Information Security Policy

Caris Clothing

Operated by Carisclothing LLC

Effective Date: September 15, 2025
Last Reviewed/Updated: September 11, 2026
Policy Owner: Carisclothing LLC – Owner/Management

1. Purpose

Carisclothing LLC (“Caris Clothing,” “we,” “us,” or “our”) is committed to protecting customer information and maintaining appropriate security controls for payment card transactions conducted through our e-commerce business.

This Information Security Policy establishes the administrative, technical, and organizational practices used by Caris Clothing to protect customer information and payment-related data and to support compliance with applicable requirements of the Payment Card Industry Data Security Standard (PCI DSS).

Because Caris Clothing uses third-party service providers for e-commerce and payment processing, security responsibilities are shared between Caris Clothing and those service providers according to the services they provide.

2. Scope

This policy applies to Caris Clothing's business operations, personnel, systems, applications, and third-party services involved in the processing, transmission, or handling of customer and payment-related information.

The primary e-commerce environment consists of:

  • Shopify as the e-commerce website and checkout platform

  • Clover Payments as the third-party payment gateway/processor for online card transactions

  • PayPal as an additional payment service where offered to customers

  • Other approved third-party service providers used for business operations, order fulfillment, customer support, or related services

Caris Clothing does not intentionally store full payment card numbers, CVV codes, or other sensitive authentication data on its own systems.

Merchant One is not currently used as a payment gateway or processor by Caris Clothing.

3. Roles and Responsibilities

3.1 Policy Owner

Caris Clothing's Owner/Management is responsible for maintaining this Information Security Policy and overseeing the company's information-security and PCI DSS responsibilities.

The responsible business role may be contacted through:

Carisclothing LLC (Caris Clothing)
35 West 31st Street, Store 1
New York, NY 10001-4418
United States

Email: support@carisclothing.com

3.2 Personnel

Any employee, contractor, or other person authorized to access Caris Clothing systems or customer information is responsible for:

  • Protecting company and customer information

  • Maintaining the confidentiality of account credentials

  • Using only authorized systems and applications

  • Following applicable security procedures

  • Reporting suspected security incidents or unauthorized access promptly

Access to information and systems is limited to what is necessary for legitimate business purposes.

3.3 Third-Party Providers

Third-party service providers are responsible for the security controls applicable to the services they provide to Caris Clothing.

Caris Clothing relies on applicable security and PCI DSS controls maintained by its payment and e-commerce service providers, including Shopify, Clover Payments, and PayPal.

4. Payment Card Security

Caris Clothing accepts online payments through its Shopify e-commerce website.

For card transactions:

  • Customers enter payment information through the applicable Shopify checkout/payment environment.

  • Clover Payments processes applicable online card transactions as the third-party payment gateway/processor.

  • PayPal may process transactions when a customer selects PayPal as the payment method.

  • Caris Clothing does not intentionally store full payment card numbers or CVV/security codes.

  • Payment information is transmitted to the applicable payment service provider for authorization and processing.

  • Caris Clothing does not retain sensitive authentication data after authorization.

Caris Clothing does not request or collect payment card information through email, ordinary text messages, social media messages, or other unsecured communication methods.

If a customer provides payment card information through an inappropriate channel, personnel should not record or retain that information and should direct the customer to use the authorized payment process.

5. Protection of Customer Information

Caris Clothing implements reasonable administrative, technical, and organizational safeguards designed to protect customer information against unauthorized access, disclosure, alteration, destruction, or misuse.

These safeguards include:

  • Use of reputable third-party e-commerce and payment service providers

  • Secure website and payment-processing environments

  • Encrypted transmission of information where supported by the applicable service

  • Access controls

  • Account authentication controls

  • Limiting access to authorized personnel

  • Secure handling of customer and order information

  • Periodic review of security practices

Caris Clothing does not intentionally maintain a database of full payment card numbers.

6. Access Control and Authentication

Access to Caris Clothing systems and customer information is restricted to authorized individuals who require access for legitimate business purposes.

Caris Clothing follows these principles:

  • User accounts are assigned only to authorized individuals where individual accounts are available.

  • Credentials must be kept confidential.

  • Passwords must not be shared with unauthorized individuals.

  • Strong, unique passwords should be used for administrative and business accounts.

