California Consumer Privacy Act (CCPA / CPRA) Policy

Last Updated: August 26, 2026

This California Consumer Privacy Act Policy applies to California residents and supplements the information contained in the Vita Asana Privacy Policy.

Vita Asana is operated by VITA ASANA SRL (“Vita Asana,” “we,” “us,” or “our”).

This policy describes our practices concerning personal information and the rights available to eligible California residents under the California Consumer Privacy Act, as amended by the California Privacy Rights Act. These laws are collectively referred to in this policy as the “CCPA.”

The California Privacy Rights Act amended the CCPA rather than creating a separate privacy law.

This policy should be read together with our:

Nothing in this policy limits any consumer right that cannot lawfully be waived or restricted.

1. Applicability

The CCPA applies only where its statutory requirements and applicability thresholds are satisfied.

The law generally applies to a for-profit business that:

  • Does business in California

  • Collects personal information or has personal information collected on its behalf

  • Determines the purposes and means of processing that information

  • Satisfies one or more applicable statutory thresholds

If Vita Asana is not legally subject to a particular CCPA requirement, we may nevertheless consider a California privacy request voluntarily where reasonably practicable and permitted by law.

Voluntarily processing a request does not constitute an admission or certification that the CCPA applies to:

  • Vita Asana

  • VITA ASANA SRL

  • Every category of information

  • Every consumer interaction

  • Every processing activity described in this policy

Where the CCPA applies, we will process eligible requests in accordance with applicable law.

2. Scope

This policy applies to personal information collected from or concerning California residents through activities including:

  • Visiting or using vita-asana.com

  • Browsing products or website content

  • Placing or attempting to place an order

  • Using checkout

  • Creating or using a customer account

  • Contacting customer support

  • Requesting a return, refund, replacement, or other resolution

  • Submitting a review, photograph, video, or other content

  • Subscribing to marketing communications

  • Using website privacy controls

  • Submitting a privacy request

  • Participating in a promotion or survey

  • Interacting with Vita Asana advertising

  • Communicating with Vita Asana through supported channels

This policy does not apply to information that is exempt from or outside the scope of the CCPA.

3. Meaning of Personal Information

For purposes of this policy, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked directly or indirectly with a particular consumer or household.

Personal information does not include information that is:

  • Publicly available as defined by applicable law

  • Lawfully made available from government records

  • Deidentified

  • Aggregated in a manner that cannot reasonably identify a consumer or household

  • Otherwise excluded or exempt under the CCPA

Personal information includes sensitive personal information where the applicable statutory definition is satisfied.

4. Categories of Personal Information Collected

The following describes the categories of personal information that Vita Asana has collected or may have collected during the preceding 12 months, depending on how a consumer interacted with us.

A. Identifiers

Examples may include:

  • Full name

  • Email address

  • Postal address

  • Billing address

  • Shipping address

  • Telephone number

  • Customer-account identifier

  • Order number

  • IP address

  • Cookie identifier

  • Device identifier

  • Advertising identifier

  • Other online identifiers

B. California Customer-Records Information

Examples may include:

  • Name

  • Address

  • Telephone number

  • Payment-related information

  • Purchase information

  • Other information provided in connection with an order, account, or customer-service request

Vita Asana does not ordinarily receive or store complete payment-card numbers or card security codes. Those details are generally processed by Shopify and authorized payment providers.

C. Commercial Information

Examples may include:

  • Products viewed

  • Products purchased

  • Order history

  • Shopping-cart activity

  • Checkout activity

  • Transaction amounts

  • Discounts used

  • Returns

  • Refunds

  • Replacements

  • Chargebacks

  • Product preferences

  • Customer-service history

D. Internet or Other Electronic Network Activity

Examples may include:

  • Browsing activity

  • Website searches

  • Products and pages viewed

  • Referral URLs

  • Clickstream information

  • Session activity

  • Clicks, taps, and scrolling

  • Shopping-cart and checkout interactions

  • Advertising interactions

  • Browser type

  • Device type

  • Operating system

  • Website errors

  • Date and time of access

E. Geolocation Information

Examples may include:

  • Approximate location inferred from an IP address

  • Billing region

  • Shipping destination

  • Delivery location

  • Location information associated with carrier tracking, payment verification, or fraud screening

Vita Asana does not ordinarily seek to collect precise geolocation through the storefront unless it is necessary for a feature knowingly used by a consumer or another purpose disclosed at or before collection.

