SNAPFISH PRIVACY NOTICE

Effective Date: January 1, 2023

At Snapfish, our purpose is to help our customers capture, preserve, and share life’s important moments through professional and personal photography, and personalized products. We are equally committed to respecting your privacy.

This Privacy Notice (“Notice”) explains how Snapfish (“Snapfish,” “we,” “our,” or “us”) collects and uses personal information and the choices you can make. This Notice applies to your use of Snapfish.com and our other Snapfish websites, applications, and services that link to this Notice. This Notice also addresses information we collect from you when you contact one of our customer service representatives, or when you respond to a survey or enter a contest or sweepstakes that we administer.

Our Sites and Apps may be linked on other websites or may contain links to other websites. Our Privacy Notice only applies to our Sites and Apps, and we are not responsible for the privacy practices, security standards, or content of other sites. You should check the privacy policies of those sites before providing your personal information to them.

We encourage you to read this Privacy Notice in its entirety before using our services. By creating an online account, using our services, or making a purchase with any of our brands, you acknowledge that you have read and agree to this Privacy Notice. Your use of our Sites and Apps is also subject to our Terms and Conditions.

What personal information do we collect? How do we use that information?

We collect various types of personal information when you register with us via our websites, mobile sites or mobile applications (our “Sites and Apps”); purchase any products or services from us; visit or are photographed at one of our offices, studios, or on-site photography locations; contact one of our customer service representatives; register for customer rewards programs; or complete a survey or enter a contest or sweepstakes that we sponsor. This information may be collected directly from you (for example, when you complete our forms or enter your information on our websites to make a purchase) or indirectly through your device or browser when you visit our Sites and Apps.

We use your information to fulfill product orders, to customize and improve the advertising and content you see, to offer suggestions for personalized products based on your content, to deliver marketing communications and promotional materials that you may be interested in, to contact you and provide customer service, to protect the security or integrity of our databases or websites, to detect and prevent fraud or illegal activity, to take precautions against liability, to detect and remediate misuse of our Sites and Apps, to develop and improve our products and services, and for internal operational purposes.

The following chart describes what categories of personal information we may collect, how we collect that information from you, the business purposes for which we generally use such information, and which types of trusted third-party service providers we may share that information with:

In addition to any personal information that you might provide when you do things like buy our products and services or create an account with our brands, we may also have access to other information about you if you interact with our brands via social media, or in certain other situations.

Social Media
If you log into your account with any of our brands through a social media site, we will also have access to certain information from that site, such as your name, account information and profile photo, in accordance with the site’s account verification procedures. Also, if you interact with content on our social media profiles (for example, if you “like” or share a post from one of our brand’s Facebook, Twitter, or Instagram accounts), those social media sites may share information about you with us, including your public profile, e-mail address and friend list. If you choose to “like” or share content, information about you may be publicly displayed on the social network, depending on your privacy settings. You should review the Privacy Notice of that social media site and check your privacy settings through that site. If you post information on a social media or another third-party service that references our brands or our products and services (e.g., via a Twitter hashtag), we may publish your post on our social media accounts or websites.

Information You Provide About Others
The content you choose to upload to our service, including your photos and the information you store in your address book, may include personal information of others. If you choose to share your photographs or other information with someone else through a feature we offer, we will use the personal information you provide (for example, the e-mail address of the recipient) to fulfill your request and for other purposes described in this Privacy Notice. Before you upload and/or share personal information of others through our service, please ensure that you have the consent of such persons to do so.

Other Information Contained in Your Photos
When you upload your photos to our platforms or give us permission to access the photos stored on your device, your photo content may also include related image information such as the time and the place your photo was taken, tags and similar information stored by your image capture device. If you wish to restrict the transfer of image metadata in your individual photos, please adjust the settings on your image capture device.

Cookies
We use cookies and other tracking technologies to collect your information when you are using our Services. We use such information to analyze trends, remember user settings, administer our Services, track user movements, and market our products and services. We may obtain reports based on the use of these technologies on an individual and/or aggregated basis. You can control cookies through your browser setting and through tools we make available through our Services. For more information about cookies and other tracking technologies we use, including how to disable them, please refer to our Cookie Notice.

Other Sources
We may also obtain data that is publicly available or from third party sources, such as address verification services or third-party marketing database partners, to improve the accuracy of and add to what we know about our customers and prospective customers. We may combine this information with your personal information for the purposes described in this Notice.

Employment
In addition to information collected from our customers, we and our service providers also collect certain information from candidates who apply for a job with Snapfish to contact you about your application and evaluate your qualifications for the position, including your name, phone number, e-mail address, postal address, education information, and employment information.

How long do we retain the personal information we collect about you?

