JOYBUY PRIVACY POLICY

Version February 2025

Jingdong Retail (UK) Limited (“Joybuy”, "we", "us" or "our") attaches great importance to the protection of its users' and customers' privacy and personal information. We collect and use Personal Data (defined below) when you visit our website (www.joybuy.com), use the Joybuy app "App" and buy our products and / or services, contact us or otherwise engage with us (together the "Services").

This Privacy Policy ("Policy") explains how we and other members of our group collect, use, retain, share, transfer or otherwise process your Personal Data (defined below) when you, or business users (your “Personnel”), access and use our Services.

Please note, our processing activities may differ if you have registered for an account with us or if you have signed-up for one of our memberships. Where there is a distinction between the way in which we use the Personal Data of members and non-members, we will make this clear below (see section 4 (Details of processing) for more information).

Please read this Policy carefully. If you have any questions, please feel free to contact us via support@joybuy.com.

You should also review our Terms of Use and Cookies Policy to understand other aspects of our relationship with you.

This Policy covers:

1. Scope
2. How we obtain your Personal Data
3. Lawful Basis of processing Personal Data
4. Details of processing
5. Sharing with third parties
6. Transfer to countries outside the EEA and UK
7. Retention periods
8. Your rights
9. Protection of minors
10. Contact details
11. Changes to this Policy

1 Scope

1.1 We will only process Personal Data in accordance with this Policy. Personal Data means information from which you may be identified both directly (from that information alone) and indirectly (when different pieces of information are combined) ("Personal Data").

1.2 The Services include links to third party websites and integrated third party services (such as our customer service agent). This Policy does not apply to such third-party services and we are not responsible for the content of these websites, services provided by these third parties or their compliance with the applicable privacy and data protection legislation. Please review third-party privacy policies and, where applicable, your privacy settings of such third parties.

2 How we obtain your Personal Data

2.1 We obtain your Personal Data in various ways:

a. We obtain your Personal Data when you provide it to us. For example, if you contact us, if you sign up for our newsletter or if you provide information to us in the course of receiving our Services.

b. We obtain your Personal Data automatically when you use our Services. For example, we automatically obtain information about you via cookies when you visit our website. For more information on this, please see our Cookie Policy here.

c. We obtain your Personal Data from other sources. For example, from social media platforms such as Facebook, Instagram, TikTok, Pinterest, Twitter if you view or interact with our content on those platforms. We will only be able to see the content you post to your social media account if your profile is set to "public" or if we are "following" you. For more information on the specific categories of Personal Data we collect and process about you, please see section 4 (Detail of processing) below.

3 Lawful Basis of processing Personal Data

3.1 We process your Personal Data where we have a lawful basis under UK and European data protection law for doing so. Lawful bases for processing include consent, contractual necessity and our “legitimate interests” or the legitimate interests of others. "Legitimate interests" is a legal term used in UK and European data protection law. When we rely on legitimate interests, we mean in pursuing our own interests we have considered your rights and interests at the same time, and concluded that these are not overridden by your rights.

3.2 It may be that providing certain Personal Data to us is a statutory or contractual requirement, a requirement necessary to enter into a contract, or that you are otherwise obliged to provide the data to us. If that is the case, we will inform you thereof separately, and will also explain the possible consequences if you fail to provide such Personal Data to us.

