Last updated: 15 September 2026

Privacy Statement

Kimaï Ltd. and its affiliates, including Kibling Retail LLC, Kibling Melrose LLC, and Kibling Retail One Ltd, as applicable (collectively “Kimai,” “we,” “us,” or “our”) is committed to respecting your privacy and protecting your personal data. This Privacy Policy (the “Policy”) describes the personal data we process, how we use and protect it, and the rights and choices you may have depending on your location. This Policy applies to all personal data that is collected by Kimaï during any written, electronic, and oral communications online when you:

• access or use our website at www.kimai.com, or any other website, application, or online service that we operate which includes a link to this Policy (collectively, the “Site(s)”);

• visit our stores (“Store(s)”);

• otherwise interact with us, such as when you sign up for our online services, enroll in our loyalty programs, sign up for subscription services, contact us through our Customer Support page, call us, or participate in official surveys or sweepstakes (“Activities”);

• interact with social media pages we control, including Instagram, X, TikTok and Pinterest (“Social Media Page(s)”); or

• engage our products or services that link to this Policy (collectively, including the Sites, Stores, Activities, and Social Media Pages, the “Services”).

By accessing, visiting, or using our Services, you agree to our Terms and Conditions, and you acknowledge that we collect and use your personal data in accordance with this Policy. If you do not feel comfortable with any part of this Policy or our Terms and Conditions, you should not use or access our Services.

We may update this Policy from time to time to reflect changes in law, our new service offerings, or for other reasons. When we make a change, we will provide you with notice of such updates as required by applicable law and will revise the “Last Updated” date at the top of this Policy. We encourage you to look for updates to this Policy by checking this page when you access our Services.

Contents

• Personal Data We Collect

• How We Collect Personal Data

• Cookies and Other Tracking Technologies

• How We Use Personal Data

• How We Disclose Personal Data

• Security

• Retention of Personal Data

• Managing Communication Preferences

• Privacy Rights

• Children’s Privacy

• Notice to Individuals in the European Economic Area, United Kingdom, and Switzerland

• International Transfers

• Third-Party Links

• U.S. Privacy Rights

• Contact Us

1. Personal Data We Collect

Personal data is any information that relates to you, identifies you personally, or could be used to identify you. We may collect the following categories of personal data, depending on how you interact with our Services:

Information You Voluntarily Provide to Us. We, or service providers that assist us in providing, maintaining, and operating our Services, may collect the following types of personal data from you:

• Order Placement. We may collect your personal data when you place an order through our Services, including, for example, your first and last name, delivery address, postal code, email address, phone number, payment account or credit card information.

• Payment Information. If and when you purchase a product or service through our Services, you will need to provide us with a credit card for payment, including billing information such as your billing address, phone number, and name on the payment card.

• Customization and design information. This may include ring size, jewelry measurements, design preferences, engraving details, product customization instructions, consultation notes, uploaded images, photographs, and other information you provide in connection with bespoke, redesigned, engraved, made-to-order, or customized products.

• Customer Support. When you engage with our support team and customer support providers, we may collect records, copies of your correspondence (including email addresses), or additional information you choose to share with us.

• Promotional Activity (“Promotion”). If you choose to participate in a Promotion through our Services, we will collect personal data you provide in connection with your participation in the Promotion, which may include, your name, date of birth, address email address, phone number, and/or other personal data identified in the Promotion terms. We use such data to administer our promotions and communicate with you.

• Newsletters and Alerts Sign Up. You may sign up through our Sites to receive electronic newsletters and promotional emails from us. To sign up, we may ask you to provide your email address. We may also use this information to tailor our newsletters to reflect your preferences. You can choose at any time not to receive marketing emails from us by clicking on the unsubscribed link within our marketing emails.

• Bridal Appointments. We offer you the choice to book an online or in-person appointment to explore our signature pieces and tailor your chosen design. To sign up, we may ask you to provide your first and last name, email address, phone number, country, and preferred appointment type.

