LS Retail Privacy Policy

If you are a California resident, please visit the California Privacy Notice section for more information about your specific privacy rights.

At LS Retail ehf., which is part of the LS Retail and its subsidiaries and affiliates ("we," "our," or "us"), are committed to protecting and respecting your privacy. This Privacy Policy explains how we collect, use, store, process, disclose, and safeguard your (“you”) personal data when you interact with our software, services, website, and other methods of communication.

While our headquarters and operations are within the European Economic Area (EEA), and we comply with the General Data Protection Regulation (EU) 2016/679 (GDPR), this Privacy Policy also extends to our subsidiaries and affiliates operating globally, ensuring compliance with other applicable privacy laws in other regions of the world.

We respect your concerns about how your Personal Data and company information are used and collected. This Privacy Policy describes how we collect, use, and share personal data, along with details on how you can contact us with privacy-related inquiries. Additionally, the Policy outlines your rights as a data subject, including the right to object to certain uses of your personal data, and the choices available to you regarding how we process your information.

This Privacy Policy was last revised: May 2025

The personal data we collect is essential for various business purposes, including ensuring security, improving our products and services, processing transactions, and fulfilling legal obligations. For example, when you request a demo of our solutions, subscribe to our communications, or register for our events. Below, we explain the types of personal data we collect, why we collect them, and how they are used.

We may collect and process the following categories of personal data:

• Personal information: Name, job title, company name, postal address, email address, phone number, signature, and demographic information.
• Account information: Username, password, and other security details related to your account, if applicable.
• Transaction data: Credit or debit card information, transaction details, purchase history, payment methods, and fraud prevention data.
• Usage and technical data: Browsing behavior, logs, cookies, IP addresses, device identifiers, search history, Browser type, operating system, internet connection details, device versions, software application versions, and geolocation data.
• Marketing and communication preferences: Preferences for receiving communications from us and third parties, including marketing consent.
• Purchasing information: Products or services purchased or considered, and customer service interactions.
• Audio-visual information: CCTV footage or other audio-visual recordings collected at our physical locations or at our Events.
• Information from third parties: Data received from partners or third-party providers regarding services or products you've interacted with.
• Other information provided by you: Any other information you submit directly through forms, communications, or website interactions. This includes data you submit via forms on our website (e.g., lsretail.com), communications, surveys, or feedback forms, as well as any other voluntary submissions of information.

We use and share your personal data responsibly and in accordance with applicable data protection laws, including the general data protection regulation (GDPR). We rely on several legal bases to process your personal data, such as consent, contractual necessity, legal obligations, and legitimate interests. Below, we outline how we use your data and the circumstances under which we may share it.

How we use your data

We use your personal data for the following purposes:

• Provision of services: to deliver our software, products, and services to you, including customer support and personalized settings such as language preferences.
• Account management: to manage your account, including creating and maintaining your login credentials, processing password reset requests, and verifying your identity.
• Billing and payment processing: to process payments, issue invoices, and manage billing-related activities for services you purchase from us.
• Fraud detection and security: to detect, investigate, and prevent fraud, unauthorized activities, or illegal activities, and to maintain the security of our systems and services.
• Compliance with legal obligations: to comply with laws, regulations, and legal processes such as court orders, tax obligations, and regulatory requirements.
• Improvement and development: to improve our products, services, and website functionality through research and data analytics. This also includes enhancing security, detecting issues, and improving user experiences.
• Marketing and communications: we may send you promotional materials and marketing communications related to our products and services. You may opt-out of marketing communications at any time.

We use cookies, server logs and similar tools to collect personal data, please see clause 9, for further information.

How we share your data

We may share your personal data with third parties in specific situations:

• Service providers: we share your personal data with trusted partners and third-party service providers who perform services on our behalf, such as cloud hosting, payment processing, venue hosts and customer support. These service providers only access your data as needed to perform their functions and are bound by confidentiality agreements and data protection laws.
• Business transfers: if we are involved in a merger, acquisition, or sale of assets, your personal data may be shared as part of that transaction. In such cases, you will be notified of any changes in ownership or use of your personal data.
• Affiliates and subsidiaries: we may share your personal data with our group companies and subsidiaries for internal business administration, legal compliance, and to provide you with information of our products and services.
• Legal compliance: where required by law, regulation, or in response to a valid legal request, we may disclose your personal data to governmental authorities, courts, or law enforcement agencies.
• Marketing partners: with your consent, we may share your personal data with marketing partners for promotional purposes, including interest-based advertising. You have the right to opt-out of such data sharing at any time.
• Fraud prevention: we may share your personal data with third-party fraud prevention agencies to help protect against, detect, and investigate fraudulent activity or other security-related risks.

