PRIVACY POLICY

Last updated: November 1, 2026

CHULA SURF LLC (“Chula,” “we,” “us,” or “our”) operates the Chula website, online store, and related services.

This Privacy Policy explains how we collect, use, disclose, and protect your personal information when you visit our website, make a purchase, create or use an account, subscribe to our communications, contact us, or otherwise interact with Chula.

Our online store is powered by Shopify, which provides the ecommerce platform that allows us to offer our products and services to you.

Please read this Privacy Policy carefully. By accessing or using our website or services, you acknowledge that you have read and understood the practices described in this Privacy Policy.

If there is a conflict between our Terms and Conditions and this Privacy Policy regarding the collection, use, processing, or disclosure of personal information, this Privacy Policy will control.

PERSONAL INFORMATION WE COLLECT

When we use the term “personal information,” we mean information that identifies you, relates to you, describes you, or can reasonably be linked to you.

Personal information does not include information that has been anonymized or de-identified so that it can no longer reasonably be linked to an individual.

Depending on how you interact with Chula, we may collect or process the following categories of information.

Contact Information

This may include:

• Name

• Email address

• Phone number

• Billing address

• Shipping address

• Country or region

Order and Transaction Information

This may include:

• Products purchased

• Products viewed

• Items placed in your cart

• Wishlist activity, where available

• Order history

• Returns and refund requests

• Order cancellations

• Shipping and fulfillment information

• Transaction history

Payment Information

When you make a purchase, payment information may be processed through Shopify and our payment service providers.

Depending on the payment method used, this may include:

• Credit or debit card information

• Payment account information

• Billing information

• Payment confirmation

• Transaction details

Chula does not necessarily receive or store complete payment card information directly. Payment information may instead be processed securely by Shopify or other authorized payment providers.

Account Information

If customer accounts are available and you create one, we may process information such as:

• Name

• Email address

• Username or account identifier

• Account preferences

• Saved addresses

• Order history

• Account settings

Account credentials may also be processed through Shopify or other service providers that help operate our website.

Communications With Chula

We collect information you provide when communicating with us, including when you:

• Contact customer support

• Request a return or refund

• Report a damaged or lost order

• Submit a question

• Contact us regarding a collaboration or partnership

• Send us photos, videos, or other documentation related to an order

Device and Technical Information

When you access our website, we or our service providers may automatically collect certain technical information, including:

• IP address

• Device type

• Browser type

• Operating system

• Network information

• Device identifiers

• Cookie identifiers

• Approximate location derived from your IP address

Website Usage Information

We may collect information about how you interact with our website, including:

• Pages viewed

• Products viewed

• Links clicked

• Search activity

• Shopping activity

• Cart activity

• Referral source

• Time spent on pages

• How and when you navigate our website

Marketing Information

If you subscribe to Chula emails or otherwise agree to receive marketing communications, we may process information such as:

• Email address

• Marketing preferences

• Subscription status

• Email engagement

• Products or collections you may be interested in

HOW WE COLLECT PERSONAL INFORMATION

We may collect personal information from several sources.

Directly From You

We collect information you provide when you:

• Place an order

• Create an account

• Subscribe to our email list

• Complete a form

• Contact customer support

• Request a refund or return

• Communicate with Chula

• Otherwise voluntarily provide information to us

Automatically Through Our Website

We may automatically collect information through:

• Cookies

• Pixels

• Tags

• Analytics technologies

• Similar tracking technologies

• Your browser or device

From Shopify and Our Service Providers

We may receive information from companies that help us operate Chula, including providers involved in:

• Ecommerce services

• Payments

• Shipping and fulfillment

• Analytics

• Marketing

• Email communications

• Website hosting

• Fraud prevention

• Customer support

From Business and Marketing Partners

Where permitted by law, we may also receive information from advertising platforms, social media platforms, analytics providers, or other business partners.