Snapfish will retain your information only for as long as is necessary for the purposes set out in this Notice, for as long as your account is active (i.e., for the lifetime of your user account), or as needed to provide the Sites, Apps and associated services (Services) to you. If you no longer want Snapfish to use your information to provide the Services to you, you may close your account. Snapfish will retain and use your information to the extent necessary to comply with our legal obligations (for example, if we are required to retain your information to comply with applicable tax laws), resolve disputes, perform and enforce our agreements, and as otherwise described in this Notice.

How do we share your information with third parties?

We do not sell, license or share the personal information we collect with unaffiliated third parties for their marketing purposes.

We may share personal information in the following situations.

Service Providers
We sometimes use third-party service providers to act on our behalf, for example to help us fulfill your product orders, process payments, enhance and personalize your shopping experience with us, or to deliver our advertisements. Our service providers may receive your name and contact information, payment information, photos and other content you upload to our Sites and Apps, information about purchases you’ve made, cookies and other device identifiers, IP address, and website browsing and interaction activity. These service providers are only allowed to use your information in connection with the specific service they provide on our behalf.

Partners and Affiliates
Snapfish is part of the Shutterfly family of companies and brands. We may share your information among our corporate affiliates and subsidiaries for purposes described in this Notice. This allows us to offer features such as the ability to use your Snapfish account credentials across all of our Web properties and applications where available. We also work with third parties who act as our partners to offer you joint products and services – for example, we work with prominent retailers to offer ship-to-store options to customers in many locations. If you decide to use such products or services, we will share certain information about you with our partners for use as needed to enable us to provide the service.

Law Enforcement, Mergers, and Other Situations
We may be required to share your personal information in other, limited circumstances. For example, we may be required to share certain information to respond to a subpoena or similar judicial process, to comply with state, federal or local laws, to protect the security or integrity of our databases or website, to take precautions against liability, in the event of a corporate reorganization or, to the extent required by law, to provide information to law enforcement agencies. Additionally, your information may be transferred to another organization if, for example, we transfer the ownership or operation of the Sites and Apps because we have merged with or have been acquired by another organization, or if we liquidate our assets. In those cases, the new company’s use of your information will still be subject to this Notice and the privacy preferences you have expressed to us.

Does our website collect information from children?

Our Sites and Apps are intended for use by general audiences and are not targeted directly at children. We will not knowingly collect personally identifiable information from children. If we become aware that a child under the age of 16 has provided personal information through our websites or apps, we will remove their personally identifiable information from our files. If a parent or guardian becomes aware that their child has provided such information through our websites or apps, the parent or guardian should contact us in writing at privacy@snapfish.com so that we may respond appropriately.

What options do you have to limit our collection and use of your personal information?

You have choices about how your information is collected and used. You can notify us of your preferences when you create an account with us, and if you would like to review, correct or delete your personal information on our Sites and Apps, you can do so via your account settings. There may be times when we are unable to fulfill your request – for example, if providing access to your personal information would reveal confidential commercial or proprietary information or personal information about someone else (and we cannot separate your data), if we are prohibited by law from disclosing the information, or if we have a legal obligation to retain certain data. We may require additional personal information from you for the purposes of verifying your identity and rights. Some jurisdictions provide additional legal rights, as described in our Supplemental Notices below.

Opting out of Marketing Communications
If you no longer want to receive marketing communications from us, you can unsubscribe by following instructions contained in the messages you receive, by changing your marketing preferences through your Account Settings, or by contacting us through Customer Service. We reserve the right to send you certain communications relating to the services we provide, such as service announcements and administrative messages (for example, communications related to a pending order, an unresolved customer service issue, or a Notice update). We do not offer you the ability to opt-out of receiving those communications.

Cookie Options
You may manage the cookies that Snapfish uses through the settings in our Privacy Preference Center, which can be found in our Cookie Notice. You may also change your web browser settings to reject Cookies from the site or to alert you before a cookie is placed on your computer. Each browser is different, so you should check your browser’s “Help” menu to learn how to change your cookie preferences. Please note that cookie-based opt-outs only apply to the specific computer and browser on which the opt-out cookie is applied. If you clear cookies from your device, your opt-out will no longer be valid and you will need to opt out again where you want your choices to apply. If you accept a cookie, you can delete it at any time through your web browser. If you choose not to accept Cookies, though, you will not be able to enjoy all the features available to our registered users.

“Do Not Track” is a preference you can set in your web browser to let the sites you visit know that you do not want them collecting information about you. Our sites do not currently respond to all “Do Not Track” settings; however, we treat Global Privacy Control signals as requests to opt out of the “sale or sharing” of personal information pursuant to the California Privacy Rights Act.