Data protection measures

We ensure that any sharing of your personal data is done in accordance with GDPR and other applicable laws. This includes entering into data processing agreements with third-party service providers and ensuring that they implement adequate technical and organizational measures to safeguard your data.

Under the general data protection regulation (GDPR), we rely on a variety of legal grounds to process your personal data. The legal basis we use depends on the specific purpose for which your data is being processed. Below are the main legal bases we rely on:

• Contractual necessity: we process your personal data to fulfill our contractual obligations or to take steps at your request before entering into a contract. This includes activities such as providing our software, other products (if applicable) and services, processing transactions, and managing your account.
• Legitimate interests: we may process your data based on our legitimate interests, provided that those interests are not overridden by your rights and freedoms. Our legitimate interests include improving our products and services, managing and developing customer relationships, conducting business operations, fraud detection, and maintaining the security of our systems.
• Consent: in situations where we rely on your consent, we will ensure that you have given explicit permission for us to process your personal data. This primarily applies to sending you marketing communications and processing sensitive data (where applicable). You can withdraw your consent at any time without affecting the lawfulness of the processing based on consent before its withdrawal.
• Legal obligation: we may need to process your personal data to comply with legal and regulatory obligations (if applicable), such as tax laws, court orders, or other statutory requirements. This includes providing information to law enforcement agencies or other governmental bodies when legally required.

Each of these legal bases ensures that our processing activities are lawful, transparent, and aligned with both GDPR and other applicable data protection laws. Where required, we will provide additional information to ensure you understand the legal basis on which your data is being processed for specific purposes.

5. Data transfers, storage, and processing globally

As part of our global operations, your personal data may be transferred to, stored, or processed in countries outside of the EU and the European Economic Area (EEA). These transfers may occur within the ls retail, its subsidiaries or affiliates, or to trusted third-party vendors and service providers, in order to deliver our software, services, and products as described in this privacy policy.

When your personal data is transferred outside the EU/EEA to countries that may not offer the same level of data protection as within the EU/EEA, we ensure that adequate safeguards are in place to protect your information in compliance with the general data protection regulation (GDPR). These safeguards may include:

• Standard contractual clauses (SCCS): these are legal agreements approved by the European commission, ensuring that your data is protected when transferred outside the EU/EEA.
• Adequacy decisions: in certain cases, your personal data may be transferred to countries that the European commission has determined offer an adequate level of data protection. These countries have been formally recognized through an "adequacy decision," meaning that their legal frameworks provide protection comparable to GDPR standards. In such cases, no additional safeguards are required for transferring your data.
• Binding corporate rules (BCRS): for intra-group transfers, we may rely on BCRS to ensure a consistent level of protection for personal data within the ls retail group of companies.
• Other lawful mechanisms: in certain cases, we may rely on additional mechanisms, such as obtaining your explicit consent for cross-border transfers or transferring data under specific legal exemptions.

We take reasonable steps to ensure that all third parties and service providers with whom we share your personal data uphold strong privacy and security standards, irrespective of where they are located. This includes entering into data processing agreements with third-party vendors that comply with GDPR requirements and conducting due diligence to verify that they implement robust data protection practices.

Your privacy and the protection of your personal data remain a priority, and we will inform you whenever significant changes to our international data transfer practices occur.

6. Data retention

We will retain your personal data for as long as necessary to provide our services to you, fulfill legal and contractual obligations, or protect ourselves from potential disputes. This retention will be carried out in accordance with our data retention policy, which complies with applicable laws on record-keeping, bookkeeping, and the need for proof of business relationships in case of legal disputes.

Even after we cease providing services to you, we may continue to retain your personal data to:

• Comply with our legal and regulatory obligations;
• Support fraud monitoring, detection, and prevention activities; and
• Meet our tax, accounting, and reporting obligations, including retention required by contractual agreements with our partners.

When retaining your personal data, we will adhere to applicable laws, such as limitation periods for legal claims and statutory record retention requirements. Once your personal data is no longer required for these purposes, it will be securely deleted or anonymized in accordance with GDPR.

7. Your privacy rights

As a data subject within the EU and the European Economic Area (EEA), you have specific rights regarding your personal data, as outlined below. Depending on your location and applicable laws, you may have additional rights concerning our collection, use, and disclosure of your personal data.

