Introduction This privacy policy (“policy) explains how we process your personal data, incl. what we use it for and how we store and protect it. Furthermore, the policy explains the rights that you have when we process your personal data. Why? Because we care about your privacy. 1. Who are we We are the entity responsible for the processing of your personal data in accordance with this policy. Here’s our information: Reform Clothing Ltd 14a Falcon Rd, Belfast, BT12 6RD, Company registration no: NI674281 Email: help@getresponsible.com Phone: +44 28 9568 3595 To make the policy more user friendly we use “we”, “us”, “our” etc. to describe our company. When we talk about our “website” we mean https://www.getresponsible.com . When we refer to “you” we mean you as a user of our website, app or customer of our online services or products. 2. Links to other websites etc. On our website, in our emails and on our social-media profiles, we may have links to other companies, apps or websites (“other websites”) that aren’t ours. This policy doesn’t cover how those other websites process your data. We encourage you to read the privacy notices on the other websites you visit. 3. When does the policy apply? The policy is related to the information we collect and process about you when you visit and sign up to our services via our website (see section 1) and use our services and products. So the privacy policy doesn’t apply when you use or visit or use other Reform websites. 4. Why, what and for long we process your data Here is information about us: We are an e-commerce platform that sells a multitude of high quality second hand garments (with a promise to never be sold above the original RRP). It is our passion to make fashion more sustainable and ethical. To give you a better understanding of why, what and for how long we process your data, we’ve divided our processing activities into areas describing the different purposes we process your data for. Deliver our services & products. As mentioned above, we are a trading platform for secondhand apparel and sneakers.we’re an e-commerce platform that sells a multitude of high quality second hand garments (with a promise to never be sold above the original RRP). So we process your data to deliver this platform to you. This includes: • Registering and identifying you as a customer/user, • Creating your account and setting up your account on our platform, • Logging and saving the actions you take when you use our website and platform, • Delivering the services and/or products as mentioned above, • Handling payment transactions, • Responding to your questions and providing you with customer service and support, including sending service related messages to you, and • Providing you with other services that can be ordered through the website. The data we process about you in that regard is: Ordinary personal data: • Your contact and account details, incl. your name, email, telephone number, address, country, • Your payment information incl. bank details, • Your requests and actions, e.g. sign-up and use of our website, when you accepted our terms & conditions and when you contacted us for support etc. If you email us, we will collect the content of your message. • Information about what choices you made when you became a customer and how you use our platform, • The type of service / product you have bought and information about our delivery of our service / product to you, • Login details and verification • UX research, customer feedback etc. • Purchase history, • Other types of interactions you will have with us and our service, e.g user interviews, tests, customer feedback etc. • Information required to comply with requirements of public or governmental authorities. Sensitive personal data: We don’t process sensitive personal data. Here is the legal basis for our processing of your data: • Your consent, • To perform our contract with you, • Necessary for the pursuit of legitimate purposes of you (while balancing the user's interest), • For the establishment, exercise or defence of legal claims (when necessary), • Comply with our legal obligations. ​ We will keep these data for as long as they are necessary for the purposes for which they are being processed and in accordance with our data retention policy. Special circumstances or legal requirements may entail that such periods may be shorter or longer, including for the purpose of complying with legal requirements for the erasure or keeping of data. As a general rule, data will be kept for as long as you use our product or services or have an account with us and for a further duration as outlined in our data retention policy. We collect the data directly from you, incl. your use of our platform. Marketing: We process your data for marketing-related purposes, including • sending you newsletters, email marketing and SMS marketing (if you’ve given consent), • providing you with offers, sending you guides, • tailoring our communication with you to accommodate your areas of interests and focus, • sending you relevant promotions. • If you sign up for an event, webinar etc. we’ll process your data in that regard. ​ The data we process about you in that regard is: Ordinary personal data: • Your contact details, incl. your name, email, title, telephone number, address and country, • Purchase history, interest areas and use of our services, • What newsletters you signed up for, when you asked to receive email marketing, SMS marketing and guides, • What events, webinars, courses and other arrangements you signed for, when, about what and if you provide feedback, what you thought it. Sensitive personal data: We don’t process sensitive personal data. Here is the legal basis for our processing of your data: • Your consent, • Legitimate interest, so we can give you the best experience when interacting with us and / or make use of our services and products, • For the establishment, exercise or defense of legal claims (when necessary). We collect the data directly from you and from social media platforms for the purpose of carrying out the marketing activities. We