PRIVACY POLICY

Last updated: 10 September 2026

CAVE ("CAVE", "we", "us" or "our") respects your privacy and is committed to protecting your personal data.

This Privacy Policy explains how we collect, use, store and disclose your personal information when you visit caveclothing.store (the "Site"), make a purchase, contact us, subscribe to our communications or otherwise interact with our services (collectively, the "Services").

Please read this Privacy Policy carefully to understand how and why we process your personal information.

1. Personal Information We Collect

The personal information we collect depends on how you interact with CAVE and our Services.

Information you provide directly to us

When you place an order, contact us, subscribe to marketing communications, submit a review or otherwise interact with our Services, we may collect information such as:

• Your name;
• Email address;
• Telephone number, where provided;
• Billing and shipping addresses;
• Order and purchase information;
• Payment confirmation and transaction information;
• Information relating to returns, refunds and exchanges;
• Information you provide when contacting customer support;
• Marketing preferences;
• Reviews or other information you voluntarily submit through our Site.

Payment information is processed through the payment providers available at checkout. CAVE does not necessarily receive or store your complete credit or debit card details.

Information collected automatically

When you visit or interact with our Site, we and our service providers may automatically collect certain information, including:

• IP address;
• Device and browser information;
• Network information;
• Pages and products viewed;
• Items added to your cart;
• Checkout and purchase events;
• Referring website, advertisement or source;
• Date and time of visits;
• Interactions with our Site and, where applicable, our marketing communications.

This information may be collected through cookies, pixels and similar technologies, subject to applicable consent requirements.

2. How We Use Your Personal Information

We may use your personal information to:

• Process and fulfil your orders;
• Process payments;
• Arrange production, fulfilment and delivery;
• Send order, shipping and delivery notifications;
• Process returns, refunds and exchanges;
• Respond to questions and provide customer support;
• Operate, maintain, secure and improve our Site and Services;
• Understand how visitors interact with our Site;
• Provide product review and affiliate/referral functionality;
• Measure the effectiveness of our marketing and advertising;
• Detect and prevent fraud, abuse or other unlawful activity;
• Comply with applicable tax, accounting, consumer protection and other legal obligations;
• Send marketing communications where permitted by law and, where required, with your consent;
• Measure or personalise advertising where permitted by applicable law and subject to applicable consent requirements.

3. Legal Bases for Processing

Where the General Data Protection Regulation ("GDPR") applies, we process your personal information on one or more of the following legal bases:

Performance of a contract: where processing is necessary to process your purchase, payment, production, delivery, return, refund or another request relating to our contractual relationship with you.

Legal obligation: where processing is necessary to comply with applicable tax, accounting, consumer protection or other legal requirements.

Legitimate interests: where processing is necessary for legitimate business purposes, such as operating and securing our Services, preventing fraud, providing customer support and improving our business, provided that these interests do not override your fundamental rights and freedoms.

Consent: where applicable law requires your consent, including for certain marketing communications, non-essential cookies and tracking or advertising technologies. Where we rely on consent, you may withdraw it at any time.

4. Shopify

Our online store is powered by Shopify, which provides the e-commerce platform that enables us to operate our Site and sell our products.

Shopify may process personal information in connection with your use of our Site, including information necessary to operate the store, provide checkout functionality, process transactions, maintain security and provide other e-commerce services.

We also use Shopify Network Intelligence. This feature allows Shopify to process customer information generated through our store together with information from other Shopify services to improve Shopify-powered services and features, including those relating to analytics, personalisation and advertising.

Where required by applicable law, processing for these purposes is subject to applicable privacy choices and consent requirements.

Shopify processes personal information in accordance with its own privacy documentation and applicable data protection obligations.

5. Payments

Payments made through our Site are processed by the payment methods and payment service providers available at checkout.

These providers may collect and process information necessary to complete your transaction, including payment details, billing information and transaction data.

Their processing of personal information may also be governed by their respective privacy policies.

6. Order Fulfilment and Shipping

We may share information necessary to produce, fulfil and deliver your order with production, fulfilment, logistics and shipping providers.

CAVE uses Printful in connection with the production and/or fulfilment of certain products and orders.

Where necessary to fulfil an order, information such as your name, delivery address, contact details and relevant order information may be provided to Printful or other fulfilment and delivery providers.

We only share information that is reasonably necessary to provide the relevant service.

7. Marketing Communications

Where permitted by applicable law, CAVE may send communications relating to new collections, artist collaborations, events, products, promotions and other CAVE news.

Where consent is required, we will only send these communications after you have actively chosen to receive them.

You can unsubscribe from marketing emails at any time by using the unsubscribe option included in our communications.

Withdrawing from marketing communications will not prevent us from sending essential transactional or service-related communications, such as information relating to your order, payment, shipment, return or refund.

8. Cookies and Similar Technologies

Our Site uses cookies, pixels and similar technologies.

Some cookies and technologies are strictly necessary for the operation, security and functionality of our Site.

Other technologies may be used for purposes such as:

• Remembering your preferences;
• Measuring website performance;
• Understanding how visitors use our Site;
• Analytics;
• Measuring marketing campaigns;
• Advertising and personalisation.

Where required by applicable law, non-essential cookies and similar technologies will only be used after you have provided the necessary consent.

You can manage or withdraw your consent through the cookie preference options available on our Site.

You may also configure your browser to block or delete cookies. Please note that blocking certain cookies may affect some features or functionality of the Site.

