Unified Commerce Group Retail Brands Privacy Policy

Last updated: 26 March, 2026

This Privacy Policy describes how GREATS and Unified Commerce Group affiliated brands  (a list of which can be found at: (https://www.unifiedcommercegroup.com/#brands) (“Company,” “we,” “our,” or “us”), collect, use, share, disclose, and protect personal data when you use our websites, applications, products, and services that link to this Privacy Policy (collectively, the “Services”). It also explains your privacy rights and how to exercise them. This Privacy Policy is intended to satisfy applicable requirements of US state consumer privacy laws, Canadian federal and provincial privacy laws, and EU/EEA and UK data protection laws, including the EU General Data Protection Regulation (GDPR), the UK GDPR, and applicable ePrivacy rules. It applies to information collected through the Services and in electronic communications between you and the Services. This Privacy Policy does not apply to information collected offline or on websites or services that do not link to this policy, or to certain sector-specific data subject to separate notices. We may provide additional privacy disclosures for particular products, features, or activities, which supplement this policy. By using the Services, you acknowledge that you have read this Privacy Policy. If you reside in the EU/EEA/UK, our processing of your personal data will be based on the lawful bases described below, and you have rights under GDPR as described in the “Your Rights” section.

1. Controller, Contact Details, and Data Protection Officer

Controller:

• GREATS: UCGREATS, LLC, 12094 Life Science Ct, Draper, UT 84020, United States; Email: support@greatsbrand.com

If applicable, Data Protection Officer (DPO): Director of Data Privacy [privacy@ucghub.net]

2. Scope and Audience

This Privacy Policy is intended for users of our Services in the United States, Canada, the EU/EEA, and the UK. State-specific disclosures and rights are integrated throughout and/or provided in regional addenda below. If you are a California resident, see the California Privacy Addendum (CCPA/CPRA) referenced in the “State-Specific Disclosures” section.

3. Personal Data We Collect

We collect and process personal data, which may include: account and contact information (e.g., name, email, phone, address); identifiers (e.g., device identifiers, online identifiers, IP address); commercial information (e.g., purchases, order history, subscription status, loyalty and rewards data); payment information (processed by our payment providers and subject to their privacy/security obligations); internet or network activity (e.g., log files, analytics, usage data, browsing history on our Services); location information (general location; precise geolocation only if enabled/consented); inferences drawn from other personal data (e.g., profiles reflecting preferences); user-generated content (e.g., product reviews, survey responses, support communications, size or measurement information you choose to store); and images, recordings, or similar content if you upload or consent to such collection. We receive updated delivery and address information from carriers or other third parties to correct our records and facilitate delivery.  Sensitive personal data (as may be defined under applicable laws) is collected only with appropriate disclosures and, where required, consent. Sensitive categories may include precise geolocation; financial account credentials; government ID numbers; health-related data; data about sex life or sexual orientation; racial or ethnic origin; religious or philosophical beliefs; genetic and biometric data; citizenship/immigration status; and personal data of known children.

User-Generated Content
We offer features that allow you to submit content publicly or semi-publicly (for example, product reviews, photos, videos, ratings, Q&A, testimonials, or forum posts) (collectively, “User Content”). User Content you choose to post may be visible to others, can be indexed by search engines, and may be copied or shared. Do not include sensitive personal data in User Content. Even after removal, copies may persist in cached or archived pages or where others have saved or shared the content. We process User Content to publish and display it on the Services, operate community features, moderate for fraud, spam, abuse, or policy violations (via automated tools and human review), improve our products and Services, and comply with legal obligations. We disclose User Content to service providers that host, store, moderate, and analyze content; and, where you choose to make User Content public, to other users and the public. Processing of User Content is based on performance of a contract (to provide the Services and display your submissions) and our legitimate interests (to maintain safe, trustworthy Services, prevent abuse, and improve features). Where we use your User Content for marketing that identifies you, we will obtain consent where required. Your User Content is also governed by our Terms, including any license you grant to us to host, display, and distribute your submissions. You may request deletion or correction of User Content you posted. Where User Content has been shared, re-posted, or is subject to legal holds or the rights of others, we may limit or delay deletion consistent with applicable law. We may require account login or other verification to process User Content requests. For rules governing what User Content you may post and how we moderate, remove, and restrict user content and accounts, please review our Community Guidelines.