• Right to be informed: you have the right to know how your personal data is collected, used or shared.
• Right of access: you have the right to request confirmation of whether we are processing your personal data and, if so, to request access to that data.
• Right to rectification: you have the right to request correction of any inaccurate, incomplete, or outdated personal data we hold about you.
• Right to erasure: you may request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected or under other legal conditions.
• Right to restriction of processing: you can request that we restrict the processing of your personal data under certain circumstances, such as when you contest its accuracy or object to our processing.
• Right to data portability: you can request to receive your personal data in a structured, commonly used, and machine-readable format, and to request its transfer to another data controller when technically feasible.
• Right to object: you have the right to object to the processing of your personal data for specific purposes, including direct marketing.
• Right to withdraw consent: where we process your personal data based on your consent, you can withdraw that consent at any time.
• Right not to be discriminated against: you have the right not to be discriminated against for exercising any of your rights outlined above.

To exercise these rights or for any inquiries related to your personal data, please contact us at dataprivacy@lsretail.com.

We do not sell or share your personal information with third parties for monetary or other valuable consideration.

If you have concerns about our processing of your personal data, you may report these to the icelandic data protection authority at www.personuvernd.is.

8. Security of your personal data

At ls retail, we prioritize the security of your personal data and implement appropriate technical and organizational measures to protect it from unauthorized access, disclosure, alteration, or destruction. Our security protocols include:

• Encryption and secure servers: we utilize the latest encryption technologies and secure server environments to safeguard your data.
• Regular security assessments: we conduct regular assessments to identify and mitigate potential security risks associated with our data processing activities.

While we implement robust security measures to protect your information, please be aware that no method of data transmission or storage is completely secure. Despite our best efforts, there is always some level of risks associated with data transmission information over the internet. By using our website, applications, or services, you acknowledge these inherent risks. Any transfer is at your own risk. Ls retail cannot accept responsibility for unauthorized access, loss, or misuse of data that may occur despite our security efforts.

To enhance your security, we encourage you to adopt best practices when using our services. This includes creating strong passwords, safeguarding your credentials against unauthorized use, and avoiding the use of identical login information across multiple services. If you suspect that your interaction with us is no longer secure, or if you believe that your personal data has been compromised, please contact us immediately at dataprivacy@lsretail.com.

If a breach occurs that is likely to result in a high risk to your rights and freedoms, we will notify the relevant supervisory authority, after becoming aware of the breach. We will also provide information about the nature of the breach, its potential consequences, and the measures taken or proposed to address it.

We use cookies and similar technologies on our website to enhance your user experience and analyze website traffic. Cookies are small data files stored on your device by a website that help us understand how our site is being used, allowing us to improve the functionality and performance of our services.

Cookies are small text files that are placed on your device when you visit our website. They enable us to remember your preferences and understand how users interact with our site. When you visit our website, you will be presented with a cookie banner where you can manage your cookie preferences. You can change your preferences at any time by clicking the ‘cookie settings’ link available on our site. While your browser settings allow you to block or delete cookies, we recommend using our cookie management tools for more granular control in line with legal requirement.

Types of cookies we use

• Essential cookies: these cookies are necessary for the website to function properly. They allow you to navigate our site and use its features, such as accessing secure areas. Without these cookies, certain services cannot be provided.
• Performance cookies: these cookies help us measure how our website is used by collecting information about visits, page views, and traffic sources. This information allows us to analyze and improve the performance of our website.
• Functional cookies: these cookies enable our website to remember choices you make (such as your username, language, or region) and provide enhanced, more personalized features.
• Marketing cookies: these cookies may be set by us or by third-party providers whose services we have added to our pages. They may be used to build a profile of your interests and show you relevant advertisements on other sites.

Most web browsers allow you to refuse cookies or delete cookies that have already been set. For more information on how to do this, please refer to your browser's help section. Please note that if you choose to disable cookies, your experience on our website may be limited.

Manage Cookie Settings

Web beacons

In addition to cookies, we may use digital images known as "web beacons" on our website or in our emails. Web beacons help us track the effectiveness of our marketing campaigns by monitoring how many users have opened an email or visited a specific page on our website. They allow us to manage cookies, count visits, and determine which marketing efforts are successful.

Our services and website are not intended for individuals under the age of 18. We do not knowingly collect, use, or disclose personal data from anyone under this age. If we determine upon collection that a user is under 18, we will not process their personal data without obtaining verifiable parental or guardian consent.

If we become aware that we have inadvertently collected personal data from a child under the age of 18, we will take reasonable steps to delete such information from our records. If you are a parent or guardian and believe that your child has provided us with personal data without your consent, please contact us immediately through the contact details provided in this policy, and we will promptly take appropriate action.

