At girligirl boutique, we have a huge respect for your privacy. Third parties (such as AdRoll) may place cookies on your browser for targeted advertising, analytical and/or measurement purposes. Information collected may include IP addresses, cookie identifiers, website activity and non-tracking technologies

Collection of Data:

Our site uses technologies of  third-party to help us recognize your device and understand how you use our site(s) so that we can improve our services to reflect your interests and serve you advertisements about the [products and/or services] that are likely to be of more interest to you. Specifically, these partners collect information about your activity on our site(s) to enable us to:

measure and analyze traffic and browsing activity on our site(s);

show advertisements for our products and/or services to you on third-party sites;

measure and analyze the performance of our advertising campaigns; 

Opting-Out 

Our partners [such as NextRoll] may use non-cookie technologies that may not be impacted by browser settings that block cookies. Your browser may not permit you to block such technologies. For this reason, you can opt out here to decline the collection and use of information for the purpose of serving you interest based advertising.

Here are other ways in which to control your data:

Web Browser: You can opt-out of receiving interest-based ads served by us or on our behalf by clicking on the blue icon that typically appears in the corner of the ads we serve and following the instructions provided.

Cross Device Opt- Out: In some cases, we may link multiple browsers or devices to you. If you opt-out on a browser or device and we have additional devices or browsers linked to you, we will extend your opt-out decision to any other linked browsers and devices. Since we only link users across browsers and devices in certain conditions, there may be cases where you are still being tracked in a different browser or device we have not linked, and where we are treating you as a different user.

Mobile Device Opt-Out:To opt-out of receiving interest-based ads that are based on your behavior across different mobile applications, please follow instructions for iOS and Android devices:

iOS 7 or Higher: Go to your Settings > Select Privacy > Select Advertising > Enable the “Limit Ad Tracking” setting

For Android devices with OS 2.2 or higher and Google Play Services version 4.0 or higher: Open your Google Settings app > Select Ads > Enable “Opt out of interest-based advertising”.

Any terms defined in the CCPA have the same meaning when used in this section.

Information We Collect and the Purposes for Which this Information is Used

We collect information that identifies, relates to, describes, references, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or device (“personal information”). This collection of information is listed in What Data We Collect.

We set out below the CCPA categories of personal information we have collected from consumers within the last twelve (12) months in respect of our Services. Please note that personal information in certain categories may overlap with other categories.

Category

Collected

Details

Source

A.

Identifiers

Yes

Device IP address, email address, cookie string data, pseudonymous data (e.g. hashed emails), operating system, and your device type, and mobile device's identifier (such as the Apple IDFA or Android Advertising ID) and any other unique identifier that may be assigned to any device by third parties and cross-referenced to recognize a device.

Directly and indirectly from consumers, third party data providers, ad exchanges, supply-side platforms and Audience Partners. In the case of business email addresses, RollWorks B2B Services may infer a business email address.

B.

Personal information listed in the California Customer Records statute (Cal. Civ. Code § 1798.80(e))

Yes

Name, business address, business telephone number, education, employment, employment history, household income.the perceived general education level of consumers may be collected for marketing, advertising and analytics.

Directly from third party data providers and Audience Partners.

C.

Protected classification characteristics under California or federal law

Yes

Limited to age ranges such as 35-44, 45-54, 55-64 and 65+ and male/female gender categories are sometimes collected for use for NextRoll Services that do not carry a risk of unintended discrimination.

From Audience Partners.

D.

Commercial information

Yes

Records of products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.

Directly from consumers and Customers.

E.

Biometric information

No

-

-

F.

Internet or other similar network activity

Yes

Browsing history, search history, information on a consumer's interaction with a website, application or advertisement. For example, which pages you visited and when, what items were clicked on a page, how much time was spent on a page, whether you downloaded a white paper on a B2B website, what items you placed into your online shopping cart, what products were purchased and the price of the products purchased.

Directly from browsing history on Customers’ Digital Properties.

Non-personal information about one of our ads (e.g. the third party who served the ad, and the name of the ad) may be connected with browsing history or activity on our websites for the purposes of determining attribution information (e.g. whether particular ad led to a consumer visiting our website, and, if so, which particular ad campaign).

G.

Geolocation data

Yes

Non-precise geolocation derived from IP address.

Directly from consumers, ad exchanges, publishers and supply-side platforms and audience partners.

H.

Sensory data

No

-

-

I.

Professional or employment-related information

Yes

Current or past job history, including details about the employer (industry, name, company location, company domain or URL), and employee (positions held, duration of employment, and office location of the company where the employee worked).

Third party data providers and audience partners.

J.

Non-public education information (per the Family Educational Rights and Privacy Act (20 U.S.C. Section 1232g, 34 C.F.R Part 99))

No

-

-

K.

