Effective Date: August 20, 2026

This Privacy Policy describes how Worn & Wound LLC (“Worn & Wound,” “we,” “us,” or “our”) collects, uses, discloses, and protects personal information when you visit or make a purchase from windupwatchshop.com or wornandwound.com (together, the “Sites”), register for or attend a Windup Watch Fair event, or otherwise interact with us (collectively, the “Services”). This Privacy Policy applies identically to both Sites, which are operated by the same company.

By using the Services, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Services.

Section 1 — Information We Collect

Information you provide directly. When you make a purchase, create an account, sign up for our newsletter, enter a promotion, submit a review, or contact customer service, we collect information such as your name, billing and shipping address, email address, phone number, order history, and the contents of your communications with us. Payment card information is collected and processed by our payment processor as described in Section 14 and is not stored by us.

Information collected automatically. When you browse the Sites, we automatically receive your IP address, browser and device type, operating system, referring URLs, pages viewed, and similar usage data, collected through cookies and similar technologies described in Section 4.

Windup Watch Fair events. If you register for or attend a Windup Watch Fair event, we collect your name and contact information, and any information you choose to share with us or with participating brand partners at the event. Ticketing platforms used for events maintain their own privacy policies.

Information from other sources. We may receive information about you from our service providers (such as Shopify), shipping carriers, and advertising and analytics partners.

Section 2 — How We Use Your Information

We use personal information to: process and fulfill orders, arrange shipping, returns, and warranty service; communicate with you about your order or account; provide customer support; send marketing communications where you have opted in; administer promotions and the Windup Rewards program; operate, analyze, and improve the Sites; personalize content and product recommendations; detect and prevent fraud and security incidents; and comply with legal obligations.

Section 3 — Automated Decision-Making

We do not use automated decision-making technology to make decisions that produce legal or similarly significant effects concerning you (such as decisions about lending, housing, or employment). If we adopt personalization or other automated tools that would qualify as such under applicable law, including California’s automated decision-making technology regulations, we will update this Policy and provide any required notice and opt-out rights before doing so.

Section 4 — Cookies, Tracking, and Global Privacy Control

We and our service providers use cookies, pixels, and similar technologies to operate the Sites, keep items in your cart, remember your preferences, analyze traffic, and support advertising. These include: strictly necessary cookies set by our e-commerce platform, Shopify (for example, session, cart, and checkout cookies); analytics cookies, including Google Analytics; and advertising cookies and pixels set by our advertising partners to measure campaigns and, where applicable, deliver interest-based advertising.

You can control or delete cookies through your browser settings, though some Site features may not function without strictly necessary cookies.

We honor the Global Privacy Control (GPC) and other legally recognized universal opt-out signals. If your browser or device transmits a GPC signal, we treat it as a valid request to opt out of the sale or sharing of your personal information and of targeted advertising for that browser or device, as required by California, Colorado, Connecticut, Texas, and other applicable state laws. Other than GPC and similar recognized signals, we do not respond to browser “Do Not Track” signals, for which no industry standard has been adopted.

Section 5 — How We Share Your Information

We do not sell your personal information in exchange for money, and we do not share your personal information with unrelated third parties for their own independent marketing purposes without your consent. However, like most online retailers, we use advertising cookies and pixels that may involve disclosing identifiers and browsing information to advertising partners; some state laws define this as a “sale” or “sharing” of personal information. You may opt out of such disclosures at any time as described in Section 6, including through the Global Privacy Control.

We share personal information with the following categories of recipients:

• Service providers that host and operate the Sites and our business, including Shopify (e-commerce platform and payment infrastructure), payment processors, shipping and fulfillment carriers, email and SMS marketing platforms, analytics providers, and customer-service tools. Service providers are permitted to use your information only to provide services to us.
• Advertising and analytics partners, as described in Section 4, unless and until you opt out.
• Brand partners and authorized dealers, only as needed to fulfill warranty service, repairs, or authentication requests for products you purchased.
• Legal and safety recipients, where disclosure is necessary to comply with law, regulation, legal process, or a government request; to enforce this Policy or our Terms of Service; to detect or prevent fraud, security, or technical issues; or to protect the rights, property, and safety of Worn & Wound, our customers, or the public.
• A successor entity, if Worn & Wound is acquired by or merged with another company, in which case your information may be transferred to the new owner subject to this Policy or a materially similar one.

