PRIVACY NOTICE FOR LULU RETAIL

Privacy Notice

This Privacy Notice effective as on 24 August 2026, applies to all personal information collected by Lulu Hypermarket LLC (“Lulu”, “we”, “our” or “us”). We know that you care how information about you is used and shared, and we appreciate your trust that we will do so carefully and sensibly. This Privacy Notice describes how Lulu collects and processes your personal information when you access or use Lulu's websites, mobile applications, online stores, happiness account / loyalty program, products, devices and other services that reference this Privacy Notice (collectively, the “Lulu Services"). Lulu processes personal data in accordance with applicable data protection laws. Where required by law, Lulu will obtain the data subject's consent before processing personal data. This privacy statement will further explain how and why we collect your personal information for the purpose of both managing your accounts with us and processing transactions made between you and Lulu.

1.Who Is Responsible for Your Personal Data

The Data Controller responsible for processing personal data under this Privacy Notice is Lulu Hypermarket LLC, having its registered office at P. O. Box 4048, Abu Dhabi, United Arab Emirates. For any privacy-related enquiries, please contact:

1. Data Protection Officer
2. Email: [email protected]

2.Lawful Basis for Processing Your Personal Data

We may need to process your personal data so that we can manage your customer accounts (including your Happiness Account), provide you with the goods and services you want to purchase, and help you with any orders and refunds and to provide you with a secure, convenient, and pleasant shopping experience.

Lulu processes personal data only where permitted under applicable law, including where:

1. you have provided your consent;
2. processing is necessary for the performance of a contract;
3. processing is necessary to comply with a legal obligation;
4. processing is necessary to protect Lulu's legitimate interests, provided such interests do not override your rights and freedoms;
5. processing is necessary for the establishment, exercise or defence of legal claims.

3.How We Collect Personal Data and What Personal Information About Our Customers We Collect

This section tells you what kind of Personal Data we may collect from you and how we collect your personal data when you use Lulu Services and the personally identifiable information we may receive from other sources. We collect your personal information to provide and continually improve our products and services. Here are the types of personal information we collect:

We collect information related to your use of our website using cookies, web beacons, and log information. We use all this information to improve the functionality of the website every time we do an overall review of our users’ activities, which helps us to make your access more secure and seamless user experience.

1. Cookies are small files containing strings of text stored on your computer that we use to authenticate you in transactions made on our websites and deliver content specific to your interests and preferences with product recommendations, display personalised content, and provide other customised features and services.
2. Keeping track of items stored in your shopping cart.
3. Web beacons are used often together with cookies. We use web beacons to monitor the user’s activity on our website, specifically on how long users visit our web pages, so we would be able to generate reviews and results on website traffic, unique visitor counts, and other impression functions.
4. Log information may include website requests, operating system, browser details, date and time of your request, and cookies that may identify your browser.
5. We use IP addresses to analyse trends, administer the site, track user's movement, and gather broad demographic information for operational use. IP addresses may in certain circumstances be considered Personal Data under applicable laws and may be processed together with other information for security, fraud prevention, analytics and operational purposes.
6. We may conduct research and diagnostics to improve our content, products, and services. We frequently take necessary steps to protect our platform from cyber threats and implement the latest safety and security measures.
7. We may deliver content, including advertisements, that we believe may be of interest to you on our website and on third-party websites.

Lulu's cookies allow you to take advantage of some of Lulu's essential features. For instance, if you block or otherwise reject our cookies, you will not be able to add items to your shopping cart, proceed to checkout, or use any Lulu products and services that require you to sign in.

Approved third parties may also set cookies when you interact with Lulu Services. Third- parties include search engines, providers of measurement and analytics services, social media networks, and advertising companies. Third parties use cookies in the process of delivering content, including ads that we believe may be of your interest, to measure the effectiveness of their ads, and to perform services on behalf of Lulu.

Lulu Services will obtain your consent before placing non-essential cookies on your device, as required by applicable law. You can manage your cookie preferences through your browser settings.

3.1 Information You Give Us:

1. We receive and store any information you voluntarily provide when using Lulu's stores, websites, mobile applications, products and services. You can choose not to provide certain information, but then you might not be able to take advantage of many of Lulu Services, when you register on both the physical store and online store.
2. When you shop with us online, browse our websites, or use our mobile applications.
3. When you use our online or printed vouchers or coupons.
4. When you contact us or we contact you or you join our promotions, competitions, surveys, and products reviews about Lulu Services.