F. Audio, Electronic, Visual, or Similar Information

Examples may include:

  • Customer-support communications

  • Voicemail messages

  • Photographs or videos submitted for a product, delivery, return, refund, or safety inquiry

  • Product reviews

  • Chat messages

  • Contact-form submissions

  • Website interaction data used for heatmaps or session replays

  • Technical support records

Session-replay technology may create a visual reconstruction of website interactions. It is not a camera or microphone recording of a visitor.

G. Inferences and Preferences

Examples may include:

  • Product interests

  • Shopping preferences

  • Likely marketing interests

  • Customer segments

  • Advertising attribution

  • Preferences inferred from browsing or purchase activity

  • Fraud or transaction-risk indicators

Vita Asana does not use product interests or purchase history to diagnose a medical condition.

H. Sensitive Personal Information

Limited sensitive personal information may be processed when reasonably necessary for:

  • Secure account access

  • Payment authentication

  • Transaction verification

  • Fraud prevention

  • Website and account security

  • Communications directed to Vita Asana

  • Compliance with legal obligations

Complete payment-card credentials are generally processed by Shopify, payment processors, digital-wallet providers, banks, or card networks rather than stored in Vita Asana’s ordinary business systems.

We do not intentionally request:

  • Social Security numbers

  • Government identification documents

  • Genetic data

  • Biometric information used to identify a person

  • Racial or ethnic origin

  • Religious or philosophical beliefs

  • Union membership

  • Information concerning sex life or sexual orientation

  • Medical records or medical diagnoses

Please do not submit unnecessary sensitive information through email, chat, product reviews, or general website forms.

Categories Not Ordinarily Collected

As part of our ordinary online retail operations, we do not intentionally collect:

  • Professional or employment-related information

  • Formal education records

  • Genetic data

  • Biometric identifiers used to identify a consumer

  • Protected classification information unrelated to a transaction

  • Precise geolocation

This does not prevent a consumer from voluntarily including information in a communication. Consumers should avoid providing information that is not reasonably necessary for the request.

5. Sources of Personal Information

We may collect personal information from the following categories of sources.

Directly From You

For example, when you:

  • Place an order

  • Create an account

  • Contact customer support

  • Submit a form

  • Request a return or refund

  • Submit a privacy request

  • Subscribe to marketing

  • Submit a review

  • Provide photographs or videos

  • Participate in a promotion

Automatically Through the Website

For example, through:

  • Cookies

  • Pixels

  • Tags

  • Local or session storage

  • Device identifiers

  • Advertising identifiers

  • Server logs

  • Analytics technologies

  • Session-replay technologies

  • Advertising and attribution technologies

  • Security and fraud-prevention tools

More information is available in our Cookie Policy.

From Service Providers and Business Partners

These may include:

  • Shopify

  • Payment processors

  • Banks and card networks

  • Digital-wallet providers

  • Fraud-prevention providers

  • Transaction-verification providers

  • Product suppliers

  • Warehouses and fulfillment partners

  • Shipping carriers and delivery partners

  • Customer-support and chat providers

  • Product-review platforms

  • Analytics and session-replay providers

  • Advertising and attribution platforms

  • Email and communication providers

  • Technology and hosting providers

From Other Lawful Sources

These may include:

  • Publicly available sources

  • Social-media platforms

  • Authorized representatives

  • Government agencies

  • Law-enforcement authorities

  • Professional advisers

  • Parties involved in investigating fraud, delivery issues, disputes, or legal claims