Section 6 — Your Privacy Rights

We extend the following rights to all United States residents, regardless of your state of residence:

• Right to know and access the categories and specific pieces of personal information we have collected about you, the sources of that information, our purposes for collecting it, and the categories of third parties to which it has been disclosed.
• Right to correct inaccurate personal information.
• Right to delete personal information we have collected from you, subject to legal exceptions (for example, records we must keep for tax, fraud-prevention, or legal-compliance purposes).
• Right to data portability — to receive a copy of your personal information in a portable and readily usable format.
• Right to opt out of the sale or sharing of personal information and of processing for targeted advertising.
• Right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects.
• Right to non-discrimination — we will not deny you goods or services, charge different prices, or provide a different level of service because you exercised any of these rights.
• Right to appeal a refusal to act on a request, as described below.

How to exercise your rights. Submit a request by email to privacy@wornandwound.com with the subject line “Privacy Request,” by mail to the address in Section 16, or through any privacy preference tool offered on the Sites. We will verify your request using information reasonably necessary to confirm your identity and will respond within 45 days, extendable once by an additional 45 days where reasonably necessary, with notice to you. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and independent verification of your identity.

Appeals. If we decline to act on your request in whole or in part, you may appeal by replying to our response or writing to the contact in Section 16 with the subject line “Privacy Appeal.” We will respond within 60 days, or the shorter period your state’s law requires, and will explain the result. If your appeal is denied, you may contact your state Attorney General, and, where your state provides one, any other complaint mechanism identified in our response.

Sensitive personal information. We do not knowingly collect or process sensitive personal information — such as precise geolocation, racial or ethnic origin, religious beliefs, health information, sexual orientation, citizenship or immigration status, or genetic or biometric data — except as strictly necessary to provide the Services, and we do not use or disclose sensitive personal information for purposes requiring an opt-in or a right to limit under applicable law.

State laws. These rights are provided consistent with the comprehensive consumer privacy laws of, among others: California (Cal. Civ. Code § 1798.100 et seq., CCPA as amended by the CPRA), Virginia (Va. Code § 59.1-575 et seq.), Colorado (Colo. Rev. Stat. § 6-1-1301 et seq.), Connecticut (Conn. Gen. Stat. § 42-515 et seq.), Utah (Utah Code § 13-61-101 et seq.), Texas (Tex. Bus. & Com. Code § 541.001 et seq.), Oregon (Or. Rev. Stat. § 646A.570 et seq.), Montana (Mont. Code § 30-14-2801 et seq.), Delaware (6 Del. C. § 12D-101 et seq.), Iowa (Iowa Code § 715D.1 et seq.), Nebraska (Neb. Rev. Stat. § 87-1101 et seq.), New Hampshire (N.H. Rev. Stat. § 507-H:1 et seq.), New Jersey (N.J. Stat. § 56:8-166.4 et seq.), Tennessee (Tenn. Code § 47-18-3201 et seq.), Minnesota (Minn. Stat. § 325O.01 et seq.), Maryland (Md. Code, Com. Law § 14-4601 et seq.), Indiana (Ind. Code § 24-15-1-1 et seq.), Kentucky (Ky. Rev. Stat. § 367.3611 et seq.), Rhode Island (R.I. Gen. Laws § 6-48.1-1 et seq.), Oklahoma (Oklahoma Consumer Data Privacy Act, effective January 1, 2027), and Alabama (Alabama Personal Data Protection Act, effective May 1, 2027). Because we extend these rights to all US residents, residents of states whose laws take effect after this Policy’s effective date, or whose laws set applicability thresholds we may not meet, may exercise them now.

