This Privacy Policy describes how Smalltown Graffiti (“we,” “us,” or “our”) collects, uses, discloses, and protects your personal information when you visit our website [smalltowngraffiti.news] (the “Website”) or use our services (collectively, the “Services”). We are committed to protecting your privacy and complying with applicable data protection laws, including but not limited to the General Data Protection Regulation (GDPR) in the European Union, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), the UK GDPR, Brazil’s Lei Geral de Proteção de Dados (LGPD), Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA), and other relevant global privacy laws.By using our Services, you agree to the collection and use of information in accordance with this Privacy Policy. If you do not agree, please do not use our Services.
1. Information
We Collect:
- Email addresses (for newsletter subscribers only).
1.2 Information Collected Automatically
- Cookies and Tracking Technologies: We use cookies to track user activity, remember preferences, and improve functionality. This may include analytics data from tools like Google Analytics.
- Location Data: Approximate location based on IP address or precise location if you enable location services (with your consent where required).
For users in California (under CCPA/CPRA), we have collected email addresses in the past 12 months. We do not knowingly collect personal information from children under 16 (or the applicable age in your jurisdiction). If we learn we have collected such information, we will delete it.
2. How We Use Your Information
We use your personal information for the following purposes:
- For Communication: Send newsletter emails.
Under GDPR and similar laws, our legal bases for processing include:
- Your consent (e.g., for marketing).
- Performance of a contract (e.g., fulfilling orders).
- Legitimate interests (e.g., improving services, provided they do not override your rights).
- Legal obligations (e.g., tax reporting).
For CCPA/CPRA purposes, we use personal information for business purposes such as auditing, security, debugging, short-term transient use, performing services, internal research, and quality control.
3. Sharing and Disclosure of Information
We may share your personal information with:
- Service Providers: Third parties that assist with hosting, analytics, payment processing, email delivery, or customer support (e.g., Google, Stripe). These providers are contractually obligated to protect your data and use it only for the services they provide.
- Business Partners: Affiliates or partners for joint marketing or services, with your consent where required.
- Legal Authorities: If required by law, subpoena, or to protect our rights, safety, or property.
- With Your Consent: For any other purpose disclosed at the time of collection.
For CCPA/CPRA, we may “sell” or “share” personal information (as defined under those laws) for targeted advertising or analytics. In the past 12 months, we have disclosed identifiers, internet activity, and inferences to advertising partners. You have the right to opt out of such sales/sharing (see Section 6).We do not sell personal information of minors under 16 without affirmative authorization.
4. International Data Transfers
If you are in the EU/EEA/UK, your data may be transferred to countries outside these regions, such as the United States. We ensure adequate safeguards, including Standard Contractual Clauses (SCCs), Binding Corporate Rules, or other mechanisms approved under GDPR. For transfers under other laws, we comply with applicable requirements to protect your data.
5. Data Security
We implement reasonable technical, administrative, and physical measures to protect your personal information from unauthorized access, loss, or alteration. This includes encryption for sensitive data, access controls, and regular security audits. However, no system is completely secure, and we cannot guarantee absolute security. In the event of a data breach, we will notify affected users and authorities as required by law (e.g., within 72 hours under GDPR).
6. Your Rights and Choices
Depending on your location and applicable laws, you may have the following rights:
- Access: Request a copy of your personal information.
- Rectification: Correct inaccurate or incomplete data.
- Deletion/Erasure: Request deletion of your data (subject to legal exceptions).
- Restriction/Objection: Restrict processing or object to it (e.g., for direct marketing).
- Portability: Receive your data in a structured, machine-readable format.
- Withdraw Consent: Revoke consent at any time, without affecting prior processing.
- Opt-Out of Sale/Sharing (CCPA/CPRA): California residents can opt out of the sale or sharing of personal information by [insert method, e.g., submitting a request via email or a “Do Not Sell My Personal Information” link].
- Limit Use of Sensitive Personal Information (CPRA): Opt out of using sensitive data for certain purposes.
- Non-Discrimination (CCPA/CPRA): We will not discriminate against you for exercising your rights.
To exercise these rights, contact us at peter@smalltowngraffiti.ca. We will respond within the required timeframe (e.g., 1 month under GDPR, 45 days under CCPA). We may verify your identity before processing requests. You can manage cookies via your browser settings or our cookie consent tool. For Global Privacy Control (GPC) signals, we honor opt-out preferences where applicable.If you are in the EU/UK, you can complain to your local data protection authority (e.g., the Information Commissioner’s Office in the UK). California residents can contact the California Attorney General.
7. Data Retention
We retain personal information only as long as necessary for the purposes outlined in this Policy, or as required by law. For example:
- Marketing data: Until you unsubscribe or withdraw consent.
After retention periods, we securely delete or anonymize data.
8. Third-Party Links and Services
Our Services may contain links to third-party websites or integrate third-party services. We are not responsible for their privacy practices. Review their policies before providing information.
9. Children’s Privacy
Our Services are not directed to children under 13 (or 16 under some laws). We do not knowingly collect data from them. If we become aware of such collection, we will delete it.
10. Changes to This Privacy Policy
We may update this Policy to reflect changes in our practices or legal requirements. We will notify you of material changes via email or a notice on our Website, and update the “Last Updated” date. Continued use of Services after changes constitutes acceptance.
11. Contact Us
For questions, requests, or complaints about this Privacy Policy or our data practices:
- Email: peter@smalltowngraffiti.ca
If applicable:
- Data Protection Officer (DPO): [DPO Name and Contact]
- EU/UK Representative: [Representative Name and Contact]
