WALL STREET WRAPS
PRIVACY POLICY
Effective date: September 1, 2026
Last updated: September 19, 2026
1. ABOUT THIS POLICY
Wall Street Wraps respects your privacy. This Policy explains how personal information is collected, used, disclosed, stored, and protected when you visit www.wallstreetwraps.com, use a Wall Street Wraps service that links to this Policy, contact us, or visit a participating store.
It covers our global website and the operations identified below, including in the Philippines, UK, EU and the United States. The services and information involved depend on the country, store, and features you use. Additional notices may apply to a particular store, promotion, application or service. Mandatory local law continues to apply; this Policy does not remove any right that law gives you.
2. WHO IS RESPONSIBLE FOR YOUR INFORMATION
Privacy Contact: info@wallstreetwraps.com
Subject line: Privacy Request
“Wall Street Wraps,” “we,” “us” and “our” mean the identified business responsible for the particular processing. The brand name alone does not identify the legal controller. Some stores may be independently operated. The business identified when you order, on your receipt or in the store's privacy notice is responsible for information it controls for its own operations. A store and the global website operator may each be responsible for different uses of information. Where they jointly determine a use, we explain the relevant responsibilities and contact arrangements. You can contact our general privacy address if you are unsure which business handles your information. We will help identify the appropriate contact.
3. INFORMATION WE COLLECT AND ITS SOURCES
We collect information you provide directly, information generated when you use our services, and information lawfully provided by businesses involved in your transaction. Depending on your interaction, this includes:
• Contact and account information: your name, email address, telephone number, delivery or billing address, account identifiers and preferences, where accounts are offered.
• Orders and transactions: items purchased, customizations, delivery or pickup instructions, store selected, order history, transaction references, payment status, receipts, refunds and complaints. Payment providers process the payment credentials required for the payment method you choose; the information available to us depends on that provider and the payment arrangement.
• Communications: inquiries, customer-service messages, feedback, survey responses, reviews and information needed to investigate a complaint. Please provide only information relevant to your request.
• Marketing and participation information: subscription choices, consent records, promotion entries, and membership or reward activity where those features are offered.
• Business inquiries: your business contact details, organization, role, and information relevant to a catering, supply, or franchise inquiry. Detailed recruitment or franchise due-diligence processing may be covered by a separate notice.
• Device and website information: IP address, browser and device type, operating system, language, approximate location derived from IP address, referring pages, pages viewed, interaction times, security logs and cookie identifiers. Additional analytics or advertising information is collected only through tools actually enabled and subject to the choices described below.
• Store and event information: transaction records, incident reports and, at locations using CCTV, images and recording times. A local notice explains the relevant surveillance. Separate notices apply to guest Wi-Fi, recorded calls or other additional services if offered.
• Sensitive information you specifically provide: for example, an allergy or health detail relevant to a food request or incident. Section 5 explains the additional protections for this information.
Other sources can include the store fulfilling your order; a delivery or payment provider; a person placing an order on your behalf; and a social platform when you contact us through it or choose an integration. We receive only the information made available through the relevant interaction. Giving another person's details requires appropriate authority and a lawful basis.
Information is not anonymous merely because your name is absent. Identifiers, browsing records and other information that can reasonably be linked to you are handled as personal information.
4. WHY WE USE INFORMATION AND OUR LEGAL BASES
We use information for the following purposes, using the legal basis permitted by the law applicable to that processing:
Orders, accounts and customer requests.
We use the necessary contact, account and transaction information to accept and fulfill orders, arrange delivery, manage payments and refunds, provide requested account features and respond to service requests. Where applicable, the basis is performing a contract with you or taking requested steps before entering one.
Customer service and business inquiries.
We use relevant communications and business details to answer questions, resolve issues, and evaluate requested business opportunities. The basis is contract or pre-contract necessity where applicable, or our legitimate interest in responding to inquiries where that basis is available and the required balancing test is met.
Security and service reliability.
We use necessary technical and incident information to secure the website and stores, prevent fraud, troubleshoot failures and protect people and property. We rely on an applicable legal obligation or a permitted legitimate interest, subject to local requirements. CCTV has the further limits in Section 10.
Marketing and optional personalization.