Do not upload any data you do not have permission to use. If you are a copyright owner (or authorized agent) and believe User Content infringes your rights, please see our DMCA Policy for more information about how to submit a notice under the Digital Millennium Copyright Act (DMCA).

 Agentic Storefront and Third-Party Platform Data Collection

When you purchase products through an Agentic Storefront or third-party platform (such as Google Shopping or Microsoft Copilot) (“Participating Providers”), we may collect the following categories of personal data in connection with your transaction:

• Contact and shipping information (name, email address, phone number, shipping address);
• Order information (product details, order total, taxes, shipping fees);
• Payment-related information (billing address, card metadata, card network information) as processed by our payment processor;
• Transaction identifiers and order status information; and
• Any additional information you provide to complete the purchase.

This information is collected and shared between the Company, Shopify (our e-commerce platform provider), and the applicable Participating Partner (such as Google or Microsoft) to process and fulfill your order. 

4. Sources of Personal Data

We collect personal data directly from you (e.g., account registration, purchases, support), automatically (e.g., through cookies, SDKs, and similar technologies), by observing your activities on the Services, and from third parties (e.g., data brokers, analytics and advertising partners, payment and shipping processors, identity verification providers).  We also receive personal data from Participating Partners (such as Google and Microsoft) and Shopify in connection with purchases you make through Agentic Storefronts. This includes order information, contact details, and shipping information necessary to fulfill your purchase. 

5. Purposes of Processing

We use personal data for the following purposes: providing, operating, and supporting the Services (including account creation, order processing and fulfillment, customer support); personalizing, maintaining, and improving the Services and user experience (including debugging, analytics, quality assurance, and research); marketing and advertising, including direct marketing with your consent where required, and, where applicable, targeted advertising as described below; security and fraud prevention, incident detection, and protecting the rights, property, and safety of the Company, our users, and others; compliance with legal obligations and responding to lawful requests; and internal business purposes compatible with the original collection context and disclosed purposes (subject to purpose limitation and data minimization). We do not collect or use personal data for purposes that are materially different, unrelated, or incompatible with those disclosed without notice and, where required, consent.

Brand-specific practices include processing orders and payments; maintaining accounts; responding to requests; remembering preferences; customizing content and offerings, including offerings from affiliated brands; understanding shopping behavior to improve Services; sending marketing and advertising communications (with consent where required); protecting our rights and complying with law; and preventing fraud and security incidents. For SMS messaging programs, we use cookies to help track items placed in your shopping cart, including when you abandon your cart, to determine when to send cart reminder messages; we do not share your opt-in status with third parties for purposes unrelated to delivering messaging services.

Agentic Storefront Transaction Processing

When you purchase products through an Agentic Storefront, we process your personal data for the following purposes:

• Processing and fulfilling your order, including shipping and delivery;
• Communicating with you about your order status, including delivery updates;
• Providing customer service and handling returns, exchanges, and refunds;
• Calculating and remitting applicable taxes;
• Fraud prevention and security purposes;
• Legal compliance and responding to lawful requests; and
• Email marketing, only where you have expressly consented to receive marketing communications from us (for example, by checking an opt-in box during checkout).

We will not use your email address for marketing purposes unless you have expressly opted in to receive such communications. You may opt out of marketing emails at any time by following the unsubscribe instructions in any marketing email or by contacting us.

6. Legal Bases for Processing (EU/EEA/UK)

Where GDPR or UK GDPR applies, we process personal data based on performance of a contract (e.g., to provide the Services, process orders); legitimate interests (e.g., to secure and improve the Services, prevent fraud, personalize non-intrusive aspects), balanced against your interests and rights; consent (e.g., certain cookies/trackers, targeted advertising in relevant jurisdictions, certain marketing communications, precise geolocation, processing of sensitive data where required); compliance with legal obligations; and protection of vital interests (only in limited circumstances). You may withdraw consent at any time where consent is the legal basis, without affecting the lawfulness of processing prior to withdrawal.