Section 7 — Additional California Disclosures

California residents may request, once per calendar year, information about any disclosure of personal information to third parties for those parties’ direct marketing purposes under Cal. Civ. Code § 1798.83 (“Shine the Light”). As stated in Section 5, we do not disclose personal information to unrelated third parties for their own direct marketing purposes; a request may nonetheless be sent to the contact in Section 16. Our response to browser signals, as required to be disclosed by the California Online Privacy Protection Act, is described in Section 4.

Section 8 — International Customers

We are a US-based company, and your personal information is processed and stored in the United States.

European Economic Area and United Kingdom. If you are located in the EEA or UK, we process your personal information on the following legal bases: performance of a contract (fulfilling your order), our legitimate interests (fraud prevention, security, and analytics), your consent (marketing communications, which you may withdraw at any time), and compliance with legal obligations. Where required for transfers of personal data from the EEA or UK to the United States, we rely on the European Commission’s Standard Contractual Clauses or the UK International Data Transfer Addendum. You have the rights provided by the GDPR and UK GDPR — including access, rectification, erasure, restriction, portability, and objection (GDPR Articles 15–21) — which you may exercise through the contact in Section 16, and you have the right to lodge a complaint with your local supervisory authority.

Canada. We handle Canadian customers’ personal information consistent with the practices described in this Policy. This section will be updated if Canada enacts its pending federal private-sector privacy reform.

Section 9 — Children’s Privacy

The Sites are not directed to children, and we do not knowingly collect personal information from anyone under the age of 16. By using the Services, you represent that you are at least the age of majority in your state or province of residence. If we learn that we have collected personal information from a child under 16, we will delete it. We do not sell the personal information of any consumer we know to be under 16.

Section 10 — Data Security

We use commercially reasonable administrative, technical, and physical safeguards designed to protect personal information, including encryption in transit (TLS/SSL) and PCI-DSS-compliant handling of payment card data by our payment processor. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

Section 11 — Data Retention

We retain personal information only as long as necessary for the purposes described in this Policy, unless a longer period is required or permitted by law. In general: order and transaction records are retained for seven years for tax, accounting, and legal-compliance purposes; marketing contact information is retained until you unsubscribe or opt out, plus a suppression record to honor your choice; account information is retained while your account is active and for two years thereafter; and website analytics data is retained according to our analytics providers’ standard retention settings.

Section 12 — Email and SMS Marketing

With your opt-in consent, we send marketing emails and, where you have separately opted in, marketing text messages about products, promotions, and events. Consent to marketing is never a condition of purchase. Message frequency varies and message and data rates may apply. You may opt out of marketing emails at any time using the unsubscribe link in any message, and out of SMS messages by replying STOP (reply HELP for assistance). Our SMS program operates with prior express written consent as required by the Telephone Consumer Protection Act and uses a registered ten-digit long code consistent with US carrier requirements.

Section 13 — Third-Party Links

The Sites contain links to third-party websites, including brand-partner sites and social media platforms. We are not responsible for the privacy practices of third parties, and this Policy does not apply once you leave the Sites. We encourage you to review the privacy policy of any site you visit.

Section 14 — Shopify and Payment Processing

The Sites’ e-commerce functions are hosted on Shopify Inc., which provides the platform through which we sell our products. Payment card data is collected, processed, and encrypted by Shopify and its payment gateways in accordance with the Payment Card Industry Data Security Standard (PCI-DSS); purchase transaction data is retained only as long as necessary to complete the transaction. For more information, see Shopify’s Privacy Policy at shopify.com/legal/privacy.

Section 15 — Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will post any updated Policy on this page with a revised effective date. If we make material changes to how we handle previously collected personal information, we will provide prominent notice on the Sites and, where we have your email address on file, notice by email, before the changes take effect.

Section 16 — Contact Us

To ask a question, register a complaint, or exercise any of the rights described in this Policy, contact our Privacy Compliance Officer:

Worn & Wound LLC — Attn: Privacy Compliance Officer
540 President St., Suite 1G
Brooklyn, NY 11215
Email: info@wornandwound.com (subject line: “Privacy Request”)