6. Business and Commercial Purposes

We may collect, use, retain, and disclose personal information for purposes including:

  • Operating and maintaining the online store

  • Providing product information

  • Processing and fulfilling orders

  • Processing payments

  • Managing customer accounts

  • Providing order confirmations and delivery updates

  • Shipping and tracking orders

  • Providing customer support

  • Processing returns, refunds, replacements, and chargebacks

  • Authenticating transactions

  • Preventing fraud and abuse

  • Protecting website, account, and payment security

  • Maintaining business and transaction records

  • Diagnosing website errors

  • Measuring website performance

  • Understanding product and customer interest

  • Improving website navigation and content

  • Conducting analytics and attribution

  • Measuring advertising performance

  • Personalizing content or marketing where permitted

  • Sending requested or consented communications

  • Administering reviews and promotions

  • Complying with tax, accounting, legal, and regulatory requirements

  • Responding to lawful requests

  • Establishing, exercising, or defending legal claims

  • Enforcing our agreements and store policies

  • Evaluating or completing a business transaction such as a merger, acquisition, financing, or restructuring

Our collection, use, disclosure, and retention of personal information are intended to be reasonably necessary and proportionate to the disclosed purpose or another purpose compatible with the context in which the information was collected.

We will not use personal information for a materially different, unrelated, or incompatible purpose without providing any notice or choice required by applicable law.

7. Retention of Personal Information

We retain each category of personal information only for as long as reasonably necessary and proportionate to the purpose for which it was collected or another permitted purpose.

Retention periods may depend on:

  • The nature and sensitivity of the information

  • The purpose for which it was collected

  • The duration of the customer relationship

  • Order and payment-processing requirements

  • Shipping and delivery requirements

  • Return, refund, replacement, and chargeback periods

  • Fraud-prevention and security requirements

  • Accounting and tax obligations

  • Contractual requirements

  • Applicable limitation periods

  • Legal holds

  • Regulatory requirements

  • The need to establish, exercise, or defend legal claims

Transaction records may be retained longer than advertising identifiers because transaction records can be required for tax, accounting, customer support, fraud prevention, and payment disputes.

When personal information is no longer reasonably required, we may:

  • Delete it

  • Anonymize it

  • Aggregate it

  • Securely restrict its use

8. Disclosure for Business Purposes

During the preceding 12 months, we have disclosed or may have disclosed the categories of personal information described above for operational or business purposes to:

  • Shopify and ecommerce-platform providers

  • Payment processors

  • Banks and card networks

  • Digital-wallet providers

  • Fraud-prevention and security providers

  • Product suppliers

  • Warehouses and fulfillment providers

  • Shipping carriers and delivery partners

  • Customer-support and chat providers

  • Product-review platforms

  • Email and communication providers

  • Hosting and technology providers

  • Analytics and website-performance providers

  • Legal, accounting, insurance, and professional advisers

  • Government agencies, regulators, courts, or law-enforcement authorities where legally required

  • Parties involved in a merger, acquisition, financing, restructuring, or similar business transaction

The categories disclosed for these purposes may include:

  • Identifiers

  • California customer-records information

  • Commercial information

  • Internet or electronic network activity

  • Approximate geolocation

  • Customer-submitted electronic or visual information

  • Inferences

  • Limited sensitive personal information necessary for account, payment, security, or fraud-prevention purposes

Where required, service providers and contractors are subject to contractual restrictions concerning their processing of personal information.

9. Sale or Sharing of Personal Information

Vita Asana does not sell personal information for monetary payment.

However, the CCPA defines “sale” more broadly than an exchange for money. Certain disclosures made through advertising, analytics, attribution, or similar technologies may be considered a sale or sharing under California law even when no money is exchanged.