HOW WE USE YOUR PERSONAL INFORMATION

We may use personal information for the following purposes.

Providing and Fulfilling Our Services

We may use your information to:

• Process purchases

• Process payments

• Confirm orders

• Produce and fulfill orders

• Arrange shipping

• Provide tracking information

• Manage returns and refunds

• Manage customer accounts

• Communicate about your order

• Provide customer support

Improving Chula

We may use information to:

• Understand how customers use our website

• Improve our website experience

• Improve our products and collections

• Analyze website performance

• Understand customer preferences

• Improve our customer service

• Develop new features or services

Marketing and Advertising

Where permitted by law, we may use personal information to:

• Send promotional emails

• Announce new collections

• Share information about pop-ups and events

• Provide offers or discounts

• Measure the effectiveness of marketing campaigns

• Personalize advertising

• Show advertisements that may be more relevant to your interests

Where consent is required by applicable law, we will obtain that consent before using your information for these purposes.

Security and Fraud Prevention

We may use personal information to:

• Detect suspicious activity

• Prevent fraudulent transactions

• Protect customer accounts

• Protect our website

• Investigate potential abuse

• Maintain the security and integrity of our services

Communicating With You

We may use your information to:

• Answer questions

• Respond to customer support requests

• Provide information about an order

• Handle complaints

• Communicate about returns, refunds, or shipping

• Maintain our relationship with you

Legal and Regulatory Purposes

We may process personal information when reasonably necessary to:

• Comply with applicable laws

• Meet tax or accounting obligations

• Respond to lawful government requests

• Respond to subpoenas, court orders, or legal processes

• Establish, exercise, or defend legal claims

• Enforce our terms and policies

• Protect Chula, our customers, or others

LEGAL BASES FOR PROCESSING

If you are located in the United Kingdom, European Economic Area, or another jurisdiction that requires us to identify a lawful basis for processing personal information, we may rely on one or more of the following legal bases.

Performance of a Contract

We process personal information when it is necessary to fulfill our agreement with you.

For example, this may include processing your information to:

• Accept and process an order

• Receive payment

• Fulfill and ship products

• Provide order updates

• Process an approved return or refund

• Provide customer service relating to your purchase

Legitimate Interests

We may process information where doing so is reasonably necessary for Chula's legitimate business interests and those interests are not overridden by your privacy rights.

These interests may include:

• Operating and improving our business

• Improving our website

• Understanding website performance

• Preventing fraud

• Protecting our systems

• Providing customer support

• Understanding customer preferences

• Promoting our products where permitted by law

Consent

We may rely on your consent when required, including for certain:

• Marketing communications

• Advertising technologies

• Cookies

• Similar tracking technologies

Where we rely on consent, you may withdraw your consent at any time.

Withdrawing consent does not affect processing that was lawfully carried out before the withdrawal.

Legal Obligations

We may process personal information when necessary to comply with legal obligations, including tax, accounting, regulatory, or law enforcement requirements.

COOKIES AND SIMILAR TECHNOLOGIES

Chula, Shopify, and certain service providers may use cookies and similar technologies when you visit our website.

These technologies can help us:

• Keep the website functioning

• Remember preferences

• Maintain shopping cart functionality

• Understand website traffic

• Measure website performance

• Prevent fraud

• Understand how visitors interact with Chula

• Measure advertising performance

• Personalize advertising where permitted

Some cookies are necessary for the website to function properly.

Other cookies, such as analytics or advertising cookies, may be optional depending on your location and applicable law.

Where required, you may be presented with privacy or cookie controls that allow you to manage certain preferences.

You may also be able to control cookies through your browser settings. Disabling certain cookies may affect the functionality or availability of portions of the Chula website.

MARKETING COMMUNICATIONS

If you subscribe to Chula marketing communications, we may send you emails relating to:

• New collections

• Product releases

• Promotions

• Discounts

• Pop-ups

• Events

• Brand updates

• Other Chula news

You can unsubscribe from promotional emails at any time by using the unsubscribe option included in the email.

