1. This Policy applies to prijems.com and any subdomain or interface operated by us (the "Site"), and to Personal Information collected in connection with orders, memorandum transactions, trade account applications, custom sourcing requests, inquiries, appointments, trade shows, and marketing communications, whether online, by email, by telephone, or in person.
2. This Policy does not apply to third-party websites or services accessed through links on the Site, which are governed by their own policies. The Classic Cuts stone search currently runs on modernrusticdiamond.com and is governed by the privacy policy published there.
3. This Policy is incorporated into and forms part of our Terms of Service.

1. "Personal Information" means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual or household, and includes "personal data" as defined in the UK GDPR and the EU GDPR.
2. "Sensitive Personal Information" has the meaning given in the California Consumer Privacy Act as amended ("CCPA"), and "special category data" has the meaning given in Article 9 of the UK GDPR and the EU GDPR.
3. "Process" and "Processing" mean any operation performed upon Personal Information, whether or not by automated means.
4. "Service Provider", "Contractor", "Third Party", "Sell" (including "Sale"), and "Share" (including "Sharing") have the meanings given to them in the CCPA.
5. "Controller" and "Processor" have the meanings given to them in the UK GDPR and the EU GDPR.

Privacy inquiries, and requests under clauses 19 to 21, may be made to PRIJEMS Inc by any of the following means.

• Email: sales@prijems.com, with "Privacy" in the subject line
• Telephone: (213) 489-1234
• Post: PRIJEMS Inc, 550 South Hill Street, Suite 891, Los Angeles, California 90013

Depending on how you deal with us, we collect the following.

• Identity and contact details. Name, email address, telephone number, and billing and shipping addresses.
• Business and trade details. Company name, job title, business address, resale certificate or seller’s permit, tax identification numbers, trade references, and documents you provide with a trade or memo application to verify your business or identity.
• Transaction details. Stones you buy, request, return, or hold on memo, with the related order, invoice, shipping, and payment records. Card payments are entered into the checkout of our ecommerce platform and handled by its payment processors, and we do not store full card numbers.
• Communications. Emails, calls, and messages with us, including what you tell us about the stones you are looking for.
• Account and preferences. Customer account login details and your marketing preferences.

When you use the Site, we and our Service Providers collect your device and browser type, IP address and the approximate location derived from it, the pages and stones you view, the searches and filters you use, the site that referred you, and the date and time of your visit. Much of this is collected through cookies and similar technologies, described in clause 14.

• Payment processors and shipping carriers, which tell us whether a payment cleared or was flagged for fraud, and where a shipment is.
• Trade references you name in an application, and public business sources, such as company websites and trade association directories, that we check when reviewing it.
• Trade show organizers, where you allow them to share your badge details with exhibitors.

We do not seek to collect Sensitive Personal Information or special category data. Where a tax identifier, identity document, or financial account detail is needed to verify a business, meet a legal obligation, or process a payment, we use it only for that purpose and not to infer characteristics about you.

We use Personal Information to:

• process, ship, insure, and support orders, returns, and memorandum transactions;
• review trade and memo applications and manage trade accounts;
• answer inquiries and source stones you ask us to find;
• take payments, send invoices, and prevent fraud;
• send marketing communications, as described in clause 10;
• operate, secure, and improve the Site, including learning which stones and pages people look at;
• meet tax, accounting, anti-money laundering, sanctions, and other legal obligations; and
• establish, exercise, or defend legal claims.

Where the UK GDPR or the EU GDPR applies, we rely on the following legal bases.

• Contract. To take steps you request before an order or memo, and to perform it.
• Legal obligation. To keep records and meet tax, anti-money laundering, and sanctions requirements.
• Legitimate interests. To run and secure a trade business, prevent fraud, improve the Site, and contact trade buyers about stones relevant to their business, where your rights do not override those interests.
• Consent. For marketing email where consent is required, and for non-essential cookies. You may withdraw consent at any time, without affecting Processing that took place before.

We do not make decisions about you based solely on automated Processing that produce legal or similarly significant effects.

We send marketing email to people who sign up for it and, where the law allows, to trade contacts about stones relevant to their business. Every marketing email includes a way to unsubscribe. Unsubscribing does not stop messages about your orders, memos, or account.

We disclose Personal Information to Service Providers and Processors that act on our instructions. By category, they are:

• our ecommerce platform, including hosting, checkout, and customer accounts;
• email, customer communication, and marketing email services;
• site search and filtering, stone viewing, form, analytics, and security tools; and
• professional advisers, including accountants, lawyers, and auditors.

