Data Security & Breach Response Policy

When you shop with cradleandcrib, certain personal details are needed to complete your purchase and provide the services you request. Protecting those details is an important part of operating our online furniture store.

Data security involves more than protecting checkout transactions. It also concerns customer correspondence, shipping records, account access, business systems, and the service providers involved in operating our website.

This policy explains our approach to information security, how we address suspected security incidents, and what customers can expect if an incident affects their personal information. It supplements our Privacy Policy and does not replace any protection or notification requirement established by applicable law.

OUR DATA SECURITY PRINCIPLES

1. Scope of Our Data Security Responsibilities

This policy concerns personal information and business records handled in connection with the cradleandcrib online store.

It covers information associated with website visits, customer accounts, furniture purchases, payment confirmations, deliveries, returns, refunds, and customer service communications.

Our website operates through Shopify ecommerce infrastructure, alongside other service providers that may support payments, logistics, customer assistance, and technical operations.

Responsibility for information security depends on which organization controls the information, the services being performed, and applicable legal obligations. The involvement of a third-party provider does not automatically remove responsibilities that cradleandcrib may have toward customers.

2. Information That May Require Protection

Different shopping activities involve different categories of information. We consider those differences when determining appropriate handling and security needs.

Customer records may include names, email addresses, telephone numbers, billing and delivery addresses, purchased merchandise, order references, and communications relating to customer service.

Transaction-related records may contain payment status, transaction identifiers, payment method details made available by supported providers, and information relevant to refunds or disputes.

Technical information, including device characteristics, IP addresses, account activity, and security-related records, may also require protection when it can identify or be associated with an individual.

3. Security Measures and Risk Management

Our approach to information security is based on using reasonable safeguards appropriate to the information involved and the operational risks associated with our services.

Depending on the system and the services involved, safeguards may include access restrictions, authentication controls, secure transmission technologies, platform security features, and procedures for handling customer information.

Security requirements may differ between payment systems, customer service records, website functionality, and information held by independent service providers.

We seek to assess security needs in light of the information's sensitivity, the nature of the processing, and foreseeable risks. The description of potential safeguards in this policy does not represent a guarantee that a particular technology prevents every form of unauthorized activity.

4. Payment Processing and Financial Data

Payments are made through payment methods supported by our ecommerce checkout.

Payment service providers may process information necessary to authorize purchases, verify transactions, reduce fraud, and arrange eligible refunds.

cradleandcrib may receive limited transaction information needed for order management, accounting, customer support, and payment reconciliation.

Customers should never send complete payment card numbers, card security codes, banking passwords, or other sensitive authentication credentials through ordinary customer service correspondence.

The handling of payment credentials depends on the payment services used, their applicable security requirements, and the responsibilities established by their service arrangements. We do not describe ordinary email correspondence as a secure substitute for payment checkout.

5. Account Access and Authorized Use

Access to customer information should be limited to individuals and service providers with a legitimate reason to use it.

Appropriate account permissions and authentication practices help reduce the risk of unauthorized access, accidental disclosure, and improper changes to business records.

When a customer requests changes to sensitive account or transaction information, reasonable identity verification may be necessary to protect the account against unauthorized activity.

Customers are encouraged to protect their own login information, avoid sharing account access with unknown parties, and report suspicious activity associated with their purchases.

6. Security Considerations for Service Providers

Online retail operations may require information to be processed by businesses providing ecommerce infrastructure, payment services, shipping arrangements, fraud prevention, customer support, or other operational functions.

Information shared with these providers should be relevant to the work being performed and handled according to applicable contractual and legal requirements.

Service providers may maintain separate security controls and incident response procedures for information within their systems.

If an incident involving a provider may affect customer information, we will review the circumstances, coordinate with relevant parties as appropriate, and determine our notification and other responsibilities under applicable law.

7. Recognizing Potential Security Incidents

A potential security incident may involve unauthorized account access, accidental disclosure of customer information, compromised credentials, malicious software, suspicious transactions, or unexpected exposure of business records.

Not every unusual website event or unsuccessful login attempt represents a confirmed personal information breach.

The nature of an incident must be examined before determining whether personal information was accessed, acquired, altered, disclosed, or otherwise compromised.

Customer reports, service provider notifications, unusual account activity, and other credible indications of a problem may provide grounds for further review.

8. Initial Response to a Suspected Breach

When credible information indicates a possible security breach, the appropriate response depends on the affected systems, information involved, and potential consequences.

Response measures may include restricting affected access, reviewing credentials, coordinating with relevant service providers, preserving available evidence, and taking reasonable steps to prevent continued unauthorized activity.

Any immediate containment action should consider the need to preserve information that may be necessary for an investigation or legal reporting obligation.

Where specialized technical or legal expertise is necessary, appropriate assistance may be sought to assess the incident and determine the required response.

9. Investigating the Scope and Impact

A security investigation seeks to establish what occurred, which systems or services were involved, and whether personal information may have been exposed.