• Feedback or Surveys. We may provide you with the opportunity to participate in surveys or provide feedback about your experience. If you participate, we may request certain personal data from you, typically including contact information (such as name and email address). Participation in these surveys is entirely voluntary. We use this information to improve our services and offerings.

• Web Forms. We may collect your name, email, phone number, home address, order number, store location, transaction information, product SKU, and other additional information you choose to provide when you inquire about our products or services or would like to get in touch with us. If you provide contact information, we may contact you to respond to your inquiries.

Information We Automatically Collect. To the extent permitted under applicable law, we may automatically collect certain types of personal data about you when you use or interact with our Services, including visiting our Stores.

• Usage Data. When you browse our Sites or apps, we automatically collect log data such as your web request, Internet Protocol (“IP”) address, browser type, domain names, referring and exit pages and URLs, pages viewed and the order of these page views, the date and time you access our servers, and other diagnostic data.

• Device Information. When you use your desktop or mobile devices to access our Services, we may be able to identify your device’s unique device identifier, MAC address, operating system, and your mobile device’s advertising ID.

• Video Recordings/CCTV. We may use closed-circuit television, video recordings, photography, or similar technologies (collectively “CCTV”) to monitor our Stores for security, fraud, loss prevention, incident reporting, and operational purposes. No CCTV is deployed in an area where it would not otherwise be permissible under the relevant law. We have a legitimate interest in using CCTV to protect our visitors and have limited such use to public locations where visitors do not have an expectation to privacy.

Information We Collect from Third Parties. From time to time, we may obtain personal data about you from third party sources as required or permitted by law. These sources may include:

• Social Media. We may offer you the opportunity to engage with our content on or through third-party social networking websites, plug-ins and applications. When you engage with our content on or through third-party social networking websites, plug-ins and applications, you may allow us to have access to certain information associated with your social media account (e.g., name, username, email address, profile picture, gender) to deliver the content or as part of the operation of the third-party website, plug-in or application. When you provide information from your social media account, we may use this information to personalize your experience on our Services and on the third-party social networking websites, plug-ins and applications, and to provide you with other products or services you may request.

• Third Party Partners. Unless prohibited by applicable law, we may obtain your personal data from marketing partners, analytics providers, Promotion providers, and other third-party partners to market to you, including to match custom audiences or create lookalike audiences on social media or other marketing platforms so that we can better understand which of our Services may be of interest to you, market our Services to you, and to provide us information necessary to improve our Services.

• Other Individuals. We may receive certain information about you from people with whom you are friends or otherwise connected. For instance, when your friend or other people connected to you would like to send you a gift card, or order products through our Services, we may obtain your name, contact information, and addresses. Please note, if you provide us with information about someone else, please ensure you have the person’s permission to do so for the purposes detailed in this Policy.

• Single Sign-on (“SSO”). SSO is an authentication method that enables you to securely authenticate your login within multiple applications and websites by using one set of credentials. If you choose to login to our Services through a third-party platform (such as Shop, PayPal, or Klarna) we may have access to certain information from that platform, such as your username, email address, or phone number to send you verification code. The information we receive may vary based on your privacy settings on such platform or as otherwise controlled by the provider of such platform.

2. How We Collect Personal Data

We collect your personal data from a variety of sources, including directly from you, automatically when you interact with our Services, and from third parties, as described below:

• When you provide it directly. We collect personal data directly from you when you: buy our products online; book an appointment with us online or in one of the stores that carry our products; sign up for updates and marketing communications from us; participate in our sweepstakes, surveys, programs or events; request specific product customizations from us; contact us for customer service; communicate with us on social media; or otherwise interact with us via our online services.

• When we collect it automatically. We automatically collect your personal data when you use our online services. For example, we may collect information from or about the computer, phone or other device on which you have installed, or from which you access, our online services, and information about your usage of our online services. For more information, please see the “Cookies and Other Tracking Technologies” Section below.

• When we receive it from third parties. We may receive information about you from third parties, such as companies with whom we run competitions and events, organizations we work with, publicly available sources, or information which is published in the media. Depending on your settings or the privacy policies of social media or messaging services that we partner with, such as Facebook, Instagram, Pinterest, or X, we may collect information about you from these sources as well, with your permission.