We use contact details and preferences to send the marketing you choose to receive. Our standard is a separate opt-in for promotional email, text and similar direct messages. Consent is also obtained for optional tracking where required. We do not make an ordinary purchase conditional on agreeing to unrelated marketing.
Measurement and improvement.
We use service feedback and appropriately limited usage data to understand performance and improve our services. We use anonymous or aggregated information where practicable. Identifiable analytics relies on consent where required, or another lawful basis only where available and appropriate. A non-consent basis does not override a separate cookie-consent requirement.
Legal compliance and claims.
We use relevant records to meet tax, accounting, consumer-protection, food-safety and other legal duties, and to establish, exercise or defend legal claims. The basis is the applicable legal duty or another permitted basis for the particular claim.
Sensitive information requires an additional lawful condition.
We do not rely on legitimate interests where local law does not permit it, or where the required assessment does not support the processing. We identify required and optional fields when collecting information. Without information needed to deliver an order, process payment, or answer a request, we may be unable to provide that particular service.
5. ALLERGIES AND OTHER SENSITIVE INFORMATION
An allergy, medical detail or dietary instruction may reveal health information or another protected characteristic. We limit collection to what is necessary for the specific request, safety concern or legal obligation. Where consent is required, we request specific, separate consent before processing sensitive information. An ordinary purchase contract, a general privacy checkbox or a general legitimate interest does not replace that requirement. We rely on an exception only where its legal conditions are met.
Access is limited to people who need the information to handle the request or incident. We do not use allergy or health information to build advertising audiences. Please do not send medical records, identity documents, or unrelated sensitive details through an ordinary contact form. If additional information is needed, we will explain the purpose and appropriate submission method.
6. WHO RECEIVES INFORMATION
We disclose relevant information only for a stated purpose and on an appropriate legal basis. Recipients may include:
• The store and delivery personnel handling your order, to prepare, fulfill and support it.
• Technology providers supplying hosting, website functionality, customer communications, payment processing, security, storage and other contracted services.
• Payment, delivery and marketplace businesses involved in your transaction. Some operate as independent controllers for their own payment, fraud-prevention, account or delivery services.
• Related companies or franchise operators when needed for the service you request, support, lawful administration or another disclosed purpose. Brand affiliation does not authorize unrestricted sharing.
• Analytics or advertising providers, where enabled, subject to consent, opt-out rights and the disclosures in Section 7.
• Professional advisers, insurers, regulators, courts or public authorities when a lawful and necessary disclosure is required or justified.
• A proposed buyer or successor in a genuine business transaction, subject to confidentiality, purpose limits and applicable notice or consent requirements.
Providers processing information on our instructions must be subject to appropriate contractual and security obligations. Independent controllers remain responsible for their own processing. We explain the relevant roles rather than treating every recipient as a service provider.
We do not sell personal information for money. Some advertising-related disclosures can nevertheless be a “sale” or “sharing” under certain laws, even without payment. Section 7 and the applicable regional disclosures explain this separately. We do not give a partner your contact information for its own direct marketing without the required separate permission.
7. COOKIES, ANALYTICS AND ADVERTISING
Our website uses cookies and similar technologies. Essential technologies support functions such as security, network operation and services you request. Optional technologies, where enabled, may remember preferences, measure website use or support advertising.
The Cookie Settings control provides information about the technologies actually used, their providers, purposes and durations. Where prior consent is required, non-essential technologies remain disabled until you choose to allow them. You can accept, reject or change optional categories and withdraw consent through Cookie Settings. Rejecting optional tracking does not prevent ordinary browsing or purchasing, although a particular optional feature may be unavailable.
Where advertising technologies are enabled, providers may receive online identifiers, device information and interaction data and combine them with information from other websites or services to measure advertising or personalize it. The applicable provider and choice details appear in Cookie Settings and the regional disclosures below.
Where applicable law requires, we honor recognized opt-out preference signals, including Global Privacy Control, for the sale or sharing of information and targeted advertising. These signals are distinct from older browser “Do Not Track” settings. Your cookie choices may be specific to your browser or device. Clearing cookies can remove saved choices. Browser settings can provide additional controls, but do not replace the choices we must provide. Email unsubscribe and advertising-cookie choices are separate controls.
8. WIX AND THIRD-PARTY SERVICES
Our website is hosted on Wix.
