Privacy Policy

This Privacy Policy explains how Plushie Planet (“Plushie Planet”, “we”, “us” or “our”) collects, uses, discloses, retains and protects personal data when you visit planetplushie.com and its language versions (together, the “Website”), when you contact us, and when you otherwise interact with us in connection with the Website. It also explains the choices you have and the rights you may exercise under the data protection laws that apply to you.

We have written this policy to meet the requirements of the major data protection frameworks that apply to a website with an international audience, including the EU General Data Protection Regulation (“GDPR”), the UK GDPR and Data Protection Act 2018, the Swiss Federal Act on Data Protection (“FADP”), the California Consumer Privacy Act as amended by the California Privacy Rights Act (“CCPA”) and comparable US state laws, Brazil’s Lei Geral de Proteção de Dados (“LGPD”), the Republic of Korea’s Personal Information Protection Act (“PIPA”), Japan’s Act on the Protection of Personal Information (“APPI”), the People’s Republic of China’s Personal Information Protection Law (“PIPL”), Canada’s PIPEDA, Australia’s Privacy Act 1988, and Singapore’s Personal Data Protection Act (“PDPA”). Where a law gives you more protection than this policy describes, that law prevails.

Please read this policy together with our Terms of Service. If you do not agree with this policy, please do not use the Website.

1. Who we are and how to contact us

The controller responsible for the processing of personal data described in this policy is:

Plushie Planet, 1050 17th Street, Denver, Colorado 80202, United States of America. Email: [email protected]

We also operate an Asia-Pacific supply-chain and manufacturing hub in Shenzhen, China. That hub does not operate the Website and does not receive Website visitor data except where necessary to answer an enquiry you have addressed to it.

For any question about this policy or our handling of your personal data, or to exercise any of your rights, please write to [email protected] with the subject line “Privacy”. Enquiries sent this way are routed to the person responsible for data protection matters at Plushie Planet, who acts as our privacy contact for the purposes of the GDPR, the LGPD (as our encarregado), the PIPA (as our person in charge of personal information protection) and other applicable laws.

2. Scope of this policy

This policy applies to personal data processed through the Website, including the public pages, the contact form, the news, collections and cultural-strategy sections, and the technical services that deliver them.

This policy does not apply to:

• websites, apps, marketplaces and social media platforms operated by third parties, including the Facebook, Instagram and TikTok accounts we link to, and any authorised retailer through which you may purchase our products. Those services are governed by their own privacy notices;
• personal data of our employees, job applicants, suppliers and business partners, which we handle under separate notices provided to them;
• other Plushie Planet services that publish their own privacy notice. Where such a notice exists, it governs that service.

3. Key points at a glance

• The Website does not sell anything and does not offer visitor accounts. You can browse the entire Website without giving us your name, email address or any other directly identifying information.
• We collect directly identifying data only when you choose to contact us, for example through the contact form or by email.
• We measure traffic in a privacy-friendly way. Our own measurement tool stores no IP address, no cookie and no visitor identifier.
• Google Analytics and Google Ads cookies are set only if you click “Accept” in our cookie banner. If you click “Reject”, or make no choice, Google tags operate in a restricted, cookieless mode described in section 6.
• We do not sell your personal data, and we do not use it for automated decision-making that produces legal or similarly significant effects on you.
• You have rights over your personal data, including access, correction, deletion and objection, which you can exercise free of charge by emailing [email protected].

4. Personal data we collect

We collect only the personal data that is reasonably necessary for the purposes described in section 5. The categories are as follows.

4.1 Data you give us

Contact form. When you submit the contact form we collect your name, email address, the subject of your message (optional), the content of your message, and the language version of the Website you were using. Please do not include sensitive information (such as health data, government identification numbers or financial account details) in your message; we do not need it and ask that you not send it.

Email and other correspondence. If you write to us at [email protected] or any other address we publish, we receive your email address, your name as it appears in your email, the content of your message, any attachments, and the technical header information that accompanies an email.

