Privacy Policy

Privacy Policy

Effective Date: April 29, 2026
Last Updated: April 29, 2026

1. Introduction

This Privacy Policy describes how Fiesta Carnival ("we," "us," or "our") collects, uses, shares, and protects information about you when you visit fiestacarnival.com (the "Site"), shop at our Anaheim retail location, or otherwise interact with us. By using the Site, you agree to the practices described in this Policy. The Site is intended for users located in the United States. If you access the Site from outside the U.S., your information will be transferred to and processed in the U.S.

2. Information We Collect

We collect the following categories of personal information, organized using the categories defined under the California Consumer Privacy Act (CCPA/CPRA):

• Identifiers: name, email address, postal/shipping address, phone number, IP address, device identifiers, account login credentials.
  Source: directly from you; automatically from your device.
• Commercial information: order history, products viewed, products purchased, returns, loyalty program participation.
  Source: directly from you; from our store systems.
• Internet or other electronic network activity: pages viewed, time on page, referring URLs, browser type, clicks, cookie data.
  Source: automatically from your device.
• Geolocation data: approximate location based on IP address; precise shipping address you provide.
  Source: directly from you; automatically from your device.
• Payment information: payment card details and billing information (processed by our payment provider; we do not store full card numbers).
  Source: directly from you.
• Communications: emails, phone calls, SMS, contact form submissions, and customer service interactions.
  Source: directly from you.
• Inferences: preferences and characteristics drawn from the above (for example, party themes you tend to shop for).
  Source: derived by us or our service providers from other data.
• Sensitive personal information: We do not knowingly collect sensitive personal information as defined by CPRA (such as Social Security numbers, government IDs, precise geolocation, race, religion, health data, or biometrics).

In-store purchases: At our Anaheim retail location, we may collect your name, email, and phone number for receipts, loyalty program enrollment, and follow-up customer service. In-store credit card transactions are processed by our point-of-sale provider; we do not retain full card numbers.

3. How We Use Your Information

We use the information we collect to:

• Process and fulfill orders, including payment, shipping, in-store pickup, and returns
• Communicate with you about orders, account activity, and customer service inquiries
• Operate our loyalty, school, teacher, and community partnership programs
• Screen orders and accounts for fraud, abuse, or security risk
• Send marketing emails and SMS, where you have opted in
• Operate, maintain, secure, and improve the Site
• Personalize your experience and recommend relevant products
• Comply with legal obligations and enforce our Terms of Service
• Conduct analytics and measure the performance of our marketing

4. Sources of Information

We collect information directly from you (when you place an order, create an account, sign up for marketing, or contact us), automatically from your device (through cookies and similar technologies), and from our service providers (such as Shopify, our payment processor, our shipping carriers, and our marketing platforms).

5. How We Share Your Information

We share personal information with the following categories of third parties, only as necessary to operate our business:

• E-commerce platform: Shopify (powers our online store and processes payments via Shopify Payments). See shopify.com/legal/privacy.
• Payment processors: Shopify Payments and any in-store POS provider
• Shipping and logistics: USPS, UPS, FedEx, and other carriers; local delivery providers
• Email and SMS marketing platforms: Klaviyo (where you have opted in)
• Analytics and advertising providers: Google Analytics, Google Ads, Meta (Facebook/Instagram), and similar platforms
• Customer review platforms: Google Business Profile, Yelp, and similar services where you choose to leave reviews
• Professional advisors: legal, accounting, and IT vendors
• Legal and regulatory authorities: where required by law, court order, or to protect our rights or the safety of others
• Successor entity: in connection with a merger, acquisition, financing, or sale of assets

6. Sale and Sharing of Personal Information

We do not sell personal information for monetary value.

However, under California's broad definition of "sharing" for cross-context behavioral advertising, our use of advertising cookies and pixels (such as Meta Pixel, Google Ads, and similar tools) may constitute "sharing" of identifiers and internet activity data. We do not share information about consumers we know to be under 16.