3.3 If we rely on your consent to process your Personal Data, we will ask for this before processing.

4 Details of processing

4.1 The table below sets out what Personal Data we process about you, for which purposes and on which legal basis.

Activity	Personal Data processed	Lawful basis and purposes for processing
Visiting our website or app (“Cookie Information”)	• IP address • Your device's unique identifier, such as its IMEI (International Mobile Equipment Identity) or MEID (Mobile Equipment Identifier) • Browsing history • Cookie preferences • Movements on our websites or websites of third parties gathered through tracking cookies • Information gathered through “event tracking” activities. • Information gathered through “device fingerprinting”, where we combine information about the browser, hardware device and their settings to infer it is the same user using our Services. For detailed information about our use of cookies, we refer to our Cookie Policy.	We collect these Personal Data on the basis of your consent or, in case we are not legally required to obtain consent, on the basis of our legitimate interests, namely improving our online services. This is the case with regard to technical cookies necessary for the functioning of the website and several analytic cookies that are not used to treat you differently from other users. We process your Personal Data for purposes of (i) improving our website and/or app, (ii) being able to show you the products and services that fit your preferences, (iii) being able to provide you with consistent service across all your devices, (iv) enhancing our security and protecting your information and (v) identifying you and enhancing your shopping experiences.
Registering a user account (“user account information”)	• Your gathered cookie information • Telephone number • Email address • Gender • Date of birth • Login details, such as your login name, password, answers to passphrase protection answers, and your Google, Facebook and/or AppleID login information (if you choose to login through one of these third parties). • User avatar We collect these Personal Data on the basis of your consent or, in case we are not legally required to obtain consent, on the basis of our legitimate interests, namely verifying your identity for security reasons. We process your Personal Data for the purposes of (i) registering you as a user to our Services, (ii) verifying your identity to make sure you are who you say you are, and (iii) enhancing our security and protecting your information.	We collect these Personal Data on the basis of your consent or, in case we are not legally required to obtain consent, on the basis of our legitimate interests, namely verifying your identity for security reasons. We process your Personal Data for the purposes of (i) registering you as a user to our Services, (ii) verifying your identity to make sure you are who you say you are, and (iii) enhancing our security and protecting your information. We collect and process your Personal Data for security and risk management purposes, including to detect and prevent fraud, unauthorized activities, and access, and to ensure the security of our Services.
Additional memberships (“membership information”)	• Your gathered cookie information • Your provided user account information • Your provided shopping information with regard to purchases made through the membership card • Family card name • Members added to the family card • Type of membership • Duration of the membership • Credit and coupon amounts • Information with regard to cancellation of the membership	We collect these Personal Data on the basis of your consent or, in case we are not legally required to obtain consent, as this is necessary for the performance of a contract or on the basis of our legitimate interests, namely verifying your identity for security reasons. We process your Personal Data for the purposes of (i) registering you as a member, (ii) carrying out our obligations with regard to your membership, (iii) verifying your identity to make sure you are who you say you are, and (iv) enhancing our security and protecting your information.
Online shopping (“shopping information”)	• Your gathered cookie information • Your provided user account information • Contents of your shopping basket • Order information, such as verification information, the consignee`s name, order number, the goods and/or services purchased, serial numbers, price and terms of payment • Payment details, such as you bank card number, billing address, payment method, amount paid, date of payment and outstanding payments • Delivery information, such as your address or chosen delivery depot, track and trace code and third party delivery company • Order history, such as received and/or cancelled orders, pictures of damaged products, receipts of your orders and information regarding refunds • Location information.- We may derive your approximate regional location from your IP address..	We collect these Personal Data on the basis of your consent or, in case we are not legally required to obtain consent, as this is necessary for the performance of a contract or on the basis of our legitimate interests, namely improving our online services, verifying your identity for reasons of security and for carrying out debtor management activities. We process your Personal Data for the purposes of (i) enhancing your shopping experiences, (ii) carrying out your orders (including identifying your closest delivery location), payments and deliveries as per the contract, (iii) gathering and collecting your order history, (iv) verifying your identity to make sure you are who you say you are, and (v) enhancing our security and protecting your information. We collect and process your Personal Data for security and risk management purposes, including to detect and prevent fraud, unauthorized activities, and access, and to ensure the security of our Services.
Customer service or otherwise corresponding with you	• If registered, your provided user account information • If not registered, your name, e-mail address, delivery address, and telephone number • Content of your message, including voice recording of your conversation with our customer services personnel, for instance a complaint or pictures of a damaged product	We collect these Personal Data on the basis of your consent or, in case we are not legally required to obtain consent, as this is necessary for the performance of a contract or on the basis of our legitimate interests, namely verifying your identity for reasons of security, improving our services and providing customer service. We process your Personal Data for the purposes of (i) following up on your questions, complaints and claims, (ii) to provide after-sales services, (iii) providing information with regard to products or services that are relevant to you, (iv) verifying your identity to make sure you are who you say you are, and (v) enhancing our security and protecting your information.
Newsletter	• If registered, your provided user account information • If not registered, your name and e-mail address • Preferences for receiving information, such as frequency and categories of information	We collect these Personal Data on the basis of your consent. We process your Personal Data for the purposes of (i) providing information with regard to products or services that you might like, and (ii) providing offers.
Other general purposes	• If registered, your provided user account information • If not registered, any other information we possibly have of you that is necessary for the relevant purpose of processing.	We collect these Personal Data as this might be necessary for compliance with a legal obligation that is applicable to us as a data controller or for purposes of our legitimate interests, namely carrying out our regular business activities and protecting our interests in case of conflicts. We process your Personal Data for purposes of (i) following requests of public authorities, (ii) conducting criminal investigations, prosecutions, trails and the execution of judgments, (iii) protecting rights of third parties, (iv) conducting statistical or academic researches, or (v) other circumstances as stipulated by relevant laws and regulations.
Social media		We collect these Personal Data on the basis of our legitimate interests, namely promoting our services and monitoring our social media presence.