Messages sent through social media. If you contact us through a social media platform, we receive the information that the platform makes available to us, such as your profile name and the content of your message, in accordance with your settings on that platform.

Business enquiries. If you contact us on behalf of a company, for example about licensing, collaborations, wholesale, press or partnerships, we collect your professional contact details, your organisation and role, and the content of our correspondence.

4.2 Data collected automatically

Technical and security data. Whenever you access the Website, your browser automatically transmits certain technical information to the servers that deliver it, including your IP address, the date and time of the request, the page or file requested, the HTTP status code, the amount of data transferred, the referring web address, and your browser’s user-agent string (which describes your browser type, version and operating system). This information is necessary to deliver the Website to you, to keep it secure and to diagnose faults. It is processed by our content delivery and security provider and by our hosting infrastructure, as described in section 7.

First-party measurement. We operate our own lightweight measurement tool to understand how the Website is used and how quickly it loads. For each page view it records: the path of the page viewed; the domain name only of the referring website (never the full referring address, and nothing at all when you move between our own pages); the language version of the page; whether your device is mobile or desktop; and your country, which our content delivery provider derives from your IP address at the network edge. It also records standard page-performance measurements (Largest Contentful Paint, Interaction to Next Paint and Cumulative Layout Shift) together with the page path. Each record is time-stamped. This tool does not store your IP address or your user-agent string, does not use cookies or similar storage on your device, and does not assign you any identifier, so the records cannot be used to recognise you across visits or to build a profile of you.

Google Analytics and Google Ads. The Website uses Google Analytics 4 and Google Ads conversion measurement, provided by Google, in combination with Google Consent Mode. What data is processed depends on your cookie choice. Section 6 explains this in detail.

Cookies. We use a small number of cookies, listed in section 6.

4.3 Data we receive from third parties

We do not buy personal data and we do not receive personal data about you from data brokers. We may receive aggregated, non-identifying statistics from Google and from social media platforms about how users interact with our content. If a third party, such as a retailer or partner, refers an enquiry from you to us, we will receive the information you provided to that party for that purpose.

4.4 Sensitive data

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health, sexual orientation, biometric or genetic data) or data about criminal convictions. If you send us such data unprompted, we will delete it unless we are required to keep it or you have explicitly asked us to use it for a specific purpose.

5. How we use personal data and our legal bases

Several laws, including the GDPR, the UK GDPR and the LGPD, require us to identify a legal basis for each use of personal data. The list below sets out each purpose, the data involved and the legal basis we rely on.

• Responding to your enquiries and requests, including customer-service, product, press, partnership and licensing enquiries. Data: contact-form data, correspondence. Legal basis: taking steps at your request before entering into a contract, or performance of a contract (GDPR Art. 6(1)(b)), where your enquiry relates to one; otherwise our legitimate interest in answering the people who contact us (Art. 6(1)(f)).
• Delivering the Website and displaying it in your language. Data: technical data; the language cookie. Legal basis: our legitimate interest in providing a functioning website (Art. 6(1)(f)); for the language cookie, the fact that it is strictly necessary to provide the service you request.
• Keeping the Website and our systems secure, including detecting and blocking abusive traffic, spam submissions, denial-of-service attacks and attempts at unauthorised access. Data: technical and security data; contact-form data. Legal basis: our legitimate interest in protecting our systems, our visitors and our business (Art. 6(1)(f)).
• Measuring and improving the Website through our first-party measurement tool. Data: the measurement records described in section 4.2. Legal basis: our legitimate interest in understanding which content is useful and in keeping the Website fast and reliable (Art. 6(1)(f)). Because the tool stores no identifiers and no IP addresses, its impact on your privacy is minimal.
• Audience analytics and advertising measurement with Google, using cookies. Data: the data described in section 6.3. Legal basis: your consent (Art. 6(1)(a)), which you give by clicking “Accept” and may withdraw at any time.
• Cookieless Google measurement where consent has not been given. Data: the limited data described in section 6.2. Legal basis: our legitimate interest in obtaining aggregate measurement of Website performance and advertising effectiveness (Art. 6(1)(f)). You may object to this processing at any time, as explained in section 6.4.
• Complying with legal obligations, such as responding to lawful requests from public authorities, keeping records required by law, and handling requests from you under data protection law. Data: any relevant data. Legal basis: compliance with a legal obligation (Art. 6(1)(c)).
• Establishing, exercising or defending legal claims, and enforcing our Terms of Service and our intellectual-property rights, including action against counterfeit products. Data: any relevant data. Legal basis: our legitimate interest in protecting our rights (Art. 6(1)(f)).
• Business transactions. If we are involved in a merger, acquisition, financing, reorganisation or sale of assets, personal data may be reviewed or transferred as part of that transaction, subject to confidentiality obligations. Legal basis: our legitimate interest in carrying out such transactions (Art. 6(1)(f)).

