Privacy policy

Stephen Matthew Designs, LLC (hereinafter referred to as “Stephen Matthew Designs,” “SMD,” “us,” “we,” “our,” or “Company”) has created this Privacy Policy to apply to all users of this website for the brand XYSTI MIAMI (www.xystimiami.com), including our mobile site, and the services contained or offered therein where this Privacy Policy is linked (collectively, our “Services”). This Privacy Policy describes, among other things, the types of information we collect from users, how we use it, and how you can access or exercise rights regarding your information.

This Privacy Policy is integrated into our Terms & Conditions of Use (“Terms & Conditions”).

If you are a resident of certain jurisdictions within the United States, the European Union (“EU”), European Economic Area (“EEA”), or United Kingdom (“UK”), you may be entitled to certain individual rights under various privacy laws, including, but not limited to, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act of 2020 (“CCPA”), the General Data Protection Regulation (“GDPR”), and the UK Data Protection Act 2018. Please see the Notice to Certain United States Residents of Data Subject Rights and Notice to Individuals in the European Economic Area and the UK sections below for a description of rights you may be entitled to and how to exercise them.

I. Information We Collect About You

We may collect the following categories of information about you, which are described in more detail below: (a) information you provide to us, (b) information we may automatically collect, and (c) information we may receive from third parties. All such information is referred to in this Privacy Policy as “Information” or “Personal Information.”

II. Information You Provide to Us

In using our Services, you may provide us with Information, including, without limitation:

• Individual identifiers such as your name, profile data, billing and delivery address, phone number, account credentials including username and password, and email address.
• Commercial information including payment and transactional information, records of products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies. We use third-party payment processors to facilitate payments and only store payment information when permitted and appropriate.
• Communications with us, preferences, and other Information you provide, such as live-chat communications or messages, opinions and feedback, marketing preferences, and Information that you share when contacting us directly for customer support or other services.
• Additional Information as otherwise described to you at the point of collection or pursuant to your consent.

III. Information We May Automatically Collect About You

Our Services may automatically collect categories of usage and technical Information about you. This Information may be used by Stephen Matthew Designs for operation of the Services, maintenance and improvement of the Services, security, analytics, and general statistics regarding use of the Services.

This Information may include:

• IP address, which is the number associated with the service through which you access the Internet.
• Date and time of your visit or use of our Services.
• Domain server from which you use our Services, type of computer, web browser, search engine, operating system, or platform you use.
• Data identifying the web pages you visited before and after visiting our website or using our Services.
• Your movement and activity within the website, which may be aggregated with other information.
• Mobile device information, including device type, operating-system version, mobile carrier, and device identifiers where available.

IV. Information We May Receive From Third Parties

We may collect additional Information about you from third-party websites, social media platforms, service providers, and sources providing publicly available information to help us provide services to you, prevent fraud, improve our Services, and conduct marketing and advertising activities.

This Privacy Policy applies to Information collected through our Services. We are not responsible for the privacy and security practices of other websites or social media platforms or the information they may independently collect. You should review the privacy policies of such third parties. Links to other websites or content do not constitute or imply an endorsement or recommendation by us.

A. Cookies & Technologies Used

We and/or service providers operating on our behalf may collect Information about your activity, or activity on devices associated with you over time, on our sites and applications and across non-affiliated websites or online applications.

We may collect this Information using technologies such as cookies, web beacons, session replay, pixels, software development kits, third-party libraries, and similar technologies. Third-party service providers, advertisers, and/or partners may also view, edit, or set their own cookies, place web beacons, or use pixels and tags on social media posts, ads, and chatbots to track click-through rates on the XYSTI MIAMI website.

Cookies or browser cookies. A cookie is a small file placed on your device. You may refuse to accept browser cookies by activating the appropriate setting in your browser. However, if you select this setting, you may be unable to access certain parts of our Services. Unless you have adjusted your browser settings to refuse cookies, our systems may issue cookies when you use our website.