4.2 If your Personal Data is processed on the basis of legitimate interests, information can be obtained by you as to the specific legitimate interest we are relying on and how we have considered your rights and interests at the same time. For more information, please contact us at support@joybuy.com.

4.3 It may be that we intend to further process your Personal Data for a purpose other than those for which the Personal Data have been collected. In such case, we will provide you with information about the(se) other purpose(s), the lawful basis we are relying on, and all relevant further information prior to that further processing.

5 Sharing with third parties

5.1 To ensure the smooth delivery of our Services, we may share your Personal Data with some third parties. This, however, only takes place strictly on a need-to-know-basis with:

a. Group companies of Joybuy, who may also process your Personal Data for the purposes set out in this Policy.

b. subcontractors and service providers involved in delivery of the Services, such as:

• shipping and trucking companies and depots for purposes of providing our Services;

• auditing companies, consulting and law firms for professional advisory services;

• third party merchants in order for you to carry out purchases of goods and services of third parties that provide offers through our website and App;

• hosting and payment providers for technical and financial infrastructure services;

• marketing partners including online platforms and publishers for providing you with offers through our mailing list, for gathering information about your preferences for provision of customer services, and for collecting and analysing your other behavior preferences on our website or App to retarget and run customized advertisements

• third party customer services company to provide customer services to all employed or engaged by a data processor of Joybuy or affiliated companies of Joybuy, on a need-to-know basis;

5.2 We will also disclose your Personal Data to third parties, on a need-to-know basis to:
a. competent authorities, such as the authorities of the country of transit or destination for customs clearance where such disclosure is required in order to comply with legal requests, where required or legally permitted to establish, exercise or defend legal rights; in order to enforce or apply our terms of supply and other agreements with you; or to protect the rights, property, or safety of Joybuy, our customers, or others, in as far as required by the laws of the respective country; and

b. incidentally: other third parties, on a need-to-know basis, for instance in case of a merger, acquisition, asset transfer or similar transaction of where this is needed to comply with the law or to protect our own rights, properties and safety – in which case we will disclose your Personal Data to the prospective buyer of such business or assets subject to the terms of this Policy.

6 Transfer to countries outside the EEA and UK

6.1 Some of our recipients as referenced above are located in countries outside the United Kingdom ("UK") and the European Economic Area ("EEA") that may not – by law – provide the same level of data protection as you are used to in the European Union or UK. In those cases, we will ensure that there are appropriate safeguards in place to protect your Personal Data.