Where we rely on legitimate interests, we have balanced our interests against your rights and freedoms and concluded that our processing is proportionate. You can request more information about this balancing by contacting us.

We do not use your personal data to send you marketing emails unless you have asked to receive them or the law otherwise permits it, and you can always opt out. We will not use your personal data for a purpose that is incompatible with the purpose for which it was collected without informing you and, where required, obtaining your consent.

6. Cookies, similar technologies and Google services

6.1 Cookies we use

A cookie is a small text file that a website stores in your browser. The Website uses the following cookies:

• cookie_consent (first-party, strictly necessary). Records whether you clicked “Accept” or “Reject” in the cookie banner, so that we respect your choice and do not ask again on every page. Value: “accepted” or “rejected”. Duration: 12 months.
• NEXT_LOCALE (first-party, strictly necessary for the function you requested). Set when you choose a language from the language menu, so the Website opens in that language next time. Duration: 12 months.
• Google Analytics cookies such as _ga and _ga_<container ID> (third-party, analytics). Set only after you click “Accept”. They distinguish users and sessions so that Google Analytics can produce statistics about how the Website is used. Duration: up to 24 months.
• Google Ads cookies such as _gcl_au and related Google advertising cookies (third-party, advertising measurement). Set only after you click “Accept”. They allow us to measure whether our Google advertisements lead people to the Website. Duration: typically up to 90 days, or as determined by Google.

The administration area of the Website uses an authentication cookie for our authorised staff only; it is never set for visitors.

We do not use local storage, session storage or browser fingerprinting to track visitors.

6.2 What happens before you choose, and if you click “Reject”

The Website uses Google Consent Mode (version 2). Until you click “Accept”, all four Google consent signals (analytics storage, advertising storage, advertising user data and advertising personalisation) are set to “denied”. In this state Google tags do not set or read cookies on your device. They may, however, send limited, cookieless signals to Google when a page loads, such as the fact that a page was viewed, the time, the consent state, your browser’s user-agent and the page address. Because these requests are made directly from your browser to Google, your IP address is necessarily transmitted to Google in the process. We have configured Google Analytics to anonymise IP addresses, and we have enabled Google Ads data redaction, which removes advertising click identifiers from these signals while consent is denied. Google uses these signals in aggregated form to model overall statistics and does not use them to identify you.

We have also enabled a Google feature called URL passthrough, which may carry information about an advertisement click (for example a Google click identifier) in the address of the pages you visit on the Website, rather than in a cookie, so that a visit can be attributed to an advertisement in aggregate without storing anything on your device.

6.3 If you click “Accept”

If you click “Accept”, the four consent signals switch to “granted”, Google Analytics and Google Ads may set the cookies listed in section 6.1, and Google will process information about your use of the Website, including pages viewed, interactions, approximate location, device and browser information, and the online identifiers contained in those cookies. Google acts as our processor for Google Analytics. For Google Ads measurement, Google may act as an independent controller; Google’s use of data is described at policies.google.com/technologies/partner-sites.

