Customer Service

Much of your information is stored in your Lulus account profile. You may change or correct the information in your account profile by clicking here or emailing privacy@lulus.com. Only your first and last name and email address are required to have an account with Lulus. If you would like to cancel your account entirely, please email privacy@lulus.com or click “Delete My Data” in your Lulus account profile.

We take commercially reasonable steps to safeguard and deter unauthorized access to your information. Lulus complies with the Payment Card Industry Data Security Standard (PCI DSS). This means that when we collect or transmit sensitive information such as a credit or debit card number, we use industry-standard methods to protect that information.

Although we take reasonable measures to safeguard against unauthorized disclosures of your information, no e-commerce platform, website, electronic database or system is completely secure.

Unless you have exercised one of your rights listed in this Policy, Lulus will retain your information for as long as is necessary for our legitimate business purposes. This includes retaining your information to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures. Once you have terminated your relationship with us, we may retain your information in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts; for other legitimate business purposes, such as to demonstrate our business practices and contractual obligations or provide you with information about our products and services in case of interest; or otherwise in accordance with our internal retention procedures. Lulus will always retain data to the extent necessary to comply with our legal and financial obligations (for example, to satisfy our auditors, to comply with applicable tax/revenue laws, to enforce our agreements, and as otherwise described in this policy) If you would like to know more about the retention periods applicable to your personal information, you can contact us using details provided in the Who We Are section above.

Lulus is located in the United States, and we primarily store your information in the United States. By using our website and/or providing us with information, you understand that your personal information may be transferred to and stored in the United States. For customers in the European Economic Area (“EEA”), United Kingdom (“UK”), Switzerland or Canada, see the EEA/UK/Switzerland/Canada Privacy Rights section below for more details on our processing of your personal information and your rights.

At times, we may transfer your personal information outside of the United States, in which case we take reasonable steps to make sure your personal information continues to be appropriately protected. However, no data transfer system is completely secure.

Depending on the state in the United States within which you reside (such as California, Colorado, Oregon, or Delaware), you may have certain rights regarding your personal information, subject to legal limitations. In addition to the disclosures above, this section also provides supplemental information about how we process your personal information, as further described in subsection G below.

Request to Know

You may have the right to request that we disclose certain information to you about our collection, use, disclosure, and sale of your personal information. Subject to legal limitations, if you submit a Request to Know, for each category of personal information listed in the Information We Collect section above, we will provide:

• The categories of personal information we collected about you.
• The categories of sources for the personal information we collected about you.
• Our business or commercial purpose for collecting that personal information.
• The categories of third parties with whom we disclose, sell, or share that personal information.

You may also have the right to request that we disclose the specific pieces of personal information we collected about you. Once we receive and confirm your verifiable consumer request, we will disclose to you:

• The specific pieces of personal information Lulus has retained about you.

Based on your state of residence, you may also have the right to request a list of third parties to whom we disclose personal information. Once we receive and confirm you verifiable consumer request, we will disclose to you:

• The list of third parties to whom we generally disclose personal information.

Request to Delete

You may have the right to request that we delete personal information that we collected from you and retained, with certain exceptions.

Request to Correct

You may have the right to request that we correct inaccurate personal information that we maintain about you, with certain exceptions.

How to Submit a Request to Know / Request to Delete / Request to Correct

If you have an account with Lulus, you can make a request to delete or know in your account profile by clicking on the “See My Data” or “Delete My Data” tools. A request to delete through this tool will delete your Lulus account profile. See Section IV above for more information.

If you do not have an account with Lulus, you can make requests by going to https://www.lulus.com/mydata, entering your email address as a “Guest User”, following the instructions in the verification email, and selecting “Delete My Data” or “See My Data” tools.

You may have a right to opt out of (i) the sale or sharing of your personal information and/or (ii) targeted advertising. We engage in certain routine practices that may be considered a “sale” or “sharing” under applicable law. For example, our website integrates Cookies of trusted partners (third party companies) to enable us to show advertisements for our products and/or services to you on third-party websites and apps and for other analytics and personalization purposes. For additional information about our use of Cookies, please see our Cookie Policy.

• Authorized agents may submit requests on your behalf by submitting a request using the methods described above and indicating that they are submitting the request as an agent. If you designate an authorized agent to submit a Request to Know, Delete, or Correct, we may contact you directly to verify your own identity or to confirm that you provided the authorized agent with permission to submit the request.
• If you designated an authorized agent to submit a Request to Opt Out, we may seek additional information directly from the authorized agent to process this request.

You have the right not to receive discriminatory treatment by us for the exercise of your privacy rights. We will never discriminate against you for exercising your privacy rights. However, there are certain functions of our website and mobile application that are only available to account holders, such as wishlists, “loves,” online credit, certain promotions, and our loyalty program.

If we deny your rights request, you may have the right to appeal. To submit an appeal, contact us at privacy@lulus.com.