7. Cookies, Analytics, and Advertising Technologies

We use cookies, SDKs, and similar technologies to operate the Services, measure engagement, and, where permitted, to personalize content and ads. Where required by the ePrivacy rules or other applicable data protection laws, we obtain consent for non-essential cookies and provide controls via a cookie banner and/or preference center. You can set your browser to refuse all or some cookies or alert you when cookies are being sent, noting that some features may not function if cookies are disabled. You can review or change your cookie preferences at any time via the “Cookie Settings” link in the footer or our preference center.

Our Services may allow third parties to collect information about your online activities over time and across different websites or online services. We work with third-party advertising and analytics providers, including Facebook, Google Ads, Snapchat (advertising), and Google Analytics, Yotpo, and Klaviyo (analytics). We also partner with affiliate networks such as Rakuten. These parties may collect information via cookies and similar technologies to provide interest-based advertising and analytics. Industry opt-outs are available at the Network Advertising Initiative and Digital Advertising Alliance opt-out pages.

Information about our response to do-not-track signals or opt-out preference signals, and your options to limit tracking, is described below and/or available via our preference center.

8. Targeted Advertising, Sales, and Opt-Outs

Some US laws require disclosures about “selling” personal data and/or “processing personal data for targeted advertising” (including cross-context behavioral advertising), and give you the right to opt out. If we engage in such activities, we will provide clear, conspicuous disclosures and offer easily accessible opt-out mechanisms, including honoring applicable universal opt-out preference signals where required. If we do not “sell” personal data or engage in “targeted advertising,” we will state that clearly in our live policy. If we sell or share sensitive or biometric data of residents of certain states (e.g., Florida, Texas), we will also display the required notices prominently, such as: “NOTICE: This website may sell your [sensitive/biometric] personal data.”

9. Profiling and Automated Decision-Making

Where we engage in profiling or automated decision-making that produces legal or similarly significant effects, we will provide additional, plain-language disclosures describing the decisions involved, the personal data used, the logic involved (and role of human involvement), evaluations for fairness/accuracy, potential benefits and consequences, and information on how to exercise applicable opt-out rights. For California, additional ADMT notice requirements will apply on a phased basis under forthcoming regulations; where applicable, we will provide a separate ADMT pre-use notice.

10. Disclosures and Categories of Recipients

We disclose personal data to service providers, processors, contractors, and vendors that support our operations (e.g., hosting, fulfillment, payment processing, analytics, fraud prevention, support) under appropriate contractual terms; affiliates and subsidiaries (where applicable); advertising and analytics partners (only as disclosed and subject to applicable opt-outs and consent signaling); other third parties as required by law or to protect rights, safety, and property; and in connection with corporate transactions (e.g., mergers, acquisitions), subject to legal requirements. We provide required disclosures of: (i) categories of personal data shared with third parties; and (ii) categories of third parties receiving the data, with sufficient detail to meaningfully describe the category (e.g., analytics providers, advertising partners, payment processors, fulfillment partners).

Brand-specific practices include intra-group sharing among our corporate family to provide, maintain, market, and improve the Services and affiliated brand offerings; service providers assisting with order fulfillment, delivery, postal mail and email, list hygiene, data analysis, marketing, payment processing, and customer service; SMS program vendors; business reorganizations; and legal and safety disclosures.

Data Sharing with Agentic Storefront Partners

When you purchase products through an Agentic Storefront or third-party platform, we share personal data with the following categories of recipients to process and fulfill your transaction:

Shopify. Shopify, Inc. is our e-commerce platform provider. Shopify processes personal data on our behalf to facilitate checkout, payment processing, and order management. Shopify's processing of customer personal data is governed by the Shopify Consumer Privacy Policy and our Data Processing Addendum with Shopify.