3. Cookies and Other Tracking Technologies

We and our third-party partners and service providers (such as advertisers and analytics providers) may use cookies and similar digital tracking technologies (such as pixels, web beacons, and tags) (collectively, “Tracking Technologies”) on our Sites and other online services to gather information when you interact with our Sites and Services. These Tracking Technologies help us operate our Services, understand your usage, improve functionality, and, depending on your choices and where you live, deliver and measure advertising.

Tracking Technologies can be placed on our Sites by us or by third-party partners we engage for our purposes. Third-party cookies may also be deployed on our behalf on third-party websites (e.g. to measure the effectiveness of ads).

Types of Tracking Technologies. Our Sites and Services may use the following types of tracking technologies:

• Strictly Necessary. These Tracking Technologies are required for the operation of Sites and Services. These Tracking Technologies do not gather information about you for marketing purposes.

• Functional. These Tracking Technologies are used to recognize you when you return to Sites and Services. They remember the choices you make (such as your username, or the region you are in) and the changes you make to text size, fonts and other features you can customize. While these Tracking Technologies can be disabled, this may result in less functionality during your use of our Sites and Services.

• Analytics. These Tracking Technologies allow us and our analytics service providers/processors to count visits and traffic sources, or test new features, so that we can measure and improve the performance of our Sites and Services, including as part of our analytics practices to improve the content offered. They help us understand how visitors use our Sites and Services, which site or page the user came from, the number of each user’s visits and how long a user stays on the Sites and Services.

• Analytics (Partner). These Tracking Technologies allow our third-party analytics partners to track information about your usage of the Sites and Services (as defined in the Privacy Policy). These third-party analytics partners may obtain information about how visitors use our Sites and Services, which site or page the user came from, the number of each user’s visits and how long a user stays on the Sites and Services. These third-party analytics partners may use the information for their own purposes.

• Targeting and Marketing. Targeting Tracking Technologies may be set through our Sites and Services (as defined in the Privacy Policy), by our advertising partners to deliver content, including ads, that are relevant to your interests across your devices, based on how you interact with our advertisements or content. They may be used by our advertising partners to build a profile of your interests and to show you relevant ads on other sites. They do not store directly personal data but are based on uniquely identifying your browser and internet device. If you do not allow these Tracking Technologies, you will experience less targeted advertising.

• Social Media. These Tracking Technologies are set by a range of social media partners that we add to the website. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit.

Why We Use Tracking Technologies.

We may use these Tracking Technologies for the following purposes:

• to enable basic functioning of our Sites or to fix any technical issue through gathering relevant technical data;

• for web analytics to improve our Sites (structure, features, accessibility and usability, content) or to fix any technical issue through gathering relevant technical data;

• to enable certain basic functions of online browsing and shopping with us (for example, save information you generated or provided on our website such as preferred items, items placed in the cart, billing address to save time and effort when you next return to our Sites or shop with us);

• to monitor the effectiveness of our online ads and marketing (by recording your interactions with our ads on third-party websites, our social media platforms or our marketing emails);

• to learn more about your preferences and Internet browsing tastes to provide you with tailored advertising (you certainly don't want to hear from us about something you are not interested in); and

• to collect information around abandoned shopping carts. A cart is considered abandoned within one hour of inactivity/lack of purchase. Once the cart is considered abandoned, an SMS message will be sent as a reminder.

How to Manage Your Tracking Technologies Preferences.

• Your Privacy Choices. Please refer to Section 9 below for more information about whether you have the right to opt-out of sales and targeted advertising, and if so, how to exercise that right. Please note that you may still receive generalized ads after opting out. Your opt-out choice will only apply to your use of our Sites through the current browser or device you are using and only so long as that browser’s cookies are not erased.

• Cookies Settings. If you are located in European Countries (defined below), you may consent to or withdraw your consent to sharing your personal data via tracking technologies at any time by clicking the “Cookies Preferences” link in the website footer and changing your preferences.

