Website Privacy Notice

Last Updated: 4^th August 2025

1.  Introduction

Bruusta Inc, of 8 The Green, Suite R, Dover, Kent County, Delaware 19901, USA (“bruusta”, “us”, “we”, “our”) are fully committed to the protection of the Personal Data we process in line with the data protection principles set out in the relevant data protection laws. These Data Protection Laws include the Data Protection Act 2018 (“DPA 2018”); the Privacy and Electronic Communications Regulations 2003 (PECR) as amended; the California Consumer Privacy Act (CCPA); the California Privacy Rights Act (CPRA); the Colorado Privacy Act (CPA); the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTDPA); the Delaware Personal Data Privacy Act (DPDPA); the Florida Digital Bill of Rights (FDBR); the Indiana Consumer Data Protection Act (ICDPA); the Iowa Consumer Data Protection Act (ICDPA); the Montana Consumer Data Privacy Act (MCDPA); s1 – s9 Oregon Consumer Privacy Act (OCPA); the Tennessee Information Protection Act (TIPA); the Texas Data Privacy and Security Act (TDPSA); the Utah Consumer Privacy Act (UCPA); and the Virginia Consumer Data Protection Act (CDPA) collectively referred to herein as the “Data Protection Law”.

If you are in California, United States, please refer to your California Consumer Privacy Act (“CCPA”) rights in Appendix A.

The purpose of this privacy notice is to explain what Personal Data we collect about you when you visit our website or register to use our services. Bruusta is the data controller for your personal data, and we comply with applicable data protection laws, including the UK GDPR where relevant. While our products are currently only available for purchase in the U.S., our website and app may be accessed by users internationally. Where applicable, we comply with data protection laws such as the UK General Data Protection Regulation (UK GDPR) for users based in the United Kingdom.

We are committed to protecting the security and confidentiality of your personal data. We use appropriate technical and organizational measures to help prevent unauthorized access, disclosure, or misuse of your information.

Please read this privacy notice carefully as it provides important information about how we handle your personal information and your rights. If you have any questions about any aspect of this privacy notice, you can contact us using the information provided below (in the Contact us section).

We update this privacy notice from time to time in response to changes in applicable laws and regulations, to our processing practices and to the products and services we offer. When changes are made, we will update the date at the top of this document. Please review this privacy notice periodically to check for updates.

2.  Who this privacy notice applies to

This privacy notice applies to you if:

1.                You visit our website

2.                You are a registered customer

3.                You complete a new registration

4.                You make an enquiry about our services

5.                You complete an online form

6.                You sign up to receive newsletters and/or other promotional communications from us

3.  What Personal Data is

‘‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.

‘Special Category Personal Data’ is more sensitive Personal Data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation. Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.

4.  Personal Data we collect

The type of Personal Data we collect about you will depend on our relationship with you. We process all information you give us, either through our website, www.bruusta.com (“our site”), or interacting with us by telephone, email or otherwise. This includes information you provide when you use or report a problem with our site, register for our service, make a purchase from us over the phone, search for a product or service, or other social media functions linked to our site.

We may process the following information following an enquiry:

●       Name

●       Date of Birth

●       Email address

●       Account password

●       Any information you share through our social media channels

●       Device information

●       Location data

We use your name, email address and telephone number to contact you about your enquiry. The list of information processed when setting up an account may include, but is not limited to:

●       Name

●       Address

●       Email address

●       Telephone number(s)

●       Date of Birth

●       Account password

●       Device information

●       Location data

All online payments are securely processed through Shopify Payments. We do not store or have access to your full credit or debit card information. Shopify Payments is PCI DSS compliant and uses encryption and other safeguards to protect your data. You can read more in Shopify’s Privacy Policy.

Cookies and Web Beacons

We use cookies on our website and web beacons in some emails. Cookies are small text files and web beacons are small graphic images. They’re downloaded to your device when you visit a website or receive certain emails, unless you’ve set your browser to reject them.

You can adjust your browser settings to refuse some or all cookies. Please note that blocking some cookies may affect site functionality.

How We Respond To Do No Track Signals

We do not respect browser Do Not Track settings for our analytics cookies, as we use analytics information to understand web traffic. This data is not shared with third parties.

5.  Purposes for which we use Personal Data and the legal bases

We will only use your Personal Data when the law allows. Most commonly, we will use your Personal Data in the following circumstances:

6.  Personalised In-App Content

We tailor app content — including useful news, updates, and offers — to better match your experience and preferences. This personalisation is a standard part of our service and can’t be turned off in the app. However, you’re always in control of your data and may request deletion of your account and associated information at any time through the Delete Account option in the My Account screen in the bruusta app.

7.  Sharing your data

We currently only offer our products and services within the United States, and it is unlikely that we will share your personal data outside the U.S.