While you are transacting on our website, personally identifiable information collected about you may include:

1. First and last name, email address, contact details including phone numbers, and PIN/ZIP code.
2. Demographic profile (like your age, gender, occupation, education, address and durables owned).
3. Personal preferences and interests.
4. Your opinion on services, products, and features on our website.
5. The pages you visit/access.
6. The links you click on our website.
7. The number of times you access the page.
8. Things you view, add to bag, add to wish list.
9. Other websites you open simultaneously while browsing ours.

3.2 Information from Other Sources:

We might receive information about you from other sources such as updated delivery and address information from our carriers, which we use to correct our records and deliver your next purchase more easily.

1. To update your delivery and address information using information obtained from our carriers or other third parties, which will be used to correct our records, facilitate smoother deliveries for your future purchases, and enable easier communication; Your account information, purchase history, redemption information, and page-view information from certain merchants with whom we operate co-branded businesses or for whom we provide technical, fulfilment, advertising, or other services;
2. Lulu may collect your information about your interactions with products and services offered by our affiliates;
3. Lulu may also collect your search history and links, including paid listings.

4.For What Purpose Does Lulu Use Customer Personal Data

Using personal data may happen in the following circumstances regarding product and service fulfilment and transactions between the user and Lulu.

4.1 Operational procedures and transactions:

1. Customer Personal Data is being used to take and handle orders, deliver products and services, process payments, and communicate with you about orders, products and services, and promotional offers.
2. Customer Personal Data is being used to provide customer service, processing and assistance with dispute resolution, payment processing including returns, refunds, and other transaction-related issues.
3. Customer Personal Data is being used to recommend features, products, and services that might be of interest to you, identify your preferences, and personalise your experience with Lulu Services.
4. Customer Personal Data is being used to communicate with you in relation to Lulu Services via different channels (e.g., by phone, e-mail, chat).
5. Customer Personal Data is being used to managing subscription services, including order management, billing, improving reorder experiences, communicating with the user about subscription, and offer other products and services.
6. Customer Personal Data is being used to Fulfil other technical, logistical, financial, tax, legal, compliance, administrative, and/or back-office functions.
7. Customer Personal Data is being used for conducting a transaction where we collect information required by law.
8. Customer Personal Data is being used to prevent and detect fraud and abuse to protect the security of our customers, Lulu, and others. We may also use scoring methods to assess and manage credit risks.

4.2 Cross-Border transaction of your Personal Data

1. As part of our operations, Lulu may transfer personal data to recipients located outside the United Arab Emirates.
2. Where such transfers occur, Lulu will implement appropriate legal, technical and organisational safeguards to ensure that the Personal Data remains adequately protected. Such safeguards may include contractual protection, transfers to jurisdictions recognised as providing an adequate level of protection, implementation of internal data protection policies, or such other measures as may be required by applicable law.
3. Lulu may share anonymised or aggregated data (which does not identify an individual directly or indirectly) with business partners, advertisers, or research agencies for the purpose of market analysis, trend detection, or improving services. Such data is outside the scope of “Personal Data” as defined under applicable law.
4. Lulu undertakes vendor due diligence and executes appropriate data processing agreements and risk assessments or confidentiality undertaking with all third-parties who receive or process Personal Data.
5. Lulu does not sell, rent, trade, or otherwise monetise Personal Data of its customers to any third party for direct commercial gain.

4.3 Online Marketing and Social Media

1. Lulu may send promotional communications, product updates, surveys and marketing information through SMS, WhatsApp, email, mobile applications and social media where you have provided consent or where otherwise permitted under applicable law. You may withdraw your consent or unsubscribe from marketing communications at any time by contacting us.
2. Delivering coupons, redeeming happiness points, mobile coupons, newsletters, in-store receipt messages, e-mails, mobile messages, and social media notifications, and administering raffle draws and contests in both physical store and e-commerce.
3. Responding to requests for information about our products and services in our stores and on our websites or mobile application and connecting with the user through phone call, text, email, online shop, or social media for communications regarding transactions and inquiries.
4. Lulu Services may include third-party advertising and links to other websites and applications. Third-party advertising partners may collect information about you when you interact with their content, advertising, and services.
5. Non personal information will be disclosed with our partners and third-party services to deliver best offer & services.
6. Lulu may provide our customer Personal Data to our advertising partners, business partners, or research agencies which allows them to serve you with more useful and relevant Lulu ads. We never share your name or other information which directly identifies our customers personal information. Instead, we use anonymized or aggregated data (which does not identify an individual directly or indirectly). Such data is outside the scope of “Personal Data” as defined under applicable law.