6.2 Transfers of your Personal Data to a country outside the EEA and UK may in the first place be legitimised on the basis of an 'adequacy decision'. This is a decision in which the European Commission (for the EEA) and the Secretary of State (in the UK), which states that a certain country offers a materially equivalent level of data protection to that provided for under data protection law in the EEA / UK (as applicable). See this link for the current list of adequacy decisions that apply to transfers from the EEA and this link for transfers from the UK.

6.3 If and insofar as we transfer Personal Data with parties in countries outside the EEA and UK to which no adequacy decision applies, we will enter into approved standard contractual clauses. A copy of the agreed standard contractual clauses can be requested by you. If needed, we will in addition make use of supplementary measures in order to protect your Personal Data.

6.4 Please also contact us at support@joybuy.com if you would like to obtain additional information on the transfer of your personal data out of the EEA and UK.

6.5 The Personal Data processed by us are primarily stored on a server located in the Netherlands.

7 Retention periods

7.1 In principle, we do not store your Personal Data any longer than is strictly necessary for the purposes for which we process your Personal Data. Joybuy has put in place a Retention Policy to ensure that your Personal Data are automatically deleted in accordance with the table below.

7.2 We have the following retention terms in place:

Activity	Retention period
Visiting our website or app	We refer to our Cookie Policy for the retention terms per cookie used by us.
User account information	3 years after your last activity
Membership information	3 years after your last activity
Shopping information	3 years after your last activity
Customer service and correspondence	3 years after your last activity
Newsletter preferences	3 years after your last activity
Other general purposes	3 years after your last activity

7.3 Please contact us at support@joybuy.com, should you wish to be further informed on how long we process your Personal Data.

8 Your rights (incl. the right to object)

8.1 In relation to our processing of your Personal Data, you have the below privacy rights under certain circumstances. To exercise these rights, please email support@joybuy.com and state Privacy Query in the subject line. For more information on your privacy rights, please see this webpage of the UK Information Commissioner’s Office (ICO) https://ico.org.uk/.

a. Right to withdraw consent: In so far as our processing of your Personal Data is based on your consent (see above), you have the right to withdraw consent without detriment at any time. To withdraw your consent please email support@joybuy.com.

You can change your preferences and object to receiving further marketing at any time selecting the "unsubscribe" link at the end of all our marketing and promotional update communications to you, or by sending us an email to support@joybuy.com and state Privacy Query in the subject line.

b. Right of access: You have the right to find out what Personal Data we hold about you and request access to your Personal Data. This enables you to receive a copy of the Personal Data we hold about you (but not necessarily the documents themselves). We will then also provide you with further details of our processing of your Personal Data in accordance with applicable law.

c. Right to rectification: You have the right to request rectification of the Personal Data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected.

d. Right to erasure: You have the right to request erasure of your Personal Data. This enables you to ask us to delete or remove Personal Data where: (i) the Personal Data are no longer necessary, (ii) you have withdrawn your consent, (iii) you have objected to the processing activities, (iv) the Personal Data have been unlawfully processed, (v) the Personal Data have to be erased on the basis of a legal requirement, or (vi) where the Personal Data have been collected in relation to the offer of information society services. We do not have to honour your request to the extent that the processing is necessary: (i) for exercising the right of freedom of expression and information, (ii) for compliance with a legal obligation which requires processing, (iii) for reasons of public interest in the area of public health, (iv) for archiving purposes, or (v) for the establishment, exercise or defence of legal claims.

e. Right to object: You have the right to object to processing of your Personal Data where we are relying on legitimate interests as processing ground (see above). Insofar as the processing of your Personal Data takes place for direct marketing purposes, we will always honour your request. For processing for other purposes, we will also cease and desist processing, unless we have compelling legitimate grounds for the processing which override your interests, rights and freedoms or that are related to the institution, exercise or substantiation of a legal claim.

