Privacy Notice

1

Data Collection & Processing

When we use the term "personal data" in this Privacy Notice, we mean information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an individual. It does not include aggregated or de-identified information that is maintained in a form that is not reasonably capable of being associated with or linked to an individual. AzLytics does not collect, use, or disclose sensitive personal data.

Categories of Data Subjects

Merchant Data: Personal data collected, processed and managed on behalf of our business customers ("merchants"), as part of our eCommerce analytics platform. We process such Merchant Data on behalf of and under the instruction of the respective customer. This Privacy Notice does not apply to such processing done on our customers' behalf.

User Data: Personal data concerning our customers' internal focal persons who directly engage with AzLytics, including account administrators, users, billing contacts and authorised signatories on behalf of the customer.

Prospect Data: Personal data relating to visitors of our website, participants at our events, and any other prospective customer, user or partner who visits, subscribes, or otherwise interacts with our website and Services.

Types of Personal Data Collected

Usage & Device Information: Connectivity, technical and aggregated usage data, such as user agent, IP addresses and approximate geolocation, device data (type, OS, browser version, locale), activity logs, session recordings, and other electronic network activity information.

Contact & Business Details: Name, email, phone number, position, workplace and professional information, communications history, feedback, contractual and billing details, preferences, attributes and purchasing details including subscription history.

Customer Data: Personal data provided by customers or processed on their behalf under their instruction, in accordance with our Data Processing Addendum.

2

Data Uses & Lawful Bases for Processing

We use your personal data as necessary for the following business and commercial purposes:

Purpose

Description

Lawful Basis (GDPR)

Service Delivery & Enhancement

To provide, maintain, improve and personalise our Services, including analytics dashboards, daily briefs, and simulation features.

Performance of contract; Legitimate interest

Account Management

To create and manage your account, verify identity, process billing and subscription payments.

Performance of contract

Customer Support

To respond to enquiries, provide technical support, and communicate service-related information.

Performance of contract; Legitimate interest

Analytics & Product Development

To analyse usage patterns, improve functionality, develop new features, and conduct internal research.

Legitimate interest

Marketing & Communications

To send promotional materials, newsletters, product updates, and event invitations (with opt-out available).

Consent; Legitimate interest

Security & Fraud Prevention

To detect, prevent, and address security incidents, fraud, and technical issues.

Legitimate interest; Legal obligation

Legal & Compliance

To comply with applicable laws, regulations, legal processes, or enforceable governmental requests.

Legal obligation

3

Data Storage and Transfer

We and our authorised service providers maintain, store and process personal data in the European Union (primarily Germany), the United States and other locations, as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law.

AzLytics is headquartered in Sheridan, Wyoming, within the European Economic Area (EEA). Where we transfer personal data outside the EEA, Switzerland or the United Kingdom, we rely on appropriate lawful transfer mechanisms, including the European Commission's Standard Contractual Clauses (SCCs) as approved under Decision 2021/914, or any subsequent version thereof. You can obtain a copy by contacting us at hello@azlytics.io.

While privacy laws may vary between jurisdictions, AzLytics is committed to protecting personal data in accordance with this Privacy Notice, customary industry standards, and appropriate contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

4

How Long We Retain Your Personal Data

We retain personal data for as long as we deem it reasonably necessary in order to maintain and expand our relationship and provide you with our Services and offerings; in order to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes.

To determine the appropriate retention period, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure, the purposes for which we process your personal data, and the applicable legal requirements.

Generally, we retain customers' personal data for up to 60 days following termination of services, at which point we securely delete or anonymise any customer personal data in our possession, unless retention is required by law.

If you have any questions about our data retention policy, please contact us at hello@azlytics.io.

5

How We Disclose Your Personal Data

We disclose personal data in the following ways:

Service Providers: We engage selected third-party companies to perform services on our behalf, including hosting, CDNs, data security, billing, analytics, email distribution, session recording, and customer support tools. They may only use the data as determined in our agreements with them.

Service Integrations: Using our Services fully requires connecting with third-party services such as Shopify, Meta Ads, Google Ads, Klaviyo, and other eCommerce and marketing platforms. We do not receive or store your passwords for any of these services.

Business Customers: Our customers have access to any personal data we process on their behalf, as well as personal data relating to their users as it relates to their use of our Services.

Legal Compliance: We may disclose personal data to government and law enforcement officials in response to a subpoena, search warrant or court order, or in compliance with applicable laws and regulations.

Protecting Rights and Safety: We may share personal data with others if we believe in good faith that this will help protect the rights, property or personal safety of AzLytics, our users, customers, or any members of the general public.