• Global Privacy Control. If you are a resident of the United States, depending on your state of resident, you may also opt-out of having your personal data shared with third parties for targeted advertising or sales via cookies or other similar tracking technologies by using an opt-out preference signal. The Global Privacy Control signal is currently the only opt-out preference signal we recognize. You can visit the Global Privacy Control official site at

  https://globalprivacycontrol.org/#about to learn how to configure your device to send such signals. We will honor and process the opt-out preference signal in a frictionless manner. Your opt-out choice will only apply to your use of our Site through the current browser or device you are using and only so long as that browser’s cookies are not erased. You will need to submit a separate opt-out of sharing request on each device and browser you use to visit our Sites to completely opt-out using this method. Please note that you may still receive generalized ads after opting out.

• Browser Controls. Alternatively, you can set or amend your web browser controls to accept or refuse cookies. If you choose to reject cookies, you may still use our Sites although your access to some functionality and areas may be restricted. If you want to understand your browser’s cookie default setting, or learn to modify your browser’s cookie settings, please use the “Help,” “Tools” or “Edit” menu in your browser or review the instructions provided by the following browsers:

  • Google Chrome

  • Microsoft Edge

  • Microsoft Internet Explorer

  • Apple Safari Mobile

  • Android Browser

• Opting-out of Third-Party Analytics. We may use third-party service providers to monitor and analyze the use of our online, web-based, and mobile-based Services, such as Google Analytics. Google Analytics is an analytics service offered by Google LLC (“Google”) that tracks and reports website traffic. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en. To opt out of Google Analytics or to prevent your data from being collected and used by Google Analytics, please visit: https://tools.google.com/dlpage/gaoptout.

• Disabling Certain Interest Based Advertising. Many advertising companies that collect information for interest-based advertising are members of the Digital Advertising Alliance (DAA), which maintain websites where people can opt out of interest-based advertising from their members. To opt out of website interest-based advertising provided by each organization’s respective participating companies, visit the DAA’s opt-out portal available at http://optout.aboutads.info.

4. How We Use Personal Data

We may process your personal data for the following commercial and business purposes:

a) To Operate and Administer Our Services. We may use your personal data to provide you with the Services that you request, such as processing and completing purchases, returns, subscriptions, and similar transactions.

b) To Provide Customer Support or Respond to You. We collect any information that you provide to us when you contact us to respond to your inquiries and to fulfill your requests. Without your personal data, we cannot respond to you or ensure your continued use and satisfaction of the Services.

c) To Provide You with Service-Related Communications. We may send you administrative communications, for example, privacy policy and terms updates, security updates, or confirmations of your transactions. Service-related communications are not promotional in nature. You may not be able to unsubscribe from certain service-related communications, otherwise you may miss important developments relating to your account or the Services.

d) To Provide Marketing Communications. Subject to your marketing preferences (which may include consent to marketing under applicable law), sending you special discounts and offers, newsletters or marketing communications we believe may interest you, for our own products and services. When you no longer wish to receive these marketing messages from us, you can opt out at any time by unsubscribing or following the instructions contained within such messages. We may also collect and use your online or mobile identifiers for the purpose of marketing campaigns. Please see the “Cookies and Other Tracking Technologies” Section for more information.

e) To Infer Your Interest and Personalize Your Experience. We may process your personal data to personalize your experience on the Services by presenting products and offers tailored to you. We may use such information to enable you to interact with our Services more easily across devices, or to recommend more relevant content to you. For example, when you enable the social sharing functionalities of your social media account(s) by interacting with our content on or through third-party social networking websites, plug-ins and applications, we may use this information to personalize your experience on our Services and on the third-party social networking websites, plug-ins and applications.

f) To Research and Develop Our Services. We may process your personal data and derive analytical and statistical data to better understand the way you use and interact with our Services, including by carrying out data analysis, audits, fraud monitoring and prevention, internal quality assurance, developing new products, enhancing, improving or modifying our Services, identifying usage trends, auditing use and functionality of our Services, determining the effectiveness of our promotional campaigns, and operating and expanding our business activities.