6.4 How to change your choice or object

You can change your mind at any time. To withdraw consent or change your choice, delete the cookie_consent cookie for planetplushie.com in your browser settings (or clear the Website’s cookies); the cookie banner will then appear again on your next visit and you can make a new choice. Withdrawing consent does not affect the lawfulness of processing carried out before you withdrew it.

You can also:

• block or delete cookies through your browser settings. Most browsers let you refuse all cookies, refuse third-party cookies only, or delete cookies when you close the browser. Blocking strictly necessary cookies may mean the Website forgets your language or cookie choice;
• install the Google Analytics opt-out browser add-on, available at tools.google.com/dlpage/gaoptout;
• manage Google advertising personalisation at adssettings.google.com;
• object to the cookieless measurement described in section 6.2 by contacting us, or prevent it entirely by blocking requests to Google domains with a browser extension.

6.5 Do Not Track

Browsers can send a “Do Not Track” signal. Because there is no common industry standard for responding to it, the Website does not currently change its behaviour in response to Do Not Track. Your cookie choice in our banner is respected regardless.

7. How we share personal data

We do not sell personal data, and we do not rent or trade it. We share personal data only as described below.

Service providers (processors). We use carefully selected service providers who process personal data on our behalf and on our instructions, under written contracts that require them to protect it and to use it only to provide their services to us. At the date of this policy they include:

• Cloudflare, Inc. — content delivery network, DNS, TLS encryption and protection against malicious traffic. All traffic to the Website passes through Cloudflare, which processes technical data, including IP addresses, and supplies the visitor-country signal used by our measurement tool;
• cloud hosting and storage providers, including Alibaba Cloud (servers located in Singapore), which host the Website, its database and its backups, and cloud object-storage providers that hold Website media and encrypted backup copies;
• email service providers, including a transactional email delivery service (currently Resend) that delivers contact-form notifications to our team, and our business mailbox provider (currently GoDaddy), which hosts the mailbox that receives your emails;
• Google LLC / Google Ireland Limited — Google Analytics and Google Ads measurement, as described in section 6;
• professional and technical contractors who help us develop, maintain and secure the Website, where they need access to perform their work.

Within our group and our teams. Your enquiry may be shared with the Plushie Planet team best placed to answer it, including our team in Shenzhen, China, for product, manufacturing or supply-chain questions. Access is limited to people who need it.

Partners at your request. If your enquiry concerns an authorised retailer, licensing partner or collaboration, we may share the relevant details with that partner so that it can respond, where you have asked us to or where it is clearly necessary to deal with your enquiry.

Legal and safety reasons. We may disclose personal data where we believe in good faith that disclosure is required by applicable law, regulation, legal process or an enforceable request of a public authority, or is necessary to protect the rights, property or safety of Plushie Planet, our visitors or others, including to investigate fraud, counterfeiting or security incidents.

Corporate transactions. In connection with a merger, acquisition, financing, reorganisation, insolvency or sale of all or part of our business, personal data may be disclosed to the counterparty and its advisers under confidentiality obligations, and may be transferred as one of the assets. We will inform you where required by law.

With your consent. We will share personal data in other circumstances where you have asked us to or given your consent.

8. International transfers

Plushie Planet is headquartered in the United States, the Website is hosted on servers in Singapore, our content delivery provider operates a global network, and our team works in several countries. As a result, your personal data will be processed in countries other than your own, including the United States, Singapore and, for enquiries handled by our Asia-Pacific team, the People’s Republic of China. These countries may not offer the same level of data protection as the country where you live.