f. Right to restriction: You have the right to request restriction of processing of your Personal Data in case: (i) the accuracy of the Personal Data is contested by you, during the period we verify your request, (ii) the processing is unlawful and restriction is requested by you instead of erasure, (iii) we no longer need the Personal Data but they are required by you for the establishment, exercise or defence of legal claims, or (iv) in case you have objected to processing, during the period we verify your request. If we have restricted the processing of your Personal Data, this means that we will only store them and no longer process them in any other way, unless: (i) with your consent, (ii) for the establishment, exercise or defence of legal claims, (iii) for the protection of the rights of another natural or legal person, (iv) or for reasons of important public interest

g. Right to data portability: You have the right to request to transfer of your Personal Data to you or to a third party of your choice (right to data portability). We will provide to you, or such third, your Personal Data in a structured, commonly used, machine-readable format. Please note that this right only applies if it concerns processing that is carried out by us by automated means, and only if the our processing ground for such processing is your consent or the performance of a contract to which you are a party (see above).

h. Automated decision-making: You have the right not to be subject to a decision based solely on automated processing, which significantly impacts you (“which produces legal effects concerning you or similarly significantly affects you”). In this respect, please be informed that when processing your Personal Data, we do not make use of automated decision-making. We may make use of automated decision-making with your explicit consent.

i. Right to complaint: In addition to the above mentioned, rights you have the right to lodge a complaint with a supervisory authority, in the UK this is the Information Commissioner (ICO). Please see this webpage https://ico.org.uk/ for an overview of the supervisory authorities, and information about your rights and our obligations in relation to your Personal Data, as well as how to deal with any complaints that you have about our processing of your Personal Data. However, if you have a complaint, we would appreciate the chance to deal with your concerns before you approach the supervisory authority, by contacting us at support@joybuy.com. If you are based in the EEA, you can find your supervisory authority here https://edpb.europa.eu/about-edpb/about-edpb/members_en.

8.2 The exercise of the abovementioned rights is free of charge and can be carried out by e-mail at support@joybuy.com. If requests are manifestly unfounded or excessive, in particular because of the repetitive character, we will where lawfully permitted, either charge you a reasonable fee or refuse to comply with the request.

8.3 We may request specific information from you to help us confirm your identity before we comply with a request from you concerning one of your rights.

8.4 We will provide you with information about the follow-up to the request without undue delay and in principle within one month of receipt of the request. Depending on the complexity of the request and on the number of requests, this period can be extended by another two months. We will notify you of such an extension within one month of receipt of the request. The applicable privacy legislation may allow or require us to refuse your request. If we cannot comply with your request, we will inform you of the reasons why, subject to any legal or regulatory restrictions.

8.5 If you want to de-register from Joybuy, you can do so through your account. You can also contact us at support@joybuy.com to delete your account. With regard to storing your Personal Data after deletion, we refer to our storage periods.

8.6 If you have subscribed to our newsletter, you can always revoke your consent through the unsubscribe-link at the bottom of the newsletter.

9 Protection of minors

9.1 Joybuy attaches great importance to the protection of Personal Data of minors. The Services are intended for use by those who are at least 18 years of age. If you are a minor under the age of 18, you must obtain prior written consent from your parent or legal guardian before using our Services. Joybuy protects Personal Data of minors in accordance with applicable laws and regulations. For Personal Data of minors collected with the consent of parents or legal guardians, we will only use or disclose it when permitted by law, explicitly consented to by the parent or guardian or required for protecting the child. If we find ourselves collecting personal information of a minor without the prior consent of a verifiable parent or legal guardian, we will delete promptly upon becoming aware.

10 Contact details

10.1 Jingdong Retail (UK) Limited (Company number: 15830555) is a controller which administers and hosts the Services and from which global and strategic decisions are made. For any questions, comments or requests, you may contact us via support@joybuy.com. Please let us know by e-mail if you prefer to have further contact over the phone.
10.2 Our address is: Jingdong Retail (UK) Limited, Floor 3, 20 King Street, London SW1Y 6QY

10.3 Further, the data protection officer can be contacted at DPO@jd.com.

11 Changes to this Policy

Policy11.1 Joybuy reserves the right to change this Policy on a regular basis. Where required, Joybuy will inform you of updates made to this Policy. The current version is always available on our website and in our App. This Policy was last amended and revised in February 2025.