Privacy Policy

INTRODUCTION

This Privacy Policy applies to the sites ("Sites") owned, operated, or controlled by CCA and B, LLC d/b/a The Lumistella Company (the “Company”), its affiliates and all entities and brands under its control such as The Elf on the Shelf®, Elf Pets®, Elf Mates®, et. al, including all trademarks owned or controlled by such entities, collectively referred to herein as "we," "us" or "our"., including, but not limited to: elfontheshelf.com, ccaandb.com, santasnorthpole.com and the services ("Services") including mobile applications published to Google Play and iTunes App Stores or other related internet-based technologies owned, maintained, or managed by us, are intended for use by the whole family, which may include young children with parental participation and supervision.

We recognize the importance of protecting any information collected from the users (each "User" or collectively, "Users," referred to herein as "you" or "your") of our Sites and Services, and we have established this Privacy Policy to inform you about the types of information we gather about you while using our Sites and Services. This includes how we may use that information, whether we disclose it to anyone, and the choices you have regarding use of and correction of the information. When you use our Sites and Services and input information, you expressly consent to the use of such information according to this Privacy Policy. We understand your privacy is important. We encourage you to refer to this policy on an ongoing basis to stay up to date on our most current privacy practices, which may change from time to time as an effort to remain compliant with relevant privacy regulation. The date that this policy was last changed is noted above. If any future modification requires us to provide notice to a parent or receive parental consent, we will take the steps necessary to comply with those requirements at that time.

YOU NEED TO AGREE TO THIS PRIVACY POLICY AND THE TERMS OF USE, OR IF YOU HAVE NOT REACHED THE AGE OF MAJORITY IN YOUR JURISDICTION, A PARENT OR LEGAL GUARDIAN, MUST READ AND ACCEPT THEM ON YOUR BEHALF. IF YOU, OR YOUR PARENT/GUARDIAN ON YOUR BEHALF, DO NOT WISH TO BE BOUND BY THIS PRIVACY POLICY OR THE TERMS OF USE, PLEASE EXIT THE SERVICE NOW AND DO NOT DOWNLOAD, ACCESS OR USE OUR SITES AND SERVICES.

Contact us at compliance@lumistella.com concerning anything you do not understand.

CHANGES TO THIS POLICY

We may make changes to the policy from time to time so please be sure to check regularly. If we make a material change to this policy and we have your contact details, we will contact you before we make the change.

CHILDREN'S PRIVACY

KIDS PRIVACY ASSURED BY PRIVO: COPPA SAFE HARBOR CERTIFICATION

The Company is a member of the PRIVO Kids Privacy Assured COPPA Safe Harbor Certification Program ("the Program"). The Program certification applies to the digital properties listed on the validation page that is viewable by clicking on the link below. PRIVO is an independent, third-party organization committed to safeguarding children's personal information collected online. The PRIVO COPPA certification Seal posted on this page indicates the Company has established COPPA compliant privacy practices and has agreed to submit to PRIVO's oversight and consumer dispute resolution process. If you have questions or concerns about our privacy practices, please contact us at 1-877-919-4105 or compliance@lumistella.com. If you have further concerns after you have contacted us, you can contact PRIVO directly at privacy@privo.com.

To view the PRIVO verified page for the COPPA safe harbor program please visit this link: https://cert.privo.com/#/companies/elfontheshelf

The following is intended to provide additional clarification on specific Services we offer:

• Mobile Applications (iOS and Google Play mobile applications published by us)
  
  • We do not collect any personal information from children in our mobile applications.
  • The Company uses the 3rd party services listed below to collect technical information, in aggregate, for reporting, analytics, and performance monitoring.
  • Some mobile applications utilize alerts, which you may control via the alert setting within the application. The alerts are not sent remotely by a server.
  • Geolocation information is collected by our mobile applications and websites at the city level.
• SantasNorthPole.com website
  
  • This site does not contain advertisements.
  • The Write a Letter to Santa feature on www.santasnorthpole.com does not store any information from the user. The content of the letter is disposed immediately after the form is submitted.