You have the right to opt out of this sharing. To opt out:

• Visit our Your Privacy Choices page, or
• Set the Global Privacy Control (GPC) signal in your browser — we honor GPC signals as a valid opt-out request for the browser making the signal, or
• Contact us using Section 13 below

7. Cookies and Tracking Technologies

We and our service providers use cookies, pixel tags, web beacons, and similar technologies to operate the Site and understand how it is used. We use:

• Strictly necessary cookies: required for core Site functions like the cart and checkout
• Analytics cookies: help us understand traffic and Site performance
• Advertising cookies: used to deliver relevant ads and measure campaign performance

You can manage cookies through your browser settings or through the cookie banner on the Site. Disabling cookies may affect Site functionality. As noted in Section 6, we honor Global Privacy Control signals as an opt-out of advertising-related sharing.

8. Email and SMS Marketing

If you opt in, we may send you promotional emails and SMS about new products, sales, and events. You can unsubscribe from marketing email at any time using the unsubscribe link in any message. You can opt out of SMS by replying STOP. Standard message and data rates may apply. We comply with CAN-SPAM and the Telephone Consumer Protection Act (TCPA).

9. Data Retention

We retain personal information only as long as necessary to fulfill the purposes for which we collected it, including legal, accounting, or reporting requirements. Typical retention periods:

• Order and transaction records: 7 years (for tax and accounting compliance)
• Account information: until account deletion, plus up to 90 days in backups
• Marketing contacts: until you unsubscribe, plus up to 90 days in backups
• Customer service correspondence: up to 3 years
• Website analytics: up to 26 months
• Cookies: per the lifespan of each cookie (typically 30 days to 2 years)

Where you request deletion, we will delete your information within the timeframes required by applicable law, except where retention is required for legal, fraud prevention, or compliance purposes.

10. Data Security

We use commercially reasonable administrative, technical, and physical safeguards to protect personal information, including encryption in transit (TLS), restricted access controls, and reliance on PCI-DSS-compliant payment processors. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security. If you have reason to believe your information has been compromised, please contact us using Section 13.

11. Your Privacy Rights

California Residents (CCPA/CPRA)

If you are a California resident, you have the right to:

• Know the categories and specific pieces of personal information we have collected about you
• Request a copy of your personal information in a portable format
• Request deletion of your personal information, subject to legal exceptions
• Correct inaccurate personal information we hold about you
• Opt out of the sale or sharing of your personal information (we do not sell; we may share for cross-context behavioral advertising — see Section 6)
• Limit the use and disclosure of sensitive personal information (we do not collect SPI)
• Non-discrimination for exercising your rights
• Designate an authorized agent to make a request on your behalf, subject to verification

To submit a request, contact us using Section 13 or use our Your Privacy Choices page. We will verify your identity (typically by confirming details from a recent order or your account) before processing your request, and we will respond within 45 days, with one 45-day extension where reasonably necessary.

California Shine the Light: California Civil Code Section 1798.83 permits California residents to request information about disclosures of personal information to third parties for direct marketing purposes. To make such a request, contact us using Section 13.

Residents of Other U.S. States

If you reside in a state with a comprehensive privacy law (including Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, and others), you may have similar rights to access, delete, correct, or opt out of certain uses of your information, and to opt out of profiling for decisions producing legal or similarly significant effects.

Appeals

If we deny your privacy request, you may appeal our decision by contacting us at the email in Section 13 with "Privacy Appeal" in the subject line. We will respond within 60 days. If your appeal is denied, residents of certain states may contact their state Attorney General to submit a complaint.

12. Children's Privacy

The Site is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it. Purchases through the Site require users to be 18 or older, as described in our Terms of Service. Minors aged 13 to 17 may use the Site only with the involvement of a parent or guardian.

13. Contact Us

For questions about this Privacy Policy, to exercise your privacy rights, or to submit a privacy request:

Fiesta Carnival
2084 E Lincoln Ave
Anaheim, CA 92806
Phone: (714) 603-7543
Email: fcanaheim2022@gmail.com

Privacy requests: please write "Privacy Request" in the subject line.

14. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. We will post the updated policy on this page and update the "Last Updated" date. For material changes, we will provide additional notice (such as a banner on the Site) for at least 30 days. Your continued use of the Site after changes take effect constitutes acceptance of the updated policy.