Web Beacons. Website pages may contain small electronic files known as web beacons, clear GIFs, pixel tags, or single-pixel GIFs that permit us, for example, to count users who have visited certain pages and to generate related statistics. These technical methods may be used to analyze traffic patterns and may involve transmission of information directly to us or to third parties authorized by us to collect information on our behalf. Our Services may use retargeting pixels from advertising networks including Google and Meta/Facebook. We may also use web beacons in HTML emails to determine whether recipients have opened those emails or clicked links.

Analytics. We may use analytics tools, such as Google Analytics, to provide information about traffic to our website and use of our Services. Such providers may process collected data in accordance with their own privacy policies and services.

Our use of online tracking technologies may be considered a “sale” or “sharing” under certain laws. To the extent these technologies are deemed a “sale” or “sharing,” you may opt out by submitting a request or by broadcasting an opt-out preference signal, such as the Global Privacy Control (“GPC”), through browsers or browser extensions that support such a signal.

If you use GPC, you may need to enable it for each supported browser or browser extension you use. Some features of our website may not be available to you as a result of these choices.

You may also exercise applicable rights through our Data Sharing Opt-Out page:

V. How We Use Your Information

A. Use and Purpose of Processing Your Information

We use and process your Information for purposes that may include, but are not limited to:

• Providing the Services and information you request.
• Fulfilling your orders, managing your online account, personalizing your shopping experience, notifying you about product availability where applicable, and maintaining records relating to purchases.
• Responding to inquiries and questions and providing customer service.
• Conducting general or targeted marketing and advertising activities tailored to your interests, where permitted, including sending promotional material or special offers, provided you have not opted out or where consent is otherwise required.
• Fulfilling contracts we have with you.
• Managing, improving, and maintaining relationships with third-party service providers, vendors, suppliers, affiliates, subsidiaries, and business partners.
• Maintaining, improving, customizing, or administering the Services; conducting business analysis; resolving technical problems; improving security; and developing or improving products and services.
• Complying with our Terms & Conditions.
• Conducting analytics and business-intelligence activities.
• Complying with applicable laws and regulations and responding to lawful requests.
• Carrying out other purposes disclosed to you when we collect your Information or pursuant to your consent.

We may also use Information that has been de-identified and/or aggregated for lawful purposes not otherwise listed above.

B. Sharing or Disclosing Your Information

We may share and/or disclose your Information as described in this Privacy Policy and in the following circumstances:

Third-Party Service Providers. We may share your Information with service providers that perform functions or services on our behalf, such as hosting the Services, managing databases, conducting analytics, processing payments, providing customer service, fulfilling or shipping orders, or sending communications. These providers may use your Information only as permitted in connection with the services they provide.

Disclosure for Legal and Administrative Reasons. We may disclose your Information when required by law or legal process; to cooperate with an investigation or audit; to comply with governmental requests; to protect the rights, property, or safety of us, our affiliates, employees, contractors, partners, customers, or users; to enforce our Terms & Conditions; or to verify the identity of a user of our Services.

Online Promotions and Advertising. We may work with third parties to administer and analyze advertising or promotional campaigns and to provide a more tailored online experience. These parties may use cookies or similar technologies to collect information about website traffic, browsing or purchasing activity, device information, IP addresses, page interactions, and other online activity, subject to applicable law and available privacy choices.

Online Communications. Information you submit in a public forum, chatbot, or third-party social network may be read, collected, or used by us or other participants. You are responsible for Information you choose to submit in those environments.

Business Transfers. Your Information may be transferred or otherwise conveyed to a third party if we merge with or are acquired by another business, sell all or substantially all of our assets, enter bankruptcy or insolvency proceedings, or otherwise reorganize our business.

Subsidiaries and Affiliates. We may share Information with our subsidiaries and affiliates where permitted.

De-identified or Aggregated Data. We may share information on an aggregated or de-identified basis where the information does not reasonably identify you.

With Your Consent. We may share Information consistent with this Privacy Policy with your consent or at your direction.