Where we transfer personal data out of the European Economic Area, the United Kingdom or Switzerland to a country that has not been recognised as providing an adequate level of protection, we rely on appropriate safeguards, in particular:

• the Standard Contractual Clauses adopted by the European Commission, with the UK International Data Transfer Addendum and Swiss adaptations where applicable, together with supplementary measures where needed; and
• for transfers to US service providers that participate in it, the EU-US Data Privacy Framework, its UK Extension and the Swiss-US Data Privacy Framework.

For transfers from other jurisdictions we use the mechanisms those laws require or permit, such as contractual protections, your consent where it is the applicable basis, or the necessity of the transfer to answer your request. You may request a copy of the relevant safeguards by contacting us; we may redact commercially sensitive terms.

9. How long we keep personal data

We keep personal data only for as long as necessary for the purposes for which it was collected, and then we delete or anonymise it. Specifically:

• Contact-form submissions and correspondence: for up to 24 months after our last exchange with you about the matter, so that we can follow up and refer back to previous conversations, unless a longer period is needed because the correspondence concerns a contract, a dispute or a legal claim, in which case we keep it for the applicable limitation period;
• First-party measurement records: for up to 26 months, after which they are deleted or reduced to aggregate totals that contain no individual records;
• Technical and security logs: for a short period, normally not exceeding 90 days, unless a specific log is needed to investigate a security incident or abuse;
• Google Analytics data: in accordance with the data-retention setting of our Google Analytics property, which does not exceed 14 months for user-level and event-level data;
• cookie_consent and NEXT_LOCALE cookies: 12 months from when they are set, unless you delete them sooner;
• Records of requests you make under data protection law: for up to 3 years after the request is closed, to demonstrate that we handled it correctly.

When we delete data, it is removed from our active systems and then from our backups as the backups are overwritten in the ordinary course, which takes no more than a few months.

10. How we protect personal data

We use technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access, appropriate to the risk. These include:

• encryption of all traffic between your browser and the Website using HTTPS/TLS;
• placing our servers behind a content delivery and security network, with firewall rules that block direct access to the origin servers from the public internet;
• restricting administrative access to a small number of authorised personnel, with individual accounts, strong passwords and login-attempt limits;
• automated spam and abuse controls on the contact form;
• regular, automatic backups stored in separate locations, so that data can be restored if needed;
• data minimisation by design, such as a measurement tool that stores no identifiers and no IP addresses;
• contractual confidentiality and security obligations on our service providers.

No method of transmission over the internet or of electronic storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority and, where required, you, within the timeframes required by law.

11. Your rights

Depending on where you live, you have some or all of the following rights. We will honour these rights for every visitor wherever reasonably possible, even where the law of your country does not strictly require it.

• Access: to obtain confirmation of whether we process your personal data and to receive a copy of it, together with information about how we process it;
• Correction: to have inaccurate personal data corrected and incomplete data completed;
• Deletion: to have your personal data deleted, for example where it is no longer needed or you withdraw consent, subject to legal exceptions;
• Restriction: to ask us to restrict processing while a dispute about accuracy or lawfulness is resolved, or in other circumstances set out in law;
• Objection: to object at any time to processing based on our legitimate interests, on grounds relating to your particular situation, and to object at any time, without needing to give a reason, to processing for direct marketing;
• Portability: to receive personal data you provided to us in a structured, commonly used, machine-readable format and to have it transmitted to another controller, where processing is based on consent or contract and carried out by automated means;
• Withdrawal of consent: to withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (see section 6.4 for cookies);
• Not to be subject to solely automated decisions that produce legal or similarly significant effects. We do not make such decisions;
• Complaint: to lodge a complaint with a data protection supervisory authority, in particular in the country where you live or work or where an alleged infringement occurred. We would appreciate the chance to address your concern first, so please consider contacting us before doing so.

How to exercise your rights. Email [email protected] with the subject line “Privacy request”, tell us which right you wish to exercise, and give us enough information to locate your data (for example, the email address you used to contact us). We will respond within one month of receiving your request (or a shorter period where local law requires it, such as 15 days under the LGPD or 10 days under the PIPA), and we may extend that period by up to two further months for complex or numerous requests, in which case we will tell you why. Exercising your rights is free of charge, unless a request is manifestly unfounded or excessive.