g) To Administer Promotional Events. When you participate in sweepstakes, contests, and similar promotions, we may process your personal data to administer such activities (each of which may have additional rules and could contain additional information about how we process your personal data).

h) To Facilitate Corporate Acquisitions, Mergers and Transactions. We may process any information regarding your account and your use of our Services as is necessary in the context of corporate acquisitions, mergers, or other corporate transactions.

i) To Enforce Compliance with Our Terms, Agreements and Policies. When you access or use our Services, you are bound to our Terms. We may process your personal data when actively monitoring, investigating, preventing, and mitigating any alleged or actual prohibited, illicit or illegal activities on our Services. We may also process your personal data to investigate, prevent or mitigate violations of our internal terms, agreements or policies; enforce our agreements with third parties; recover payments due to us; and protect our and others’ rights, privacy, safety, or property.

j) To Ensure the Security of the Services. We may process your personal data to combat spam, malware, malicious activities, or security risks; improve and enforce our security measures; and to monitor and verify your identity so that unauthorized users do not gain access to your information.

k) To Maintain Legal and Regulatory Compliance. Our Services are subject to certain laws and regulations which may require us to process your personal data. For example, we process your personal data to pay our taxes, to fulfill our business obligations, or as necessary to manage risk as required under applicable law, or to respond to requests by judicial process or governmental agencies.

m) With Your Consent. For any other purpose disclosed to you prior to you providing us your personal data or which is reasonably necessary to provide the Services or other related services requested, with your permission or upon your direction.

We may also aggregate or deidentify any personal data that we collect in connection with our Services, such that the information is no longer personally identifiable or attributable to you.

5. How We Disclose Personal Data

We may disclose your personal data for business and commercial purposes as described in this Policy. We take reasonable steps to limit access to your personal data to our employees, agents, contractors, and other parties to the extent necessary for the purposes set out in this Policy. Where required, we provide you with the ability to opt out of these disclosures or first obtain your consent. We may disclose your personal data as described in categories under Section 1, in the following ways:

a) Within Our Corporate Group. We may disclose some or all of your personal data with our subsidiaries and corporate affiliates Kibling Retail One Ltd, and

Kibling Retail LLC, joint ventures, or other companies under common control with us for the purposes described in this Privacy Policy unless otherwise prohibited by applicable law or by contractual agreement with our vendors, service providers or other third parties.

b) To Service Providers. We may disclose personal data to service providers, contractors, professional advisors, and other entities that need this information to provide services to us, such as: assisting us in operations; managing a database of customer information; hosting the Sites; designing and/or operating the Sites’ features; tracking the Sites’ activities and analytics; enabling us to send you special offers or perform other administrative services; delivery and shipping; operating our Customer Service. These service providers may have access to or process your personal data only for the purpose of providing services to us.

c) Business Partners, Sponsors, and Other Third Parties. We may disclose your personal data to business partners, co-sponsors of promotions, and other third parties in order to provide you with Services that may interest you. For example, we may co-sponsor promotions, sweepstakes, or other events with a third party and may share your personal data in connection with these events. If you provide additional information to any of these third parties, such information provided to these third parties will be subject to each third party's privacy practices and policies.

d) Analytics and Interest-based Advertising Partners. We use third-party analytics and advertising to collect information about your use of the Sites, see the overall patterns of usage on the Sites, deliver advertisements to your social media account based on email addresses, optimize ad performance, and determine whether our advertising is effective. Where permitted by law, we may share your personal data with marketing and advertising partners for targeted advertising purposes, such as matching custom audience or creating lookalike audience on social media or other marketing platforms, so that we can better understand which of our Services may be of interest to you, market our Services to you, and to provide us information necessary to improve our Services.

e) As Necessary to Comply with Our Legal Obligations. We may also disclose personal data in order to assist with or otherwise enable our compliance with a legal or regulatory obligation, protect and defend our rights or property, protect the safety of our users or the public, and to establish or defend our legal rights.

f) As Part of a Corporate Transaction. We reserve the right to transfer the information we maintain, including your personal data, in the event we sell or transfer all or a portion of our business or assets. If we engage in such a sale or transfer, we will make reasonable efforts to direct the recipient to use your personal data in a manner that is consistent with this Policy. After such a sale or transfer, you may contact the recipient with any inquiries concerning the recipient’s privacy practices.

g) With Outside Professional Advisors. We may share or disclose your personal data with any of our professional advisors such as attorneys or accountants (“Outside Professionals”) to facilitate the professional advice from those Outside Professionals.

