SUBDUED

PRIVACY POLICY

United States

Effective Date: January 1, 2026    |    Last Updated: June 2026

Introduction

Welcome to Subdued. OSIT Impresa S.p.A. ("Subdued," "we," "us," or "our") is committed to protecting the personal information you share with us when you visit our website (www.subdued.com), use our mobile application, shop in our stores, or interact with our customer service team.

This Privacy Policy explains what personal information we collect, how we use it, who we share it with, and what choices and rights you have. It applies to US residents, including residents of California and other states with specific privacy laws.

Please read this policy carefully. By using our services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree, please discontinue use of our services.

Who We Are

Subdued is a fashion brand operated by OSIT Impresa S.p.A., headquartered in Albano Laziale, Rome, Italy. Our products are sold through our website and, where applicable, retail stores.

Contact email: infosubduedshop@subdued.com

Privacy inquiries: privacy@subdued.com

Website: www.subdued.com

Information We Collect

We collect personal information that you provide directly, that is generated through your use of our services, and that we receive from third parties.

Information You Provide

• Account registration: name, email address, password, date of birth, and contact details.
• Purchase information: billing and shipping address, payment method details (processed by our payment service providers), and order history.
• Communications: messages and information you send us via email, contact forms, WhatsApp, chatbots, or social media.
• Loyalty program: preferences, purchase history used to assign you to promotional clusters, and reward points (if applicable).
• Store pick-up: name, address, and identification verification for in-store order collection.

Information We Collect Automatically

• Browsing data: pages visited, time spent on pages, links clicked, shopping cart contents, recently viewed and compared products.
• Device and technical data: IP address, browser type and version, operating system, device identifiers.
• Cookies and tracking technologies: as described in our Cookie Policy below.
• App usage: if you use our mobile app, we collect usage data, language preferences, and, if you grant permission, device location (GPS) solely to power the store-finder feature; location is processed locally on your device and is not stored on our servers.

Information from Third Parties

• Social login: if you register or log in using a social network (such as Facebook or Google), that provider may share your name, email address, and profile picture with us based on your settings with that provider.
• Payment processors: our payment service providers (including Global-E) share transaction status information with us; they handle card data directly and under their own privacy policies.
• Analytics providers: see the Cookie Policy section for details.

How We Use Your Information

We use personal information for the following purposes:

• To process and fulfill your orders, including shipping and managing returns.
• To create and manage your online account.
• To respond to your inquiries, complaints, and customer service requests.
• To send transactional communications (order confirmations, shipping updates, receipts).
• To send marketing communications (promotional emails, newsletters, SMS) where you have opted in or where permitted by applicable law.
• To personalize your experience and product recommendations based on your purchase and browsing history, with your consent where required.
• To improve our website, app, and services through analytics.
• To prevent fraud and ensure the security of our services.
• To comply with legal obligations.
• To operate in-store video surveillance for asset protection and safety (in-store customers).
• To manage call center and messaging interactions for quality monitoring and service delivery.

Legal Basis for Processing

Under applicable US law, we process your personal information based on the following grounds (which we also apply where required by international law):

• Contract performance: processing necessary to fulfill your orders, manage your account, and provide customer service.
• Legitimate interests: analytics, fraud prevention, security, and limited non-invasive promotional personalization, subject to your right to opt out.
• Consent: marketing communications, profiling for personalized advertising, and use of non-essential cookies. You may withdraw consent at any time.
• Legal obligation: compliance with applicable laws and regulatory requirements.

Cookies and Tracking Technologies

What Are Cookies?

Cookies are small text files placed on your device when you visit our website. We also use similar technologies such as web beacons, pixels, and local storage.

Types of Cookies We Use

Strictly Necessary Cookies

These cookies are essential for the website to function and cannot be switched off. They include session management, security, cart persistence, and language preferences.

Analytics / Performance Cookies

These help us understand how visitors use our website by collecting aggregated information. We use tools including Google Analytics, Hotjar, and Snowplow. These cookies are active only with your consent.

Marketing / Advertising Cookies

These cookies track your browsing activity to show you relevant advertising on other platforms, including through Facebook Pixel, TikTok Pixel, and Pinterest. Active only with your consent.

Preference Cookies

These remember your settings and preferences across visits, such as country selection.

Your Cookie Choices

When you first visit our site, you will be shown a cookie preference banner. You can accept or decline non-essential cookies at any time. You can also manage cookies through your browser settings or through the browser opt-out tools provided by each analytics and advertising provider.

Note: disabling certain cookies may affect the functionality of our website.

How We Share Your Information

We do not sell your personal information. We share personal information only in the following circumstances:

• With other Subdued group companies: to operate our loyalty programs, marketing, and shared services across the Subdued brand.
• With service providers: third parties who perform services on our behalf, including IT infrastructure, payment processing (Global-E and other processors), logistics and shipping carriers, customer service platforms, analytics providers, and marketing technology vendors. These vendors are contractually bound to use your data only as directed by us.
• With advertising partners: only where you have consented to marketing and profiling cookies.
• In business transfers: if we are involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.
• For legal reasons: when required by law, court order, or regulatory authority; to protect the rights, property, or safety of Subdued, its customers, or others; or to prevent fraud or illegal activity.