The Company uses the 3rd party services listed below to collect technical information, in aggregate, for reporting, analytics, and performance monitoring.

TYPES OF INFORMATION WE COLLECT FROM CHILDREN

When a child registers for an account, we collect their date of birth, username and password. We also collect a parent email address to seek consent. We also use the parent’s email address for basic account administration. Account creation is used on SantasNorthPole.com to provide a user profile which allows a user to save their game state and save related, site-specific information to help provide a more enjoyable user experience;

THIRD PARTY SERVICE PROVIDERS USED IN RELATION TO CHILDREN

We work with the following third-party service providers in relation to children under 13 years old. These third parties do not share our user's information.

• We work with Google Analytics on both our Sites and Services to provide our service and to better understand your use of it, this third party use anonymized information and is not allowed to share your data. For more information on Google Analytics see here.
• We work with Firebase on our Sites and Services (specifically, mobile applications) to help monitor performance, your usage, and assess any issues with the application. For more information on Firebase, see here.
• We use Crashlytics on our Sites and Services (specifically Ideas for Scout Elves) to track crash reporting, application logging, online review and statistical analysis of application logs. For more information on Crashlytics, see here
• We use FusionAuth, an identity and access management tool, to provide compliant authentication, authorization, and user management on our Site (specifically santasnorthpole.com). For more information on FusionAuth, see here: https://fusionauth.io/product-privacy-policy.

Some of the features on our Sites and Services are directed to parents and adults, we do not intentionally or knowingly seek Submissions from children under 13 years old in connection with those features. Any content submitted by children under 13 years, including Submissions through the Write a Letter to Santa feature, is not stored or retained.

For more information in our privacy practices related to children, please contact compliance@lumistella.com.

HOW TO UPDATE OR REMOVE YOUR INFORMATION

We retain your information and content for as long as necessary to provide our service. If you or your child wish to opt out of services, review your information or delete it, please contact us at:

The Lumistella Company
Compliance Department
3350 Riverwood Parkway, Ste 300
Atlanta, GA 30339
Phone Number: (1)877.919.4105
E-mail: Compliance@lumistella.com

GENERAL PRIVACY POLICY

TYPES OF INFORMATION WE COLLECT

• Marketing information you provide to us when you opt-in to receive emails from us; and
• Analytics information when you visit our sites or use our applications, including usage, viewing and technical data, when you visit our sites, use our applications on third-party sites or platforms or open emails we send. This information is collected anonymously.

HOW WE COLLECT YOUR INFORMATION

We collect information you provide to us when you request products, services or information from us, register with us, participate in public forums or other activities on our sites and applications, respond to customer surveys, or otherwise interact with us. Please keep in mind that when you provide information to us on a third-party site or platform (for example, via our applications), the information you provide may be separately collected by the third-party site or platform. The information we collect is covered by this Privacy Policy and the information the third-party site or platform collects is subject to the third-party site or platform's privacy practices. Privacy choices you have made on the third-party site or platform will not apply to our use of the information we have collected directly through our applications.

We collect information through technology, such as cookies, Flash cookies, tags, Web beacons, pixels, and JavaScript (alone or in conjunction with cookies) when you visit our sites and applications or use our applications on third-party sites or platforms. Please see our Cookie Policy for more information.

INFORMATION SHARING

We will not share your personal information outside of our affiliated companies (defined below) except in limited circumstances, including:

1. When you allow us to share your personal information with another company, such as:
   
   1. Electing to share your personal information with carefully selected companies so that they can send you offers and promotions about their products and services (but only with specific consent).
   2. Directing us to share your personal information with third-party sites or platforms, such as social networking sites (Please note that once we share your personal information with another company, the information received by the other company becomes subject to the other company's privacy practices.)
2. When companies perform services on our behalf, like email delivery, package delivery and customer service; however, these companies are prohibited from using your personal information for purposes other than those requested by us or required by law.
3. When we engage in partnerships with other brands where we may temporarily provide the ability for re-targeting campaigns.
4. When we share personal information with third parties in connection with the sale of a business, to enforce our Terms of Use or rules, to provide the Sites and Services to you, to ensure the safety and security of our guests and third parties, to protect our rights and property and the rights and property of our guests and third parties, to comply with legal process or in other cases that disclosure is required by law.

