LEGAL NOTICES

This Customer Privacy Policy explains how SABRACADABRA LTD ("SABRACADABRA", "we", "us", or "our") collects, uses, shares and protects your personal information when you interact with us online or through any other digital experience we control.

SABRACADABRA LTD is a company incorporated in England and Wales and operates globally through its online channels.

This Privacy Policy is intended to meet the requirements of UK and European data protection law (including the UK GDPR and EU GDPR), and is applied consistently in other countries where we operate, subject to any mandatory local rules. Where local law grants you additional rights or imposes specific obligations on us, we will comply with those local rules.

Orders are currently fulfilled primarily from Italy, with some shipments from the United Kingdom and, where necessary, other locations depending on stock and logistics. Your personal information will be processed in those countries in order to prepare, ship and deliver your purchases.

1. WHAT IS COVERED BY THIS PRIVACY POLICY?

This Privacy Policy covers situations where we access, collect, store, process, use, disclose or otherwise handle personal information about you in connection with:

• visits to or use of our websites, mobile sites, apps, and other digital services that link to this Privacy Policy;

• your purchase of our products, creation and use of an account, and participation in our marketing programmes and campaigns;

• your communications and interactions with our customer support and brand teams, including email, chat, social media and other direct contact.

This Privacy Policy does not cover services or sites operated by third parties acting on their own account, including:

• social media platforms (such as Instagram, TikTok, WeChat, WhatsApp, Facebook or others), even if we publish content or run campaigns there; or

• third-party marketplaces, payment providers or logistics providers where they act as independent controllers of your data.

These third parties have their own privacy and cookie policies. The way they use your information is governed by their rules, not ours. We encourage you to read those policies carefully.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL INFORMATION?

For the purposes of UK and EU data protection law, the entity that determines "why" and "how" your personal information is processed is:

SABRACADABRA LTD
A company incorporated in England and Wales
Registered office: London, United Kingdom

SABRACADABRA LTD acts as the data controller of your personal information for the activities described in this Privacy Policy.

We may engage carefully selected third parties (such as hosting providers, payment processors, fraud-prevention service providers, fulfilment partners and analytics providers) to process personal information on our behalf in accordance with our written instructions. These entities act as data processors (or equivalent concepts under local law) and are bound by confidentiality and data security obligations.

In some situations, third parties may act as independent controllers (for example, social media platforms, independent logistics providers or regulated payment institutions). In those cases, their own privacy policies will apply to the way they handle your personal information.

3. HOW CAN YOU CONTACT US ABOUT PRIVACY?

We have appointed a privacy contact responsible for overseeing questions in relation to this Privacy Policy and our handling of personal information.

If you have any questions, concerns, or requests to exercise your data protection rights, you can contact us at:

Email: dataprivacy@sabracadabra.com

You also have the right to lodge a complaint with your local data protection authority if you believe we have not handled your personal information in line with applicable law. In the UK, the supervisory authority is the Information Commissioner's Office (ICO). We would appreciate the opportunity to respond to your concerns directly before you contact a regulator.

4. WHAT PERSONAL INFORMATION DO WE COLLECT?

"Personal information" (or "personal data") means any information that identifies you or can be used to identify you directly or indirectly. We may collect and process the following categories:

• Identity data – for example, first name, last name, title, date of birth, and unique identifiers (such as account ID or order number).

• Contact data – for example, email address, telephone number, billing address, delivery address and country of residence.

• Account and profile data – for example, username, password, language and currency preferences, wishlist, saved items, purchase history and communication preferences.

• Order and transaction data – details regarding the products you purchase or return, order dates and numbers, payment status, fulfilment status and related correspondence. Payment card details are handled by our payment providers and are not stored in full by us.

• Technical and usage data – for example, IP address, device identifiers, browser type, operating system, time zone settings, information about how you use our site (pages viewed, scrolls, clicks, referring URLs) and how you interact with our emails or campaigns. This may be collected via cookies and similar technologies (see Section 7).

• Marketing and communications data – for example, your choices for receiving marketing from us and your responses to surveys, campaigns or events.

• Support and interaction data – for example, messages and correspondence with our customer service, including the content of your requests and any information you choose to provide.

We do not intentionally collect special categories of personal data about you (such as health information, political opinions or religious beliefs), nor information relating to criminal convictions, unless required by law or you provide such information voluntarily in a specific context (for example, in relation to a complaint). In those rare cases, we will only use such information where strictly necessary and permitted by law.

5. WHEN AND HOW DO WE COLLECT YOUR PERSONAL INFORMATION?

We collect personal information directly from you, automatically when you interact with our services, and from third-party sources:

• Directly from you – for example, when you create an account, make a purchase, sign up to a newsletter, contact customer service, participate in a campaign, or otherwise communicate with us.