C. Categories of Information Sold or Shared

We may sell or share certain categories of Personal Information as those terms are defined under applicable privacy laws. For purposes of this Privacy Policy, “sell,” “sold,” or “sale” may include disclosure of Personal Information for monetary or other valuable consideration, but generally does not include a transfer of Personal Information as part of a merger, bankruptcy, or disposition of all or a portion of our business.

Identifying Information: Name, mailing address, email address, phone number, and other identifiers.

Payment and Transaction Information: Information associated with payment and transaction processing. We use third-party payment processors and do not intentionally store full payment-card information unless provided through and permitted by the applicable payment service.

Usage and Technical Information: Information about your interaction with our website and content on third-party sites or platforms, such as IP address, browsing history, search history, device information, and user-interaction data.

VI. Links to Other Websites or Services

Our Services may contain links to other websites or services that are not owned or controlled by us, including social media platforms such as Facebook, Instagram, or YouTube, or may redirect you away from our Services.

We may also collect, use, and share aggregated data such as statistical or demographic data for lawful purposes. Aggregated data may be derived from Personal Information but is not considered Personal Information where it does not directly or indirectly identify you. If we combine aggregated data with Personal Information in a manner that can identify you, we will treat the combined data as Personal Information in accordance with this Privacy Policy.

This Privacy Policy applies to Information collected through our Services. We are not responsible for the privacy or security practices of third-party websites, services, or social media platforms. You should review their respective privacy policies.

VII. Information Security

We use commercially reasonable administrative, physical, and technical safeguards designed to protect Personal Information and provide our Services.

However, no data transmitted over the Internet or stored by us or our service providers can be guaranteed to be completely secure. We therefore cannot promise or guarantee that Information or private communications will always remain private or secure.

If you believe your Information has been accessed or acquired by an unauthorized person, please promptly contact us so that appropriate measures can be considered.

VIII. Data Retention

We retain Information for as long as reasonably necessary to provide our Services and for legitimate business purposes, and as necessary to comply with legal obligations, resolve disputes, enforce agreements and policies, prevent fraud, and maintain business records.

Retention periods may vary depending on the nature of the Information, the purpose for which it was collected, and applicable legal requirements.

In accordance with routine recordkeeping practices, we may delete records containing Information when they are no longer required.

IX. Your Choices

1. Marketing Communications. If you do not want to receive marketing or promotional emails from us, you may use the “unsubscribe” link contained in an email or contact us using the information below.

2. Text Messages. If you voluntarily sign up to receive SMS or text-message marketing from SMD or service providers acting on our behalf, your participation is subject to the terms presented when you opt in. Where required by law, recurring automated promotional or personalized marketing text messages will be sent only after obtaining the required consent. You may opt out according to the instructions contained in the applicable text-message program.

3. Online Advertising and Tracking Choices. You may have options to limit certain targeted advertising and tracking through your browser, device settings, advertising-industry opt-out tools, privacy signals such as GPC, and our Data Sharing Opt-Out page.

You may also use available Google tools or browser settings to manage certain Google Analytics or advertising preferences.

X. Notice to Certain United States Residents of Data Subject Rights

We provide this supplemental section to address potentially applicable U.S. state privacy laws, including the California Consumer Privacy Act and other State Privacy Laws.

To the extent a State Privacy Law applies to the collection or processing of your Information, you may have some or all of the rights described below. The specific rights available to you may depend on your state of residency and other factors.

To exercise applicable rights, see the Exercising Your Data Subject Rights section below.

Right to Know, Access, and Data Portability. You may have the right to request information regarding our collection and use of your Personal Information, including categories of Information collected, sources, purposes, categories of third parties, and specific pieces of Information we hold about you. You may also have the right to receive certain Information in a portable and readily usable format where technically feasible.

Deletion Rights. You may have the right to request deletion of Personal Information we collected from you, subject to applicable exceptions.

Correction Rights. You may have the right to request correction of inaccurate Personal Information we maintain about you.

Sale, Sharing, and Targeted Advertising Opt-Out Rights. You may have the right to opt out of processing of Personal Information for purposes that may include:

• Sale of Personal Information.
• Targeted advertising.
• Sharing of Personal Information for cross-context behavioral advertising.
• Certain forms of profiling where applicable.