If you unsubscribe from marketing communications, we may still send you non-promotional messages when necessary, including communications relating to:

• Orders

• Payments

• Shipping

• Returns

• Refunds

• Customer service

• Account security

HOW WE DISCLOSE PERSONAL INFORMATION

We may disclose personal information to third parties when reasonably necessary to operate Chula, provide our services, comply with law, or support other purposes described in this Privacy Policy.

Shopify

Our website and ecommerce services are powered by Shopify.

Shopify processes personal information relating to your access to and use of our store in order to provide its services and help us operate our business.

Information you provide through the Chula website may therefore be transmitted to or processed by Shopify.

In some circumstances, Shopify may process personal information for its own purposes in accordance with Shopify's own privacy practices.

Service Providers

We may disclose information to vendors and service providers that perform services on our behalf, including companies that provide:

• Payment processing

• Order fulfillment

• Shipping

• Website hosting

• Cloud storage

• Data analytics

• Customer support

• Email delivery

• Fraud prevention

• Information technology services

These providers may process information as necessary to perform services for Chula.

Fulfillment and Shipping Partners

Because Chula uses fulfillment partners for certain products, order information may be shared with companies involved in:

• Producing your order

• Packaging your order

• Shipping your order

• Providing delivery services

This information may include your name, shipping address, order information, and other information necessary to fulfill and deliver your purchase.

Marketing and Advertising Partners

Where permitted by law, we may disclose or make certain information available to advertising, analytics, and marketing partners.

This may help us:

• Measure advertising effectiveness

• Understand website activity

• Reach customers who may be interested in Chula

• Provide advertising based on website interactions

Depending on where you live, certain disclosures for advertising purposes may legally be considered a “sale” or “sharing” of personal information, even if no money is exchanged for the information.

At Your Direction

We may disclose information when you ask us to do so or consent to a particular disclosure.

Business Transactions

If Chula is involved in a merger, acquisition, restructuring, financing, sale of assets, bankruptcy, or similar transaction, personal information may be disclosed or transferred as part of that transaction where permitted by law.

Legal Requirements

We may disclose information where reasonably necessary to:

• Comply with applicable law

• Respond to valid legal process

• Respond to government or law enforcement requests

• Enforce our agreements or policies

• Protect Chula's rights

• Protect our customers

• Prevent fraud or harmful activity

RELATIONSHIP WITH SHOPIFY

Shopify provides the ecommerce infrastructure that powers the Chula online store.

As part of providing these services, Shopify may collect and process personal information relating to your access to and use of our store.

Information submitted through Chula may be transmitted to Shopify and its service providers, including service providers located in countries other than your own.

Shopify may also provide enhanced ecommerce, analytics, security, advertising, and personalization features.

In certain circumstances, Shopify may act as an independent controller of personal information and may be responsible for responding to requests regarding processing that Shopify performs for its own purposes.

You can review Shopify's consumer privacy information and privacy controls directly through Shopify.

TARGETED ADVERTISING & YOUR PRIVACY CHOICES

Chula may collect certain personal information from your interactions with our website, including through cookies and similar technologies.

We may also disclose certain personal information to advertising, analytics, or marketing partners to help us understand website activity, measure advertising performance, and show advertising that may be more relevant to your interests.

Depending on where you live, some of these activities may be considered a “sale,” “sharing,” or processing for “targeted advertising” under applicable privacy laws.

Chula does not sell your personal information for money.

However, certain advertising-related disclosures may fall within broader legal definitions of “sale” or “sharing.”

Your Right to Opt Out

Depending on your location, you may have the right to opt out of:

• The sale of personal information

• The sharing of personal information for certain advertising purposes

• Processing of personal information for targeted advertising

You may exercise these rights through Chula's Data Sharing Opt-Out page.