Participating Partners (Google and Microsoft). When you purchase products through an Agentic Storefront operated by a Participating Partner, personal data is shared with that Participating Partner for the following purposes:

• Initiating, processing, and completing the transaction;
• Providing post-purchase order status updates;
• Fraud and abuse prevention; and
• Legal compliance purposes.

For purchases through Google Shopping or related Google services, your personal data is shared with Google LLC. Google's collection and use of your personal data is governed by the Google Privacy Policy and the Google Controller-Controller Data Protection Terms.

For purchases through Microsoft Copilot, your personal data is shared with Microsoft Online, Inc. Microsoft's collection and use of your personal data is governed by the Microsoft Privacy Statement.

Independent Controllers. With respect to personal data processed in connection with Agentic Storefront transactions, the Company, Shopify, and the applicable Participating Partner each act as independent data controllers and not as joint controllers. Each party is independently responsible for complying with applicable data protection laws with respect to the personal data it processes.

Restricted Data. Certain data elements collected in connection with Agentic Storefront transactions, including billing address, card metadata, card network, and payment card information ("Restricted Data"), may only be used for payment processing, customer support, and fraud detection, and for no other purpose, including to personalize or target advertising. 

11. International Data Transfers

If you reside in the EU/EEA or UK, your personal data may be transferred to countries that may not provide the same level of data protection as your home jurisdiction. Where we transfer personal data internationally, we will rely on appropriate safeguards under applicable law, such as adequacy decisions or Standard Contractual Clauses (and, where applicable, the UK International Data Transfer Addendum), and, where necessary, supplementary measures. You may obtain a copy of the relevant transfer safeguards by contacting us.

If you reside in Canada, your personal data may be transferred to countries that may not provide a comparable level of data protection as your home jurisdiction. As a result, your personal data may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to the laws in those jurisdictions.  For example, information may be shared in response to valid demands or requests from government authorities, courts and law enforcement officials in those countries.  Subject to applicable laws in such other jurisdictions, we will use reasonable efforts to ensure that appropriate protections, such as contractual obligations, are in place to require our service providers and vendors to maintain protections on personal information that are equivalent to those that apply in Canada.

Brand-specific information: we are hosted by Amazon Web Services with global servers, and personal information may be stored in the United States and other countries. If you live in Canada, your information may be transferred to and stored in the United States; additional information is available via the brand contacts listed below.

When you purchase products through an Agentic Storefront, your personal data may be transferred to and processed in the United States and other countries where Shopify, Google, Microsoft, and our other service providers maintain servers. Where required by applicable law, such transfers are subject to appropriate safeguards, including Standard Contractual Clauses or other transfer mechanisms approved by applicable data protection authorities.

12. Data Retention

We retain personal data for as long as reasonably necessary to achieve the purposes described in this Privacy Policy, and as otherwise required or permitted by law, including to comply with legal obligations, resolve disputes, maintain security and integrity, and enforce agreements. Where required, we will disclose retention periods for each personal data category or the criteria used to determine retention. We maintain and apply a retention schedule; when data is no longer needed, we delete or irreversibly anonymize it.

Brand-specific practice: we retain usage data for internal analysis, security, and functionality improvement; retention periods may vary based on legal or operational needs.

13. Children’s Privacy

We do not knowingly collect personal data from children where prohibited by applicable law. In the United States, our Services are not directed to children under 13. In Canada, we do not knowingly collect, use, or disclose personal data of individuals under the age of majority for online services without appropriate parental consent. In the EU/EEA and UK, we do not knowingly process personal data of children under 16 (or the lower age set by local law) for online services without appropriate parental consent. We also do not knowingly “sell” or use for targeted advertising the personal data of minors where opt-in is required. Where we have actual knowledge that a user is a minor under applicable law, we will seek appropriate consents and provide required opt-in/opt-out mechanisms. If we learn we have collected personal data from a child in violation of applicable law, we will delete it.

