Privacy Notice for EU/EEA & UK Customers (GDPR)

Effective Date: 4/30/2026 Last Updated: 4/30/2026

This Notice describes how Sales Peak Inc., doing business as Organo Republic ("Organo Republic," "we," "us," "our") processes personal data of customers and visitors located in the European Economic Area (EEA), the United Kingdom, and Switzerland, in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679) and the equivalent UK GDPR.

If you are not located in these regions, this Notice does not apply to you. Please refer to our main Privacy Policy.

1. Data Controller

The data controller responsible for your personal data is:

Sales Peak Inc. DBA Organo Republic 3719 NW 50th St, Miami, FL 33142, USA Email: support@organorepublic.com Phone: +1 (305) 306-7345

2. Personal Data We Collect

We process the following categories of personal data:

• Identity & contact data: name, email, phone number, billing/shipping address.

• Account data: username, password (hashed), account preferences, order history.

• Transaction data: items purchased, prices, payment method (payment card data is handled by our payment processor).

• Technical data: IP address, browser type, device identifiers, operating system, time zone.

• Usage data: pages viewed, time on site, links clicked, products viewed, cart contents.

• Marketing data: preferences, opt-in status, interaction with our communications, loyalty program activity.

• Communications: messages you send to our customer support.

We do not intentionally collect special categories of personal data (e.g., health data, religious beliefs).

3. Purposes and Legal Bases for Processing

We process your personal data on the following legal bases (Article 6 GDPR):

Where we rely on legitimate interests, we have balanced those interests against your rights and freedoms. You can object to such processing at any time (see Section 7).

4. Who We Share Your Data With

We share personal data with the following categories of recipients, all of whom are bound by appropriate contractual obligations:

• Shopify Inc. - our e-commerce platform provider (hosts our store, processes orders).

• Payment processors - Shopify Payments, PayPal, Shop Pay - to process payments securely.

• Shipping and logistics providers - to deliver your order.

• Email and marketing platforms - Klaviyo (and similar) - to send transactional and marketing emails.

• Analytics providers - Google Analytics - only where you have given consent.

• Customer support tools.

• Professional advisors - accountants, lawyers, auditors, where necessary.

• Public authorities - where legally required.

We do not sell your personal data, and we do not share your personal data with third-party advertising partners for cross-context behavioral advertising.

5. International Data Transfers

We are established in the United States. Your personal data is therefore transferred outside the EEA/UK to the United States and may be transferred to other jurisdictions where our service providers operate.

We rely on the following safeguards under Articles 44–49 GDPR:

• EU–U.S. Data Privacy Framework (and UK Extension) - for transfers to U.S. organizations certified under the framework, where applicable.

• Standard Contractual Clauses (SCCs) - approved by the European Commission, in place with our processors. The UK addendum applies to UK transfers.

• Supplementary measures - including encryption in transit (TLS) and at rest, access controls, and contractual data protection commitments.

You may request a copy of the applicable safeguards by contacting us at support@organorepublic.com.

6. Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected:

• Order and transaction records: retained for 7 years to comply with U.S. tax and accounting law, even after account deletion.

• Account data: retained until you delete your account or request deletion, after which it is deleted or anonymized within 30 days, except where retention is required by law (see "Order and transaction records" above).

• Marketing data: retained until you withdraw consent; a minimal suppression record (e.g., a hashed email) is kept afterwards solely to honor your opt-out.

• Customer support records: up to 3 years after the last interaction.

• Cookies and analytics: as set out in our Cookie Policy (typically up to 26 months).

7. Your Rights Under GDPR

You have the following rights regarding your personal data:

• Right of access (Art. 15) - obtain confirmation of and a copy of your personal data.

• Right to rectification (Art. 16) - correct inaccurate or incomplete data.

• Right to erasure / "right to be forgotten" (Art. 17) - request deletion in certain circumstances.

• Right to restriction of processing (Art. 18).

• Right to data portability (Art. 20) - receive your data in a structured, machine-readable format.

• Right to object (Art. 21) - object to processing based on legitimate interests, including profiling, and to direct marketing at any time.

• Right to withdraw consent (Art. 7(3)) - at any time, without affecting prior lawful processing.

• Right not to be subject to automated decision-making (Art. 22) - we do not use solely automated decision-making that produces legal or similarly significant effects.

How to Exercise Your Rights

Send a request to support@organorepublic.com or by post to the address in Section 1. We will respond within one month (extendable by two further months for complex requests). We may need to verify your identity before responding.

Right to Lodge a Complaint

You have the right to lodge a complaint with your local supervisory authority. A list of EU/EEA authorities is available at edpb.europa.eu/about-edpb/board/members_en. UK residents may contact the Information Commissioner's Office at ico.org.uk.

We would, however, appreciate the chance to deal with your concerns first - please contact us before lodging a complaint.

8. Cookies

Our website uses cookies and similar technologies. We set non-essential cookies (analytics, functional) only with your consent, which you provide via our cookie banner. You can change your preferences at any time via the Cookie Settings link in the footer. For details, see our Cookie Policy.

9. Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, accidental loss, alteration, or destruction. These include encryption (HTTPS/TLS), access controls, logging, and regular reviews of our security practices. Despite our efforts, no method of transmission over the Internet is 100% secure.

10. Children

Our services are not directed to children under 16. We do not knowingly process the personal data of children. If you believe a child has provided us with personal data, please contact us so we can delete it.

 

11. Changes to This Notice

We may update this Notice from time to time. The "Last Updated" date at the top will reflect the most recent revision. Material changes will be communicated to you via email or a prominent notice on our website.

12. Contact Us

Sales Peak Inc. DBA Organo Republic 3719 NW 50th St Miami, FL 33142, USA Email: support@organorepublic.com Phone: +1 (305) 306-7345