Global Privacy Notice

Effective Date: July 2026
Last Reviewed: July 2026

Who we are

Fearless Girl and the Fearless Girl Official Gift Shop are managed by State Street Global Advisors Trust Company (“we”, “us”, “our”). We are strongly committed to protecting your privacy and personal information or personal data (“Personal Data”). This Global Privacy Notice (“Notice”) is intended to comply with the relevant transparency requirements under the applicable privacy or data protection laws and describes how and why we might access, collect, store, use, and/or share your Personal Data when you visit www.fearlessgirl.com (“Website”, “Site(s)”) or use our services (“Services”). This Notice applies to any Personal Data we may collect from you through our Website and our Services.

Personal Data We Collect

Personal Data You Provide

Depending on how you interact with our Sites and Services, and subject to the laws or regulations applicable based on the relevant jurisdiction, we may collect the following personal data about you:

Name, contact information, & payment: If you place an order, you will provide us with your email address, name, postal address, phone number, and payment information via Shopify.

Email address: If you sign up to receive emails from us via Join Our Newsletter, you will provide us with your email address.

Name & contact information: If you contact us, you will provide us with your name, email address, and any information you choose to provide in your message. You may also provide us with your phone number.

How we collect your Personal Data

We collect your Personal Data in a variety of ways and from various sources. For example, we may collect your Personal Data:

• Through direct interactions with you, for example, when you fill out a form, send us email, or when you call us.
• Directly and indirectly from activity on our Website. For example, from submissions through our website or website usage details collected automatically. Please see our Cookies Disclosure for further information regarding the usage, device and location information that may be collected.

Personal Data Collected by Shopify

Our online store is hosted by Shopify. In addition to the personal data we collect, Shopify collects and processes your personal data to provide services, such as advanced product and store customization, analytics, and advertising services. Please review Shopify’s consumer privacy policy here. Depending on the state in which you reside, you may opt out of or object to Shopify’s processing of your data through Shopify’s webform available here.

Sensitive Personal Data and Criminal Records

We do not collect or process Sensitive Personal Data in relation to the Sites and Services we provide within this Notice. We recognize that certain jurisdictions have enacted laws that require higher protection of certain Sensitive Personal Data. Sensitive Personal Data includes categories of information identified by the applicable privacy laws as requiring special treatment or protection. This information may include, but is not limited to, racial or ethnic origin; political opinions; religious, philosophical, or other similar beliefs; membership of a trade union or profession or trade association; physical or mental health; biometric data; or sexual orientation.

Legal Basis for Processing Your Personal Data:

Where applicable data protection laws require us to identify a legal basis for processing your personal data, we rely on one or more of the following legal bases, depending on the purpose of the processing:

• Performance of a contract. We process personal data where necessary to provide the Sites and Services you request, process and fulfill orders, arrange shipping and delivery, process payments through our service providers, communicate with you about purchases, and take steps at your request before entering into a transaction.
• Consent. We rely on your consent where required by applicable law, including for certain marketing communications, newsletter subscriptions, non-essential cookies or similar technologies, and any other processing for which we ask for your consent. You may withdraw your consent at any time where processing is based on consent.
• Legitimate interests. We process personal data where necessary for our legitimate interests or those of a third party, provided those interests are not overridden by your rights and freedoms. These interests may include operating, securing, maintaining, and improving the Sites and Services; responding to inquiries; preventing fraud or misuse; analyzing Site performance; customizing your experience; and supporting ordinary business administration.
• Compliance with legal obligations. We process personal data where necessary to comply with applicable laws, regulations, legal processes, regulatory requests, tax, accounting, recordkeeping, consumer protection, sanctions, fraud-prevention, or other legal obligations.
• Establishing, exercising, or defending legal rights. We may process personal data where necessary to protect our rights, resolve disputes, enforce applicable terms and policies, investigate or respond to claims, or cooperate with courts, regulators, law enforcement, or other competent authorities.
• Vital interests. In limited circumstances, we may process personal data where necessary to protect the vital interests of you or another person, such as in an emergency involving health or safety.

The specific legal basis that applies may vary depending on the jurisdiction in which you are located, the nature of the personal data, and the particular purpose for which we process it. Where we rely on legitimate interests, we consider and balance our interests against your privacy rights and reasonable expectations.

 How We Use Your Personal Data

In addition to the purposes stated above, we may use all the personal data we collect in accordance with applicable law such as to:

• Market our business;
• Maintain and improve our Sites and Services;
• Protect the security and integrity of our Sites and Services;
• Customize your experience with us;
• Investigate, prevent, or take action regarding illegal activities, suspected fraud, situations involving potential threats to the physical safety of any person and to otherwise fulfill our legal obligations;
• Monitor compliance with and enforce this Privacy Notice and any applicable agreements and policies;
• Defend our legal rights and the rights of others;
• Fulfill any other purposes for which you provide it;
• For any purpose that is reasonably necessary to or compatible with the original purpose for which we collected the personal data as disclosed to you; and
• Comply with applicable law.
• For our legitimate interest, as a commercial organization, provided our use is proportionate and respects your privacy rights.

Automated Decision-Making

We do not use automated decision-making, including profiling, that produces legal or similarly significant effects.

