Welcome to Jalpen (“Jalpen,” “we,” “us,” or “our”). We are a premium women’s handbag brand based in New York City, New York, operating through our website at jalpen.com (the “Site”).

We are committed to protecting your personal information and your right to privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our Site, make a purchase, sign up for our emails, or interact with us in any way.

Please read this policy carefully. If you disagree with its terms, please discontinue use of our Site.

For questions or concerns about this policy, contact us at:

Jalpen New York, NY Email: privacy@jalpen.com

             Information We Collect

A. Information You Provide Directly

When you place an order, create an account, subscribe to our emails, contact us, or otherwise interact with us, we may collect:

• Identifiers: Full name, email address, billing address, shipping address, phone number, and account credentials
• Payment information: Credit/debit card details, billing address, and payment verification data (note: full card numbers are never stored by Jalpen — they are processed securely by our payment processors)
• Order information: Products purchased, order history, cart contents, returns, and exchanges
• Communications: Messages, emails, and inquiries you send us

• Account information: Username, password, and saved preferences if you create an account

B. Information Collected Automatically

When you visit our Site, certain information is collected automatically through cookies, pixels, and similar technologies:

• Device and technical data: IP address, browser type and version, operating system, device identifiers, screen resolution, and language settings
• Usage data: Pages visited, time spent on pages, links clicked, referring URLs, exit pages, and traffic sources
• Shopping behavior: Products viewed, items added to cart, checkout steps initiated, and purchases completed
• Cookie and tracking data: Unique identifiers set by our cookies and third-party cookies (see Section 5 for full details)
• Geolocation: General location inferred from your IP address (we do not collect precise GPS location)

C. Information From Third Parties

We may receive information about you from:

• Analytics providers (Google Analytics) regarding how you interact with our Site

• Advertising partners (Meta/Facebook) for ad targeting and measurement

• Email marketing platforms (Klaviyo) for behavioral data tied to email campaigns

• Payment processors (PayPal, Stripe) for transaction verification

• Social media platforms when you interact with our social accounts or ads

            How We Use Your Information

We use the information we collect for the following purposes:

We do not use your personal information for purposes incompatible with those listed above without providing you additional notice.

          How We Share Your Information

We do not sell your personal information to data brokers. We share personal information only with the following categories of recipients, each bound by confidentiality obligations or their own privacy policies:

A.  Fulfillment and Logistics Partners

To deliver your order, we share your name, shipping address, phone number, and order contents with our fulfillment and logistics partners, including our overseas manufacturing and warehousing partners and international shipping carriers such as DHL, USPS, UPS, and FedEx. These partners are located in the United States and internationally, including in Asia. Your data may be processed and stored in countries with different privacy protections than those in the United States.

B. Payment Processors

We share order and billing information with:

• PayPal (paypal.com/us/legalhub/paypal/privacy-full) — PayPal acts as an independent data controller for transactions processed through its Please review PayPal’s Privacy Statement for details on how PayPal handles your data.
• Stripe (stripe.com/privacy) — if applicable at checkout

C. Email and SMS Marketing Platform

We use Klaviyo to manage our email and SMS marketing. Klaviyo receives your name, email address, phone number (if provided), and on-site behavioral data including products viewed, cart additions, and purchase history. Klaviyo’s privacy policy is available at klaviyo.com/privacy.

D. Advertising and Analytics Platforms

• Meta (Facebook/Instagram): We use Meta Pixel and the Meta Conversions API on our Site. Meta receives behavioral event data (page views, product views, add-to-cart, purchases) and may receive hashed versions of your email address if you are an identified Meta uses this data for ad targeting, measurement, and audience building. Meta acts as an independent data controller. Learn more at facebook.com/privacy/policy.
• Google Analytics: We use Google Analytics 4 to understand Site traffic and user behavior. Google receives device/session data, behavioral data, and inferred geolocation. No personally identifiable information (such as your name or email) is transmitted to Google Analytics. Google’s privacy policy is at google.com/privacy.

E.  Technology and Hosting Providers

Our Site is built on WordPress and WooCommerce. Your data is stored on our hosting provider’s secure servers. We also use third-party plugins and tools that may process your data as necessary to operate the Site (e.g., live chat, reviews, security plugins).

F. Legal and Compliance

We may disclose your information to law enforcement, regulators, courts, or other authorities if required by law or if we believe disclosure is necessary to protect our rights, your safety, or the safety of others.

G.  Business Transfer

In the event of a merger, acquisition, sale of assets, or bankruptcy, your personal information may be transferred to the successor entity. We will notify you via email and/or a

prominent notice on our Site prior to such a transfer.

      Cookies and Tracking Technologies

What We Use

We use the following cookies and tracking technologies on jalpen.com:

Your Cookie Choices

You can manage your cookie preferences at any time using our Cookie Preferences link in the Site footer. You may also:

• Use your browser settings to block or delete cookies

• Use the Google Analytics Opt-Out Browser Add-on at google.com/dlpage/gaoptout
• Opt out of Meta ad targeting at com/settings/?tab=ads

• Use the Global Privacy Control (GPC) signal in supported browsers — we honor GPC as a valid opt-out of cookies used for advertising purposes in California, Colorado, and other applicable states

Please note that disabling certain cookies may affect Site functionality, including your ability to add items to your cart or complete a purchase.