We also disclose what is needed to complete a transaction to payment processors, banks, shipping carriers, and insurers, which handle it under their own terms.

1. Our team in Los Angeles and our office in Mumbai may access Personal Information to coordinate orders, memos, and sourcing.
2. LITHOS Diamonds LLC, an affiliated company, operates from the same Los Angeles office. We do not give LITHOS Personal Information collected by PRIJEMS for its own marketing.

1. We do not sell Personal Information for money. Where we allow advertising or analytics partners to collect information through cookies or pixels on the Site, the CCPA may treat that as a Sale or Sharing. You may opt out through the Your Privacy Choices link in the Site footer, or by using a browser or extension that sends a Global Privacy Control signal, which we treat as a request to opt out.
2. We do not knowingly Sell or Share the Personal Information of anyone under 16, and we do not disclose Personal Information to third parties for their own direct marketing purposes.
3. We may disclose Personal Information where the law requires it, to protect our rights, property, or safety or those of others, or to a successor in a merger, acquisition, or sale of all or part of our business.

• Strictly necessary. Keep your cart, run checkout and customer accounts, and protect the Site against fraud and abuse.
• Preferences. Remember choices such as your country and currency.
• Analytics. Show us how the Site is used, so we can improve it.
• Marketing. Measure engagement with our email and, where used, our advertising.

Where the law requires consent, including in the UK and EEA, non-essential cookies are set only after you accept them. You can change that choice later through the Your Privacy Choices link or by clearing cookies in your browser.

There is no common standard for Do Not Track signals, and the Site does not respond to them. The Site does honor Global Privacy Control, as described in clause 13.

We keep Personal Information only as long as we need it for the purposes in clause 8, using these criteria.

• Orders, invoices, and memo records. For as long as tax, accounting, and anti-money laundering record-keeping rules require after the transaction.
• Trade accounts. While the account is open, and afterward for as long as needed to close out memos, claims, and record-keeping obligations.
• Inquiries that do not lead to an order. For as long as the conversation may reasonably continue, after which we delete or de-identify them.
• Marketing. Until you unsubscribe, after which we keep only what is needed to make sure you stay unsubscribed.
• Legal claims. Longer, where information is needed to establish or defend a claim.

We use administrative, technical, and physical safeguards appropriate to the information we hold, and card payments are handled by processors that meet the Payment Card Industry Data Security Standard. No system is completely secure. If a breach affects your Personal Information, we will notify you as the law requires.

We are based in the United States and have an office in India. Personal Information is processed in both countries, and in other countries where our Service Providers operate, which may not offer the same protection as the law where you live. Where UK or EU law requires a safeguard for a transfer, we use a mechanism that law recognizes, such as standard contractual clauses.

California and a number of other states give residents rights over their Personal Information. We honor the following requests from residents of any US state:

• to know what Personal Information we hold about you, where it came from, why we use it, and who we disclose it to;
• to receive a copy of it in a portable format;
• to correct Personal Information that is inaccurate;
• to delete Personal Information, subject to exceptions the law allows, such as records we are required to keep;
• to opt out of any Sale or Sharing, as described in clause 13; and
• to exercise any of these rights without being treated differently for doing so.

If the UK GDPR or the EU GDPR applies to you, you may ask us to give you access to your Personal Information, correct it, erase it, restrict or object to our Processing of it, or transfer it to you or another organization. You may object at any time to Processing for direct marketing, and withdraw consent where we rely on it.

You also have the right to complain to a data protection authority, including the Information Commissioner’s Office in the UK or the authority where you live in the EEA.

1. Make a request by any method in clause 3. We will ask for enough information to confirm who you are, usually by matching details you give us against our records. For a trade account, we respond to the email address on the account.
2. An authorized agent may make a request on your behalf with your signed permission. We may still need to verify your identity with you directly.
3. Under the CCPA, we confirm receipt within 10 business days and respond within 45 calendar days, which we may extend once by up to 45 more days with notice. Under the UK GDPR and the EU GDPR, we respond within one month, which we may extend by up to two further months where a request is complex.
4. If we decline a request, we will explain why. You may appeal by replying to that decision, and the owner of the business will review the appeal.

The Site is not directed to children under 16, and we do not knowingly collect their Personal Information. If we learn that we have, we will delete it.

We may update this Policy. The effective date at the top of this page shows when it last changed. Where a change is material, we will give notice on the Site or by email as the law requires.