To protect your data, we may need to verify your identity before acting on a request, normally by confirming that you control the email address associated with the data. We will not ask for more information than is necessary for that purpose. You may use an authorised agent to submit a request where local law allows; we may ask the agent for proof of authorisation and may ask you to confirm your identity directly.

We will not discriminate against you for exercising any of your rights.

12. Children

The Website is a general-audience brand website. It is not directed to children, and many of our designer collectibles are intended for adult collectors. We do not knowingly collect personal data from children under the age of 16 (or a lower or higher minimum age set by the law of your country, such as 13 in the United States under COPPA, or 14 in the Republic of Korea and the People’s Republic of China). If you are below that age, please do not send us personal data through the contact form; ask a parent or guardian to contact us on your behalf.

If you are a parent or guardian and believe that your child has provided personal data to us, please contact us and we will delete it promptly.

13. Additional information for specific regions

The following supplements apply to residents of the regions indicated. If there is a conflict between this section and the rest of the policy, this section prevails for residents of that region.

13.1 European Economic Area, United Kingdom and Switzerland

The controller is identified in section 1, and the purposes and legal bases are set out in section 5. Providing personal data through the contact form is voluntary, but if you do not provide your email address we cannot reply to you. We do not carry out automated decision-making, including profiling, with legal or similarly significant effects.

Plushie Planet does not have an establishment in the European Union or the United Kingdom. Where Article 27 of the GDPR or the UK GDPR requires us to designate a representative, we will publish the representative’s details in this policy. You may contact the supervisory authority in your EU Member State of residence (a list is available on the website of the European Data Protection Board), the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner.

13.2 United States (California and other states)

This section provides the notice required by the CCPA and by comparable comprehensive privacy laws in other US states, including Colorado, Virginia, Connecticut, Utah, Texas, Oregon and others, to the extent they apply to us.

Categories of personal information collected in the past 12 months: identifiers (name, email address, IP address); internet or other electronic network activity information (pages viewed, referring domain, interactions, performance measurements); approximate geolocation (country, and approximate location derived by Google where you accept cookies); and the content of communications you send us. We collect this information from you directly, from your device and browser, and from our service providers, for the business and commercial purposes described in section 5. We disclose these categories for business purposes to the service providers described in section 7.

Sale and sharing. We do not sell personal information for money. Where you click “Accept” in our cookie banner, the use of Google Ads cookies for advertising measurement may be considered “sharing” for cross-context behavioural advertising, or “targeted advertising”, under some state laws. You may opt out at any time by declining or withdrawing cookie consent as described in section 6.4, or by emailing [email protected] with the subject line “Do not sell or share”. We do not knowingly sell or share the personal information of consumers under 16 years of age.

Sensitive personal information. We do not collect or use sensitive personal information for the purpose of inferring characteristics about you.

Your rights. Subject to applicable law, you have the right to know what personal information we collect, use and disclose; to access it; to correct it; to delete it; to opt out of its sale, sharing or use for targeted advertising; and not to receive discriminatory treatment for exercising these rights. Where a state law provides a right to appeal our decision on your request, you may appeal by replying to our decision with the subject line “Appeal”; if you are dissatisfied with the outcome, you may contact your state Attorney General.

Retention. Our retention periods for each category are set out in section 9.

Shine the Light. California residents may request information about disclosures of personal information to third parties for their direct marketing purposes. We do not make such disclosures.

13.3 Brazil

Under the LGPD you have the rights listed in Article 18, including confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary or excessive data, portability, deletion of data processed with consent, information about the public and private entities with which we share data, information about the possibility of refusing consent and its consequences, and revocation of consent. Our encarregado (data protection officer) can be contacted at [email protected]. You may also petition the Autoridade Nacional de Proteção de Dados (ANPD). International transfers are carried out in accordance with Articles 33 to 36 of the LGPD and the ANPD’s regulations.