Depending on the technologies enabled during the preceding 12 months, we may have sold or shared the following categories for advertising, audience, attribution, or measurement purposes:

  • Identifiers and online identifiers

  • Commercial information

  • Internet or other electronic network activity

  • Approximate geolocation

  • Marketing-related inferences

  • Hashed or pseudonymized contact identifiers where permitted

These categories may have been sold or shared with:

  • Advertising networks

  • Search-advertising providers

  • Analytics providers

  • Marketing-technology providers

  • Advertising measurement and attribution providers

  • Shopify advertising or enhanced-service features

  • Other providers involved in cross-context behavioral advertising

We do not knowingly sell or share:

  • Complete payment-card information

  • Card security codes

  • Customer-account passwords

  • Government identification documents

  • Sensitive personal information for the purpose of inferring characteristics

  • Personal information belonging to consumers under 16 without legally required affirmative authorization

California residents may opt out as explained below.

10. California Privacy Rights

Subject to applicable exceptions and verification requirements, eligible California residents may have the following rights:

  • Right to know and access

  • Right to data portability

  • Right to delete

  • Right to correct

  • Right to opt out of sale or sharing

  • Right to limit certain uses and disclosures of sensitive personal information

  • Right to receive notice at or before collection

  • Right to non-discrimination for exercising privacy rights

11. Right to Know and Access

You may request that we disclose:

  • The categories of personal information collected about you

  • The categories of sources from which it was collected

  • The business or commercial purposes for collecting, using, selling, or sharing it

  • The categories of third parties to whom it was disclosed

  • The categories sold or shared

  • The categories disclosed for business purposes

  • Specific pieces of personal information maintained about you

Where required, information will be provided in a portable and, where technically feasible, readily usable format.

The CCPA may limit requests to know to two requests within a 12-month period.

We will not disclose complete payment-card numbers, card security codes, passwords, or other credentials that would permit access to an account.

We may also withhold information where disclosure would create a substantial and unreasonable risk to security, another person’s privacy, or the integrity of a customer, payment, or business system.

12. Right to Delete

Subject to applicable exceptions, you may request deletion of personal information collected from or concerning you.

We may retain information where reasonably necessary to:

  • Complete a transaction

  • Fulfill an order

  • Provide a product or service requested by you

  • Maintain customer-support records

  • Process a return, refund, replacement, or chargeback

  • Detect and prevent fraud

  • Protect security and system integrity

  • Correct or troubleshoot errors

  • Comply with legal obligations

  • Maintain tax, accounting, or transaction records

  • Exercise or defend legal rights

  • Perform another purpose permitted by law

Deletion from active systems may not immediately remove information from archived or backup systems where immediate deletion is technically impracticable.

Information retained in a backup will remain protected and will not be used for an unrelated purpose except where permitted by law.

13. Right to Correct

You may request correction of inaccurate personal information maintained about you.

When evaluating a correction request, we may consider:

  • The nature of the information

  • The source of the information

  • Documentation you provide

  • The totality of the circumstances

  • Whether the requested correction can reasonably be verified

We may ask for information reasonably necessary to demonstrate that the existing information is inaccurate.

A request may be denied where we determine, based on the totality of the circumstances, that the disputed information is more likely than not accurate or another legal exception applies.

14. Right to Opt Out of Sale or Sharing

You may direct us not to sell or share your personal information as those terms are defined by the CCPA.

The most direct way to submit an opt-out is through our:

Additional information is available on our:

You may also submit an opt-out through:

You do not need to create an account, place an order, or pay a fee solely to submit a browser-level opt-out request.

An opt-out does not prevent disclosures reasonably necessary to:

  • Fulfill an order

  • Process a payment

  • Provide requested support

  • Maintain security

  • Prevent fraud

  • Remember essential privacy preferences

  • Comply with law

  • Exercise or defend legal claims

  • Use service providers or contractors for permitted operational purposes

15. Global Privacy Control

Some browsers and browser extensions can transmit a privacy preference signal known as Global Privacy Control, or GPC.

Where required by applicable law and supported by our website and privacy systems, Vita Asana treats a recognized GPC signal as a request to opt out of applicable:

  • Sale of personal information

  • Sharing for cross-context behavioral advertising

  • Processing for targeted advertising

A GPC signal generally applies to the browser and device transmitting it. You may need to enable GPC separately on each browser, device, or browser profile you use.