6. Security

We have implemented technical and organizational security measures intended to safeguard the personal data in our custody and control. While we endeavor to protect our systems, sites, operations and information against unauthorized access, use, modification and disclosure, due to the inherent nature of the Internet and other risk factors, we cannot guarantee that any information, during transmission or while stored on our systems, will be absolutely safe from intrusion by others.

Please recognize that protecting your personal data is also your responsibility. We ask you to be responsible for safeguarding your password, and other authentication information you use to access our Services. You should not disclose your authentication information to any third party and should immediately notify us of any unauthorized use of your password.

7. Retention of Personal Data

Our retention periods for personal data are based on business needs and legal requirements. We will keep your personal data for as long as is reasonably necessary for the purposes for which it is collected, for other purposes described in this Policy, or as may be required by applicable law. For example, we may retain certain transaction details and correspondence until the time limit for claims arising from the transaction has expired. In addition, we retain your email address and information about your marketing preferences to ensure that we can honor those preferences. If you wish to cancel your account or request that we no longer use your information to provide you Services, we may still retain and use your personal data as necessary to comply with our legal obligations, resolve disputes, and enforce our agreements.

8. Managing Communication Preferences

Marketing Emails. You can opt-out of receiving marketing communications from us. Direct marketing includes any communications to you that are only based on advertising or promoting our products and services. We will only contact you by electronic means based on our legitimate interests, as permitted by applicable law, or your consent.

You may unsubscribe from our marketing emails. Please note that if you have already requested products or services when you decide to unsubscribe, there may be a short period of time for us to update your preferences. You can unsubscribe by emailing us at [email protected] or click on the unsubscribe button in the marketing email we send you.

For users in the European Economic Area, the United Kingdom and Switzerland, to the extent we can rely on legitimate interest under the applicable law, we will only send you information about our Services that are similar to those which were the subject of a previous sale or negotiations of a sale to you. We will contact you by electronic means for marketing purposes only if you have consented to such communication. You may raise such objections with regard to initial or further processing for purposes of direct marketing, at any time and free of charge.

Text Messages. You may opt in to receive mobile alerts about your orders via text messages. To do so, you will have to provide us with your phone number. Standard message and data rates will apply. At any time, you can reply STOP to opt out. You must be 18 years old or older to participate or have parent/guardian permission. To unsubscribe from SMS communications, follow the instructions in the message.

We will only send you marketing text messages if you provide us with your phone number and your consent. Standard message and data rates will apply. At any time, you can reply STOP to opt out. You must be 18 years old or older to participate or have parent/guardian permission. To unsubscribe from these marketing text messages, follow the instructions in the message.

9. Privacy Rights

Depending on where you reside, you may be able to exercise certain rights with respect to your personal data. For United States residents, please see Section 14. For individuals using or accessing our Service while located in the European Economic Area, the United Kingdom, or Switzerland, please see Section 11. Depending upon the applicable law, access to your rights under the applicable law may be denied.

Submitting a Rights Request

You can assert your privacy rights by (i) going to our Privacy Request Form; (ii) emailing us at [email protected] with the subject line “Privacy Rights Request” advising us which privacy rights you would like to exercise. Depending on your state or country of residence, applicable law may limit how many times per year you may submit a Right to Know/Access. We may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by law.

We may contact you by phone or e-mail to verify your identity before we process your request. Depending on your request, we will ask for information such as your name, address, an e-mail address or a phone number you have used with us. For certain requests, we may also ask you to provide details about your most recent purchases.

Where permitted by law, you may use an authorized agent to submit a request on your behalf. If you use an authorized agent to submit requests on your behalf, we will require you to verify your identity with us, or have you confirm the authorized agent is authorized to act on your behalf.