Although we have not "sold" personal information for money in the past 12 months, we engage in routine practices involving third parties that could be considered a "sale" or “sharing” as defined under applicable law. We do not knowingly sell or share any personal information of minors under the age of 18.

Below please find a chart detailing the categories of personal information we collected and with whom it was sold/shared or disclosed for a business purpose in the past 12 months. In addition, from time to time, we may share aggregate or de-identified information with any category of third party listed below for various purposes, including for compliance with reporting obligations, for business or marketing purposes, or to assist such parties in understanding your use of our Digital Properties.

We do not collect or disclose Sensitive Personal Information for any purpose other than those specified below:

• To perform the services or provide goods reasonably expected by an average consumer;
• To prevent, detect, and investigate security incidents;
• To resist malicious, deceptive, fraudulent, or illegal actions directed at the business or to prosecute those responsible for those actions;
• To ensure the physical safety of individuals;
• For short-term, transient use, including non-personalized advertising;
• To verify or maintain the quality or safety of a service or device; or
• To comply with a legal obligation or to exercise or defend legal claims.

These additional disclosures apply only to individuals who reside in California as required by the California Consumer Privacy Act (“CCPA”), Colorado as required by the Colorado Privacy Act (“CPA”), and New Jersey as required by the New Jersey Data Privacy Law (“NJDPL”). We offer incentives to customers that involve the sharing of personal information with us. The personal information collected and retained by us in operating these programs is described in this Privacy Policy, and includes your name and contact details, your date of birth information, your payment information, your contact history with us, your purchase and product feedback history, additional details about you, information about your device type and how you use our website, your public reviews and blog comments and inferences from data and other personal information we may collect in connection with your interaction with our service and/or participation in any of our promotional programs. We may share this information with our affiliates and subsidiaries, service providers, professional consultants, and vendors necessary to complete transactions that you request, and as otherwise described in this Privacy Policy. We do not sell or share your personal information with Data Brokers, as defined by the CPA.

Benefits provided through our promotional programs may be deemed a “financial incentive” (e.g., promotional goods) and/or a different price or rate for goods or services or a different level or quality of goods or services (e.g., discounts, coupons, other promotions) under the CCPA, CPA, and NJDPL. We currently offer the following promotional programs in connection with the collection and retention of personal information:

• Love Rewards: We offer rewards to customers participating in Love Rewards, consistent with our Love Rewards Terms and Conditions. Participants in Love Rewards receive promotional offers, including discounts, coupons and opportunities to participate in other promotional opportunities. You can join Love Rewards by logging into your existing Lulus.com account, selecting “Account Info” and then selecting the option to opt in to Love Rewards, or if you do not already have an account, by registering on account on Lulus.com and opting-in to Love Rewards.
  The benefits of Love Rewards are described in our Love Rewards Terms and Conditions.The categories of personal information collected through your participation in Love Rewards that may be shared for the purposes of targeted advertising include Personal Identifiers, Commercial Information and Internet or Other Electronic Network Activity. The Love Rewards Terms and Conditions explain how to opt-in, participate, and opt-out. Our good-faith estimate of the value of your personal information is the value of the benefit we offer to you. We have calculated such value by using the expense related to the benefit. If you choose to exercise your data privacy rights and request a deletion of your personal information, your Lulus account and any Love Rewards program benefits are deleted. We are only able to provide Love Rewards program benefits to Lulus account holders.
• Surveys: You may also be offered the opportunity to participate in a survey. Participation in the survey may result in Lulus collecting additional information from you, including your preferences, experiences, beliefs, opinions, and responses to the survey questions. Any applicable terms and conditions will explain how to opt-in, participate, and opt-out. Our good-faith estimate of the value of your personal information is the value of the benefit we offer to you. We have calculated such value by using the expense related to the benefit.
• Limited-Time Promotions: From time to time, we may offer incentives limited to a specific time period, or time limited sweepstakes, contests and other promotions. Participation in a limited-time offer or promotion is governed by the applicable terms and conditions for the program, which will also describe any financial incentives associated with the promotion. Our good-faith estimate of the value of your personal information is the value of the benefit we offer to you. We have calculated such value by using the expense related to the benefit.
• Discounts: We also from time to time offer discounts connected to customer’s submission of their email address, phone number or other personal information. You can always opt out of our marketing emails or SMS messaging at any time. Our good-faith estimate of the value of your personal information is the value of the benefit we offer to you. We have calculated such value by using the expense related to the benefit.
• Product Reviews: When you review a product on our website, you are automatically entered into our Wear. Write. Win. Giveaway, which is governed by our Giveaway Terms. The Giveaway Terms and Conditions explain how to opt-in, participate, and opt-out. The value of your personal information is our good-faith estimate of the value of the prize divided by the number of entrants. We have calculated such value by using the expense related to the benefit.