We encourage parents and guardians to educate their children on safe internet practices and to monitor their online activity to ensure their personal information is not shared without consent.

11. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our services, privacy practices, legal obligations, or technical advancements. Any updates will be posted on this page, and the "last revised" date will be updated to indicate when the changes were made.

In case of significant changes, we will take appropriate measures to notify you, in line with the nature of the updates. Your continued use of our website or services after such changes will constitute your acceptance of the revised privacy policy. We encourage you to review this policy periodically to stay informed about how we collect, use, and protect your personal data.

12. Contact information

We welcome questions and comments about this privacy policy. Please send queries to dataprivacy@lsretail.com or to:

LS Retail ehf.
Attn: legal department
Hagasmari 3
201 Kopavogur
Iceland

Last updated date: May 2025

LS Retail, its affiliates and subsidiaries (“we”, “our” or “us”) may collect the personal information of individuals who are resident in the state of California, USA ("consumers" or "you").

The defined terms used in this notice shall have the same meanings ascribed to them in the California consumer privacy act of 2018, as amended by the California privacy rights act of 2020 ("CCPA").

Where applicable, this California privacy notice (this "notice") will apply to you, in addition to the information contained in our privacy policy, this notice describes how we collect, sources, use, disclose and otherwise process your personal information, offline and online, within the scope of the CCPA.

Personal information disclosures

When we use the term "personal information" in this notice, we mean information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household in accordance with the CCPA.

For the purposes of this notice, personal information does not include:

• De-identified, aggregated or anonymized information that is maintained in a form that is not capable of being associated with or linked to you or a particular household.
• Publicly available information from government records.
• Information about job applicants, employees and other personnel which is covered by the terms of the candidate privacy notice.
• Information about the employees and other representatives of third-party entities who we may interact with in a commercial context.

Recipients of personal information

We share personal information internally among LS Retail affiliates (please refer to https://www.lsretail.com/contact-us and https://www.lsretail.com/find-a-partner for a list of our affiliates) and with our service providers that help us operate this website and our business. We may also share personal information with a variety of third parties, including for marketing purposes; if we are subject to certain corporate transactions or reorganizations; with third parties to comply with law or to protect our rights or the rights and safety of others; or for purposes otherwise disclosed.

For purposes of this notice, when we use the term "third party" we mean entities that are not service providers or contractors providing services on behalf of aptos and that are not entities with whom you interact with directly.

In the last 12 months, we have collected each of the categories of personal information noted below and disclosed it, for a business purpose, to the categories of recipients listed below. The sections below also indicate when we sold or shared the personal information to third parties in the last 12 months and the types of third parties.

• Identifiers, such as names, email address, postal address and job titles
• Commercial information including records of products or services purchased, obtained or considered, or other purchasing or consuming histories or tendencies.
• Internet/electronic network activity, such as ip address, device information, browsing history and search history, information regarding your interaction with our website (and our service provider's) and advertisements.
• Geolocation data, such as location information from your device or estimated location based on your ip address.
• Other personal information, such as information you post on our websites or on social media pages, and information you submit to us.
• Inferences, such as predictions about your interests and preferences based on your internet or electronic network activity.

• Service providers;
• Affiliates;
• Advertising partners;
• Analytics vendors;
• Marketing service and hosting service providers;
• Social network platforms;
• Contractors;
• Data brokers
• Government entities

• Advertising partners;
• Analytics vendors;
• Marketing service providers;
• Data brokers;
• Hosting service providers; and
• Social network platforms

Sources of personal information

As described in our privacy policy, we collect personal information directly from you when you provide it to us, automatically using cookies and other tracking technologies, from the categories of third parties listed in that policy and by combining personal information we may otherwise obtain.

Purposes for collecting personal information

We collect, sell, share or disclose personal information about you for the business and commercial purposes further described in the "legal basis for processing" section of the privacy policy including to:

• Analyze, improve and prevent the misuse of our website;
• Respond to inquiries and otherwise communicate with customers or individuals inquiring about our product offering or events;
• Optimize and personalize your experience with our website, such as to identify and/or store your location;
• Register you for events that we host or sponsor;
• Send you marketing information such as news, alerts and events that may be of interest to you, unless you opt out of subscribing to our communications;
• Comply with regulatory requirements, including legal and ethical obligations;
• Support our recordkeeping, legal services and other business operations;
• Protect or defend our rights and the rights of others, or as otherwise required by law; and
• Further any business transfers, such as in the event of a sale, a merger or bankruptcy reorganization (and sale).