Global Privacy Control

If you visit the Chula website with a recognized Global Privacy Control (“GPC”) opt-out preference signal enabled, we will process that signal as an opt-out request where required by applicable law.

The request will generally apply to the browser and device from which the signal is sent.

Where the device or browser can be associated with a Shopify account, the preference may also be applied to that account as supported by Shopify and applicable law.

Other Browser Signals

Other than recognized opt-out preference signals such as Global Privacy Control, Chula does not currently respond to general “Do Not Track” browser signals unless required by applicable law.

U.S. STATE PRIVACY RIGHTS

Depending on the state in which you reside and whether the applicable privacy law applies to Chula, you may have certain rights regarding your personal information.

These may include the following.

Right to Know or Access

You may have the right to request information about the personal information we collect, use, or disclose about you.

Right to Delete

You may have the right to request deletion of certain personal information we maintain about you, subject to applicable exceptions.

Right to Correct

You may have the right to request correction of inaccurate personal information.

Right to Data Portability

You may have the right to receive certain personal information in a portable format.

Right to Opt Out

You may have the right to opt out of certain:

• Sales of personal information

• Sharing of personal information

• Targeted advertising

Chula's Data Sharing Opt-Out page provides a method for exercising applicable advertising-related opt-out rights.

Right to Limit Certain Uses of Sensitive Personal Information

Where applicable, you may have the right to limit certain uses or disclosures of sensitive personal information.

Chula does not use sensitive personal information for the purpose of inferring characteristics about customers.

Where sensitive personal information is processed, we use it only as reasonably necessary for purposes such as processing payments, securing accounts, preventing fraud, providing requested services, or complying with applicable law.

Right to Non-Discrimination

We will not unlawfully discriminate against you for exercising an applicable privacy right.

Depending on the applicable law, this means we will not deny goods or services, charge a different price, or provide a different level or quality of service solely because you exercised a privacy right, except where legally permitted.

Authorized Agents

Where permitted by applicable law, you may authorize another person to submit a privacy request on your behalf.

We may require appropriate evidence showing that the person is authorized to act for you and may still need to verify your identity.

EXERCISING YOUR PRIVACY RIGHTS

To submit a request to access, correct, delete, or otherwise exercise an applicable privacy right, contact:

info@chulasurf.com

Please use the subject line:

Privacy Request

Depending on the request, we may need to verify your identity before processing it.

Verification may involve asking you to confirm information associated with your account, order, or prior interactions with Chula.

We will respond to valid requests within the timeframe required by applicable law.

Certain requests may be denied or limited where permitted by law. If this occurs, we will provide an explanation where required.

For requests relating specifically to sale, sharing, or targeted advertising, you may also use our Data Sharing Opt-Out page.

PRIVACY RIGHTS FOR UK AND EEA RESIDENTS

If you are located in the United Kingdom or European Economic Area, you may have additional rights under applicable data protection law.

Subject to applicable limitations and exceptions, these rights may include:

Access

You may request access to personal information we process about you.

Correction

You may request correction of inaccurate or incomplete personal information.

Deletion

You may request deletion of personal information in certain circumstances.

Restriction of Processing

You may have the right to ask us to restrict how we process your personal information.

Objection to Processing

Where we rely on legitimate interests, you may have the right to object to certain processing.

You may also object to certain direct marketing activities.

Data Portability

You may have the right to receive certain personal information in a structured, commonly used, machine-readable format and, where technically feasible, request that it be transferred to another organization.

Withdrawal of Consent

Where processing is based on consent, you may withdraw your consent at any time.

Withdrawal does not affect the lawfulness of processing carried out before your consent was withdrawn.

Complaints

You may have the right to lodge a complaint with the data protection authority responsible for your location.

We encourage you to contact us first so that we can try to address your concern.

THIRD-PARTY WEBSITES AND SERVICES

The Chula website may contain links to websites, social media platforms, or other services operated by third parties.

