#1. Whether these laws apply to us at all
Honestly: probably not. The CCPA as amended by the CPRA applies to businesses over roughly $26.6 million in annual revenue, or handling the personal information of 100,000 or more California consumers or households, or deriving half their revenue from selling or sharing it. A furniture showroom in Lahore meets none of those thresholds, and the Virginia, Colorado, Connecticut, Utah and Texas statutes have comparable gates.
We publish this notice anyway, and honour the rights in it for any US resident who asks. Thresholds decide who can be fined. They do not decide what it is reasonable for a person to expect, and a notice that only appears once a regulator can reach you is a notice written for the regulator.
#2. Categories collected, disclosed and sold
Categories are named as they appear in California Civil Code §1798.140(v). "Disclosed for a business purpose" means given to a service provider under contract, which is not a sale.
| CCPA category | Do we collect it? | Disclosed for a business purpose to | Sold or shared? |
|---|---|---|---|
| A. Identifiers (name, address, phone, email, IP) | Yes | Hosting, delivery, payment providers | No |
| B. Customer records (§1798.80) — name, address, phone, payment metadata | Yes | Hosting, payment providers, accountant | No |
| C. Protected classifications (age, race, religion, sex) | No | — | No |
| D. Commercial information (orders, products considered) | Yes | Hosting, accountant | No |
| E. Biometric information | No | — | No |
| F. Internet or network activity (pages viewed, referrer) | Yes, with consent | Google Analytics; ad networks only if you consent | No |
| G. Precise geolocation | No. Approximate city from IP only | — | No |
| H. Audio, electronic, visual (showroom CCTV, photos you send) | Yes, in the showroom | Nobody, unless there is an incident | No |
| I. Employment information | Only for applicants and staff, not customers | Accountant, payroll | No |
| J. Education information | No | — | No |
| K. Inferences used to build a profile | No | — | No |
| L. Sensitive personal information (§1798.140(ae)) | No | — | No |
Sources, purposes and retention for each of these are in sections 3, 4 and 8 of the Privacy Policy and are not repeated here.
#3. No sale. No sharing. No targeted advertising off this site
We have not sold or shared personal information in the twelve months preceding the date on this notice, and we have no arrangement under which we could. We have not sold or shared the personal information of any consumer we know to be under 16.
One thing deserves stating precisely, because it is where most retailers' notices become slippery. California and Colorado define "sale" and "sharing" broadly enough that letting an advertising network drop a cookie for cross-context behavioural advertising can constitute one, with no money changing hands. Our answer is not that this does not count. Our answer is that those cookies are denied by default and only ever set if you affirmatively allow them — so no such disclosure occurs unless you have asked for it, and you can revoke it in two clicks.
Advertising is currently not active on this site. If that changes and any arrangement could amount to a sale or share, a "Do Not Sell or Share My Personal Information" link will appear in the footer of every page before the first ad loads — not after.
#4. Your rights
- Know and access — the categories and specific pieces of personal information we hold, the sources, the purposes, and the categories of recipient. Covering the preceding 12 months, and beyond that on request where we hold it.
- Delete — subject to the exceptions in §1798.105(d), the relevant one being invoices we are required to retain.
- Correct — inaccurate personal information.
- Opt out of sale, sharing and targeted advertising — nothing to opt out of today, and honoured immediately if that ever changes.
- Limit use of sensitive personal information — we collect none, so there is nothing to limit.
- Portability — a copy in a readable, portable format.
- Appeal — Virginia, Colorado, Connecticut and Texas give you a right to appeal a refusal. Reply to our decision and a different person reviews it within 45 days, with written reasons either way, and a pointer to your Attorney General if you are still unsatisfied.
- Non-discrimination — no worse price, no worse service, no slower delivery for exercising any of this. We operate no financial-incentive programme.
#5. How to exercise them
- Email privacy@vevarte.com with the state you live in and what you want. Or call +92 300 7512464 — California requires a toll-free number for businesses that meet the threshold, and since we are a shop with a published phone number that a person actually answers, that is the number.
- We verify you to a "reasonable degree of certainty" — for a request about an order, the order number and the phone number on it. For a deletion request we ask for a second matching data point, because deletion is irreversible and impersonation is the obvious attack.
- We confirm receipt within 10 business days and substantively respond within 45 calendar days, extendable once by a further 45 with notice. In practice we answer within 21 days.
- An authorised agent may act for you with written permission signed by you; we will still verify you directly unless you have given the agent a power of attorney.
#6. Global Privacy Control
We detect and honour the GPC signal. If your browser or extension sends it, advertising cookies stay denied and we treat it as a valid opt-out of sale and sharing under every state law that recognises a universal opt-out mechanism. No form, no account, no confirmation email.
GPC is a per-browser signal, so setting it on your laptop does not set it on your phone. That is a property of the mechanism, not a limitation we have added.
#7. California Shine the Light, and minors
California Civil Code §1798.83 lets residents request the personal information disclosed to third parties for their direct marketing purposes. We disclose none, so the answer is nil — but the request is free and we will confirm it in writing.
California Business & Professions Code §22581 gives a minor who is a registered user the right to remove content they posted. We have no user accounts at all, and any review can be removed on request from the person who wrote it, regardless of age.