Privacy Policy

Effective date: October 8, 2026

This Privacy Policy describes how Dessa Brands Corp, doing business as The Noli Shop ("Noli," "we," "us," or "our"), collects, uses, and shares personal information when you visit or make a purchase from thenolishop.com (the "Site"), interact with our emails, text messages, or advertisements, or otherwise communicate with us (together, the "Services"). It also explains the rights and choices available to you.

Please read this policy carefully. By using the Services you acknowledge that you have read it. If you do not agree with it, please do not use the Services. If you have questions, contact us at [email protected].

1. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the revised policy on the Site and update the effective date above. Where required by law, we will notify you in another way as well.

2. Personal Information We Collect

The personal information we collect depends on how you interact with us. We collect it from three sources: directly from you, automatically through your use of the Site, and from third parties.

Information you provide to us

• Contact details: name, mailing address, billing and shipping address, email address, and phone number.
• Order information: the items you purchase, order history, size and fit preferences, payment confirmation, and payment details (card payments are processed by our payment processors; we do not store full card numbers).
• Account information: username, password, security questions, and other information used to secure your account.
• Customer support information: the content of messages you send us by email, chat, phone, or text, including return and exchange requests.
• Reviews and submissions: product reviews, photos, survey responses, and other content you choose to submit.
• Marketing preferences: your email and SMS subscription choices.

Information we collect automatically ("Usage Data")

When you visit the Site we and our service providers automatically collect certain information about your device and your interaction with the Site using cookies, pixels, tags, software development kits, and similar technologies (together, "Tracking Technologies"). This information may include:

• device and browser type, operating system, screen size, and language settings;
• IP address and approximate location derived from it;
• the pages and products you view, the links you click, items you add to your bag, searches you run, and the date, time, and duration of your visit;
• the website or advertisement that referred you to the Site;
• unique identifiers assigned to your device or browser, including identifiers set by advertising and analytics partners; and
• information about how you interact with our emails and text messages, such as whether you opened a message or clicked a link.

Section 4 explains which Tracking Technologies we use, who provides them, and how to control them.

Information we receive from third parties

• Shopify, the company that hosts and powers our Site and checkout.
• Payment processors (including Shopify Payments, Shop Pay, PayPal, and buy-now-pay-later providers you choose at checkout), who send us confirmation of payment and limited billing information.
• Shipping and returns partners, who send us delivery and return status.
• Advertising and marketing partners, who may send us information about the performance of our campaigns and, where you have interacted with our ads on their platforms, limited information about that interaction.
• Data and identity partners, who may help us recognize returning visitors or match an email address to a visitor who has previously agreed to receive our communications.

Any information we receive from third parties is handled in accordance with this Privacy Policy.

3. How We Use Personal Information

• To provide the Services: process payments, fulfill and ship orders, process returns and exchanges, manage pre-orders and back-in-stock notifications, maintain your account, and provide customer support.
• To communicate with you: send order confirmations, shipping and delivery updates, and responses to your inquiries.
• Marketing and advertising: send promotional emails and text messages where you have agreed to receive them; show you advertising for our products on other websites, apps, and social media platforms; measure the effectiveness of our advertising; and tailor the content and offers you see.
• Analytics and improvement: understand how visitors use the Site, identify errors and performance problems, test changes to the Site, and improve our products, Site, and Services.
• Security and fraud prevention: detect, investigate, and prevent fraudulent transactions and other illegal activity, and protect the security of the Site and our customers.
• Legal compliance: comply with applicable law, respond to lawful requests, and enforce our terms.

4. Cookies, Pixels, and Other Tracking Technologies

We use Tracking Technologies on the Site. Some are set by us and some are set by third parties who provide services to us. They fall into the following categories. The names of the providers in each category are current as of the effective date and may change; we update this list periodically.

Strictly necessary

These are required for the Site to function: keeping items in your bag, completing checkout, remembering your login, preventing fraud, and respecting your privacy choices. They cannot be switched off.

Providers: Shopify (platform, checkout, and customer-privacy controls); payment processors; Checkmate (checkout and bot protection).

Functional

These enable features you have requested or that improve your experience: customer-service chat, product reviews, loyalty rewards, pre-order and back-in-stock notifications, returns and exchanges, sign-up forms, and complete-the-look recommendations.

Providers: Gorgias (customer service and live chat); Okendo and Trustpilot (reviews); Rivo (loyalty and referrals); STOQ and Notify Me (pre-orders and back-in-stock alerts); Redo and Loop Returns (returns, exchanges, and shipping protection); Digioh and Alia (on-site forms and pop-ups); Stylitics (outfit recommendations).