4.4 Disclosure to Third Parties

Lulu Services may disclose your Personal Data to the following categories of recipients where necessary for the purposes described in this Privacy Notice:

1. Group companies;
2. Delivery and logistics providers – to deliver products to customers;
3. Payment processors – to facilitate secure payment transactions;
4. IT hosting and cloud service providers – to securely store and manage platform data;
5. Marketing and analytics providers – to run campaign and personalized content;
6. Auditor, legal counsel, tax advisors – for regulatory, dispute, or audit purposes;
7. Banks, financial institutions, and card issuers where we believe that sharing your information may be beneficial to you.
8. Government authorities or law enforcement – when required under applicable laws or law enforcement authorities.

We and/or certain authorised third-party service providers or third-party sellers/re-sellers will use the personal information provided by you to provide you with the services, which are offered by Lulu Services. From time to time, we may reveal general statistical information about our site and visitors, such as number of visitors, number and type of goods and services purchased, etc. Your trust and confidence are our highest priority. We do not rent, sell, or share your personal information and we will not disclose any of your personally identifiable information to third parties unless, we have your permission; to provide products or services you’ve requested and to help investigate, prevent, or act regarding unlawful and illegal activities, suspected fraud, potential threat to the safety or security of any person, violations of Lulu terms of use or to defend against legal claims.

4.5 Social Media

1. We operate channels, pages and accounts on some social media sites to inform, assist and engage with customers. We monitor and record comments and posts made on these channels about us so that we can improve our services.
2. Lulu Services is not responsible for any information posted on those sites other than information we have posted ourselves. We do not endorse the social media sites themselves, or any information posted on them by third parties.

5.Data Retention

Lulu keeps personal data records only for as long as required to and manage all the services anticipated by this Privacy Notice. We comply with all applicable legal requirements and taking the legal and regulatory obligations into account, retention period will be taken into consideration when your relationship with us has officially ended. We erase your Personal Data that has not been used by you for a continuous period of seven years and more.

If you no longer wish to use your Personal Data for any of our services provided to you, you may kindly contact us. Additionally, we will retain the Personal Data to the extent required by the applicable law, and to resolve any litigation and dispute as well as for the smooth functioning of our company obligations.

6.Your Rights and Information You Can Access

All information that we have collected is available in our database of contacts. For users who registered on Lulu Services, the e-commerce and marketing platform for a big variety of products and services, all information is available online in your account and you may access to such information at any time by logging in to your account through our website.

6.1 In relation to your Personal Data, you have the Followings Rights, as Mentioned Below:

1. Request correction or updating of the Personal Data that we have with us about you. This enables us to correct or update any incomplete or inaccurate data we have about you. However, we may need to verify the accuracy of the corrected or updated data provided to us by you, to secure the data and comply with our data accuracy policies.
2. Request to deletion and erasure of your Personal Data. You may request to delete or remove Personal Data where there are no reasons for us processing that data. However, in special cases we may not be able to comply with your request of erasure for specific legal reasons which will be notified to you, if applicable, at the time of your request.
3. Objection regarding processing your Personal Data, where we are relying on a legitimate interest and if there is something about your situation that makes you want to object processing on this ground which makes you feel, might impacts on your fundamental rights and freedom.
4. Request restriction of processing your Personal Data. In such circumstances that you have successfully made a request for restriction of your Personal Data, we will suspend the processing of your Personal Data where you wish to cancel all services and close your accounts; or where you are challenging the accuracy of the Personal Data that we hold, and where you may want to exercise or defend legal claims when we would normally delete or anonymise the data.

6.2 In Relation to Your Personal Data, the Following Information can be Accessed:

1. Your recent purchase status.
2. Complete details of your transactions and purchase history.
3. Personal Data (including your name, email address, login credentials, and address details).
4. Your stored payment details (including card information, promotional certificate and gift card balances).
5. Your email notification preferences (including product availability alerts, deliveries, special occasion reminders and marketing newsletters).
6. Your recently viewed products and recommendations are used to personalise your experience including “Recommended for You” and “Improve Your Recommendations”.
7. Your shopping lists and gift registries (including Wish Lists).
8. Your personal information related to your content, devices, services, and related settings, and communications and personalised advertising preferences.
9. Your recently viewed content.
10. Your profile information including your product reviews, recommendations, reminders and personal profile.

6.3 Other Data Protection Rights

In relation to your personal data, you also have the right to object in relation to direct marketing. You may also make an objection to use your personal data for direct marketing purposes. We will stop to send you such communications and sharing your personal data from third-parties.