Opting-out of Tracking Technologies based Sales and Targeted Advertising

You may exercise your right to opt out of sales and targeted advertising via Tracking Technologies at any time by clicking the “Cookie Preferences” link in the website footer and following the directions in the pop-up screen regarding how to opt-out of sales and targeted advertising.

Where required by law, we will also honor browser-based opt-out preference signals such as the Global Privacy Control (GPC). Please note that your opt-out choice will only apply to your use of our Sites through the current browser or device you are using and only so long as that browser’s cookies are not erased. You will need to submit a separate opt-out of targeted advertising request on each device and browser you use to visit our Sites to completely opt-out using this method. Please note that you may still receive generalized ads after opting out.

10. Children’s Privacy

Our Services are not directed to, and we do not knowingly collect personal data from children under the age of 18. If you are under 18, please do send any personal data about yourself to us. If we become aware that a person under 18 has provided us with personal data, we will take steps to delete such information. If you are a parent or guardian and you believe that your child has provided us with information without your consent, please contact us at [email protected], and we will take reasonable steps to ensure that such information is deleted from our databases in accordance with applicable law.

11. Notice to Individuals in the European Economic Area, United Kingdom and Switzerland

This section only applies to individuals using or accessing our Service while located in the European Economic Area, the United Kingdom, or Switzerland (collectively, the “European Countries”) at the time of data collection. We may ask you to identify or select which country you are located in when you use or access some of the Services, or we may rely on your IP address to identify which country you are located in. When we rely on your IP address, we cannot apply the terms of this section to any individual that masks or otherwise hides their location information from us so as not to appear located in European Countries. If any terms in this section conflict with other terms contained in this Policy, the terms in this section shall apply to individuals in a European Country.

Our Relationship to You

Kimai is a data controller with regard to any personal data collected from individuals accessing or using its Services. A data controller is an entity that determines the purposes for which and the manner in which any personal data is processed.

Your Privacy Rights

We provide you with the rights described below when we process your personal data which you can exercise via the Privacy Request Form on our Site.

• Right to Access. You may have the right to obtain a copy of your personal data that we hold about you, as well as other supplementary information, such as the purposes of processing, the categories of personal data that we process, the entities to whom we disclose your personal data, etc.

• Right to Rectification. You may have the right to request us correct any of your personal data in our files.

• Right to Erasure. Under certain circumstances, you may have the right to request erasure of your personal data that we hold about you. To note, this right is not absolute, and we may refuse your right to erasure if there are compelling legitimate grounds for keeping your information.

• Right to Restriction. You have the right to request that we restrict our processing of your personal data in certain circumstance. For instance, this right is available if you contest the accuracy of the personal data, or if you objected to our processing.

• Right to Object to Processing. You have the right to object to our processing of your personal data at any time and as permitted by applicable law if we process your personal data on the legal bases of consent or legitimate interests. However, we may continue to process your personal data if it is necessary for the defense of legal claims, or for any other exceptions permitted by applicable law.

• Right to Portability. Under certain circumstances, you may have the right to receive personal data we hold about you in a structured, commonly used, and machine-readable format so that you can provide that personal data to another controller.

• Right to Withdraw Consent. To the extent the processing of your personal data is based on your consent, you may withdraw your consent at any time. Your withdrawal will not affect the lawfulness of our processing based on consent before your withdrawal.

• Right to Object to Automated Decision-Making. We do not make any decisions based solely on algorithms or other automated processing that significantly affect you.

• Right to Lodge a Complaint. You may have the right to lodge a complaint with your local data protection authority about our processing of your Personal data. Contact details for data protection authorities in the European Economic Area are available here, and contact details for the United Kingdom’s ICO are available here. The Supervisory Authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), available here.

Legal Bases for Processing

12. International Transfers

When you access or use our Services, your personal data may be processed in the United States or any other country in which Kimai, its affiliates, or service providers maintain facilities. Such countries or jurisdictions may have data protection laws that are less protective than the laws of the jurisdiction in which you reside. If you do not want your information transferred to or processed or maintained outside of the country or jurisdiction where you are located, you should not use the Site or Services.