Performance and analytics

These help us understand how the Site is used and how it performs: which pages are visited, where visitors encounter errors, how quickly pages load, and how visitors respond to changes we test. Some of these tools may record how you interact with a page, such as where you scroll and click. They do not capture the contents of password or payment fields.

Providers: Google Analytics and Google Tag Manager; Microsoft Clarity; Noibu (error monitoring); Yottaa (site speed); Shoplift (A/B testing); Aimerce (first-party analytics and attribution).

Advertising and marketing

These are set by our advertising and marketing partners. They collect information about your visit, including the pages and products you view, items you add to your bag, purchases you complete, your IP address, and identifiers associated with your browser or device. Our partners use this information to show you Noli advertisements on their platforms and on other websites, to limit how often you see an ad, to measure whether our ads led to a visit or a purchase, and in some cases to build a profile of your interests across websites and apps that are not related to us. Our email and SMS providers also use pixels in the messages we send to tell us whether a message was opened or a link was clicked.

Providers: Meta (Facebook and Instagram); TikTok; Google (Google Ads and YouTube); Pinterest; Criteo; LiveIntent; Klaviyo (email and SMS marketing); ShopMy (creator and affiliate attribution).

Each of these providers has its own privacy policy that explains how it uses the information it collects. We encourage you to read them. Under California law, our use of advertising Tracking Technologies may be considered "sharing" personal information for cross-context behavioral advertising, and in some cases a "sale." Section 8 explains your right to opt out.

Your choices about Tracking Technologies

• Cookie preferences. You can set or change your cookie preferences at any time using the Cookie Preferences link in the Site footer. Advertising and analytics Tracking Technologies will not be set for visitors in regions where consent is required until you accept them.
• Do Not Sell or Share. You can opt out of the sale or sharing of your personal information, including through advertising Tracking Technologies, using the Do Not Sell or Share My Personal Information link in the Site footer.
• Global Privacy Control. We honor the Global Privacy Control (GPC) browser signal as a request to opt out of sale and sharing for the browser from which it is sent.
• Browser settings. Most browsers let you block or delete cookies. Blocking strictly necessary cookies will prevent parts of the Site, including checkout, from working.
• Platform opt-outs. You can control interest-based advertising from Meta, TikTok, Google, Pinterest, and others through the ad settings in your account on those platforms, and through the industry opt-out tools at optout.aboutads.info and optout.networkadvertising.org.
• Email and SMS. See Section 5.

Opting out of advertising Tracking Technologies does not mean you will stop seeing ads from us. It means the ads you see will be less relevant to you.

5. Email and Text Message Marketing

Email. If you sign up on the Site, make a purchase, or otherwise give us your email address, we may send you emails about our products, new arrivals, and offers, as permitted by law. You can unsubscribe at any time using the link at the bottom of any marketing email or by emailing [email protected]. Transactional emails about your orders will continue.

Text messages. We send marketing text messages, including cart and checkout reminders, only to customers who have opted in. Consent to receive texts is not a condition of purchase. Message frequency varies. Message and data rates may apply. Reply STOP to any message to opt out and HELP for help. Our SMS provider is Klaviyo.

Opt-out requests may take a few days to process across all of our systems.

6. How We Share Personal Information

We share personal information with the following categories of recipients:

• Service providers who perform services on our behalf, including Shopify (hosting, checkout, and payments), payment processors, warehouses and fulfillment partners, shipping carriers, customer-service tools, email and SMS providers, returns and exchange platforms, review platforms, loyalty providers, analytics providers, and IT and security vendors. Service providers are permitted to use personal information only to provide services to us.
• Advertising and marketing partners named in Section 4, who use Tracking Technologies on the Site and in our messages as described there.
• Affiliates within our corporate group, for the purposes described in this policy.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, bankruptcy, or sale of all or part of our business or assets.
• Legal and safety: to comply with law, subpoenas, or other legal process; to respond to requests from public authorities; to enforce our terms; and to protect the rights, property, or safety of Noli, our customers, or others.
• With your direction or consent.

We do not sell personal information for money. We do share personal information with advertising partners in ways that California and some other state laws treat as a "sale" or "sharing," as described in Sections 4 and 8.

7. Third-Party Websites and Links

The Site may link to websites and services operated by third parties, including social media platforms and payment providers. We are not responsible for their privacy practices. Please review their policies before providing them with information.