Data Retention

We retain personal information for as long as necessary to fulfill the purposes described in this policy, unless a longer retention period is required by law.

• Account information: retained until you request deletion, or after 3 years of account inactivity.
• Purchase records: retained for up to 10 years for tax and accounting purposes, or as required by applicable law.
• Customer service interactions (calls, chat, WhatsApp): up to 1 year from the date of the interaction.
• Marketing data: up to 36 months from collection; after that, anonymized or deleted.
• Profiling and personalization data: updated at least every 6 months; deleted when you no longer meet the criteria for a profile segment or you request removal.
• In-store video surveillance images: automatically deleted after 48 hours, unless legally required to be retained longer.

Data Security

We use industry-standard technical and organizational measures to protect your personal information, including encryption in transit (TLS/SSL), access controls, and regular security assessments. However, no method of transmission over the internet or electronic storage is completely secure, and we cannot guarantee absolute security.

If we become aware of a data breach that affects your rights and freedoms, we will notify you and the relevant authorities as required by applicable law.

International Data Transfers

Subdued is operated by an Italy-based company. Your personal information may be transferred to and processed in Italy and other countries where our service providers operate. We take appropriate steps to ensure that transfers are protected by adequate safeguards, including data processing agreements that incorporate standard contractual protections.

If you are located in the United States, by using our services you acknowledge that your information will be transferred to and processed in Italy and other jurisdictions that may have different data protection laws than your state of residence.

Your Privacy Rights (United States)

Rights for All US Residents

Regardless of your state of residence, you may:

• Request access to the personal information we hold about you.
• Request correction of inaccurate personal information.
• Request deletion of your personal information (subject to legal exceptions).
• Opt out of marketing communications at any time by clicking "Unsubscribe" in any marketing email or contacting us at privacy@subdued.com.
• Withdraw any consent you have given at any time.

California Residents – CCPA / CPRA Rights

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA):

• Right to Know: the categories and specific pieces of personal information we have collected, used, disclosed, or sold about you.
• Right to Delete: request deletion of personal information we have collected, subject to certain exceptions.
• Right to Correct: request correction of inaccurate personal information.
• Right to Opt Out of Sale or Sharing: we do not sell personal information. We do share certain data with advertising partners for targeted advertising. You may opt out of this sharing by adjusting your cookie preferences or contacting us.
• Right to Limit Use of Sensitive Personal Information: we do not collect sensitive personal information as defined by CPRA except as necessary for service delivery.
• Right to Non-Discrimination: we will not discriminate against you for exercising any of your CCPA/CPRA rights.

To exercise your California rights, contact us at privacy@subdued.com or submit a request through our website. We will verify your identity before processing your request. You may designate an authorized agent to make a request on your behalf.

We will respond to your request within 45 days. If we need more time, we will inform you of the reason and extension period (up to 90 days total).

Other State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Texas (TDPSA), and other states with comprehensive privacy laws may have similar rights to know, access, correct, delete, and opt out of certain processing activities. Please contact us at privacy@subdued.com to exercise your rights.

Children’s Privacy

Our website and services are not directed to children under the age of 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without parental consent, we will delete that information promptly. If you believe we may have inadvertently collected information from a child under 13, please contact us at privacy@subdued.com.

Links to Third-Party Websites

Our website may contain links to third-party websites, social media platforms, or integrated services (such as payment processors and map providers). This Privacy Policy does not apply to those third-party sites. We encourage you to review the privacy policies of any third-party websites you visit.

Do Not Track

Some browsers offer a "Do Not Track" (DNT) signal. Our website does not currently respond to DNT signals in a uniform way. You can manage your tracking preferences through our cookie banner.

Marketing Communications

With your consent, we may send you promotional emails, newsletters, and SMS messages about our products, events, and offers. You can opt out of these communications at any time by:

• Clicking the "Unsubscribe" or "Manage Preferences" link in any marketing email.
• Replying "STOP" to any marketing SMS.
• Contacting us at privacy@subdued.com.

Please note that even after opting out of marketing, you will continue to receive transactional messages (such as order confirmations and shipping updates).

Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will notify you by posting the updated policy on our website and updating the "Last Updated" date above. For significant changes, we may provide additional notice (such as an email notification). Your continued use of our services after the updated policy takes effect constitutes your acceptance of the revised terms.

Contact Us

If you have questions, concerns, or requests related to this Privacy Policy or your personal information, please contact us:

By email: privacy@subdued.com

General inquiries: infosubduedshop@subdued.com

Website: www.subdued.com

We aim to respond to all privacy-related requests within 30 days. For California residents, we are required to respond within 45 days (with a possible extension to 90 days).

© 2026 OSIT Impresa S.p.A. – Subdued. All rights reserved.