If you follow a link to a third-party website or platform, its own privacy policy and terms will apply.

Chula does not control and is not responsible for the privacy, security, accuracy, or practices of third-party websites or services.

The inclusion of a link does not necessarily mean that Chula endorses the third party or its privacy practices.

Information you voluntarily make public or semi-public on social media platforms may also be visible to other users and may be used according to the policies of those platforms.

CHILDREN'S PRIVACY

Chula's website and services are not directed toward children.

We do not knowingly collect personal information from children in violation of applicable law.

If you are a parent or legal guardian and believe that a child has provided personal information to Chula without appropriate authorization, please contact us at:

info@chulasurf.com

If appropriate and legally required, we will take reasonable steps to delete the information.

Chula does not knowingly sell or share, as those terms are defined under applicable U.S. privacy laws, personal information belonging to individuals under the age for which such activity is restricted by law.

SECURITY

We use reasonable administrative, technical, and organizational measures designed to help protect personal information.

However, no method of transmission over the internet and no system for electronic storage is completely secure.

We therefore cannot guarantee absolute security.

Please avoid sending highly sensitive or confidential information through unsecured communication channels.

If you create a customer account, you are responsible for keeping your account credentials confidential and should not share your password or other access information with others.

DATA RETENTION

We retain personal information only for as long as reasonably necessary for the purposes for which it was collected, including to:

• Provide our products and services

• Maintain customer accounts

• Complete transactions

• Provide customer support

• Maintain appropriate business and financial records

• Resolve disputes

• Prevent fraud

• Enforce our agreements

• Comply with legal, tax, accounting, and regulatory requirements

The amount of time information is retained depends on factors such as:

• The type of information

• Why it was collected

• Whether you maintain an account

• Whether we have an ongoing relationship with you

• Applicable legal obligations

• Potential or actual disputes

• Security and fraud prevention requirements

When personal information is no longer reasonably necessary, we may delete, anonymize, or de-identify it, subject to applicable law and our service providers' retention practices.

INTERNATIONAL DATA TRANSFERS

Chula operates online and uses service providers, including Shopify, that may process personal information in countries other than the country where you live.

As a result, your personal information may be transferred to, stored in, or processed in another country, including the United States, Canada, or other jurisdictions where our service providers operate.

Privacy laws in those countries may differ from the laws in your country.

Where required by applicable law, appropriate safeguards may be used for international data transfers, including approved contractual protections, adequacy mechanisms, or other legally recognized transfer methods.

For personal information transferred from the European Economic Area or United Kingdom, applicable transfer mechanisms may include Standard Contractual Clauses or other recognized safeguards.

COMPLAINTS

If you have a concern about how Chula collects, uses, stores, or discloses your personal information, please contact us at:

info@chulasurf.com

We will review your concern and attempt to address it appropriately.

Depending on where you live, you may also have the right to lodge a complaint with your state, national, or local privacy or data protection authority.

Where applicable law provides a right to appeal a decision Chula makes regarding a privacy request, you may submit an appeal by contacting info@chulasurf.com and including Privacy Appeal in the subject line.

CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time to reflect:

• Changes to our business

• Changes to our website or services

• New technologies

• Changes to our service providers

• Changes to our privacy practices

• Legal or regulatory requirements

When we update this Privacy Policy, we will publish the revised version on our website and update the “Last updated” date at the top of this page.

Where required by law, we may provide additional notice of material changes.

CONTACT US

If you have questions about this Privacy Policy, Chula's privacy practices, or would like to exercise an applicable privacy right, please contact:

CHULA SURF LLC

Email: info@chulasurf.com

For privacy requests, please include Privacy Request in the subject line whenever possible.

For purposes of applicable data protection laws, CHULA SURF LLC is the controller of the personal information described in this Privacy Policy, except where another party, such as Shopify, independently determines the purposes and means of processing personal information for its own services.