If you are a California resident, you may opt out of sharing your personal information subject to California Civil Code §1798.83 (the “Shine the Light" law) with third parties for their direct marketing purposes by clicking the “Your Privacy Choices” link in the footer of our website and following the instructions.

For our customers in the European Economic Area (“EEA”), United Kingdom (“UK”), Switzerland or Canada, Lulu’s Fashion Lounge, LLC is the data controller – the company responsible for your personal information.

Lulus has designated McDermott Will & Schulte Belgium LLP as its representative in the EU, whose registered address is at Avenue des Nerviens 9-31, 1040 Brussels, Belgium. For all EU GDPR related issues, you can contact our representative office by post at their registered address or email at Lulus-eu-representative@mwe.com. We recommend you use the email channel for time-saving reasons.

Lulus has designated McDermott Will & Schulte UK LLP as its representative in the UK. For all UK GDPR related issues, you can contact our representative office by email at Lulus-uk-representative@mwe.com.

When you access or use our Digital Properties, we collect, use, and otherwise process your personal information as described in this Policy. We rely on a number of legal bases to use your information:

• As necessary to perform a contract with you or to take steps in preparation for a contract with you, including enabling you to make a purchase from us;
• Because you have consented to the processing, such as for receiving marketing messages or third-party data sharing related to advertising;
• As necessary to comply with a legal obligation, a court order, or to exercise or defend legal claims;
• As necessary for the purposes of our or a third party’s legitimate interests;
• As necessary to protect your vital interests, or those of others.

Here are some of our legitimate interests for collecting and processing your personal information:

• Detecting and preventing fraud: We have a legitimate interest in detecting and preventing fraud. To do so, it is necessary that we collect and retain information about each transaction made at Lulus. Our auditors require that we keep this information so they can verify that all transactions recorded by Lulus were made by real customers. The credit card companies we work with require this information in the event that fraudulent charges are made using your credit card.
• Providing access to and improving Lulus.com: We may use your information to improve and customize our website, including sharing of your information for such purposes, and this is necessary to pursue our legitimate interests of improving our website and our products. This is also necessary to enable us to pursue our legitimate interest in understanding how our website is being used, and to develop and expand our customer base. It is also necessary to allow us to pursue our legitimate interest in improving our website’s functionality and in obtaining insights into what our customers and potential customers want.
• Providing access to and improving our customer service: We may use your information to provide you with customer service, and also to improve the service we provide to all customers. This is necessary for us to pursue our legitimate interest in providing great customer service.
• Improving our product offerings: We may use your information to improve the products offered at Lulus, and to inform our buying team so they can provide you and our other customers with a great selection of products. This is necessary for us to pursue our legitimate interest in being your destination for affordable luxury.
• Keeping our website and your data secure: We have a legitimate interest in ensuring the security of our website, including enhancing protection of our company and our customers against spam, harassment, intellectual property infringement, crime, and security risks of all kinds.

If you reside in the EEA, UK, Switzerland or Canada, and you shopped on our website aimed at these markets, you have the following rights, subject to conditions provided in applicable data protection laws:

a)data access and portability (including the right to obtain a copy of your personal information, some of which is available through your account profile, and receive it in a structured, commonly used and machine-readable format);

b) data correction (including the ability to update your personal information, much of which you can change directly using your account settings);

c) data deletion (including the right to have Lulus delete your personal information, except information we are required by law to retain, or as otherwise provided by applicable data protection laws);

d) withdrawal of consent (when we rely on your consent to process your information, such as for our marketing emails you are free to refuse to give it. If you have given your consent, you may withdraw it at any time without any adverse consequences. The lawfulness of any processing of your personal information that occurred prior to the withdrawal of your consent will not be affected);

e) objection to processing (when our processing is based on legitimate interests; this includes, in limited circumstances, the right to ask Lulus to stop processing your personal data, including for direct marketing purposes); and

f) restrict processing of your personal information in certain circumstances.

If you would like to exercise your rights, please email privacy@lulus.com with your request and your place of residence.

Without prejudice to any other rights you may have, you have the right to lodge a complaint with your local data protection regulator.

As noted in the Where Are We Located section, we may process your personal information in countries outside the EEA/UK, Switzerland and Canada that do not provide an adequate level of data protection as defined by EU/UK/Swiss/Canadian data protection laws. Certain third countries have been officially recognized by the European Commission, UK Secretary of State, Swiss and Canadian/or authorities as providing an adequate level of protection. Transfers within our corporate group or to third parties located in such third countries take place using an acceptable data transfer mechanism, such as the EU and/or UK Standard Contractual Clauses, Binding Corporate Rules, approved Codes of Conduct and Certifications, on the basis of permissible statutory derogations, or any other valid data transfer mechanism issued by the EEA/UK/Swiss/Canadian authorities. Please reach out to us if you want to receive further information about how we transfer personal information or, where available, a copy of the relevant data transfer mechanism.