The use of online tracking technologies may be considered a “sale” or “sharing” under State Privacy Laws. Where applicable, you may opt out by submitting a request, using our Data Sharing Opt-Out page, or broadcasting an opt-out preference signal such as GPC.

Right to Limit Certain Uses of Sensitive Personal Information. Where applicable and where we process information legally defined as Sensitive Personal Information, you may have rights to limit certain uses or disclosures of such information.

Right to Non-Discrimination. You have the right not to receive discriminatory treatment for exercising rights provided under applicable privacy laws.

Right to Disclosure Regarding Direct Marketing. Where applicable, you may have rights relating to disclosure of certain third parties receiving Personal Information for their own direct-marketing purposes.

Right to Appeal. Where applicable, you may have the right to appeal a denial of a privacy request. Appeals may be submitted by emailing:

contact@xystimiami.com

If you are not satisfied with the result of an appeal, applicable law may permit you to contact your state Attorney General or another relevant authority.

Depending on the applicable State Privacy Law, there may be limits on the number or frequency of certain requests. Where permitted by law, manifestly unfounded, excessive, or repetitive requests may be subject to reasonable limitations or fees.

A. Authorized Agent

You may use an authorized agent to submit certain requests on your behalf where permitted by law. We may require proof that you authorized the agent to act for you and may require you to verify your identity directly with us. We may deny a request from an agent who does not provide appropriate verification.

B. Notice of Financial Incentive

From time to time, we may offer discounts, promotional codes, or other benefits in connection with marketing programs.

Where such a program constitutes a “financial incentive” or similar program under applicable State Privacy Laws, we will provide any notices and obtain any consent required by law. You may withdraw from an applicable program as permitted by its terms and applicable law.

C. Reasonable Fee for Requests

To the extent permitted by applicable law, we may charge a reasonable fee for requests that are manifestly unfounded, excessive, or repetitive.

D. Sensitive Data

Where we process Personal Information that is legally defined as sensitive information or sensitive data, we will process that Information in accordance with applicable legal requirements and obtain consent when required.

XI. Notice to Individuals in the European Economic Area and the UK

This section applies to individuals accessing our Services from within the European Union, European Economic Area, and United Kingdom where applicable data-protection law applies and we collect Information considered “personal data” under those laws.

Personal data includes information relating to an identified or identifiable natural person who can be identified directly or indirectly by reference to an identifier such as a name, identification number, online identifier, or one or more factors relating to the individual’s identity.

A. Identity and Contact Details of Controller

Unless otherwise stated, we are the data controller for Personal Information we process.

Contact details:

Email: contact@xystimiami.com

B. Your Data Protection Rights

Where applicable, you may have the right to request that we:

• Restrict the way we process and share your Information.
• Transfer certain Information to you or a third party.
• Provide access to your Information.
• Delete Information where it is no longer necessary or where another legal basis for deletion applies.
• Correct inaccurate or outdated Information.
• Object to certain processing.

To exercise applicable rights, see the Exercising Your Data Subject Rights section below.

Where processing is based on consent, you may also withdraw your consent at any time, without affecting the lawfulness of processing performed before withdrawal.

Contact details:

Email: contact@xystimiami.com

Requests will be considered and responded to within time periods required by applicable law. Certain Information may be exempt from a request, and we may require additional information to verify your identity.

You may also have the right to lodge a complaint with the supervisory authority applicable to you, although we encourage you to contact us first so we can attempt to address your concern.

C. Lawful Basis for Processing Your Information

The lawful basis for processing Personal Information depends on the purpose of the processing.

For many business activities, we may process Personal Information because processing is necessary for our legitimate business interests, provided such interests are not overridden by your rights and interests.

Where we process Personal Information in relation to a contract or potential contract with you, the lawful basis may be performance of the contract or taking steps at your request before entering into a contract.

Where we are required to process or disclose Personal Information to comply with law, the lawful basis may be compliance with a legal obligation.