Wix.com Ltd. and relevant service providers process website visitor information to supply hosting and the platform features we use. For processing on our behalf, Wix's Data Processing Addendum describes the controller–processor relationship and safeguards:
https://www.wix.com/about/privacy-dpa-users
Wix's published subprocessor information is available at:
https://support.wix.com/en/article/list-of-wixs-sub-processors
Separately installed applications and integrations may involve other providers and separate processing arrangements. Our required provider and transfer disclosures are included in the schedules below; a general link to Wix's documents does not replace those disclosures.
If you use an external ordering or delivery platform, such as Grab or foodpanda where available, its own notice governs information it controls. This Policy governs information the relevant Wall Street Wraps business receives and uses. The same distinction applies to payment services and social platforms.
A social login, map, video or other optional integration may disclose information to its provider when activated. We provide applicable choices before any disclosure requiring consent. A public review or post may be visible to others; avoid including sensitive information in it.
9. INTERNATIONAL PROCESSING
Our global operations and service providers may process information outside the country where you live or visit a store. Wix identifies initial processing by Wix.com Ltd. in Israel and processing by providers in additional countries. The actual destinations depend on the services used and are identified in the applicable transfer schedule.
We use the transfer mechanism and safeguards required for the particular transfer. These may include an applicable adequacy decision, approved contractual safeguards with any required assessment and additional protections, or specific consent where legally appropriate. We do not treat acceptance of this Policy as blanket permission to transfer information anywhere.
For processing subject to European or UK transfer rules, you can contact us for information about the mechanism used and a copy or description of the relevant safeguards, with protected confidential details redacted where appropriate. Korean and Philippine transfer requirements apply independently
10. STORE CCTV AND INCIDENT RECORDS
Stores using CCTV provide visible notices identifying the operator and surveillance purpose. Cameras are used for legitimate safety, security and incident-management purposes within the limits of applicable law. Local notices specify the areas covered, recording arrangements, retention period and access contact.
Footage is accessible only to authorized people with a legitimate need. A relevant recording may be preserved for a reported incident, access request, investigation or legal claim. Disclosure is assessed individually and may require redaction or other measures to protect people shown in it.
You may request access to footage concerning you where applicable law provides that right. Please identify the store, date, approximate time, and enough information to locate the recording. We consider your rights, third-party privacy, lawful restrictions and the applicable response deadlines.
11. RETENTION AND DELETION
We keep personal information only for the period necessary for the specified purpose or an applicable legal requirement. We consider the transaction or relationship, statutory recordkeeping, a specific dispute or legal hold, and the nature and sensitivity of the information.
We review retained information and delete it securely or irreversibly anonymize it when no longer needed. Legally retained records are restricted to the purpose justifying retention and segregated where required. Electronic records are deleted using methods intended to prevent recovery; physical records are securely destroyed. Backup copies remain protected and are removed through the applicable backup cycle, subject to a specific lawful preservation requirement. We comply with any shorter mandatory deletion deadline, including for backup copies.
12. SECURITY
We apply organizational, technical and physical measures appropriate to the information and risks, including controlled access, staff responsibilities, secure account practices and provider oversight. The relevant system determines the additional protections required. No system can guarantee absolute security.
If a personal-data breach occurs, we assess it, take appropriate action and notify affected individuals and authorities when required by applicable law. Report a suspected privacy or security incident using the contact details in Section 20.
13. YOUR CHOICES AND PRIVACY RIGHTS
Depending on the law applicable to our processing, you may have rights to:
• Receive information about collection, use, sources and recipients.
• Obtain access to your personal information and a copy.
• Correct inaccurate or incomplete information.
• Request deletion, blocking or restriction of processing.
• Object to particular processing, including direct marketing.
• Withdraw consent without affecting the lawfulness of processing before withdrawal.
• Obtain or transmit information in a portable format where the statutory conditions apply.
• Opt out of sale, sharing, targeted advertising or certain profiling where applicable.
• Seek review or explanation of certain automated decisions.
• Complain to the appropriate regulator and seek remedies available under law.
To make a request, email info@wallstreetwraps.com with “Privacy Request” in the subject line, or use the applicable local privacy contact. You do not need an account to submit a request. Provide enough information to identify the service or store involved and your requested action. We may ask for proportionate verification to protect your information, but will not ask for unnecessary identity documents. An authorized representative may act where permitted, subject to appropriate verification.
