your preferences. You always have full control of your marketing preferences. You can unsubscribe using the directions or link included in any marketing communication, or withdraw your consent by emailing help@biocandy.com. Customers in certain regions, such as the EEA and UK, also have the right to object at any time to their personal data being processed for direct marketing purposes; to object, email help@biocandy.com. We process all requests as soon as possible, but it may take a few days for an opt-out request to be implemented.

9. Controls for do-not-track features

Most web browsers and some mobile operating systems and mobile applications include a Do-Not-Track (“DNT”) feature or setting you can activate to signal your privacy preference not to have data about your online browsing activities monitored and collected. At this stage no uniform technology standard for recognizing and implementing DNT signals has been finalized. As such, we do not currently respond to DNT browser signals or any other mechanism that automatically communicates your choice not to be tracked online. If a standard for online tracking is adopted that we must follow in the future, we will inform you about that practice in a revised version of this privacy policy.

California and certain other U.S. state residents may opt out of tracking technologies by broadcasting an Opt-Out Preference Signal, such as the Global Privacy Control (“GPC”), on browsers and/or browser extensions that support such a signal. To download and use a browser supporting the GPC signal, visit globalprivacycontrol.org. If you choose to use the GPC signal, you will need to turn it on for each supported browser or browser extension you use. Your request to opt out of sale/sharing will be linked to your browser identifier only and not linked to any account information, because the connection between your browser and the account is not known to us.

10. Children's privacy

Our Website is not directed at individuals under the age of 16. We do not knowingly collect personal information from children under 16. If you become aware that a child has provided us with personal information, please contact us using the details in the contact section below. If we become aware that a child under 16 has provided us with personal information, we will take steps to delete such information.

11. Additional disclosures for certain U.S. residents

Several jurisdictions grant state residents rights regarding their personal information. We provide the following information to further help you understand your potential privacy rights. To exercise these rights, email us at help@biocandy.com. If you have a complaint about how we handle your data, we would like to hear from you.

Third-party marketing. California Civil Code Section 1798.83, the “Shine The Light” law, permits our customers who are California residents to request and obtain from us, once a year and free of charge, information about categories of personal information (if any) we disclosed to third parties for direct marketing purposes and the names and addresses of all third parties with which we shared personal information in the immediately preceding calendar year. If you are a California resident and would like to make such a request, please submit your request in writing using the contact information below.

Request to know. Residents of certain U.S. states have the right to know whether we are processing your personal information, and in some instances, to request that we disclose, for the preceding 12 months: whether we collect and use your personal information; the categories of personal information that we collect; the business or commercial purposes for collecting, selling, sharing, or disclosing your personal information and the categories disclosed for such purposes; whether we sell your personal information and, if so, the categories sold and the categories of third parties to whom it was sold; and the specific pieces of personal information we have collected about you. We have the right to request verification of your identity for all requests for information.

Request for correction. Residents of certain U.S. states have the right to request the correction of inaccurate or incomplete personal information that we have about them.

Request for deletion. Residents of certain U.S. states have the right to request that we delete their personal information. If you ask us to delete your personal information, we will respect your request, subject to certain exceptions provided by law, such as the exercise by another consumer of their right to free speech, our compliance requirements resulting from a legal obligation, or processing that may be required to protect against illegal activities.

Request for portable data. Residents of certain U.S. states have the right to receive, in certain circumstances, a portable format of their personal information that allows the data to be transmitted to another entity.

Opting out of sale/sharing via tracking technologies. Our use of online tracking technologies for advertising may be considered a “sale” or “sharing” under applicable law. BioCandy has not sold personal information to third parties for money in the preceding twelve (12) months, but we recognize that some state privacy laws define these terms in a way that can cover the sharing necessary to provide personalized ads. Residents of certain U.S. states may opt out by broadcasting an opt-out preference signal such as the Global Privacy Control (see Section 9) or by emailing help@biocandy.com with the subject line “Do Not Sell or Share My Personal Information.”