• Automatically – when you browse our site, open our emails or interact with our content, we may collect technical and usage data through cookies and similar technologies (see Section 7).

• From third-party sources – for example, from:

  • analytics and advertising partners (such as Google or Meta) that help us understand how people use our services and improve our campaigns;

  • payment and fraud-prevention providers that help us process payments securely and prevent abuse;

  • logistics and fulfilment partners that help us deliver your orders.

Where we receive personal information from third-party sources, we only do so where they confirm they have a lawful basis to share that information with us. Where required by law, we will inform you when we obtain data from such sources.

6. WHY DO WE USE YOUR PERSONAL INFORMATION?

We process your personal information only where we have a valid legal basis. Depending on your country or region, this may include:

• Performance of a contract – to provide the products or services you have requested (for example, to process your orders, take payment, deliver products, provide customer service, manage returns and warranties).

• Legitimate interests – to operate and improve our business, secure our services, prevent fraud and abuse, understand how our customers use our products, and develop new ones, provided that your rights and interests do not override our interests.

• Compliance with legal obligations – for example, to comply with tax, accounting, regulatory or law-enforcement requirements.

• Your consent – for example, where required for certain marketing communications, for non-essential cookies, or for specific optional services. You can withdraw your consent at any time (see Section 13).

In practice, this means we use your personal information for the following main purposes:

• To provide our products and services – including creating and managing your account, processing and fulfilling orders, managing payments and refunds, and providing customer support.

• To manage your SABRACADABRA profile – keeping your details up to date, linking your purchases and interactions to your account, and enabling you to access a consistent, personalised experience across our digital channels.

• To provide tailored communications and experiences – such as personalised product suggestions, content, and campaigns, based on your preferences, purchase history and interactions with the brand (where allowed by law and, where required, with your consent).

• To operate, secure and improve our services – including monitoring performance, diagnosing issues, detecting and preventing fraud or abuse, improving our site design and user journeys, and running analytics and reporting.

• To comply with legal and regulatory obligations – including record-keeping obligations, responding to lawful requests from authorities, and enforcing our terms and policies.

7. COOKIES AND SIMILAR TECHNOLOGIES

We use cookies and similar tracking technologies (such as pixels and tags) to enable core site functionality, remember your preferences, understand how our services are used, and tailor content and advertising.

Some cookies are strictly necessary for the site to function. Others are optional and are used for analytics, personalisation and marketing. Where required by law, we will ask for your consent before placing non-essential cookies on your device.

You can manage your cookie preferences through your browser settings and, where available, through our cookie management tool. If you block or reject certain cookies, some parts of the site may not function properly.

For more detail on the types of cookies we use and your choices, please refer to our Cookie Policy.

8. WITH WHOM DO WE SHARE YOUR PERSONAL INFORMATION?

We do not sell your personal information. We may share your personal information with:

• Service providers – including IT hosting and cloud providers, payment processors, fraud-prevention partners, logistics and fulfilment partners, customer support tools, analytics providers and marketing technology partners who process personal information on our behalf and under our instructions.

• Professional advisors and authorities – including auditors, banks, insurers, legal and other professional advisors, and public authorities where necessary for legal, regulatory or security reasons.

• Business transfers – in connection with any merger, acquisition, restructuring, financing or sale of all or part of our business, where your personal information may be shared with the relevant counterparties and their advisors, subject to appropriate confidentiality protections.

When we share personal information with third parties acting as processors, we require them by contract to protect your information, use it only for the purposes we specify, and handle it in accordance with applicable data protection laws.

9. INTERNATIONAL TRANSFERS

SABRACADABRA is based in the United Kingdom but works with partners and service providers around the world. Our warehouses and fulfilment partners are currently located mainly in Italy and in the United Kingdom, and we may work with other providers in the European Union and beyond. This means your personal information may be transferred to and processed in countries outside the UK or European Economic Area ("EEA"), including countries that may have different data protection standards from those where you live.

Where we transfer personal information outside the UK or EEA, we take steps to ensure that an adequate level of protection is provided, including by:

• transferring to countries that have been formally recognised as providing an adequate level of data protection; and/or

• using contractual protections (such as the European Commission or UK International Data Transfer Agreement / Standard Contractual Clauses) and implementing additional safeguards where appropriate.

If you would like more information about international transfers or copies of the relevant safeguards, you can contact us using the details in Section 3.

10. HOW LONG DO WE KEEP YOUR PERSONAL INFORMATION?

We keep your personal information only for as long as necessary to fulfil the purposes for which we collected it, including to meet any legal, accounting or reporting requirements.

The exact retention period depends on the type of information and the legal context but typically includes:

• retention of order and transaction records for a period required by tax and accounting laws;

• retention of account information for as long as your account is active and for a reasonable period afterwards if you close it, to handle potential disputes or enforce our terms;

• shorter retention periods for technical logs and analytics data where we only need them in aggregate form.