How do we keep your information secure?

Although no website, application, database or system is completely secure or “hacker proof,” we have safeguards in place to protect against unauthorized access and disclosures of the personal information we control, including technical, physical and administrative safeguards and security measures. Despite these measures, however, we cannot guarantee that our information security safeguards will never be compromised.

How do we make updates to this Notice?

As we implement new technology and introduce new services or otherwise change our privacy practices, or in response to changes in applicable laws or regulations, we may modify this Notice and provide notice to you by posting updates on this page. Please check back periodically to view any updates. Changes to our Notice will become effective when posted. If we change this Privacy Notice in a material way, we will endeavor to promptly notify our customers.

How can you contact us with questions about your privacy or this Notice?

For further information regarding this website privacy statement or related Snapfish policies and procedures, please contact: privacy@snapfish.com

Supplemental (CCPA) Notice to Residents of CA, CO, CT and VA

Depending on where you reside, you may also have additional legal rights with respect to your information. While some of these rights apply generally, certain rights apply in limited cases. Consistent with applicable laws, this Supplemental Notice provides a way to exercise such rights for residents of California, Virginia, Colorado and Connecticut. For information about what categories of personal information we may collect from our customers, the sources of that information, the purposes for collecting and using that information, and what types of service providers we may share that information with, please see above our section titled What personal information do we collect? How do we use that information?

The laws of California, Virginia, Colorado and Connecticut grant some or all of the following rights to consumers who reside in those states:

• The right to request information about personal information that we have collected about that customer in the 12 months preceding the customer’s request – including the categories of information collected, the source of that information, the business purpose of that collection, the categories of third parties with whom that information is shared, and the specific personal information collected about that particular customer;
• The right to receive requested information in a readily-usable and portable format if provided electronically;
• The right to request that we delete any personal information about the consumer that we have collected (although we may be entitled to retain some information for certain purposes); to exercise this right, please visit us at Customer Service;
• The right to opt-out of “sales” of personal information to third parties, the sharing of personal information with third parties for targeted advertising purposes, and/or the processing of personal information for targeted advertising purposes;
• The right to update or correct any personal information which is out of date or incorrect; and
• The right to be free from discrimination based on your exercise of your privacy rights, including the right to be free of retaliation for employees, applicants, or independent contractors.

To exercise your rights under this Supplemental Notice, please make your request online at Snapfish data privacy rights or contact us at privacy@snapfish.com. Online requests generally are resolved more quickly than those sent by email.

We cannot respond to your request to access or delete information unless we are able to both verify your identity or authority to make the request and confirm the personal information relates to you and/or your household. If you have an account on any of our Sites and Apps, we will verify your identity by having you log in to your account. If you do not have an account on our Sites and Apps, we will attempt to verify your request by asking you to provide identifying information that we will match to information in our files. We will only use information you provide in your request for the purpose of verifying your identity or authority to make the request. For account and non-account holders, we will also send you an email after you make a request to which you must reply.

You can also designate an authorized agent to make a request on your behalf. Your agent will need to provide a Power of Attorney authorizing the agent to act on your behalf, or will need to complete the same verification procedures that would be required for a request submitted by you directly, and provide information that allows us to verify your authorization. If you would like to appeal a decision related to a request to exercise your rights under this Supplemental Notice, please contact us at the phone numbers, online forms, or email address listed above.

We may deny deletion requests in whole or in part as permitted or required by applicable law. We do not charge a different price or rate or provide a different level or quality of goods or services based on your exercising your CCPA rights. We do not “sell” personal information in the ordinary sense of that term. That is, we don’t provide your personally identifiable information to third parties in exchange for money. But under California law, sharing information with third parties for targeted advertising purposes may be considered a “sale” of personal information. California residents have the right to opt out of such sharing.

Supplemental Notice to Residents of California

If you are a California resident under the age of 18, and a registered user of any site where this Notice is posted, you may request and obtain removal of content or information you have publicly posted on such site. To make such a request, please send an email with the subject line “California Minor Content Removal Request” to privacy@snapfish.com. Please specify in your request which website or application your request relates to and the specific information or content that you would like removed. Please note that your request does not ensure complete or comprehensive removal of the content or information, because, for example, some of your content may have been reposted by another visitor to our websites.

If you are a former Snapfish employee and would like to exercise your rights with respect to personal data we collected in the course of your employment, please send an email with the subject line “California Former Employee Data Request” to privacy@snapfish.com.

In 2022, Snapfish received and completed 14,503 verified deletion requests and 7 California verified access requests. Snapfish received and completed 0 verified requests to opt-out of sale/sharing. Snapfish received 0 requests to correct as customers can correct their data within their accounts. Snapfish received 0 requests to limit. Snapfish did not deny any verified requests. Snapfish responded to data subject rights requests within 4 days on average.