Retention of personal information

The period for which we retain your personal information varies, depending on the type of personal information and the purpose for which it was collected. The duration is limited to time necessary to fulfill the purposes for which the information was collected, in light of any restrictions or deletions you might request, as well as our need to address our legal obligations or rights.

Your California privacy rights

As a California resident, you may be able to exercise the following rights in relation to the personal information about you that we have collected (subject to certain limitations at law):

How to exercise your California privacy rights

To exercise your rights to know, access, correct, delete and/or "shine the light"

Please submit a request by filling out our US privacy rights request form

We may need to verify your identity and confirm you are a resident of the state of California before processing most requests, which may require us to obtain additional personal information from you. In order to verify your identity, we will generally require either the successful authentication of your account, or the matching of sufficient information you provide us to the information we maintain about you in our systems.

Please provide your name, email address and mailing address in the original request, as well as an explanation of the rights you wish to exercise. We will only use the personal information provided in connection with the us privacy rights request form to review and comply with the request. If you do not provide this information, we may not be able to verify or complete your request in all circumstances.

If you wish to submit a verifiable consumer request on behalf of another individual, we will also need sufficient information to verify that the individual is the person about whom we collected personal information and that you are authorized to submit the request on their behalf. Please see the "authorized agents" section below for more information.

In certain circumstances, we may decline a request to exercise the rights described above, in accordance with applicable law.

To exercise your right to opt out of personal information sales or sharing

To exercise your right to opt out of personal information sales or sharing, we may ask you to provide additional personal information (including your name, email address and mailing address) so that we can properly identify you in our dataset to facilitate the opt-out request. If you choose not to provide this information, we may only be able to process your request to the extent we are able to identify you in our data systems.

Once you make an opt-out request, you may change your mind and opt back in to personal information sales at any time by contacting us at dataprivacy@lsretail.com

To exercise your right to opt-out of personal information sales or sharing, please submit a request by clicking the button below:

Do not sell or share my personal information

In addition, as is common practice among companies that operate online, we permit third party advertising networks, social media companies and other third-party businesses to collect personal information directly from your browser or device through cookies or similar online tracking technologies when you visit or interact with our websites, use our apps or otherwise engage with us. For example, they may collect internet/network information, such as a cookie or device id, browsing history and website usage, geolocation data, commercial information, and inferences generated from your browsing history and interactions with our service as well as other sites and services. These third parties use this information for the purposes of serving ads that are more relevant, for ad campaign measurement and analytics, and for fraud detection and reporting and may sell or share that information to other businesses for advertising and other purposes.

You can adjust your web browser's settings or cookie settings which will allow you to opt out of certain online advertising and third party tracking activities.

Authorized agents

In certain circumstances, you are permitted to use an "authorized agent" (as that term is defined by the CCPA) to submit CCPA requests on your behalf. We may verify the authorized agent's authority to act on your behalf as follows:

For requests to know, access, correct or delete personal information, we may ask you to provide sufficient evidence to show that you have provided the authorized agent signed permission to act on your behalf, verified your own identity directly with us pursuant to the instructions set forth in this notice, and directly confirmed with us that you provided the authorized agent permission to submit the request on your behalf.

For requests to opt-out of personal information "sales" or "sharing," we may ask you to provide a signed permission demonstrating your authorized agent has been authorized by you to act on your behalf.

How to contact us

If you have any questions, comments or concerns with respect to our privacy practices or this notice, or wish to update your information, please feel free to contact us at dataprivacy@lsretail.com. You may also write to us at the following address:

LS Retail ehf.
Attn: legal department
Hagasmári 3
201 Kópavogur
Iceland

Changes in notice

From time to time, we may change our notice. We will notify you of any material changes to our notice as required by law. We will also post an updated copy of this notice on our website. Please check our website periodically for updates.

By visiting the Website and using LS Retail’s products or services, you agree to the terms of the Privacy Policy. Personal information may be processed by LS Retail’s trusted vendors and other third parties in the country where is was collected as well as other countries where laws regarding processing of Personal Information may be less stringent.

All text, graphics, logos, icons, images and other content contained on the Website as well as the selection and arrangement thereof are the exclusive property of LS Retail or its licensors and are protected by copyright and trademark laws. All rights not expressly granted are reserved.

Content made available to you on this website may contain images or other pictorial or graphic work licensed to LS Retail by 3rd parties. By downloading or accessing this content you expressly agree that your rights to use that content are limited and that you may only use this content on LS Retail’s behalf, i.e. with the sole purpose to promote LS Retail, and that you have no additional rights to the work, as set forth in the following license terms: https://stock.adobe.com/uk/license-terms https://unsplash.com/license