13.4 Republic of Korea

In accordance with the PIPA, we inform you that:

• items collected: for enquiries, name, email address, subject, message content and site language; automatically, the technical data and measurement data described in section 4.2;
• purposes, retention and destruction: as set out in sections 5 and 9. When the retention period expires or the purpose is achieved, electronic files are permanently deleted using a method that prevents recovery;
• overseas transfer: personal information is transferred over the network, at the time you submit it or visit the Website, to the recipients described in section 7, located in the United States, Singapore and other countries where they operate, for the purposes of hosting, content delivery, email delivery and analytics, and kept for the periods in section 9. You may refuse the overseas transfer by not submitting the contact form and by rejecting cookies; in that case we cannot respond to your enquiry through the form, but you can still browse the Website;
• outsourcing: the processing tasks entrusted to the service providers in section 7 are hosting, content delivery, security, email delivery and analytics;
• person in charge of personal information protection: our privacy contact, reachable at [email protected];
• remedies: you may also seek assistance from the Personal Information Infringement Report Center (privacy.kisa.or.kr, tel. 118), the Personal Information Dispute Mediation Committee (kopico.go.kr, tel. 1833-6972), the Supreme Prosecutors’ Office Cyber Investigation Division (tel. 1301) or the Korean National Police Agency Cyber Bureau (ecrm.police.go.kr, tel. 182).

13.5 Japan

We handle personal information in accordance with the APPI. Where we provide personal data to third parties in foreign countries, including the United States and Singapore, we do so on the basis of your consent or because the recipient has established a system that conforms to the standards prescribed by the Personal Information Protection Commission. Information on the personal information protection systems of those countries is published by the Personal Information Protection Commission of Japan. You may request disclosure, correction, addition, deletion, suspension of use, erasure or suspension of third-party provision of retained personal data, and disclosure of records of third-party provision, by contacting us as described in section 11.

13.6 People’s Republic of China

Where the PIPL applies, we process your personal information only on a lawful basis recognised by the PIPL, including your consent or the necessity of processing to respond to your request. By submitting your enquiry you consent to the cross-border transfer of your personal information to the recipients and countries described in sections 7 and 8, for the purposes and retention periods described in this policy. You may exercise your rights under the PIPL, including the rights to know, decide, restrict, refuse, access, copy, transfer, correct, supplement and delete, and to request explanation of our processing rules, by contacting us as described in section 11.

13.7 Canada, Australia, Singapore and other countries

If you are in Canada, we handle personal information in accordance with PIPEDA and, for residents of Québec, applicable Québec privacy law. If you are in Australia, we handle personal information in accordance with the Australian Privacy Principles; you may complain to the Office of the Australian Information Commissioner if you are not satisfied with our response. If you are in Singapore, we handle personal data in accordance with the PDPA, and you may contact the Personal Data Protection Commission. In other countries we will handle your personal data in accordance with this policy and with any mandatory requirements of local law.

14. Links to other websites and social media

The Website contains links to third-party websites and to our accounts on social media platforms such as Facebook, Instagram and TikTok. These are ordinary links: we do not embed social media plugins that transmit data to those platforms when you load our pages. When you follow a link, the third party’s own privacy policy applies, and we are not responsible for its practices. We encourage you to read the privacy policy of every website you visit.

15. Changes to this policy

We may update this policy from time to time to reflect changes in our practices, in the services we use or in the law. The “Last updated” date at the top of this page shows when it was last revised. If we make material changes, we will make them prominent on the Website before they take effect and, where required by law, seek your consent. We encourage you to review this policy periodically.

16. Contact

Plushie Planet, 1050 17th Street, Denver, Colorado 80202, United States of America. Email: [email protected]

If you contact us about this policy, we will acknowledge your message and do our best to resolve your question or concern promptly.