We may offer various financial incentives and benefits (such as free shipping, discounts, and other special offers) to customers who interact with us in our Sites and Apps and provide personal information. We offer such financial incentives and benefits for business purposes such as increasing engagement and sales or raising brand awareness, and participation is voluntary. We do not assign monetary or other value to personal information, but the value of such personal information is reasonably related to the estimated value of the financial incentive offered when the information was collected. Snapfish reserves the right to withdraw or modify the financial incentives we offer at any time.

Supplemental (GDPR) Notice to Residents of the EEA, Switzerland, and United Kingdom

Controller of Personal Information

The data controller for your personal information is Snapfish, LLC, located at 10 S. Almaden Boulevard, San Jose, CA 95113, United States of America. Please feel free to contact us for any reason at privacy@snapfish.com.

Legal Bases for How We Process Your Information

The legal bases for processing your information as set out in this Privacy Notice are as follows:

• Where use of your information is necessary to perform our obligations under a contract with you (for example, to comply with the terms of service of our websites which you accept by browsing the websites/registering, and/or our contract to provide our Services to you);
• Where use of your information is necessary for our legitimate interests or the legitimate interests of others (for example, to provide security for our websites, products, software, or applications; operate our business and our Services; for direct marketing purposes, as appropriate; to make and receive payments; to engage in employment relationships; to comply with legal requirements and defend our legal rights; and to prevent fraud);
• Where we have your consent, in accordance with applicable legal requirements, to use your information for a particular purpose; which consent you may withdraw at any time by contacting us; or
• Where we use your information to comply with applicable legal obligations (for example, keeping track of purchases for tax and auditing purposes).

Integrity and Retention of Personal Information

Snapfish makes it easy for you to keep your personal information accurate, complete, and up to date. We will retain your personal information for the period necessary to fulfill the purposes outlined in this Privacy Notice and our Sites and Apps specific privacy summaries. When assessing these periods, we carefully examine our need to collect personal information at all and if we establish a relevant need, we only retain it for the shortest possible period to realize the purpose of collection unless a longer retention period is required by law.

International Data Transfers

Snapfish servers are in the United States. If you choose to provide us with your information as described in this Privacy Notice, Snapfish may transfer your personal information cross-border. For example, Snapfish may transfer your information to affiliates, partners, or other third parties located outside of your home country, for the purposes described in this Privacy Notice. The laws governing data collection and use in the United States may differ and not provide the same level of protection as the jurisdiction in which you reside.

Where we transfer data from the EU, Switzerland, or the United Kingdom, Snapfish will implement appropriate safeguards to comply with applicable law in relation to the transfer including the EU Standard Contractual Clauses or other measures that comply with applicable law, for personal data that is being transferred to places where the EU, Switzerland, and/or the United Kingdom have determined that an adequate level of protection is not guaranteed.

By providing us with your information, you acknowledge such transfers. If applicable, you may make a complaint to the data protection supervisory authority in the country where you are based. If you would like further information about these transfer mechanisms, please feel free to contact us at privacy@snapfish.com.

Your Legal Rights

Your local laws may permit you to request that we:

• Provide access to and/or a copy of certain information we hold about you;
• Update or rectify information which is out of date or incorrect;
• Delete certain information that we are holding about you;
• Transfer your information to a third-party provider of services; and/or
• Revoke your consent for the processing of your information, to the extent we rely on consent as the legal basis to process your information; and
• For French residents only, you have the right to give directives relating to the disposal of your information after your death.

You may edit, cancel, or delete your Snapfish account information at any time by entering your login credentials using the self-service tools available. For any other request please contact our Customer Support. If you request your account to be cancelled or deleted, we will satisfy your request within 30 days. If we require more time to process your request, we will notify you about the delay.

Information necessary for the purposes of maintaining business records regarding a deleted or cancelled account, including records of credit transactions and account ownership, will be retained in accordance with applicable law. We may decline to process requests that are frivolous/vexatious, would jeopardize the privacy of others, are extremely impractical, or for which access is not otherwise required by local law. We may also decline aspects of deletion or access requests if we believe doing so would undermine our legitimate use of data for anti-fraud and security purposes.

Supplemental Notice to Residents of Nevada

Effective Date: October 1, 2020

Nevada law gives Nevada consumers the right to request that a company not sell their personal information for monetary consideration to certain other parties. This right applies even if their personal information is not currently being sold. If you are a Nevada consumer and wish to exercise this right, please send an email with the subject line “Nevada Resident Do Not Sell Request” to privacy@snapfish.com.