We respond within the applicable legal deadline, and explain any permitted extension, lawful refusal or limitation. If another controller must address part of your request, we explain that. We charge a fee only where the law permits and inform you before doing so. We do not unlawfully discriminate or retaliate because you exercise a privacy right.
To stop marketing, use the unsubscribe link in an email, the stated withdrawal method in another message, or contact us. We stop the relevant marketing within the applicable period. Essential order, service and legal messages may still be sent for their separate purposes. An objection to direct marketing also covers related profiling.
14. CHILDREN AND AUTOMATED DECISIONS
Our account, subscription and promotional features are not directed at young children. We do not knowingly collect information through those features from children under 13 without any legally required verified parental consent. Other age thresholds and protections may apply, including Korea's rules for children under 14. Parents and guardians should manage relevant online interactions for children who cannot validly consent themselves.
Children may visit our stores or participate in family activities. Where their information is involved, we provide age-appropriate information, collect only what is necessary, and obtain parental or guardian authorization when required. Applicable safeguards for children are not limited to the age thresholds above. Contact us if you believe a child has provided information without the required authorization so we can investigate and take appropriate action.
Automated systems can support functions such as security screening, service measurement or recommendations, where enabled. We provide further notice and the rights required by applicable law before introducing such processing.
15. ADDITIONAL INFORMATION FOR THE PHILIPPINES
Where Philippine data-protection law applies, this Policy is read with the Data Privacy Act of 2012, its Implementing Rules and Regulations and applicable National Privacy Commission issuances.
The relevant Philippine controller is identified in Section 2. Its Data Protection Officer or Compliance Officer for Privacy can be reached as follows:
Designation: Aireen Acoba
Email: info@WallStreetWraps.com
We apply transparency, legitimate purpose, and proportionality. Ordinary personal information is processed on an applicable lawful basis under Section 12 of the Act.
Your applicable rights include information, access, objection, correction, erasure or blocking, portability and remedies for unlawful processing. You may complain to the National Privacy Commission at https://privacy.gov.ph. Contacting us first may help resolve a concern but does not remove a right to approach the Commission. Philippine CCTV requests are handled under the applicable NPC rules, including their specific access and preservation requirements.
16. Reserved
17. ADDITIONAL INFORMATION FOR EUROPE AND THE UNITED KINGDOM
Where the GDPR or UK GDPR applies to our processing, the applicable purposes and lawful bases are explained in Section 4. Any additional condition for sensitive information is addressed in Section 5. Transfer safeguards are addressed in Section 9.
You may object at any time to direct marketing, including related profiling. Where we rely on legitimate interests for another purpose, you may object on grounds relating to your particular situation. The applicable law determines whether processing may continue. Other rights, including portability and restrictions on significant solely automated decisions, apply subject to their statutory conditions.
You may complain to the competent supervisory authority, including in the EEA country of your habitual residence, workplace or alleged infringement where the GDPR applies. UK complaints may be made to the Information Commissioner's Office: https://ico.org.uk.
18. ADDITIONAL INFORMATION FOR THE UNITED STATES
Where a US state privacy law applies to our business and the relevant processing, residents may have the access, correction, deletion, and portability rights described above, and rights to opt out of sale, sharing, targeted advertising or certain profiling. Some laws also allow limits on particular uses of sensitive information and an appeal of a decision on a privacy request.
Use the “Do Not Sell or Share My Personal Information” control and Cookie Settings for applicable advertising choices, or contact us through Section 13. We honor legally required opt-out preference signals. We do not require identity verification for a browser-based opt-out beyond what applicable law permits. Where an appeal is available, contact us with “Privacy Appeal”; we explain the decision and any further complaint route within the applicable period.
We do not knowingly sell or share personal information of children under 16. If a loyalty program or promotion constitutes a regulated financial incentive, its separate notice explains the relevant data practices, terms and withdrawal rights before enrollment.
19. CHANGES TO THIS POLICY
We update this Policy when our practices, services or legal requirements change. The date above identifies the latest version. We give advance or other notice of material changes when required and obtain fresh consent if a change requires it. Continued use of a service does not replace legally required consent.
20. CONTACT US
For privacy questions, requests or complaints:
Wall Street Wraps — Privacy Contact
Email: info@wallstreetwraps.com