However, some of the third-party tools and service providers we use (such as marketing platforms, analytics providers, and app services) may process data in other countries, including the UK or countries in the EU. When this happens, we take steps to ensure your information is handled securely and in line with relevant data protection standards — such as using contractual safeguards or working with providers certified under appropriate frameworks (e.g. Standard Contractual Clauses, adequacy decisions).

We may share limited personal information — such as your name, email, postal address, and transaction history — with approved service providers for purposes like data analysis, customer segmentation, or targeted marketing. These partners only receive the information necessary to perform their role, and we ensure they handle your data responsibly and in line with this notice.

Our website may include links to third-party websites or platforms (such as Instagram, Facebook, or TikTok). When you click these links, those sites may collect your IP address, set cookies, or track activity. Once you leave our site, this Privacy Policy no longer applies. We recommend reviewing the privacy policies of those platforms before sharing any personal information.

8.  How long we keep your data

We will retain your Personal Data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.

At the end of the retention period, your Personal Data will be securely deleted or anonymised, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.

9.  How we protect your data

We implement appropriate technical and organisational measures to protect data against unauthorised or unlawful processing and against accidental loss, destruction or damage.

In addition to the technical and organisational measures we have put in place, there are simple things you can do to in order to further protect your personal information, such as:

• Never share One Time Passcodes (OTPs);
• Never enter your details after clicking on a link in an email or text message;
• Always send confidential information by encrypted email to reduce risk of interception;
• If you are logged into any online service, do not leave your computer unattended;
• Close down your internet browser once you have logged off;
• Never download software or let anyone log on to your computer or devices remotely, during or after a cold call; and
• You can easily identify secure websites by looking at the address in the top of your browser which will begin https:// rather than http://.

10.  Your data protection rights

There are certain, fundamental, rights that you have in respect of your Personal Data:

In addition to the above, an individual also has the following rights:

11.  Exercising your data protection rights

You will not have to pay a fee to access your Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

12.  Contact us

If you would like to exercise your statutory data protection rights, or if you have any concerns or questions about how we handle Personal Data, please contact us using the following email address hello@bruusta.com

13.  How to complain

Let us know if you have a complaint about the way we process your Personal Data by contacting our Data Protection Manager using the email address provided.

In addition to the above, you have the right to make a complaint at any time to the relevant supervisory authority if you are concerned about the way in which we are handling your Personal Data.

APPENDIX A

California Consumer Privacy Act (“CCPA”) California Privacy Rights Act (CPRA)

This Appendix A (“Appendix”) applies to California residents and outlines your rights regarding the processing of the Personal Data we hold about you under the California Consumer Privacy Act (“CCPA”) and the California Privacy Rights Act (“CPRA”).

1.              Introduction

bruusta Inc. (“bruusta”) are responsible for determining the purposes and means of processing your data when:

·        You visit our website or make general enquiries with us;

·        We communicate with you regarding our services;

·        We contact you for sales and marketing purposes; and

·        During our standard business practices.

2.              Personal Data we collect, the purposes and legal basis

Please refer to the ‘Personal Data we collect’ and the ‘Purposes for which we use Personal Data and the legal basis’ sections in our main Privacy Notice to learn more about the Personal Data we collect and use.

In summary, we collect the following categories of Personal Data as classified under the CCPA:

• Online identifiers, such as your email address and IP address;
• Personal information categories (Cal. Civ. Code § 1798.80(e)), such as your first name, last name, address and phone number(s); and
• Internet or other similar network activity information, such as information regarding your interaction with our website.

Personal Data does not include publicly available information. ‘Publicly available’ means information that is lawfully made available from federal, state, or local government records. ‘Publicly available’ does not mean biometric information collected by a business about a consumer without the consumer’s knowledge.

3.              Sharing your Personal Data

bruusta shares your personal information with service providers such as technology service providers and other business partners as part of our business practices and to provide you with our Services.

Please see the ‘Sharing your data’ section in our Privacy Notice for additional details on how we disclose your personal information with selected recipients for specific purposes.

bruusta does not sell your Personal Data to advertisers or other third parties.

In summary, bruusta share the following categories of information as classified under the CCPA:

·        Online identifiers, such as your email address and IP address;

·        Personal information categories (Cal. Civ. Code § 1798.80(e)), such as your first name, last name, home address and phone number(s); and

·        Internet or other similar network activity information, such as information regarding your interaction with our website.

3.              Your rights

In addition to the rights mentioned in our main Privacy Notice, the CCPA provides California consumers with the following additional rights:

·        Right to Opt-out of the Sale of Personal Data – You have the right to opt-out of the sale of the Personal Data we have collected about you. Although this right is available to you, bruusta does not sell your Personal Data to third parties.

·        Right to Non-Discrimination – You have the right to not receive discriminatory treatment for exercising any of your CCPA rights. bruusta will not treat you differently for exercising any of the rights described in this Appendix or the main Privacy Notice.