In addition to the third parties listed in the children's section above, we use the following third parties on our general audience properties to provide you the functionality required to fully utilize our Sites and Services:

• Zendesk: Zendesk helps us provide customer service. Zendesk is not allowed to share our user data. For Zendesk's Privacy Policy, click here.
• Google Analytics: Google Analytics helps us to better understand your use of our Sites and Services. This third party uses anonymized information and is not allowed to share your data. For Google's Privacy Policy, click here.
• Google Tag Manager: We use Google Tag Manager to enhance our ability to manage event tracking in Google Analytics, such as tracking button clicks. For Google's Privacy Policy, click here.
• New Relic: New Relic provides application monitoring services, which allow us to understand how our Sites and Services are functioning and performing, which can include information about your browser, operating system and hardware, as well as your usage of our site. For New Relic's Privacy Policy, click here.
• Facebook: We utilize Facebook to allow users to share content from our Sites and Services to their social media account(s) and for ad-tracking. For Facebook's Privacy Policy, click here.
• Pinterest: We utilize Pinterest to allow users to share content from our Sites and Services to their social media account(s) and for ad-tracking. For Pinterest's Privacy Policy, click here.
• Instagram: We utilize Instagram to allow users to share content from our Sites and Services to their social media account(s) and for ad-tracking. For Instagram's Privacy Policy, click here.
• Twitter: We utilize Twitter to allow users to share content from our Sites and Services to their social media account(s) and for ad-tracking. For Twitter's Privacy Policy, click here.
• Alexa Metrics: We use Alexa to help understand how our Sites and Services are ranking and performing. For Alexa's Privacy Policy, click here.
• MailChimp: MailChimp allows us to send email marketing information and transactional emails to your registered email account. You have the option to unsubscribe at any time from this service from the links included in email communications. For Mailchimp's Privacy Policy, click here.
• Shopify: Shopify is the ecommerce platform we utilize to offer online sale of our products. This service allows you to purchase and pay for items; and provides tracking information for your order. For Shopify's Privacy Policy, click here.
• AWS: Amazon Web Services ("AWS") is a cloud platform which provides for the core functionality of our Sites and Services. For AWS's Privacy Policy, click here.
• We work with Firebase on our Sites and Services (specifically our mobile applications) to help monitor performance, your usage, and assess any issues with the application. For more information on Firebase, see here: https://firebase.google.com/support/privacy.
• We use Crashlytics on our Sites and Services (specifically Ideas for Scout Elves) to track crash reporting, application logging, online review and statistical analysis of application logs. For more information on Crashlytics, see here: https://firebase.google.com/terms/crashlytics.

YOUR CONTROLS AND CHOICES

We provide you the ability to exercise controls and choices regarding our collection, use of, and sharing of your information. In accordance with local law, your controls and choices may include:

1. You may change your choices for subscriptions, newsletters and alerts.
2. You may choose whether to receive offers and promotions from us for our products and services, or products and services that we think may be of interest to you.
3. You may choose whether we share your personal information with other companies so they can send you offers and promotions about their products and services.

You may request access to the personal information we collect about you and that we amend or delete it. You may also request third parties with whom we have shared the information do the same. Please send any requests to compliance@lumistella.com.

DATA SECURITY AND INTEGRITY

The security, integrity and confidentiality of your information are extremely important to us. We have implemented technical, administrative and physical security measures that are designed to protect guest information from unauthorized access, disclosure, use and modification. From time to time, we review our security procedures to consider appropriate new technology and methods. Please be aware though that, despite our best efforts, no security measures are perfect or impenetrable.