When we no longer need personal information for the purposes described above, we will delete or anonymise it. If we anonymise data so that it can no longer be associated with you, we may use that information indefinitely without further notice to you.

11. HOW DO WE PROTECT YOUR PERSONAL INFORMATION?

We implement appropriate technical and organisational measures designed to protect your personal information against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.

Access to personal information is limited to those employees, agents, contractors and third parties who need to know it for legitimate business purposes and who are subject to confidentiality obligations.

While we take reasonable steps to protect your information, no system or transmission over the internet can be guaranteed as completely secure. You are responsible for keeping your account credentials confidential and for notifying us immediately of any suspected unauthorised access to your account.

12. CHILDREN

Our services are not directed to children, and we do not knowingly collect personal information from anyone under the age of 16 (or such other age as may be specified by local law). If we become aware that we have collected personal information from a child contrary to applicable law, we will delete it.

13. WHAT ARE YOUR RIGHTS?

Depending on where you live and subject to applicable law, you may have some or all of the following rights in relation to your personal information:

• Right of access – to obtain confirmation as to whether we process your personal information and receive a copy of it.

• Right to rectification – to have inaccurate or incomplete personal information corrected.

• Right to erasure – to request deletion of your personal information in certain circumstances (for example, where we no longer need it for the purposes for which it was collected), subject to legal retention obligations.

• Right to restriction – to request that we limit our use of your personal information in certain circumstances (for example, while we verify or investigate your concerns about the accuracy of the data).

• Right to object – to object to our processing of your personal information where we rely on legitimate interests, including the right to object at any time to processing for direct marketing.

• Right to data portability – to receive a copy of certain personal information in a structured, commonly used, machine-readable format and to request that we transfer it to another controller, where technically feasible.

• Right to withdraw consent – where we process your personal information based on your consent, you can withdraw that consent at any time. This will not affect the lawfulness of any processing carried out before you withdraw consent.

To exercise any of these rights, contact us at dataprivacy@sabracadabra.com. We may need to verify your identity before fulfilling your request.

Your rights are subject to certain limitations and exceptions under applicable law. Where we are unable to fully comply with your request, we will explain the reasons.

14. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time, for example to reflect changes in our services, technologies, legal requirements or how we handle personal information.

When we make material changes, we will update the "Effective date" at the top of this page and, where required, notify you by email or through our services so that you can review the changes.

We encourage you to review this Privacy Policy periodically to stay informed about how we use your personal information.

15. CONTACT US

If you have any questions about this Privacy Policy, our use of your personal information, or if you wish to exercise your rights, you can reach us at:

Email: dataprivacy@sabracadabra.com

16. ADDITIONAL INFORMATION FOR CALIFORNIA RESIDENTS

This section applies in addition to the rest of this Privacy Policy if you are a resident of California and we collect personal information that is subject to the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

In this section, "personal information" has the meaning given in the CCPA and does not include information that is publicly available, de-identified or aggregated.

Over the past twelve (12) months, we have collected the categories of personal information described in Section 4 (such as identifiers, commercial information, internet or other electronic network activity information, and approximate location data). We collect these categories of personal information from the sources and for the purposes described in Sections 5 and 6 of this Privacy Policy.

• Identifiers (such as name, email address, postal address, phone number, account identifiers or device identifiers).

• Commercial information (such as records of products purchased, returned or considered).

• Internet or other electronic network activity information (such as browsing history, interactions with our site and marketing communications).

• Approximate location (derived from IP address or shipping address).

We do not "sell" your personal information for money. We also do not knowingly "share" personal information for cross-context behavioural advertising in the meaning of the CCPA. If our practices change, we will update this Privacy Policy and provide any required notices and choice mechanisms (such as a "Do Not Sell or Share My Personal Information" link).

• Right to know/access – to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which it was collected, the purposes for collecting it, and the categories of third parties with whom it is shared.

• Right to deletion – to request that we delete personal information we have collected from you, subject to certain exceptions (for example, where we need the information to provide you with services, to detect security incidents, or to comply with legal obligations).

• Right to correction – to request that we correct inaccurate personal information that we maintain about you.

• Right to opt out of sale/sharing – if we engage in activities that constitute a "sale" or "sharing" of personal information under the CCPA, you would have the right to direct us not to sell or share your personal information.

• Right to non-discrimination – we will not discriminate against you for exercising any of your rights under the CCPA.

You may exercise your California privacy rights by contacting us at dataprivacy@sabracadabra.com. We will take reasonable steps to verify your identity before responding to your request, which may include asking you to provide certain information that we already hold about you.

You may also authorise an agent to make a request on your behalf. Where you use an authorised agent, we may require proof of their authorisation and may still ask you to verify your identity directly with us.