14. Security

We implement reasonable and appropriate physical, technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, or destruction. However, no system can be guaranteed to be fully secure, and transmissions of personal data are at your own risk.

15. Your Rights

Your rights will depend on where you live and may include: access, correction, deletion, and data portability; the right to opt out of sales, targeted advertising, and, in some jurisdictions, certain profiling; the right to limit the use of sensitive data in certain jurisdictions; the right to withdraw consent where consent is the legal basis; the right to object to processing based on our legitimate interests (including a right to object to direct marketing in the EU/EEA/UK); the right to lodge a complaint with a supervisory authority (EU/EEA/UK); and the right to non-discrimination (right of no retaliation) for exercising your privacy rights. Some states provide a right to appeal a decision we make on your privacy request. Our response will describe how to submit an appeal and, in states that require it, we will provide information on how to contact your state attorney general if your appeal is denied.

Exercising Rights for Agentic Storefront Purchases

If you purchased products through an Agentic Storefront and wish to exercise your data protection rights (such as access, correction, deletion, or opt-out rights), you may submit your request to us using the contact information in Section 23 below. We will process your request in accordance with applicable law.

Because the Company, Shopify, and the applicable Participating Partner each act as independent data controllers for Agentic Storefront transactions, you may also need to submit requests directly to Shopify or the Participating Partner to fully exercise your rights with respect to personal data they hold. Each party is independently responsible for responding to requests from individuals to exercise their data protection rights.

• For requests to Shopify: Visit Shopify's Consumer Privacy Policy for information on how to submit requests.
• For requests to Google: Visit the Google Privacy Policy for information on how to submit requests.
• For requests to Microsoft: Visit the Microsoft Privacy Statement for information on how to submit requests.

We will cooperate with Participating Partners and Shopify as reasonably necessary to assist in responding to data subject requests.

16. How to Exercise Your Rights

For questions, concerns, or requests, including requests related to personal data collected in connection with Agentic Storefront purchases, you may submit requests by email to the brand you interact with, or via any webform/portal or toll-free number we make available:

• GREATS: support@greatsbrand.com

We will authenticate your request using information associated with your account or transactions and may request additional verification information where legally permitted and appropriate. Authorized agents may submit requests on your behalf where permitted by law, subject to verification of the agent’s authority and your identity. We process universal opt-out mechanisms (e.g., Global Privacy Control) and honor them as required. If we offer frictionless processing of opt-out preference signals, we will explain how you can implement and use them.

17. DMCA Takedown; Copyright Complaints

We respect intellectual property rights and expect users to do the same. If you believe that content available through the Services infringes your copyright, please see our separate DMCA Policy for information on how to submit a compliant notice and, where applicable, a counter-notification to our DMCA Agent. Our DMCA Policy also explains our repeat infringer policy and our accommodation of standard technical measures.

18.  Electronic Communications 

You may have opted in to receive future promotional electronic communications from us or we may otherwise we may contact you with promotional offerings or other communications that may be of interest to you in accordance with applicable law. We may use the personal data to: (i) communicate with you regarding our products, Services and promotions; (ii) provide you with other information that you request; and/or (iii) improve our product and service offerings. You will always have the opportunity to "unsubscribe" from receiving any of our e-mail or other communications at any time. To unsubscribe, you can contact us at [Insert Email], or as otherwise described in our electronic communications to you.

If you decide to unsubscribe, we will only contact you thereafter: (i) for the purposes allowed under applicable law; (ii) to send you notices of changes to our Privacy Policy; and (iii) to receive Service related messages.

19. Consent to Data Processing for Agentic Storefront Purchases

By purchasing products through an Agentic Storefront, you acknowledge and consent to the collection, processing, and sharing of your personal data as described in this Privacy Policy, including sharing with Shopify and the applicable Participating Partner (such as Google or Microsoft) as necessary to complete your transaction.

The applicable Participating Partner will obtain your consent to our purchase terms and this Privacy Policy as a condition of completing your purchase through the Agentic Storefront.