DATA TRANSFERS, STORAGE AND PROCESSING

Wherever your personal information is transferred, stored or processed by us, we will take reasonable steps to safeguard the privacy of your personal information. To the extent required by law, the Company will provide you with reasonable access to the personal information collected through our Websites or apps.

When we collect your information, we keep it for as long as necessary to provide our services, conduct business with you, comply with the purposes outlined in our privacy policy, comply with our legal obligations, resolve disputes and enforce any agreements. You can, at any time, always change your preferences by opting in or out to preferences or services in the same way you first gave consent, also, you can request access to your personal data, have any inaccuracies rectified, or request erasure of your personal information by mailing or sending an email, using the company contact information provided below, your personal data will at all times be kept confidential and secure in harmony with applicable privacy laws and managed in accordance with the consent you have provided to us.

Under CCPA (California Consumer Privacy Act. 2018), California residents have the right to know the categories and pieces of information we have collected, disclosed or used in the past twelve months, in addition you have the right to delete your personal information, subject to certain exceptions, the right to opt-out of the sale of your personal information, we may require the verification of your identity prior to processing some of your request, the information you provide to verify your identity will not be used for any other purpose. Finally, residents of California will not be discriminated for exercising the rights before mentioned.

COMMENTS AND QUESTIONS

If you need further explanation, have comments or questions about our privacy policy practices or have questions about your child's use of the service including reviewing or requesting deletion of your child's information, please contact the Company's Compliance Department at:

The Lumistella Company
Compliance Department
3350 Riverwood Parkway, Ste 300
Atlanta, GA 30339
Phone Number: (1)877.919.4105
E-mail: compliance@lumistella.com

INTRODUCTION

This Cookie policy applies to the sites ("Sites") owned, operated, or controlled by CCA and B, LLC d/b/a The Lumistella Company (the “Company”), its affiliates and all entities and brands under its control such as The Elf on the Shelf®, Elf Pets®, Elf Mates®, et. al, including all trademarks owned or controlled by such entities, collectively referred to herein as "we," "us" or "our"., including, but not limited to: elfontheshelf.com, ccaandb.com, santasnorthpole.com and the services ("Services") including mobile applications published to Google Play and iTunes App Stores or other related internet-based technologies owned, maintained, or managed by us, are intended for use by the whole family, which may include young children with parental participation and supervision. We recognize the importance of protecting any information collected from the users (each a "User" or collectively, "Users," referred to herein as "you" or "your") of our Sites and Services.

SCOPE

This Cookie Policy ("Policy") explains how we use cookies and other similar technologies on our Sites and Services. This policy does not apply to the privacy practices of third-party websites or services, which may be linked to our Sites and Services. This Cookie Policy is and will be treated as part of our Terms of Use. It is your responsibility to review and accept the cookie policies from third-party websites, services, or mobile applications.

COOKIES

Cookies are small text files which are downloaded to your browser when you visit a website. Most web pages contain elements from multiple web domains so when you visit our Site and Services, your browser may receive cookies from several sources. This includes third parties that we have hired to provide services on our behalf, such as site analytics or ad targeting.

Session cookies are deleted automatically when you close your browser and persistent cookies remain on your device after the browser is closed (for example to remember your user preferences when you return to the site).

What types of cookies do we use?

As described in our General Privacy Policy, we use cookies and other technologies, such as web beacons, tags and JavaScript (alone or in conjunction with cookies), to ensure visitors to our Site have the best possible experience and to provide targeted advertising. We use both session-based and persistent cookies. We set and access our own cookies on our Sites and Services and we also use third party cookies, like Google Analytics.

The following are a list of the categories of cookies and other technologies that we use:

STRICTLY NECESSARY

These cookies and other technologies are essential to enabling your use of our Sites and Services and their features. Without these cookies, services we would provide (such as remembering your settings) cannot be provided. These cookies may be associated with personal data (e.g. would provide a link to your user account).

FUNCTIONALITY

These cookies and other technologies improve your experience by enabling personalization (like remembering language and region), as well as enabling certain features like tracking progress in one of our games. These cookies may be associated with personal data (e.g. would provide a link to your user account).