We may also rely on consent where appropriate or required, including certain marketing communications, cookies, and similar technologies.

Depending on the Personal Information and circumstances, grounds for processing may include:

Legitimate Business Interests. Providing, improving, securing, and promoting our Services; communicating with customers and business partners; administering relationships; conducting business-development activities; working with service providers; fraud prevention; and maintaining the security of our business and Services.

Performance of a Contract. Processing necessary to complete ecommerce transactions, fulfill orders, provide requested services, or administer our contractual relationship with you.

Consent. Processing activities for which consent is required by applicable law, such as certain promotional communications or use of cookies and similar technologies.

Legal Obligation. Processing necessary to comply with applicable law, legal process, court orders, regulatory obligations, or lawful requests.

If processing is based on consent, applicable law may allow you to withdraw or modify consent at any time.

D. International Transfers

We operate in the United States and may use service providers located in the United States and other countries.

Information, including Personal Information, may therefore be transferred to, stored, and processed in jurisdictions outside the country where you reside. Where required, we use measures designed to address international transfers in accordance with applicable data-protection laws.

E. Retention

We retain Personal Information for as long as reasonably necessary for the purposes described in this Privacy Policy and as required or permitted by law.

Factors we may consider include whether Information is needed to:

• Provide our Services.
• Respond to inquiries or requests.
• Fulfill orders or administer accounts.
• Comply with legal, accounting, tax, or regulatory obligations.
• Resolve disputes.
• Prevent fraud or maintain security.
• Protect legitimate business interests.

We delete or anonymize Information when it is no longer reasonably required, subject to applicable legal obligations and legitimate retention needs.

XII. Exercising Your Data Subject Rights

To exercise rights described in this Privacy Policy, please submit a verifiable request using the following contact information:

Email: contact@xystimiami.com

You may also use our Data Sharing Opt-Out page where applicable:

A request should provide sufficient information to allow us to reasonably verify that you are the person about whom we collected the Information, or an authorized representative, and should describe the request with sufficient detail to allow us to understand, evaluate, and respond to it.

To protect privacy and security, we may take reasonable steps to verify your identity before fulfilling certain requests.

If you designate an authorized agent to submit a request on your behalf, we may require written permission and/or other verification permitted by applicable law.

XIII. Geographic Location of Data Storage and Processing

Our business operates in the United States. Information collected through our Services may be processed and stored in the United States and in other jurisdictions where our service providers operate.

If you access the Services from outside the United States, your Information may be transferred to and processed in jurisdictions whose privacy laws may differ from those in your country.

Where required by applicable law, we use appropriate safeguards for such transfers.

XIV. Children’s Information

The Services are not directed to children under sixteen (16).

If we become aware that we have collected Personal Information from a child in violation of applicable law, we will take steps to address and remove such Information as required.

If you believe we have mistakenly or unintentionally collected Information from a child, please contact us.

XV. Difficulty Accessing Our Privacy Policy

Individuals with disabilities who are unable to meaningfully access our Privacy Policy online may contact us to request a copy in another reasonably accessible format.

XVI. “Do Not Track” and Global Privacy Control

Some web browsers offer a “Do Not Track” setting. Because there is not a universally accepted standard for responding to all Do Not Track signals, our Services may not respond to every such signal.

Do Not Track is different from Global Privacy Control (“GPC”). Where required by applicable law and supported by our Services, GPC may communicate a consumer’s privacy preference regarding the sale or sharing of Personal Information or targeted advertising.

XVII. Changes to This Privacy Policy

We reserve the right to change, modify, or amend this Privacy Policy to reflect changes in our business practices, products and services, technologies, legal requirements, or other operational needs.

If we modify this Privacy Policy, we will update the effective or last-updated date as appropriate. Changes become effective when posted unless otherwise required by law.

XVIII. How to Contact Us

If you have questions regarding this Privacy Policy or Personal Information we maintain about you, please contact:

Stephen Matthew Designs, LLC / XYSTI MIAMI

Email: contact@xystimiami.com