Business Transfers: Should AzLytics undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, personal data may be shared with or transferred to the parties involved in such an event.

6

Cookies and Data Collection Technologies

We and our service providers use "cookies", anonymous identifiers, pixels, container tags and other technologies in order to provide our Services and ensure that they perform properly, to analyse our performance and marketing activities, for personalisation purposes, for product development and improvements, and to personalise your experience.

Cookies are packets of information sent to your web browser and then sent back by the browser each time it accesses the server that sent the cookie. Session Cookies are removed when you close your browser. Persistent Cookies last for longer periods and we use them to remember your log-in details and facilitate the use of Services features and tools.

We may also use web analytics tools such as Google Analytics. You may opt out at: https://tools.google.com/dlpage/gaoptout. Whilst we do not change our practices in response to a "Do Not Track" signal, you can manage your cookie preferences through your browser settings.

7

Communications

We engage in service and promotional communications through email, phone and notifications.

Service Communications: We may contact you with important information regarding our Services, such as notifications of changes or updates, billing issues, log-in attempts or password reset notices. You will not be able to opt out of receiving certain service communications which are integral to your use of our Services.

Promotional Communications: We may notify you about new features, additional offerings, events, special opportunities or any other information we think you will find valuable. If you do not wish to receive such promotional communications, you may notify us at hello@azlytics.io, or follow the unsubscribe instructions contained in the promotional communications you receive.

8

Data Security

We have implemented industry-standard physical, procedural and technical security measures, designed to secure your personal data, to minimise the risks of theft, damage, loss of information, or unauthorised access or use of information. These measures include encryption of data in transit and at rest, regular security assessments, access controls, and monitoring of our systems for potential vulnerabilities.

However, we cannot guarantee that our Services will be immune from any wrongdoings, malfunctions, unlawful interceptions or access, or other kinds of abuse and misuse. If there is any unexpected activity or inaccurate information, or if you have reason to believe that your information is no longer secure, please contact us at hello@azlytics.io.

9

Your Data Subject Rights

Individuals have rights concerning their personal data. Please contact us at hello@azlytics.io if you wish to exercise your privacy rights under any applicable law, including the EU or UK GDPR, the CCPA, and others:

•The right to know/request access to your personal data (categories collected, sources, purpose, and third parties with whom we have shared it).
•The right to request correction or rectification of your personal data.
•The right to request erasure (deletion) of your personal data.
•The right to restrict or object to processing (including the right to direct us not to sell or share your personal data).
•The right to data portability.
•The right to equal services and prices (freedom from discrimination).
•Under the GDPR, the right to lodge a complaint with your relevant supervisory authority.

10

Data Controller/Processor

Certain data protection laws, such as the EU GDPR, UK GDPR, and CCPA, typically distinguish between "data controllers" who determine the purposes and means of processing, and "data processors" who process data on behalf of the controller.

AzLytics is the data controller of Prospect Data. AzLytics is the data processor of Customer Data, which we process on behalf of our customers. AzLytics is both a data controller and data processor of User Data.

Our customers are solely responsible for determining whether and how they wish to use our Services, and for ensuring that all individuals using the Services on their behalf have been provided with adequate notice and given informed consent to the processing of their personal data.

11

Opt-Out of Sale/Sharing for Targeted Advertising

Under some US data protection laws, such as the CCPA, our disclosure of certain internet activity and device information with third parties through cookies may be considered a "sale" or "sharing" of personal information for targeted advertising. AzLytics has not knowingly sold or shared the personal information of individuals under the age of 16.

You may opt out of cookies that may result in a "sale" and/or "sharing" of your personal information by:

• Using the cookie consent banner or "Privacy Preferences" widget on our website.
• Setting the Global Privacy Control (GPC) for each participating browser system. Instructions are available at globalprivacycontrol.org.

12

Additional Notice & Contact Details

Updates and Amendments: We may update and amend this Privacy Notice from time to time by posting an amended version on our website. The amended version will be effective as of the date it is published. We will provide prior notice if we believe any substantial changes are involved.

External Links: While our Services may contain links to other websites or services, we are not responsible for their privacy practices. This Privacy Notice applies only to our Services.

Children: Our Services are not designed to attract minors. We do not knowingly collect personal data from minors. If you believe that we might have any such data, please contact us at hello@azlytics.io.

EU & EEA Representative: As AzLytics is headquartered in Sheridan, Wyoming (within the EEA), no separate EU representative appointment is required under Article 27 of the GDPR.

Contacting Us: AzLytics, operated by Irha Technologies LLC, Sheridan, Wyoming. Email: hello@azlytics.io | Website: azlytics.io