      Email and SMS Marketing

Email

If you subscribe to our newsletter or make a purchase, we may send you marketing emails about new arrivals, promotions, and brand updates. You can unsubscribe at any time by clicking “Unsubscribe” at the bottom of any marketing email or by emailing privacy@jalpen.com.

SMS

If you opt in to our SMS program, we will send you text messages about orders, promotions, and brand updates. Message frequency varies. Message and data rates may apply.

Your SMS opt-in consent is never shared with any third party for purposes unrelated to providing you our SMS service.

To stop receiving SMS messages, reply STOP to any message. For help, reply HELP or contact us at privacy@jalpen.com.

     Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer period is required by law. Our general retention guidelines:

When data is no longer needed, we securely delete or anonymize it.

             Data Security

We implement reasonable administrative, technical, and physical safeguards to protect your personal information, consistent with our obligations under the New York SHIELD Act and applicable US law. These measures include:

• SSL/TLS encryption for all data transmitted to and from our Site

• Encrypted storage of sensitive data

• Multi-factor authentication for administrative access

• Regular security reviews and risk assessments

• Employee training on data handling and privacy

• Contractual security requirements imposed on our service providers and fulfillment partners

No method of transmission over the Internet or electronic storage is 100% secure. If we become aware of a data breach affecting your personal information, we will notify you in accordance with applicable law — including within 30 days as required by the New York SHIELD Act.

      Your Privacy Rights

Depending on your state of residence, you may have the following rights regarding your personal information:

All US Residents

• Right to Know: Request information about what personal data we collect, use, and share
• Right to Delete: Request deletion of your personal information (subject to certain exceptions, such as legal record-keeping obligations)
• Right to Correct: Request correction of inaccurate personal information

• Right to Non-Discrimination: We will not discriminate against you for exercising your

privacy rights

• Right to Opt Out of Marketing: Unsubscribe from emails or SMS at any time

California Residents (CCPA/CPRA)

In addition to the above, California residents have the right to:

• Know the categories of personal information collected, the sources, the purposes, and the third parties with whom it is shared — in the past 12 months
• Opt out of the Sale or Sharing of personal information for cross-context behavioral advertising (see “Do Not Sell or Share My Personal Information” below)
• Limit use of Sensitive Personal Information to what is necessary to provide the service
• Data Portability: Receive a copy of your personal information in a portable format

• Authorized Agent: Designate an authorized agent to submit requests on your behalf (we will require written authorization or a power of attorney)

California’s “Shine the Light” law (Civil Code § 1798.83) also permits California residents to request information about disclosures of personal information to third parties for those third parties’ direct-marketing purposes. Contact us at privacy@jalpen.com with “Shine the Light Request” in the subject line.

Virginia, Colorado, Connecticut, Texas, Oregon, and Other State Residents

Residents of states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Texas, Oregon, Montana, Nevada, Indiana, and others) have the right to know, access, correct, delete, and opt out of the sale or use of their personal information for targeted advertising, consistent with their state’s applicable law. To exercise these rights, contact us using the methods in Section 10.

Do Not Sell or Share My Personal Information

We do not sell your personal information to data brokers or third parties for monetary compensation.

However, our use of Meta Pixel, Google Analytics advertising features, and similar technologies may constitute “sharing” of personal information for cross-context behavioral advertising under the California CPRA and similar laws. You have the right to opt out.

To opt out:

• Click “Do Not Sell or Share My Personal Information” in the footer of our Site to manage your cookie preferences
• Email us at privacy@jalpen.com with “Opt Out of Sharing” in the subject line

• Use a Global Privacy Control (GPC)-enabled browser — we honor GPC signals automatically

      How to Submit a Privacy Request

To exercise any of your privacy rights, you may:

• Email: privacy@jalpen.com (subject: “Privacy Request”)

• Web form: Available on our Contact Us page at com/contact-us

Please include your full name, email address associated with your account or purchase, and a description of your request. We will respond within 45 days. If we need more time, we will notify you within the initial 45-day period and may extend our response by an additional 45 days where permitted by law.

We may need to verify your identity before processing your request. We will not charge a fee for reasonable requests but reserve the right to charge a fee for excessive or unfounded requests.

       Children’s Privacy

Our Site is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@jalpen.com and we will delete that information promptly.

For California residents: We do not sell or share the personal information of consumers we know to be under 16 years of age without affirmative opt-in consent.

        Third-Party Websites and Links

Our Site may contain links to third-party websites, social media platforms, and partner

pages. We are not responsible for the privacy practices of those sites. We encourage you to read the privacy policies of any site you visit.

         International Visitors

Jalpen is based in New York, United States, and our Site is intended for customers in the United States. If you access our Site from outside the United States, your data may be transferred to, stored, and processed in the United States and other countries where our service providers and fulfillment partners operate, including countries in Asia. Data-protection laws in these countries may differ from those in your country of residence.

By using our Site, you consent to the transfer of your information to the United States and other countries as described in this policy.

        Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will update the “Last Updated” date at the top of this policy and, where appropriate, notify you by email or through a notice on our Site.

We encourage you to review this policy periodically. Your continued use of our Site following any changes constitutes your acceptance of the updated policy.

                         Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

Jalpen New York, NY, United States Email: privacy@jalpen.com Website:

jalpen.com/contact-us

We are committed to resolving any privacy concerns you may have promptly and transparently.

This Privacy Policy was last reviewed and updated on April 24, 2026.

This policy applies to jalpen.com and all associated Jalpen digital properties.