There are several situations when you can restrict our use of your personal data, if you have made a general objection based on the provisions abovementioned, if you are reassuring the accuracy of the personal data we have in our database, and we have used your personal data improperly, but you do not want deletion. You can also lodge a complaint with the competent data protection authority or regulator having jurisdiction over the processing of your personal data.

7.We design our systems with Your Security and Privacy in Mind

1. We work to protect the security of your personal information during transmission by using encryption protocols and software.
2. Lulu implements appropriate technical and organisational security measures designed to protect personal data from unauthorised access, disclosure, alteration, loss or destruction.
3. We maintain physical, electronic, and procedural safeguards in connection with the collection, storage, and disclosure of personal customer information. Our security procedures mean that we may occasionally request proof of identity before we disclose personal information to you.
4. It is important that you protect your password and devices against unauthorised access. Where using our platform from any device, please ensure that you sign out of your account after each session.

8.Children’s Personal Data

Lulu does not sell products to children and does not knowingly collect personal data from children, except where consent has been obtained from a parent or guardian in accordance with applicable law. If you believe that any child's personal data has been collected without appropriate consent, please contact us so that appropriate action may be taken.

9.Opt-Out Policy

Where you have opted in to receive direct marketing communications, we and selected third parties may use your Personal Data to update you with all the latest information about our product and services that we think may interest you. Your prior consent will be obtained before sending direct marketing where required by law. In any event, we will offer you the option to unsubscribe by simply clicking the unsubscribe link in the footer of the email communications and to stop receiving SMS and WhatsApp, we will offer you the option to unsubscribe on communication sent.

10.Third-Party Links on Our Website

We may offer links to third party websites. However, we are not responsible for the Personal Data or information collection policy of such third-party websites. We strongly advise you to review their terms and conditions, privacy policies and other applicable policies in associated with your subscription. We do not accept any responsibilities or liability for these policies. Please, thoroughly review them before you submit any Personal Data to a third- party website.

11.Ratings and Reviews

You agree that you are the sole author of ratings and reviews you submit to this website. You are responsible and you own the intellectual property rights that relate to the content you submitted. You agree that you would not submit anything that is false, inaccurate, or misleading, whereas if you have been paid for such compensation that it influenced the content of your review; if content have been copied from anyone else, or infringes on any third party’s copyright, patent or trademark; if content you submitted violates any law or is considered to be offensive; if information provided includes references to other websites; or contains any computer viruses, worms or other potentially damaging computer files. Lulu reserves the right to remove or to refuse to post any submission for any reason.

12.Anti-Fraud Statement

Lulu Hypermarket has been notified of fraudulent activities circulating in different locations, through phone calls, messages, emails, and such communications on prize, promotion, recruitment, investment, and money transfer. If you encounter such information, please contact us. We urge you to beware of phone calls and messages with claims of winning prizes from Lulu and asking for your bank details. We do not ask for such information from our customers. Our promotion winners are listed in our stores, official websites & social media channels, while our recruitment process is done through either our official human resource teams or affiliated professional recruiting agencies. We urge you to immediately report such suspicious communication to relevant authorities and government bodies. Lulu Services reserves the right to take legal action, including criminal action, against such individuals and entities.

If you receive any unauthorised, suspicious or fraudulent offers or interview call, please contact us.

13.Notices and Revisions

If you have any concern about privacy at Lulu, please contact us, and we will try to resolve it to the best of our ability. Our business changes constantly, and our Privacy Notice will change also. You should check our websites frequently to see recent changes. Unless stated otherwise, our current Privacy Notice applies to all information that we have about you and your account. We stand behind the promises we make, however, and will never materially change our policies and practices to make them less protective of customer information collected in the past without the consent of affected customers.

14.Important Update: Privacy Notice Changes

We request you to review the privacy notice from time to time. We may amend and update the Privacy Notice periodically, and any updates or changes will be published on our website. Kindly review it and keep yourself updated with the latest version. Any personal data which are being used by us, other than those stated in the Privacy Notice, we will inform and update you through the authorised communication method required by applicable law.

15.Contacting Us and Complaints

If you require further information regarding our Privacy Notice, or if you have a complaint about our handling of your personal information, please email us at the following address: [email protected]. If you have a complaint about our handling of personal information, we will be in contact, promptly and work with you to resolve the issue. If you have questions regarding this Privacy Notice or wish to exercise your privacy rights, please contact:

[email protected]

Lulu will investigate and respond to complaints and data subject requests within the timeframe required by applicable law.

16.Jurisdiction

This Privacy Notice shall be governed by and construed in accordance with the laws of the United Arab Emirates, including Federal Decree-Law No. 45 of 2021 concerning the Protection of Personal Data, as amended from time to time.