To the extent we transfer to another business any personal data collected from individuals while they are located in the European Countries, we transfer such data subject to appropriate safeguards and as permitted under the data protection laws, including: (i) through the use of standard contractual clauses approved by an appropriate regulatory authority, such as the European Commission or the U.K. Information Commissioner’s Office; (ii) an Article 49 derogations in specific situations; or (iii) any other compliant transfer mechanism. We may also rely on an adequacy decision of the appropriate regulatory authority confirming an adequate level of data protection in the jurisdiction of the party receiving the information.

13. Third Party Links

Our Site may include links to third party websites and/or applications of our partners or affiliates that are not owned or operated by us. If you follow a link to any of these websites, please review the privacy policies of third-party websites before you submit any personal data to them. We do not control the privacy practices of these third-party websites or applications.

14. U.S. Privacy Rights

For individuals who are United States residents, your rights in relation to your personal data are not absolute. Depending upon the applicable law, access to your rights under the applicable law may be denied.

U.S. Privacy Rights may include the following:

(a) Right to Know/Access. You may have the right to obtain a copy, or a list of categories of the personal data that we hold about you, as well as other supplementary information, such as the purposes of processing, and the entities to whom we disclose your personal data.

(b) Right to Correct. You may have the right to correct any of your personal data in our records and systems. You may request us to rectify, correct or update any of your personal data held by us that is inaccurate.

(c) Right to Delete. You may have the right to request that we delete the personal data that we hold about you. In the event your deletion request is honored, we may retain a record of your deletion request as required under applicable law.

(d) Right to Portability. You may have the right to receive a copy of the personal data we have collected about you.

(e) Right to Opt-Out Sale / Right to Opt-Out of Sharing for Targeted Advertising. You may have the right to opt out of: (i) the sale of your personal data; and (ii) the sharing of your personal data for targeted advertising or profiling, as defined under applicable law. We use Tracking Technologies (as described in the “Cookies and Other Tracking Technologies” Section above) and may disclose certain personal data to advertising partners. Under certain state laws, this may be considered a “sale” or “sharing” of personal data.

(f) Right to Opt-Out of Automated Decision-making or Profiling. In certain states, you may have the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects. We do not make decisions about you based solely on automated processing that produces legal or similarly significant effects.

(g) Right Against Discrimination. We do not discriminate against any customers who exercise any of their rights described in this Policy.

(h) Right to Appeal. In certain jurisdictions, you may have the right to appeal if we refuse to take action on your rights request. Instructions on how to appeal will be provided to you upon such a denial, but in any event, such instructions will be substantially similar to those provided below for submitting requests.

(i) Right to Obtain Third-Party List. You may have the right to request a list of specific third parties to which we have disclosed personal data.

As mentioned above, depending on where you reside or are located, you may be able to assert certain rights with respect to your personal data.

Exercising Your Rights.

For U.S. residents, depending on your state’s applicable law, you can assert your privacy rights by (i) going to our Privacy Request Form; (ii) emailing us at [email protected] with the subject line “Privacy Rights Request” and advising us which privacy rights you would like to exercise.

We may contact you by phone or e-mail to verify your identity before we can process your request to exercise certain privacy rights. Depending on your request, we will ask for information such as your name, address, an e-mail address or a phone number you have used with us. For certain requests, we may also ask you to provide details about your most recent registration.

You may designate an authorized agent to submit a request on your behalf to access or delete your personal data. To do so, you must: (1) provide that authorized agent written and signed permission to submit such request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf.

14. Third Party Links

Our Site may include links to third party websites and/or applications of our partners or affiliates that are not owned or operated by us. If you follow a link to any of these websites, please review the privacy policies of third-party websites before you submit any personal data to them. We do not control the privacy practices of these third-party websites or applications.

15. Contact Us

If you have questions about this Policy or our privacy practices, please contact us by email at [email protected], or by mail at: 24 Chiltern Street, London, England, W1U 7QW.