8. Your Privacy Rights

Depending on where you live, you may have some or all of the following rights with respect to your personal information:

• Access / Know: request the categories and specific pieces of personal information we have collected about you, the sources, the purposes, and the categories of third parties with whom we have shared it.
• Delete: request that we delete personal information we have collected from you, subject to legal exceptions.
• Correct: request that we correct inaccurate personal information.
• Portability: receive a copy of your personal information in a portable format.
• Opt out of sale, sharing, and targeted advertising: direct us not to sell or share your personal information or use it for targeted advertising. Use the Do Not Sell or Share My Personal Information link in the Site footer, or enable the Global Privacy Control signal in your browser.
• Limit use of sensitive personal information: we do not use or disclose sensitive personal information for purposes that require this right.
• Non-discrimination: we will not deny you goods or services, charge you a different price, or provide a different level of service because you exercised your rights.
• Withdraw consent where processing is based on consent.

How to exercise your rights

Email [email protected] with the subject line "Privacy Request," or write to us at the address in Section 13. For opt-outs of sale and sharing, use the footer link described above. We will need to verify your identity before responding to access, deletion, or correction requests, typically by matching information you provide against information in our records or by sending a confirmation to the email address on file. You may designate an authorized agent to make a request on your behalf; we may require proof of the agent's authority and verification of your identity. We will respond within the time required by applicable law (45 days under California law, extendable once by 45 days where reasonably necessary). If we deny your request, you may appeal by replying to our response.

California residents

This section supplements the rest of this policy and applies to California residents under the California Consumer Privacy Act as amended by the California Privacy Rights Act (together, "CCPA").

Categories of personal information collected in the preceding 12 months, and purposes:

• Identifiers (name, address, email, phone, IP address, device and cookie identifiers): to provide the Services, communicate with you, market and advertise, analyze and improve, prevent fraud.
• Customer records (billing and shipping details, order history): to provide the Services and communicate with you.
• Commercial information (products viewed, added to bag, purchased, returned): to provide the Services, market and advertise, analyze and improve.
• Internet or network activity (browsing and interaction with the Site and our messages): to market and advertise, analyze and improve, prevent fraud.
• Approximate geolocation (derived from IP address): to market and advertise, analyze and improve, prevent fraud.
• Inferences (preferences and interests drawn from the above): to market and advertise and tailor content.
• Audio or visual information (photos you submit with reviews; recorded support calls where permitted): to provide the Services.

Categories disclosed for a business purpose: all of the above, to the service providers described in Section 6.

Categories sold or shared: identifiers, commercial information, internet or network activity, approximate geolocation, and inferences, to the advertising and marketing partners named in Section 4, for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Retention: we retain personal information for as long as needed for the purposes described in this policy, including to maintain your order history, meet legal, tax, and accounting obligations, resolve disputes, and enforce our agreements. Usage Data collected through Tracking Technologies is generally retained for no more than 26 months.

Sensitive personal information: we collect payment card information only through our payment processors for the purpose of completing your purchase. We do not use sensitive personal information to infer characteristics about you.

Financial incentives: our loyalty program and sign-up discounts may be considered financial incentives under the CCPA. Participation is voluntary and you may withdraw at any time. The value of the information we collect is reasonably related to the value of the discount or reward provided.

Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for their direct marketing purposes. We do not disclose personal information to third parties for their own direct marketing purposes.

Residents of other U.S. states

If you live in Colorado, Connecticut, Delaware, Iowa, Indiana, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, or Virginia, you may have rights similar to those listed above under your state's privacy law, including the right to opt out of targeted advertising and the sale of personal information. Exercise them using the methods described above.

Residents of the EEA, United Kingdom, and Canada

If you are in the European Economic Area, United Kingdom, or Canada, we process your personal information on the following legal bases: performance of a contract (to fulfill your orders); our legitimate interests (to operate, secure, and improve the Site and to market to existing customers where permitted); your consent (for advertising cookies and, where required, marketing communications), which you may withdraw at any time; and compliance with legal obligations. You have the rights described above, including the right to object to processing based on legitimate interests, and the right to lodge a complaint with your local data protection authority. Your personal information will be transferred to and processed in the United States. Where required, we rely on standard contractual clauses or other approved transfer mechanisms.

9. Children

The Site is not intended for children under 16, and we do not knowingly collect personal information from them. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Security

We use administrative, technical, and physical safeguards designed to protect personal information, including encryption of payment information in transit. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please protect your account password and let us know if you suspect unauthorized access.

11. Data Retention

We keep personal information for as long as necessary to fulfill the purposes described in this policy unless a longer period is required or permitted by law. When we no longer need it, we delete or de-identify it.

12. Do Not Track

Some browsers offer a "Do Not Track" setting. Because there is no common standard for interpreting it, we do not respond to Do Not Track signals. We do honor the Global Privacy Control signal as described in Section 4.

13. Contact Us

For questions about this Privacy Policy or our privacy practices, or to exercise your rights, contact us at:

Dessa Brands Corp d/b/a The Noli Shop
Attn: Privacy
2420 NE 186th St, Suite 201
Miami, FL 33160
[email protected]