Inferences drawn from other personal information

Yes

Creating profiles that reflect consumer preferences and interests.

Audience partners.

For clarity, under CCPA personal information does not include:

Publicly available information from government records;

De-identified or aggregated consumer information; and

Information excluded from the CCPA's scope such as:

health or medical information covered by the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and the California Confidentiality of Medical Information Act (CMIA) or clinical trial data; and

personal information covered by certain sector-specific privacy laws, including the Fair Credit Reporting Act (FRCA), the Gramm-Leach-Bliley Act (GLBA) or California Financial Information Privacy Act (FIPA), and the Driver's Privacy Protection Act of 1994.

Purposes for Which Personal Information is Collected

NextRoll is a marketing technology company that helps big and small companies deliver products ambitious marketers use and rely on to grow their businesses. All data we collect is for the business purpose of providing services primarily for our marketing, advertising and analytical Services. However, as part of performing these Services, we also use data collected (as identified above) for the following additional business purposes:

Auditing Interactions with Consumers: count ad impressions and verify the quality of ad impressions served to unique visitors identified by cookie id or other unique identifier;

Debugging and Repair: the identification and repair of impairments to intended and existing functionalities in our Services and NextRoll Technology, perform debugging and related activities to repair errors that impair the functionality of our Services;

Security: detect security incidents and protect against malicious, deceptive, fraudulent or illegal activity, including, when necessary, to prosecute those responsible for such activities;

Internal Research and Development: conduct internal research for technological development of our Services and demonstration of the performance of these Services; and

Quality and Safety Maintenance and Verification: verify the quality or safety of our Services and improve, upgrade or enhance our Services and NextRoll Technology we provide.

For more information on how we use this data, please refer to How We Use the Data We Collect.

Sharing Personal Information

We may disclose your personal information to a third party for a business purpose (as set out above) or sell your personal information, subject to your right to opt-out of those sales (See Personal Information Sales Opt-In Rights).

The Data Sharing section sets out the personal information that we share with third parties.

Disclosure of Personal Information for a Business Purpose

With the exception of our RollWorks B2B Contact Data, NextRoll’s Services do not amount to a sale of personal information. Instead, to the extent that NextRoll discloses personal data to third parties, it does so for business purposes, primarily to perform its advertising, marketing and analytical Services, but also for the purposes set out in Purposes for which Personal Information is Collected above. However, NextRoll always provides consumers with the ability to opt-out of interest based advertising (and control their data collection in additional ways). You may opt-out of interest-based advertising, which may constitute a sale of personal information under CCPA, by visiting https://app.adroll.com/optout or through the instructions provided in the Your Choices and Opting-Out of Interest-Based Advertising and Analytics Section of this Privacy Notice.

In the preceding twelve (12) months, we have disclosed personal information for our business purposes:

Category A: Identifiers

Category F: Internet or Similar Network Activity

Category G: Geolocation

We disclose your personal information for a business purpose to the categories of third parties set out in Data Sharing.

Sales of Personal Information

In the preceding (12) twelve months, pursuant to our RollWorks B2B Contact Data Service, we have sold personal information in the form of business emails from Category A (Identifiers).

Other than our RollWorks B2B Contact Data Service, we do not consider that our Services constitute a ‘sale of personal information’ under the CCPA. However, we will still honor requests from consumers to opt-out of the collection and disclosure of their personal information.

Your Rights and Choices

The CCPA provides California residents with specific rights regarding their personal information. This section describes the rights of California residents under CCPA and provides information on how to exercise those rights.

Right to Know and Data Portability Rights

You have the right to request that we disclose certain information to you about our collection and use of personal information over the past 12 months. Once we receive and confirm your verifiable consumer request, we will disclose to you:

The categories of personal information we collected about you;

The categories of sources for the personal information we collected about you;

Our business or commercial purpose for collecting or selling that personal information;

The categories of third parties with whom we share that personal information;

The specific pieces of personal information we collected about you (otherwise known as a data portability request); and

Two separate lists where we have sold or disclosed your personal information for a business purpose:

Sales: identifying the personal information categories that each category of recipient purchased; and

Disclosures for a business purpose: identifying the personal information categories that each category of recipient obtained

Right to Delete

You have the right to request that we delete any of your personal information that we collect from you and retain, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (see Exercising Right to Know, Data Portability and Right to Deletion), we will delete (and direct our services providers to delete) your personal information from our records, unless an exception applies.