ANALYTICS / PERFORMANCE

These cookies and other technologies help us learn how well our Site and Services are performing. We use these cookies to understand, improve, and research our Site and Services. These cookies may be associated with personal data (e.g. would provide a link to your user account).

TARGETING OR ADVERTISING

Cookies and other technologies such as advertising pixels collect information about the browsing habits associated with your device and are used to make advertising more relevant to you and your interests. Third parties provide these services in return for recognizing that you (or more accurately your device) have visited a certain Site or Service. These third parties put down advertising cookies both when you visit our Sites and Services and when you use their services and navigate away from our Sites and Services. These cookies may be associated with your personal data (e.g. your account on that third-party site such as Facebook or Twitter).

LOCAL SHARED OBJECTS ("FLASH COOKIES")

Local Shared Objects (aka "Flash cookies") and local storage in HTML5 may also be used on our Sites and Services to enhance your experience by, for example, storing your user preferences and settings like volume/mute settings. Local Shared Objects are data files similar to browser cookies but can store more complex data than simple text. You can manage local shared objects by following the instructions on Adobe's help site here.

DISABLING COOKIES

If you do not agree to the use of these cookies, please disable them by following the instructions for your browser set out at allaboutcookies.org. Please note that the Site or Service may not function well if cookies are disabled. It may also stop you from saving customized settings, like login information.

For cookies that track activity in connection with targeting advertising, you can opt-out of third-party targeting cookies on the Digital Advertising Alliance's consumer choice page (http://optout.aboutads.info) or the Network Advertising Initiative's consumer choice page (http://optout.networkadvertising.org) or the European Interactive Digital Advertising Alliance consumer choice page (http://youronlinechoices.eu).

Other tools offered by third parties can help you see and manage the types of cookies and trackers that you encounter. More information about cookies and cookie management can be found on www.allaboutcookies.org and www.aboutcookies.org.

Browser manufacturers also provide help pages relating to cookie management in their products.

• Google Chrome
• Internet Explorer
• Mozilla Firefox
• Safari (Desktop)
• Safari (Mobile)
• Android Browser
• Opera
• Opera Mobile

For other browsers, please consult the documentation that your browser manufacturer provides.

After your initial visit to our Sites and Services we may change the cookies and other technologies we use.

USE OF IP ADDRESSES AND WEB LOGS

We may also use your IP address and browser type to help diagnose problems with our server, to administer our Sites and Services and to improve the Sites and Services we offer to you. An IP address is a numeric code that identifies your computer on the internet.

DO NOT TRACK

Currently, various browsers - including Internet Explorer, Firefox, and Safari - offer a "do not track" or "DNT" option that relies on technology known as a DNT header, which sends a signal to the websites visited by the user about the user's browsers DNT preference setting. We do not currently commit to responding to browser's DNT preference across its Sites, because no common industry standard for DNT has been adopted by industry groups, technology companies or regulators, including no consistent standard of interpreting user intent. We take privacy and choices regarding privacy seriously and will make efforts to continue to monitor the development around DNT browser technology and the implementation of a standard for DNT.

CHANGES TO THE TERMS OF USE OR POLICIES

From time to time, we may change the Terms of Use or any of our policies in order to better communicate the use of new applications, technologies, industry practices, regulatory requirements or other related purposes. Update dates will be reflected at the beginning of each Term or Policy when applicable to any or all of them, for our visitor's reference. When required by applicable law, we will obtain your consent to any changes.

By continuing to use our Sites and Services, you are agreeing to these Terms of Use. If you do not agree with the Terms of Use, you should immediately discontinue the use of our Sites and Services.

COMMENTS AND QUESTIONS

If you have a comment or question about the Terms of Use or any policy, please contact the Company's Compliance Department at:

The Lumistella Company
Compliance Department
3350 Riverwood Parkway, Ste 300
Atlanta, GA 30339
Phone Number: (1)877.919.4105
EMAIL: compliance@lumistella.com