Where you are signed into an account and we can reasonably associate the signal with that account, the preference may be applied more broadly where required or technically supported.

16. Right to Limit Sensitive Personal Information

California residents may have the right to limit the use or disclosure of sensitive personal information where it is used for purposes beyond those permitted without providing a right to limit.

Vita Asana currently intends to use or disclose sensitive personal information only where reasonably necessary to:

  • Provide requested products and services

  • Process payments

  • Maintain customer-account access

  • Provide customer support

  • Process communications directed to us

  • Verify transactions

  • Prevent and investigate fraud

  • Protect security

  • Comply with law

  • Establish, exercise, or defend legal claims

  • Perform another purpose permitted without offering a separate right to limit

We do not intend to use sensitive personal information to infer characteristics about consumers.

Based on these practices, Vita Asana does not currently provide a separate “Limit the Use of My Sensitive Personal Information” link.

If our practices change in a way that triggers a right to limit, we will provide the required notice and method for exercising that right.

You may contact contact@vita-asana.com with questions about sensitive personal information.

17. Right to Non-Discrimination

We will not unlawfully discriminate against you for exercising an applicable CCPA right.

Subject to applicable law, we will not because you exercised a privacy right:

  • Deny you products or services

  • Charge you a different price

  • Provide a different level or quality of service

  • Suggest that you will receive a different price, level, or quality of service

  • Retaliate against you

This does not prevent a difference that is reasonably related to the value of personal information or another practice expressly permitted by law.

Exercising a deletion or opt-out right may affect features that depend on the information involved. For example, deleting account information may prevent continued use of that account.

18. Promotions and Financial Incentives

Vita Asana may offer ordinary discounts, promotional codes, or marketing offers.

These promotions are not intended to constitute financial-incentive programs in exchange for the sale or sharing of personal information.

If we introduce a program that constitutes a financial incentive or price or service difference under the CCPA, we will provide any required notice explaining:

  • The material terms

  • The categories of information involved

  • How the incentive is reasonably related to the value of the information

  • How to opt in

  • How to withdraw

Participation in any qualifying financial-incentive program would be voluntary.

19. Exercising Your Rights

For requests to know, access, delete, or correct personal information, submit a request through:

Suggested subject line: California Privacy Request

Include:

  • Your full name

  • The email address associated with your order or account

  • The type of request

  • Your order number, if relevant

  • Enough information to help us locate the applicable records

  • The response method you prefer

For assistance with a privacy request, you may also call:

Do not send:

  • Complete payment-card numbers

  • Card security codes

  • Account passwords

  • Banking passwords

  • One-time authentication codes

  • Unnecessary government identification

  • Other unnecessary sensitive credentials

Our ordinary 24–48-business-hour customer-support response period is not the legal completion period for a verified privacy request.

20. Verification of Requests

Requests to know, access, delete, or correct may require reasonable verification.

Depending on the request and the information involved, we may verify:

  • Control of the relevant email address

  • Information associated with an order

  • Customer-account information

  • Recent transaction information

  • Other information already maintained by Vita Asana

We will request only information reasonably necessary and proportionate to verify the request.

Information submitted for verification will be used for verification, security, fraud prevention, request processing, and related legal compliance.

If we cannot verify a request to the required degree of certainty, we may:

  • Request additional information

  • Process the request to a more limited extent

  • Deny the request

  • Explain why the request could not be completed

Opt-out and applicable limitation requests generally do not require the same identity-verification process, although we may request basic information needed to identify the browser, account, or consumer to whom the request applies.

21. Authorized Agents

You may authorize another person or a business entity registered with the California Secretary of State to submit a request on your behalf.

We may require:

  • Evidence that the agent has signed permission to act for you

  • Verification of your identity directly with us

  • Direct confirmation that you authorized the agent

  • Information sufficient to identify the records involved

Different procedures may apply where an authorized agent acts under a legally valid power of attorney.