keep your data for as long as you are subscribing to our newsletters, SMS and email marketing etc. If you ask us to unsubscribe you, we will keep your data for a specific period after your request so we can show that we have honoured your request and to make sure that you aren’t receiving the material. ​ For the other types of information, we’ll keep such data for as long as the relevant activity is ongoing and for the period after that as outlined in our data retention policy. Regarding events, courses etc. we’ll keep your personal data as long as they are necessary for the purposes of the course or the event in question and for evaluating them. ​ Improve, optimise or modify the experience on our website and online service: We process your data collected by your use of our website and platform to improve the user experience on our website, the platform and the services we offer. We use the data to operate our website and the platform and to enhance the security of our website and platform, and its reliability and performance. We’ll also use the data to improve the content we show you, incl. determining what content is most helpful and how we can make the experience when visiting our website better. You can read about the cookies we use on our website: www.getresponsible.com/pages/cookie-policy ​ The data we process about you in that regard is: Ordinary personal data: • When you visit our website, our servers may automatically log the standard data provided by your web browser. It includes your computer’s Internet Protocol (IP) address, your browser type and version, your user agent, the pages you visit, the time and date of your visit, the time spent on each page, and other details. • Cookie information: We use cookies and similar technologies to collect additional website usage data and to operate our services. • We receive information when you interact with our services, e.g. when you visit our websites, when you sign into your account, or when you interact with email subscriptions. This includes information such as your IP address, browser type, browser language, operating system, the referring web page, pages visited, location, device information etc. Sensitive data: We don’t process sensitive data. ​ Here is the legal basis for our processing of your data: • Your consent, • Legitimate interest, We will keep this data for the period outlined in our data retention policy and cookie information is kept in accordance with the cookie policy We collect your data from you and your use of cookies, our website and the platform. Business- and product development: We process your data to do data analysis, audits, developing new products and services, identifying usage trends, determining the effectiveness of our campaigns and operating and expanding our business activities. The data we process about you in that regard is: • Your contact details, incl. your name, email, title, telephone number, the company you work for and their domain, and address and country • How you are using our products and services • Purchase history, interest areas and use of our digital services, • UX research, customer feedback etc. Sensitive personal data: We don’t process sensitive personal data. Here is the legal basis for our processing of your data: • Your consent, • Legitimate interest, ​ We collect your data directly from you and we’ll keep such data for as long as the relevant activity is ongoing and for the period after that as outlined in our data retention policy. Statistics: We process your data to compile statistics and analytics for the use of our website and to monitor and analyse usage and trends. The data we process about you in that regard is: Ordinary personal data: • When you visit our website, our servers may automatically log the standard data provided by your web browser. It includes your computer’s Internet Protocol (IP) address, your browser type and version, your user agent, the pages you visit, the time and date of your visit, the time spent on each page, and other details. • Cookie information: We use cookies and similar technologies to collect additional website usage data and to operate our services. • We receive information when you interact with our website, e.g. when you visit our website, log into your account and receive emails from us. This includes information such as your IP address, browser type, browser language, operating system, the referring web page, pages visited, location, device information etc. Sensitive personal data: We don’t process sensitive data in this regard. We process your data on the following legal basis: • Your consent, • Legitimate interest, Please read our cookie policy for more information about the data processors we use, the duration of the different cookies and the purposes for the processing of your data related to statistics. You can find our cookie policy here. We collect the data directly from you and from the cookies and similar technologies. Comply with obligations We also process your data to comply with legal obligations and requirements, requests from public and governmental authorities, relevant industry standards and our internal policies, and protect our operations and our rights. Here is the data we process: • Your contact details such as name, email, title and telephone/mobile number • Information required to comply with public and governmental authorities • Purchase history and use of our digital services, The data retention period will be based on statutory requirements and we aren’t processing sensitive data in that regard. 5. Additional information We do not sell or rent your data to marketers or third parties. Some of the grounds for processing your data may overlap, so there may be several reasons which justify us processing your data. We may also use your data in other ways but we will inform you about these purposes when we collect your data. If you would like more information about our legal basis for processing your data, feel free to contact us. Please note that special circumstances or legal requirements may mean that such periods may be shorter or longer, depending on the purpose of complying with legal requirements for the erasure or keeping of information. 