  • Multi-factor authentication should be enabled where available, particularly for administrative, payment, e-commerce, email, and other sensitive accounts.

  • Access should be removed or changed when an individual's business role no longer requires access.

  • Administrative access should be limited to individuals who need it.

Caris Clothing does not intentionally share administrative credentials with unauthorized persons.

7. E-Commerce Security

Caris Clothing operates its online store using Shopify.

Because Shopify and Clover Payments provide important components of the e-commerce and payment environment, Caris Clothing relies on their applicable security controls for the services they provide.

Caris Clothing will:

  • Maintain an active and supported Shopify store.

  • Use authorized Shopify applications and integrations appropriate for business operations.

  • Review installed applications and remove applications that are no longer required.

  • Limit administrative access to authorized individuals.

  • Avoid installing or using applications that are unnecessary or present an unreasonable security risk.

  • Review significant changes to the e-commerce environment before implementation where reasonably practicable.

  • Maintain current contact and account information with relevant service providers.

  • Follow security guidance provided by Shopify, Clover, PayPal, and other relevant service providers.

Caris Clothing does not intentionally modify or interfere with payment-processing security mechanisms provided by its payment service providers.

8. Transmission Security

Caris Clothing uses secure, industry-standard communication mechanisms provided by its e-commerce and payment service providers for the transmission of customer and payment-related information.

Customer and payment information should not be transmitted through unsecured channels when an approved secure method is available.

Caris Clothing does not intentionally transmit full payment card numbers through ordinary email, text messages, social media, or other unsecured communication channels.

9. Vulnerability and Security Management

Caris Clothing maintains reasonable procedures for identifying and addressing security weaknesses in systems under its control.

These procedures include:

  • Keeping business devices and supported software reasonably current.

  • Applying security updates when they become available and are appropriate for the systems involved.

  • Maintaining supported versions of applications and services where reasonably practicable.

  • Removing unnecessary software, applications, integrations, and accounts.

  • Monitoring service-provider security notifications when applicable.

  • Addressing identified security issues within a reasonable timeframe based on their potential impact.

For systems managed by third-party service providers, Caris Clothing relies on the provider's applicable vulnerability-management and security-maintenance processes.

10. Malware and Malicious Software Protection

Caris Clothing takes reasonable precautions to protect business devices and systems against malware and other malicious software.

Personnel should:

  • Avoid opening suspicious attachments or links.

  • Avoid installing unauthorized software.

  • Keep supported operating systems, browsers, and security software reasonably current.

  • Report suspected malware or compromise promptly.

  • Use trusted sources when downloading software or applications.

Where security protections are provided and managed by a third-party platform or service provider, Caris Clothing relies on that provider's applicable controls.

11. Network and System Security

Caris Clothing uses third-party hosted platforms and services for its e-commerce and payment environment.

Where network or system security is managed by a third-party provider, Caris Clothing relies on that provider's security controls applicable to the services being provided.

Caris Clothing will take reasonable steps to secure systems under its direct control, including:

  • Restricting unauthorized access

  • Maintaining device security

  • Using supported software

  • Protecting administrative credentials

  • Avoiding unnecessary exposure of systems or services to the internet

  • Reviewing security settings when significant changes are made

Caris Clothing does not intentionally store payment card data on its own computers or local systems.

12. Security Monitoring and Logging

Caris Clothing uses the security, monitoring, and logging capabilities provided by its applicable e-commerce, payment, hosting, and business service providers.

Where security events or suspicious activity are identified, Caris Clothing will review the available information and take reasonable corrective action.

Where applicable, Caris Clothing will use available account activity, transaction records, administrative logs, and security notifications to identify potentially unauthorized activity.

13. Security Awareness

Caris Clothing recognizes that personnel play an important role in protecting customer and payment-related information.

Personnel with access to company systems or customer information are expected to understand and follow applicable security practices, including:

  • Protecting passwords and authentication credentials

  • Using authorized systems and applications

  • Recognizing phishing and other suspicious communications

  • Protecting customer information

  • Not recording or retaining payment card information unnecessarily

  • Reporting suspected security incidents promptly

Security responsibilities will be communicated to personnel appropriate to their roles.

14. Physical Security

Caris Clothing takes reasonable measures to protect physical access to business locations and devices used to conduct business operations.