We may deny a request from an agent who does not provide adequate proof of authority.

22. Household Requests

Where a request concerns household information, we may need to verify each household member or obtain confirmation from each member whose personal information is involved.

We will not disclose specific pieces of personal information belonging to one household member to another member unless disclosure is authorized and can be completed securely.

23. Response Timing

Where the CCPA applies:

  • We will confirm receipt of a request to know, delete, or correct within 10 business days

  • We will generally respond to a verified request within 45 calendar days

  • If reasonably necessary, we may extend the response period by an additional 45 calendar days

  • If an extension is required, we will provide notice and explain the reason

  • We will process opt-out and applicable limitation requests as soon as reasonably feasible and no later than 15 business days

Response periods may be affected by:

  • Verification delays

  • The scope or complexity of the request

  • The number of requests received

  • Information maintained by service providers

  • Applicable legal exceptions

  • Security and fraud-prevention requirements

24. Fees

We generally do not charge a fee for processing an eligible privacy request.

Where permitted by law, we may charge a reasonable fee or decline to act if a request is:

  • Manifestly unfounded

  • Excessive

  • Repetitive

If a fee applies, we will explain the reason and provide a cost estimate before completing the request.

25. Consumers Under 16

The Vita Asana website is intended for adults and is not directed to children under 13.

We do not knowingly sell or share the personal information of consumers under 16 without the affirmative authorization required by law.

If we learn that personal information belonging to a consumer under 16 has been sold or shared without the required authorization, we will take reasonable steps to address the matter.

A parent or guardian may contact contact@vita-asana.com regarding a child’s information.

26. Automated Technologies

Vita Asana and its service providers may use automated technologies to assist with:

  • Website security

  • Fraud detection

  • Transaction screening

  • Payment authentication

  • Order-risk review

  • Advertising measurement

  • Analytics

  • Personalization

Vita Asana does not currently intend to use automated decisionmaking technology to make significant decisions concerning employment, housing, education, healthcare, lending, insurance, or similar access to essential services.

If our practices change and California law provides an applicable notice, access, or opt-out right, we will provide the required information and method for exercising that right.

27. Deidentified and Aggregated Information

Where we maintain deidentified information, we take reasonable measures designed to prevent the information from being associated with a particular consumer or household.

Where required, we will:

  • Maintain the information in deidentified form

  • Publicly commit not to reidentify it

  • Contractually require recipients not to attempt reidentification

We may also use aggregated information that cannot reasonably identify a consumer or household for analytics, reporting, research, security, and business planning.

28. Changes to This Policy

We may update this California Consumer Privacy Act (CCPA/CPRA) Policy to reflect changes to:

  • Our information practices

  • Website functionality

  • Shopify services

  • Advertising or analytics providers

  • Products and services

  • Applicable California law

  • Regulations or regulatory guidance

We intend to review this policy periodically and update it at least once every 12 months where required.

The current version will be published on this page with a revised “Last Updated” date.

29. Related Privacy Pages

This policy should be read together with:

If this California-specific policy conflicts with our general Privacy Policy regarding a right granted under the CCPA, this California-specific policy will control for eligible California residents to the extent of that conflict.

30. Contact Information

California Privacy Requests

Suggested subject line: California Privacy Request

Company Information

  • Store Name: Vita Asana

  • Company Name: VITA ASANA SRL

  • Company Number: 40630208

Company Address

VITA ASANA SRL
Str. Izvoarelor nr. 10
Sângeorz-Băi, Bistrița-Năsăud, 425300
Romania

U.S. Fulfillment & Returns Address

12900 W Airport Blvd
Sugar Land, TX 77478
United States

Customer Service Hours

  • Monday–Friday: 9:00 a.m.–5:00 p.m. Eastern Time

  • Saturday–Sunday: Closed

Ordinary customer-service inquiries are generally answered within 24–48 hours on business days. Privacy requests may require additional time for verification and processing in accordance with applicable law.