6. Keeping your data safe We use reasonable organisational, technical and administrative measures to protect the personal data that we process about you. The Internet is not a 100% secure environment and that means we cannot guarantee the security of the data you transmit to us. Emails sent via the Internet might not be encrypted, so we advise you not to include any confidential or sensitive information in your emails to us. 7. Third parties and processors We use companies (processors) to help us deliver our services to you, e.g. to provide the hosting environment for our product, process and authenticate your items, send out newsletters, to help us run our website, manage our payment etc. When we use a processor we make sure that there is a legal agreement in place regarding how they will be handling data on our behalf. We’ll also make sure that they have appropriate security measures in place and if they are located outside the EU, we’ll of course make sure that there is a legal agreement in place allowing us to give them access to the data (see more below). We share your personal data with: • Suppliers and vendors that we work with to assist our company (meaning processors, technical support, supply services, and financial institutions) Here are some of the suppliers we use: • Google Analytics, • Re:Amaze, • Shopify, • Sendgrid, • Sendcloud • Microsoft Azure • Facebook Inc. Read our cookie policy regarding the suppliers we use for those services. In the event that we are involved in a bankruptcy, merger, acquisition, reorganisation, your information may be transferred as part of that transaction. This policy will continue to apply to your information also after the information has been transferred to the new entity 8. Transfer to countries outside the EU/EEA/UK In some cases, we’ll transfer personal data to countries outside the UK/EU/EEA. The transfers will take place on the basis of the following legal basis: We’ll provide appropriate safeguards for the transfer by using • "Model Contracts for the Transfer of Personal Data to Third Countries", as published by the Commission of the European Union and/or the ICO’s international transfer agreement, • Binding Corporate Rules • or any other contractual agreement approved by the competent authorities. ​ You can always get a copy of the contract by contacting us at help@getresponsible.com Your rights You have these rights: 1 Your right of access and rectification - You have the right to ask us for copies of your personal data or ask us to rectify information you think is inaccurate. There are some exemptions, which means you may not always receive all the information we process but as a main rule you can always contact us and ask for your information. 2 Your right to erasure - You can ask us to erase your personal information in certain circumstances. 3 Your right to withdraw your consent: If processing of your personal data is based on your consent, you have the right to withdraw your consent at any time. Your withdrawal will not affect the lawfulness of the processing carried out before you withdrew your consent. You may withdraw your consent by sending an email to help@getresponsible.com 4 Your right to restriction of processing and object to processing - You have the right to ask us to restrict the processing of your information and a similar right to object to processing. 5 Your right to data portability: You have the right to receive your personal information in a structured, commonly used and machine-readable format (data portability). 6 Where your personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of personal data about you for such marketing. We will make sure to answer your request without undue delay and in any event within one month of receiving your request. It can be that the period will be extended by two further months if your request is very complex. There may be conditions or limitations on these rights. It is therefore not certain e.g. you have the right of data portability in a specific case - this depends on the specific circumstances of the processing activity. You are always welcome to contact us and ask. The same goes for some of the other rights. Complaints You can always lodge a complaint with a data protection authority, for example the ICO (The Information Commissioner’s Office). Here’s the contact details for the ICO in Northern Ireland: 3rd Floor, 14 Cromac Place, Belfast, BT7 2JB Assistance and additional information You can take steps to exercise your rights by using the contact details above. If you have questions about the policy, feel free to contact us by using the contact details in this policy. 9. How to unsubscribe to email marketing material? If you’ve subscribed to our newsletters or asked to receive marketing material from us, you can always unsubscribe. In all these emails we include an unsubscribe link and you can always click the link and easily unsubscribe. You can also unsubscribe by sending us an email to help@getresponsible.com 10. How to unsubscribe to SMS marketing material? If you have signed up to receive SMS drop marketing texts, you can always unsubscribe. Every text we send you will have an unsubscribe link at the bottom. When you click the link, you will automatically be unsubscribed from any further SMS marketing. 11. Children and our services Our services and website aren’t directed to children, and you can’t use our services if you are under the age of 16. 12. Changes to the policy Sometimes we need to make changes to this policy to reflect our current practices. We will take reasonable steps to let you know about changes via our website. If you are a registered user, we will notify you via email if significant changes are being made to the policy using the email address you gave us when you signed up. If you continue to use our website or services after the notification, we will regard this as your acceptance of our privacy practices. Version 1.1 The policy was last updated on 19 SepJanuary 23 2023.