We may deny your deletion request if retaining the information is necessary for us or our service provider(s) to:

Complete the transaction for which we collected the personal information, provide a good or service that you requested, take actions reasonably anticipated within the context of our ongoing business relations with you or otherwise perform our contract with you;

Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity or prosecute those responsible for such activities;

Exercise free speech, ensure the right of another consumer to exercise their free speech rights or exercise another right provided by law;

Comply with the California Electronic Communications Privacy Act (Cal. Penal Code § 1546 et. seq.);

Engage in public or peer-reviewed scientific, historical, or statistical research in the public interest that adheres to all other applicable ethics and privacy laws, when the information’s deletion may likely render impossible or seriously impair the research’s achievement, if you previously provided informed consent;

Enable solely internal uses that are reasonably aligned with consumer expectations based on your relationship with us;

Comply with a legal obligation; and

Make other internal and lawful uses of that information that are compatible with the context in which you provided it.

Exercising Right to Know, Data Portability and Right to Deletion

To exercise the access, data portability and deletion rights described above, please submit the consumer request to us by either:

Calling us at 1-844-740-7126; or

Visiting this webpage.

After submitting the request, a form will be sent to the requestor to verify the consumer request.

On the verification form, the requestor must:

Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal information or an authorized representative; and

Describe the request with sufficient detail that allows us to properly understand, evaluate and respond to it.

Only you, or a person registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your personal information.

You may only make a verifiable request for access of data portability twice within a 12-month period.

We cannot respond to your request or provide you with personal information if we cannot: (i) verify your identity or authority to make the request; and (ii) confirm the personal information relates to you.

We will only use personal information provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.

As mentioned above in Sales of Personal Information, we have elected to honor sale opt-out rights. Please see Personal Information Sales Opt-Out and Opt-In Rights.

Response Timing and Format

We will deliver our written response to you electronically unless you indicate delivery to be by mail.

Any disclosures we provide to you will only cover the 12-month period preceding the verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot complete a request, if applicable. Please note that personal information deleted during this period as set out in Data Retention will not be provided.

The format of our responses to you concerning personal information collected, disclosed or sold will be provided in a readily useable format that should allow you to transmit the information from one entity to another entity without hindrance.

We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.

Personal Information Sales Opt-Out Rights

To exercise the right to opt-out of our sale of your Contact Data or to opt out of interest-based advertising, you (or your authorized representative) may submit a request to us by visiting the Do Not Sell My Personal Information webpage.

Non-Discrimination

We will not discriminate against you for exercising any of your CCPA rights. Unless permitted by the CCPA, we will not:

Deny you goods or services;

Charge you different prices or rates for goods or services, including through granting discounts or other benefits, or imposing penalties;

Provide you a different level or quality of goods or services; or

Suggest that you may receive a different price or rate for goods or services or a different level or quality of goods or services.

Information for European Territory Residents: Our Legal Basis and Your Rights

Back to top

Our Legal Basis: If you interact with our Services from the European Territories, our legal basis for collecting and using the personal data described above will depend on the personal data concerned and the specific context in which we collect it. For these purposes, "European Territories" means the European Economic Area, Switzerland and the United Kingdom.

Specifically, we will normally process personal data about you based on consent (except where the purpose of processing is based on legitimate interest, as described in the “vendor” details of the Consent Management Tool presented to you while visiting Digital Properties from the European Territories). For example, when you visit a Customer’s Digital Property, you will be asked to consent to NextRoll dropping a cookie.

If you have questions about, or need further information concerning, the legal basis on which we collect and use your personal data, please email dpo@nextroll.com.

European Residents’ Privacy Rights: In addition, if you are a resident of a European Territory, you have the following data subject access rights under EU data protection law:

If you wish to access, correct, update or request deletion of your personal data, please visit our privacy requests webpage to obtain a verifiable request form.

If you wish to object to us processing your personal data or would like to otherwise restrict the processing of your personal data, we will honor that request. Please visit the Your Choices and Opting-Out of Interest-Based Advertising and Analytics portion of this Service Privacy Notice to select the best opt-out method for you.

Similarly, if we process your personal data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your personal data conducted in reliance on lawful processing grounds other than consent. You can also refuse consent for NextRoll or our Advertising Partners to drop cookies by visiting our opt-out page or by refusing consent for NextRoll (or changing your consent preferences) when you see a “consent banner” displayed on a Customer site which lists NextRoll as a vendor.

You have the right to complain to a data protection authority about our collection and use of your personal data. For more information, please contact your local data protection authority. Contact details for data protection authorities in the European Territories are available from the European Data Protection Board website. However, if you have any questions about our collection and use of your personal data, we encourage you to contact us first at support@nextroll.com. If you are unable to obtain the information or resolution that you seek, you may also contact our Data Protection Officer at dpo@nextroll.com.

In some cases, we act as a processor for our Customers (for example, when we handle our Customers’ CRM data solely to provide them Services) and, in those cases, you should direct any requests to exercise your data protection rights to the relevant Customer. If you are uncertain whether we process your personal data as a controller or a processor in any specific context, you can contact us at support@nextroll.com and we will advise you accordingly.