9. Advertising, Analytics and Marketing Technologies

CAVE uses third-party technologies and services to operate the Site, understand how visitors interact with it, communicate with customers and measure the effectiveness of our marketing.

Depending on the services enabled on our Site and your consent choices, these may include:

Meta (Facebook & Instagram) — used in connection with advertising, campaign measurement and understanding interactions with our Site.

Google & YouTube — used in connection with analytics, advertising, campaign measurement and integrations with Google services.

Brevo / PushOwl — used in connection with customer communications, marketing and related functionality.

CWILL (SendWILL) — used in connection with email collection, pop-ups and marketing functionality.

Judge.me — used to provide product review functionality and related services.

UpPromote — used in connection with affiliate and referral functionality.

These providers may process information concerning your interactions with our Site, such as pages and products viewed, cart or checkout activity, purchases, device and browser information and other events relevant to the service being provided.

Certain integrations, including our Meta and Google integrations, may transmit information through browser-based technologies and/or server-side connections.

Where these technologies involve non-essential storage, tracking or processing requiring consent, they will be used in accordance with applicable law and, where required, only after you provide consent.

You can manage or withdraw applicable consent through the cookie preferences available on our Site.

10. How We Disclose Personal Information

We may disclose personal information to third parties where reasonably necessary to operate our business and provide our Services, including:

• Shopify and other e-commerce service providers;
• Payment processors;
• Printful and other production or fulfilment providers;
• Shipping and logistics providers;
• Analytics and technology providers;
• Marketing and advertising providers, including Meta and Google where applicable;
• Email and customer communication providers;
• Product review providers;
• Affiliate and referral service providers;
• Professional advisers and technical service providers;
• Public authorities or other parties where disclosure is required by applicable law.

We may also disclose information:

• When you request or consent to the disclosure;
• To prevent or investigate fraud or unlawful activity;
• To protect our rights or the rights of others;
• To establish, exercise or defend legal claims;
• In connection with a sale, merger, restructuring or transfer of all or part of our business, subject to applicable data protection requirements.

CAVE does not sell personal information in the ordinary meaning of the term.

11. Third-Party Websites and Services

Our Site may contain links or integrations relating to websites, social media platforms and services operated by third parties.

If you access a third-party service, that third party may process information in accordance with its own privacy policy and terms.

CAVE is not responsible for the privacy practices, security or content of third-party websites or services.

We recommend reviewing the relevant privacy information before providing personal information to third parties.

12. International Data Transfers

Some service providers used by CAVE may process or store personal information outside Portugal or the European Economic Area ("EEA").

Where personal information is transferred outside the EEA, appropriate safeguards will be used where required by applicable data protection law.

These safeguards may include an adequacy decision adopted by the European Commission, Standard Contractual Clauses approved by the European Commission or another legally recognised transfer mechanism.

13. Data Retention

We retain personal information only for as long as necessary for the purposes for which it was collected and to comply with applicable legal obligations.

Retention periods may vary depending on the type of information and why it is processed.

We may retain information where necessary to:

• Fulfil and document orders;
• Maintain appropriate transaction and business records;
• Comply with tax and accounting obligations;
• Respond to customer requests;
• Resolve disputes;
• Prevent fraud;
• Establish, exercise or defend legal claims;
• Comply with other applicable legal requirements.

When personal information is no longer required, it will be deleted or otherwise handled in accordance with applicable law.

14. Security

We take reasonable technical and organisational measures to protect personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

However, no method of electronic transmission or storage can be guaranteed to be completely secure.

15. Your Rights Under the GDPR

Where the GDPR applies, you may have the right to:

• Access the personal information we hold about you;
• Rectify inaccurate or incomplete personal information;
• Request erasure of your personal information where the applicable legal requirements are met;
• Restrict processing in certain circumstances;
• Object to processing based on legitimate interests in certain circumstances;
• Object to direct marketing at any time;
• Data portability where applicable;
• Withdraw consent at any time where processing is based on consent;
• Lodge a complaint with the competent supervisory authority.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

These rights are subject to the conditions and limitations established by applicable law.

To exercise any applicable data protection rights, please contact us at caveclothingbrand@gmail.com.

We may request information reasonably necessary to verify your identity before responding to your request.

16. Children's Privacy

Our Site and Services are not specifically directed at children.

We do not knowingly collect children's personal information in violation of applicable law.

If you are a parent or legal guardian and believe that a child has provided us with personal information inappropriately, please contact us at caveclothingbrand@gmail.com.

17. Complaints

If you have questions or concerns about how we process your personal information, please contact us at caveclothingbrand@gmail.com.

If you are not satisfied with our response, you have the right, where applicable, to lodge a complaint with the competent data protection authority.

In Portugal, the supervisory authority is the Comissão Nacional de Proteção de Dados (CNPD).

This right is without prejudice to any other administrative or judicial remedies available to you.

18. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to our Services, technologies, business practices or applicable legal requirements.

When we make changes, we will update the "Last updated" date at the top of this Privacy Policy and take any additional steps required by applicable law.

19. Contact

If you have questions about this Privacy Policy, our privacy practices, or wish to exercise your data protection rights, please contact:

CAVE
Operated by: Diogo Filipe Lourenço dos Santos Machado, trading as CAVE
Email: caveclothingbrand@gmail.com
Portugal

For the purposes of the General Data Protection Regulation (GDPR) and other applicable data protection laws, Diogo Filipe Lourenço dos Santos Machado, trading as CAVE, is the data controller responsible for the processing of personal information described in this Privacy Policy.