Physical access to business devices and areas containing customer or business information should be limited to authorized individuals.

Devices used to access administrative accounts or customer information should not be left unattended in a manner that would permit unauthorized access.

Where payment-processing infrastructure is physically hosted and managed by a third-party provider, such as Shopify or Clover, Caris Clothing relies on the provider's applicable physical security controls.

15. Data Retention and Disposal

Caris Clothing retains customer and business information only for as long as reasonably necessary to:

  • Fulfill customer orders

  • Provide customer support

  • Process refunds and resolve transactions

  • Comply with legal, tax, accounting, and financial obligations

  • Maintain necessary business records

Caris Clothing does not intentionally retain full payment card numbers or sensitive authentication data.

When information is no longer required, Caris Clothing takes reasonable steps to securely delete, destroy, or anonymize the information where appropriate.

16. Security Incident Response

Caris Clothing maintains procedures for responding to suspected security incidents involving customer information, payment information, business systems, or unauthorized access.

A suspected security incident may include:

  • Unauthorized access to an administrative account

  • Suspected theft or disclosure of customer information

  • Suspected compromise of payment information

  • Malware infection

  • Phishing-related account compromise

  • Unauthorized changes to the e-commerce website

  • Suspicious payment activity

  • Loss or theft of a device containing business or customer information

When an incident is suspected, Caris Clothing will take reasonable steps to:

  1. Identify and assess the suspected incident.

  2. Secure affected accounts or systems.

  3. Change compromised credentials where appropriate.

  4. Contact the applicable service provider, such as Shopify, Clover, or PayPal.

  5. Preserve relevant information needed to investigate the incident.

  6. Determine whether additional action or notification is required.

  7. Document the incident and corrective actions taken.

Security incidents involving payment processing will be reported to the applicable payment processor or service provider as appropriate.

17. Third-Party Service Providers

Carisclothing LLC uses third-party service providers that support its e-commerce, payment processing, business operations, and other services. Relevant providers may include Shopify, Clover Payments, PayPal, and other service providers that may process, transmit, store, or potentially affect the security of account data.

17.1 Third-Party Provider Selection and Due Diligence

Before engaging a third-party service provider that may process, transmit, store, or affect the security of account data, Carisclothing LLC performs reasonable due diligence appropriate to the size and complexity of the business and the services being provided.

As applicable, the due-diligence review considers:

  • The services provided and whether the provider will have access to, process, transmit, or otherwise affect account data.
  • The provider's security practices and relevant security documentation.
  • The provider's PCI DSS compliance status, where applicable.
  • How PCI DSS security responsibilities are divided between Carisclothing LLC and the provider.
  • The provider's incident response and security breach notification practices.

  • Relevant contractual terms, policies, and security requirements.

  • Available evidence of the provider's security and compliance practices.

The extent of due diligence may be based on the type of service, the provider's role in payment processing, the potential impact on account-data security, and the size and complexity of Carisclothing LLC's operations.

17.2 Third-Party Provider Approval and Documentation

Carisclothing LLC reviews available information before establishing relationships with applicable third-party service providers and maintains reasonable documentation of the provider, services provided, and relevant security or compliance information.

Where a provider's services are changed, materially expanded, or replaced, Carisclothing LLC reviews the provider relationship and updates its third-party provider records as appropriate.

17.3 Ongoing Third-Party Provider Management

Carisclothing LLC periodically reviews its third-party service providers and updates its records when providers are added, removed, or materially changed.

Third-party providers that process, transmit, store, or could affect the security of account data are included in the business's third-party service provider inventory.

Carisclothing LLC relies on third-party providers for security controls applicable to services they provide and does not assume that a provider's PCI DSS compliance eliminates Carisclothing LLC's own PCI DSS responsibilities. 

17.4 Annual Monitoring of Third-Party Provider PCI DSS Compliance

Carisclothing LLC monitors the PCI DSS compliance status of applicable third-party service providers at least once every 12 months.

The annual review focuses on third-party service providers that process, transmit, store, or could affect the security of account data within the scope of the business's PCI DSS assessment. The review may include checking the provider's current PCI DSS compliance status, Attestation of Compliance (AOC), compliance documentation, security documentation, or other appropriate evidence provided by the service provider.