Limiting the use of sensitive personal information. Residents of California have the right to direct us to use or disclose sensitive personal information only for providing goods or services, or as otherwise minimally permitted under applicable law. We do not use or disclose sensitive personal information for any purpose other than providing our goods and Services to you, or as otherwise minimally permitted under applicable law.

Non-discrimination. You have the right to receive equal service and price, even if you exercise a privacy right.

Verification process. Upon receiving your request, we will need to verify your identity to determine you are the same person about whom we have the information in our system. These verification efforts require us to ask you to provide information so that we can match it with information you have previously provided us, or to contact you through a communication method (such as phone or email) that you have previously provided. We will only use personal information provided in your request to verify your identity or authority to make the request, and we will delete any additionally provided verification information as soon as we finish verifying you. If you are an authorized agent wishing to exercise rights on behalf of a state resident, please contact us with a copy of the consumer’s written authorization designating you as their agent; we may need to verify your identity and place of residence before completing the request.

Appeal process. If we decide not to act in response to your request to exercise a right, we will provide a timely response detailing the reasons and, depending on your jurisdiction, any rights you may have to appeal our decision, including instructions on how to contact your local Attorney General or Department of Justice for further review.

12. Additional disclosures for EEA, U.K., and Swiss individuals

If you are from the European Economic Area, the United Kingdom, or Switzerland (together, for purposes of this section, “EEA”), you are entitled to certain rights and disclosures with respect to your personal information.

Legal bases for processing. We may process or share your data based on the following legal bases:

• Consent: you have given us specific consent to use your personal information for a specific purpose.
• Legitimate interests: processing is reasonably necessary to achieve our legitimate business interests.
• Performance of a contract: we process your personal information to fulfill the terms of our contract with you.
• Legal obligations: we may disclose your information where legally required to comply with applicable law, governmental requests, a judicial proceeding, court order, or legal process.
• Vital interests: we may disclose your information where necessary to investigate, prevent, or take action regarding potential violations of our policies, suspected fraud, threats to the safety of any person, or illegal activities, or as evidence in litigation in which we are involved.

Your rights. In some countries, and in particular if you are located in the EEA, you may have the right to: access your personal information; correct inaccurate personal information; request erasure of your personal information without undue delay; request restricted processing of your personal information; request portability of the personal information you have given us; and object to the processing of your personal information.

Complaints. If you are a resident of the EEA and believe we are unlawfully processing your personal information, you have the right to complain to your local data protection supervisory authority (contact details here). If you are a resident of Switzerland, the contact details for the data protection authorities are available here. We would, however, appreciate the opportunity to address your concerns first; please direct inquiries to the contact information at the bottom of this policy.

International transfers. Your personal information may be transferred to, stored, and processed in a country other than the one in which it was collected, including the United States. It may also be processed by staff operating outside the EEA who work for us or for our third-party service providers. Data protection standards may differ from, and be lower than, the standards enforced in your jurisdiction. We maintain appropriate safeguards as required by applicable law for any personal information transferred internationally, including, where applicable, standard contractual clauses.

13. Do we make updates to this notice?

In short: yes, we will update this notice as necessary to stay compliant with relevant laws. The date last updated can be found at the top of this privacy policy, and the updated version will be effective as soon as it is accessible. If we make material changes to this privacy policy, we may notify you either by prominently posting a notice of such changes or by directly sending you a notification. We encourage you to review this privacy policy frequently to be informed of how we protect your information.

14. How can you contact us about this notice?

If you have any questions about this privacy policy, or wish to exercise your privacy rights or make a data access request, contact us at help@biocandy.com or call 1 (800) 917-7535.

BioCandy Supplements Inc., 100 Easy St, Unit 1055, Carefree, AZ 85377, United States.

For our Terms of Service, visit biocandy.com/terms-of-service. For our Return / Refund Policy, visit biocandy.com/refund-policy.