Privacy policy

SMS & Text Message Communications - A2P 10DLC Compliance

WIM Group USA LLC DBA nonprofitapparel.org participates in the Application-to-Person (A2P) 10DLC (10-Digit Long Code) messaging framework as required by major U.S. wireless carriers and the CTIA. This section discloses all material terms governing SMS/text message communications from our business.

How We Disclose Personal Information

In certain circumstances, we may disclose your personal information to third parties for legitimate purposes subject to this Privacy Policy. Such circumstances include:

Our Relationship with Shopify

Information you submit to the Services will be transmitted to and shared with Shopify, as well as third parties that may be located in countries other than where you reside, in order to provide and improve the Services for you.

To help protect, grow, and improve our business, we use certain Shopify enhanced features that incorporate data obtained from your interactions with our Store, along with other merchants and with Shopify. To provide these features, Shopify may make use of personal information collected about your interactions with our store, other merchants, and Shopify directly.

In these circumstances, Shopify is responsible for the processing of your personal information, including responding to requests to exercise your rights over that information. To learn more about how Shopify uses your personal information and any rights you may have, please visit:

• Shopify Consumer Privacy Policy
• Shopify Privacy Portal — to exercise your rights related to data processed by Shopify

Third-Party Websites & Links

The Services may provide links to websites or other online platforms operated by third parties. If you follow links to sites not affiliated or controlled by us, you should review their privacy and security policies and other terms and conditions. We do not guarantee and are not responsible for the privacy or security of such sites, including the accuracy, completeness, or reliability of information found on those sites.

Information you provide on public or semi-public venues — including on third-party social networking platforms — may be viewable by other users of the Services and/or users of those third-party platforms without limitation as to its use by us or by a third party. Our inclusion of such links does not imply any endorsement of the content on such platforms or of their owners or operators, except as expressly disclosed on the Services.

Security & Retention of Your Information

Security Measures

We implement administrative, technical, and physical security measures to protect your personal information against unauthorized access, disclosure, alteration, and destruction, including:

• Encryption in transit: All data transmitted between your device and our servers is encrypted using TLS 1.2 or higher (HTTPS);
• Encryption at rest: Sensitive data fields, including payment tokens and account credentials, are encrypted in our databases;
• Access controls: Employee access to customer data is granted on a need-to-know basis with role-based permissions;
• Password security: Passwords are stored using industry-standard hashing; plaintext passwords are never stored;
• Vendor management: Third-party vendors with access to personal data are required to maintain appropriate security standards.

In the event of a data breach likely to result in risk to your rights, we will notify affected individuals and relevant authorities in accordance with applicable law, including New York's SHIELD Act.

Retention Periods

How long we retain your personal information depends on factors such as whether we need it to maintain your account, provide the Services, comply with legal obligations, resolve disputes, or enforce applicable contracts and policies.

Your Rights & Choices

Depending on where you live, you may have some or all of the rights listed below in relation to your personal information. These rights are not absolute, may apply only in certain circumstances, and in certain cases we may decline your request as permitted by law.

Targeted Advertising & Global Privacy Control

Depending on where you reside, you may have a right to opt out of the "sale" or "sharing" of your personal information or to opt out of processing for "targeted advertising," as defined in applicable privacy laws. You can exercise these opt-out rights here.

If you visit our website with the Global Privacy Control (GPC) opt-out preference signal enabled, depending on where you are, we will automatically treat this as a request to opt out for the device and browser you use. If we can associate the device to a Shopify account, we will apply the opt-out to the account as well. Learn more at globalprivacycontrol.org. Other than the Global Privacy Control, we do not recognize other "Do Not Track" signals sent from your browser or device.

Managing Communication Preferences

We may send you promotional emails. You may opt out at any time using the unsubscribe option in our emails. If you opt out, we may still send non-promotional emails about your account or orders. For SMS opt-out instructions, see Section 5.

How to Exercise Your Rights

You may exercise any of these rights where indicated on the Services, or by contacting us using the details in Section 15. To exercise rights related to data processed by Shopify, visit privacy.shopify.com.

We will not discriminate against you for exercising these rights. We may need to verify your identity before processing your requests. You may designate an authorized agent; we will require proof of authorization and may verify your identity directly with you. We will respond in a timely manner as required by applicable law.

Children's Privacy

The Services are not intended to be used by children, and we do not knowingly collect any personal information about children under the age of majority in your jurisdiction. If you are the parent or guardian of a child who has provided us with their personal information, you may contact us using the details in Section 15 to request that it be deleted.

As of the effective date of this Privacy Policy, we do not have actual knowledge that we "share" or "sell" (as those terms are defined in applicable law) personal information of individuals under 16 years of age.

International Transfers

Please note that we may transfer, store, and process your personal information outside the country in which you reside. By using the Services, you consent to the transfer of your personal information to countries that may have different data protection rules than your own.

If we transfer your personal information out of the European Economic Area or the United Kingdom, we will rely on recognized transfer mechanisms such as the European Commission's Standard Contractual Clauses, or any equivalent contracts issued by the relevant competent authority of the UK, unless the data transfer is to a country determined to provide an adequate level of protection.

Shopify, as our hosting provider, may also transfer and process your data internationally in accordance with their own compliance mechanisms, as described in the Shopify Consumer Privacy Policy.

Complaints

If you have complaints about how we process your personal information, please contact us using the details provided in Section 15. We will review your complaint and respond in a timely manner.

Depending on where you live, you may have the right to appeal our decision, or to lodge your complaint with your local data protection authority. In the United States, you may contact your state's Attorney General office. For data processed by Shopify, complaints may be directed to Shopify via the Shopify Privacy Portal.

Changes to This Privacy Policy

We may update this Privacy Policy from time to time, including to reflect changes to our practices or for other operational, legal, or regulatory reasons. We will post the revised Privacy Policy on this website, update the "Last updated" date, and provide notice as required by applicable law.

For material changes, we will notify registered account holders by email and display a prominent notice on our website for a reasonable period. Your continued use of our Services after the effective date of any updated Policy constitutes your acceptance of the revised terms.