You acknowledge that your use of any Participating Partner's platform is also subject to that Participating Partner's terms and privacy policy, and you are encouraged to review those policies before completing a purchase through an Agentic Storefront. 

20. Additional US State-Specific Disclosures

California (CCPA/CPRA): Residents of California may review our California Privacy Addendum for more details describing, among other things, categories of personal information collected, sources, business and commercial purposes, categories of disclosures for a business purpose, categories sold or shared (if any), sensitive personal information practices (including right to limit), rights to know/correct/delete/opt-out, methods for submitting requests, opt-out preference signal processing, and the date of last review/update. We review and update at least every 12 months.

Other US States: We incorporate each state’s transparency, consumer rights, submission and appeal processes, sales/targeted advertising disclosures, and presentation requirements, as applicable. Where any state requires a separate or conspicuous opt-out method outside this Privacy Policy (e.g., a clearly labeled hyperlink), we will provide it.

Special state-specific items that may apply include sensitive/biometric data sale notices (Florida/Texas), cross-site tracking disclosures (Nevada; CalOPPA), retention schedule disclosure (Minnesota; California best practice), Oregon assumed names, and Rhode Island listing of purchasers for sales (effective January 1, 2026), if applicable.

Agentic Storefront Disclosures

For purposes of state privacy laws, including the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), the sharing of personal data with Participating Partners (such as Google and Microsoft) and Shopify in connection with Agentic Storefront transactions may constitute a "sale" or "sharing" of personal data or "processing for targeted advertising" under applicable law.

If we engage in such activities, we will provide clear disclosures and offer easily accessible opt-out mechanisms as required by applicable law. You may exercise your right to opt out by contacting us or by using any opt-out mechanism made available through the Agentic Storefront checkout experience.

For California residents: You have the right to opt out of the sale or sharing of your personal information and the right to limit the use of sensitive personal information. To exercise these rights, contact us using the information in Section 23 or use the "Do Not Sell or Share My Personal Information" link on our website. 

21. Additional Regional Disclosures for Canada

Under applicable Canadian privacy laws outside of Quebec, individuals generally have the right to access their personal information and to request corrections where that information is inaccurate or incomplete.

For residents of the Province of Quebec, enhanced rights apply under Quebec privacy legislation. These rights include the right to access and correct personal information, the right to request deletion or de-indexing of personal information (often referred to as the “right to be forgotten”), the right to data portability in prescribed circumstances, and the right to request information about how their personal information is processed, including information related to automated decision-making, where applicable.

22. Additional Regional Disclosures for EU/EEA and UK

Rights under GDPR/UK GDPR include access, rectification, erasure, restriction, data portability, objection (including to direct marketing and certain processing based on legitimate interests), and the right to withdraw consent. You also have the right to lodge a complaint with your supervisory authority. Cookies/ePrivacy: We obtain consent for non-essential cookies/trackers and allow you to change preferences at any time via our cookie banner or privacy center.

23. Data Minimization and Purpose Limitation

We collect and process only the personal data that is reasonably necessary, adequate, and relevant to achieve the disclosed purposes. If we intend to use personal data for a new purpose that is not reasonably necessary or compatible with the original purpose, we will update our disclosures and, where required, obtain consent.

24. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. Material changes will be communicated through our usual channels, and the “Last updated” date will be revised. Some jurisdictions require specific change notices and opportunities to withdraw consent for retroactive material changes; where applicable, we will provide such notices and opportunities. Please review this Privacy Policy periodically for updates.

25. How to Contact Us

If you have questions about this Privacy Policy or our privacy practices, contact the brand you interact with:

• GREATS: support@greatsbrand.com | UCGREATS, LLC, 12094 Life Science Ct, Draper, UT 84020, United States.

US opt-out page(s): Where required, we will provide conspicuous “Your Privacy Choices,” “Do Not Sell or Share My Personal Information,” and “Limit the Use of My Sensitive Personal Information” links with functionality to directly effectuate opt-outs and honor universal signals.