The information provided in this notice applies only to individuals in the European Economic Area, United Kingdom and Switzerland (collectively, “Europe”) and explains our practices regarding personal data that we collect from you or which we have obtained about you from a third party, and the legal bases for processing your personal data. It also describes your rights in respect to our processing of your personal data.

Personal data. “Personal data” as used in this notice has the same meaning given in European data protection legislation.

Controller. VSCO is the controller of your personal data covered by this Privacy Policy for purposes of European data protection legislation.

Data protection representative. Our data protection representative in the EU and UK is VeraSafe. You may contact them at:

• VeraSafe Ireland Ltd., Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork T23AT2P, Ireland
• VeraSafe United Kingdom Ltd., 37 Albert Embankment, London SE1 7TL, United Kingdom

Legal bases for processing. We use your personal data only as permitted by law. Our legal bases for processing the personal data described in our Privacy Policy are described in the table below.

Use for new purposes. We may use your personal data for reasons not described in this Privacy Policy where permitted by law and the reason is compatible with the purpose for which we collected it. If we need to use your personal data for an unrelated purpose, we will notify you and explain the applicable legal basis.

Retention. We retain personal data for as long as necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, accounting, or reporting requirements, to establish or defend legal claims, or for fraud prevention purposes.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

When we no longer require the personal data we have collected about you, we will either delete or anonymize it or, if this is not possible (for example, because your personal data has been stored in backup archives), then we will securely store your personal data and isolate it from any further processing until deletion is possible. If we anonymize your personal data (so that it can no longer be associated with you), we may use this information indefinitely without further notice to you.

Sensitive personal data. We ask that you not provide us with any sensitive personal data (e.g., social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, criminal background or trade union membership) on or through our Services, or otherwise to us.

If you provide us with any sensitive personal data to us when you use our Services, you must consent to our processing and use of such sensitive personal data in accordance with this Privacy Policy. If you do not consent to our processing and use of such sensitive personal data, you must not submit such sensitive personal data through our Services.

Your rights. You have the following rights in relation to the personal data we hold about you:

• Right of access: You can ask us if we are processing your personal data and to provide you with a copy of it (along with certain details). If you require additional copies, we may need to charge a reasonable fee.
• Right to rectification: If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified.
• Right to erasure: You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent to our processing of your personal data (where applicable).
• Right to restrict processing: You can ask us to 'block' or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data.
• Right to data portability: You have the right, in certain circumstances, to obtain personal data you have provided us with (in a structured, commonly used and machine readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice.
• Right to object: You can ask us to stop processing your personal data, and we will do so, if we are:
• relying on our own or someone else's legitimate interests to process your personal data, unless we can demonstrate compelling legal grounds for the processing; or
• processing your personal data for direct marketing purposes.
• Right to withdraw consent: If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time.
• Right to lodge a complaint with the supervisory authority: If you have a concern about any aspect of our privacy practices, including the way we have handled your personal data, you can report it to the relevant supervisory authority. You can find your data protection regulator here.

You may submit these requests through our Help Center. We may request specific information from you to help us confirm your identity and process your request. Applicable law may require or permit us to decline your request. If we decline your request, we will tell you why, subject to legal restrictions.

Cross-border data transfer. If we transfer your personal data out of Europe to a country not deemed to provide an adequate level of personal data protection for purposes of applicable data protection laws such that additional safeguards are required, the transfer will be performed:

• pursuant to the recipient’s compliance with Standard Contractual Clauses or Binding Corporate Rules;
• pursuant to the consent of the individual to whom the personal data pertains; or
• as otherwise permitted by applicable laws.

You may contact us through our Help Center if you want further information on the specific mechanism used by us when transferring your personal data out of Europe.