How We May Share or Disclose Your Personal Data

• With vendors who perform data or Site-related services on our behalf (e.g., email, hosting, maintenance, backup, analysis, etc.);
• With our corporate family, such as with subsidiaries, affiliates, and franchise partners;
• With Shopify and other third parties that may be located in other countries, in order to provide services, including advanced product and store customization, analytics, and advertising services;
• To the extent that we are required to do so by law;
• With vendors to prepare, deploy and analyze advertising content;
• In connection with any legal proceedings or prospective legal proceedings;
• To establish, exercise, or defend our or a third party’s legal rights, including providing formation to others for the purposes of fraud prevention;
• With any person who we reasonably believe may apply to a court or other competent authority for disclosure of that personal data where, in our reasonable opinion, such court or authority would be reasonably likely to order disclosure of that personal data;
• With any other person or entity as part of any business or asset sale, equity transaction, merger, acquisition, bankruptcy, liquidation, or similar proceeding, or in preparation for any of these events and that person or entity may use your personal data for their own purposes;
• With any other person or entity where you consent to the disclosure; and
• For any other purpose disclosed by us when you provide the personal data or for any other purpose we deem necessary, including to protect the health or safety of others.

No Sale of Personal Data

We do not sell, rent or lease any of your Personal Data including Personal Data of minors under the age of 16 or as defined by applicable laws or regulations.

How we Transfer and Store your Personal Data

We operate globally and we may share some of your Personal Data, with organizations (including our affiliates and our service providers) who are outside of the jurisdiction in which the Personal Data was collected. Because we are headquartered in the United States, Personal Data collected in other countries is routinely transferred to the United States for processing. That is, Personal Data collected in one jurisdiction may be transferred, stored, and processed outside the country of origin. For these transfers, we have the relevant legal safeguards in place, including (for example) by way of contractual arrangements based on sets of standard contractual clauses that have been pre-approved by the European Commission (or otherwise consistent with the requirements of the relevant jurisdiction) to ensure adequate protection, or in certain circumstances we may rely on one of the exceptions to the rules that allows us to perform these transfers. This reflects our commitment to protecting your Personal Data regardless of where your Personal Data resides. Personal Data stored or processed in a foreign jurisdiction may be accessed under a lawful order made in that jurisdiction.

Children’s Privacy

The Sites and Services are not intended for children under 16 years of age or the equivalent minimum age in the relevant jurisdiction. We do not knowingly collect, use, or disclose personal data from children under 16.

Marketing Communications and your Choices

We may use your Personal Data to market to you. We target and tailor such communications based on your interaction with us, via mail, email, online, telephone, or through third-party partners or vendors. If you do not wish to receive this information from us, please manage your preferences by clicking on the unsubscribe link in any of our emails, or by navigating to the “Contact Us” section of our website.

How we Protect Your Personal Data

We are committed to protecting the security of your Personal Data. We use reasonable technical and organization measures, in compliance with applicable law, to protect your Personal Data from unauthorized access, unlawful processing and against accidental loss, destruction or damage.

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which we collect it, such as to provide you with the service you have requested, and for the purpose of satisfying any legal, accounting, contractual, or reporting requirements that apply to us. If you unsubscribe, opt-out or withdraw consent, we will stop using your contact information for marketing and may retain limited information necessary to honor your opt-out and maintain suppression records. We periodically review marketing contact information and may delete or de-identify it after a period of inactivity, such as 24 months, unless a longer retention period is required or permitted by law.

Cookies

We use cookies on our websites or applications. Cookies are small files stored on a computer that are designed to hold small amounts of data specific to a user and the websites or applications to help tailor that user’s experience. For more information see our Cookies Disclosure.

Third-Party Links and Services

Our Website may contain links or embedded content from third-party websites, which have their own privacy policies.

Your Rights

Depending on the jurisdiction, and subject to certain exceptions, you may have specific rights regarding your Personal Data. This section describes such rights and how you may exercise them.

• Access to Specific Information
  • You may have the right to request that we disclose certain information to you regarding how we use your Personal Data. Once we receive and verify your request, we will disclose to you (depending on your request or unless an exception applies):
    • The categories of Personal Data we have collected about you.
    • The categories of sources from where the Personal Data was collected.
    • Our purpose for collecting or sharing your Personal Data.
    • The categories of third parties with whom we share your Personal Data.
    • The specific pieces of Personal Data we have collected about you.

• Where specifically required, we will provide specific pieces of Personal Data we have collected about you in a structure commonly used or in machine-readable format, and to have it transmitted directly to another person or entity (data portability).
• Request Deletion or erasure of your Personal Data in certain circumstances
• Request that your Personal Data be rectified where it is inaccurate or incomplete
• Request restriction or object to the processing of your Personal Data for certain circumstances (for example for marketing purposes)
• Withdraw your consent for the processing of your Personal Data. If we are relying on your consent to use or share your Personal Data, you have the right to fully or partially withdraw your consent, subject to certain exceptions defined in applicable laws and regulations. Please note however that this will not affect the lawfulness of the processing before its withdrawal.
• Lodge a complaint with your local data protection authority.
• Depending on your jurisdiction (e.g. in California under the California Consumer Privacy Act), you may designate an authorized agent to make a request on your behalf.

How to Exercise Your Rights or Contact Us

If you wish to exercise your rights, or have questions or comments about this Notice or about how your Personal Data is processed, please contact our Chief Privacy Officer or Data Protection Officer by email or via our website at:

Email: privacyoffice@statestreet.com
Website: http://www.statestreet.com/contact-us.html