Relevant considerations include the categories of information affected, the individuals potentially involved, the method of unauthorized access, and the likelihood of harmful misuse.

Available system records, transaction information, provider reports, and other relevant evidence may be reviewed to clarify the incident.

Findings may change as additional information becomes available. We aim to avoid presenting assumptions as confirmed facts or making unsupported statements about the scope of an incident.

10. Containment, Recovery, and Corrective Measures

Once a security issue has been identified, appropriate corrective measures should address both the immediate concern and any underlying weakness that contributed to it.

Depending on the circumstances, remediation may include updating account credentials, changing access permissions, correcting software configurations, replacing compromised components, or coordinating security changes with relevant providers.

Restoring ordinary operations should take account of whether the affected system can be used without exposing customers or business records to avoidable additional risks.

Corrective action may also involve reviewing existing procedures and considering whether changes are needed to reduce the likelihood of a similar incident.

11. Determining When Breach Notification Is Required

Security incident notification obligations vary according to applicable law, the nature of the affected information, and the circumstances of the incident.

United States state laws may require businesses to notify affected residents when qualifying personal information has been accessed or acquired without authorization.

Certain incidents may also involve notification responsibilities toward regulatory authorities, payment providers, law enforcement agencies, or other affected organizations.

We will evaluate applicable notification requirements and provide legally required notices within the periods and by the methods prescribed by the relevant law.

This policy does not establish a universal notification deadline because different laws may impose different requirements. Internal investigation or third-party involvement will not be used as a blanket reason to disregard legally required notification duties.

12. Information Provided to Affected Customers

Where a security incident requires notification, the information provided will reflect the verified facts, applicable legal requirements, and the steps customers may reasonably take to protect themselves.

Depending on the circumstances, a notification may describe the nature of the incident, categories of information involved, protective actions taken, and any relevant recommendations for affected individuals.

If material details remain under investigation, communications should distinguish confirmed information from matters that have not yet been established.

Where additional legally required information becomes available, appropriate supplemental communication will be provided. We will not knowingly misrepresent the seriousness of an incident or withhold information that applicable law requires us to disclose.

13. Practical Steps Customers Can Take

Customers can help protect their personal information by maintaining secure account credentials and remaining alert to unexpected communications.

Use passwords that are difficult to guess, avoid reusing the same password across unrelated services, and enable additional authentication protections where available.

Be cautious of messages asking for complete payment card information, passwords, verification codes, or immediate payment outside the ordinary checkout process.

If you receive a notification concerning a possible compromise, follow the verified instructions relevant to the information involved. Depending on the circumstances, this may include changing passwords, reviewing account transactions, contacting a financial institution, or monitoring credit information.

If you suspect identity theft, the United States Federal Trade Commission provides consumer guidance and recovery assistance at its official IdentityTheft.gov website.

14. Data Retention, Secure Disposal, and Incident Records

Personal information should not be retained indefinitely without a legitimate reason.

Customer and transaction records may be needed for order fulfillment, accounting, returns, disputes, fraud prevention, and applicable legal obligations.

Retention decisions depend on the type of information, why it was collected, whether it remains necessary, and the obligations applicable to the business and relevant service providers.

When records are no longer required, appropriate deletion, anonymization, or other disposal methods should be considered in light of the systems and information involved.

Records associated with a security investigation may need to be preserved to establish what occurred, support remediation, comply with reporting duties, or address legal claims. Such preservation should be consistent with applicable law and legitimate security requirements.

15. Legal Rights, Accountability, and Policy Revisions

Customers may have rights concerning the security, collection, disclosure, correction, or deletion of personal information under applicable United States federal and state laws.

A security incident does not automatically establish that every customer record was compromised. Equally, the absence of confirmed misuse does not eliminate a notification or protective obligation that applies under law.

This policy is intended to explain our approach to security and incident response. It does not waive claims, limit statutory privacy rights, or exclude liability that cannot lawfully be restricted.

We may revise this page to reflect changes in our store operations, technology providers, security practices, or applicable legal requirements.

Updates will be made available through our website. Where law requires additional notices or specific actions, publishing a general policy update will not be treated as a substitute for those obligations.

16. Reporting Security Concerns and Contact Information

If you believe your customer information has been exposed, notice unexpected account activity, receive a suspicious message claiming to represent cradleandcrib, or have questions about our data handling practices, please contact our customer service team.

Describe the issue clearly and provide relevant information that can help us understand the concern. Please do not send passwords, complete payment card numbers, card security codes, or other unnecessary sensitive information.

Reports involving potential unauthorized access or disclosure will be considered according to the available information and any applicable security or legal obligations. If you believe a payment account has been compromised, contact your financial institution directly through its verified channels.

At cradleandcrib, protecting customer information is part of maintaining a dependable shopping environment. We believe responsible data handling includes appropriate precautions, careful incident assessment, clear communication, and respect for the rights of those whose information we process.

cradleandcrib | Protecting Trust in Every Interaction