For each applicable provider, Carisclothing LLC documents the date of review, the provider reviewed, the services relevant to the business, and the available evidence of PCI DSS compliance or security status.

If a provider's PCI DSS compliance status changes, expires, or becomes unavailable, Carisclothing LLC evaluates the potential impact on its payment environment and takes appropriate action, which may include contacting the provider, obtaining updated compliance documentation, reviewing the applicable service arrangement, or considering an alternative provider.

The annual review is performed at least once every 12 months and is also performed when a material change occurs in a third-party provider's services or security status.

18. PCI DSS Responsibilities

Carisclothing LLC is responsible for maintaining the security practices applicable to its own environment and for understanding its PCI DSS responsibilities when using third-party service providers.

Third-party service providers remain responsible for the security of account data they possess or otherwise store, process, or transmit on behalf of Carisclothing LLC, and for security controls applicable to services they provide, as established by their applicable agreements and service responsibilities.

Carisclothing LLC maintains documentation sufficient to identify the third-party providers relevant to its payment environment and to understand the division of security responsibilities between the business and those providers.

18.1 PCI DSS Responsibility Allocation

Carisclothing LLC maintains information describing the allocation of PCI DSS responsibilities between the business and applicable third-party service providers.

The responsibility allocation is based on the services provided by each third-party service provider and the applicable contractual, security, and PCI DSS documentation available from the provider.

At a high level:

PCI DSS Area Carisclothing LLC Third-Party Service Provider
Protection of account data within provider-managed payment systems Oversight and appropriate merchant responsibilities Responsible for applicable provider-managed systems and services
E-commerce website and checkout infrastructure Responsible for merchant configuration, account security, and appropriate use Shopify responsible for Shopify-managed platform infrastructure and security controls
Online payment processing Responsible for appropriate merchant configuration and use of payment services Clover Payments responsible for applicable payment gateway/processing infrastructure and controls
PayPal payment processing Responsible for appropriate merchant configuration and use PayPal responsible for applicable PayPal-managed payment infrastructure and controls
Access control to merchant accounts Responsible Provider responsible for access controls within its own systems
Security of provider-managed systems Oversight and monitoring of provider relationship Responsible for applicable provider-managed systems
Security policies and procedures Responsible Provider responsible for its own applicable policies and controls
Incident response involving provider-managed services Responsible for responding to incidents affecting the business and coordinating with providers Responsible for its own applicable incident response and notification obligations
PCI DSS compliance of provider-managed services Responsible for monitoring provider compliance status Responsible for applicable PCI DSS requirements for the services it provides
Merchant-side devices, accounts, and business operations Responsible Not applicable unless specifically provided or managed by the provider

Carisclothing LLC does not assume that a third-party service provider's PCI DSS compliance eliminates the business's own PCI DSS responsibilities. The business maintains awareness of the division of responsibilities and reviews the applicable provider documentation when services or payment-processing arrangements change.

Where responsibilities are shared, Carisclothing LLC documents the applicable responsibilities based on the provider's contractual terms, PCI DSS documentation, and service configuration.

19. Security Policy Review

This Information Security Policy will be reviewed at least annually and whenever significant changes occur to Caris Clothing's business, e-commerce environment, payment-processing methods, systems, or security responsibilities.

The review will consider:

  • Changes to payment-processing methods

  • Changes to Shopify or Clover integrations

  • Addition or removal of payment service providers

  • Changes to systems or applications

  • Security incidents

  • Changes to applicable PCI DSS requirements

  • Changes to business personnel or responsibilities

The policy will be updated when necessary to remain accurate and appropriate for Caris Clothing's environment.

20. Policy Enforcement

Caris Clothing expects all personnel with access to company systems or customer information to comply with this policy.

Failure to follow applicable security requirements may result in removal or restriction of access to company systems and may lead to additional corrective action appropriate to the circumstances.

21. Contact Information

Questions regarding this Information Security Policy or information-security concerns should be directed to:

Caris Clothing - Operated by Carisclothing LLC

35 West 31st Street, Store 1
New York, NY 10001-4418
United States

Email: support@carisclothing.com

22. Approval

This Information Security Policy is approved and maintained by the management of Carisclothing LLC.

Policy Owner: Carisclothing LLC – Owner/Management
Effective Date: September 15, 2025
Last Reviewed/Updated: September 11, 2026