Data Protection and Privacy Notice

Lyst Privacy Commitment

To Our Community

If this sort of thing interests you, we would like your feedback on this Privacy Policy and our Terms & Conditions. My hope is that we will make changes as your use of the new version of Lyst evolves over the coming months. Feel free to email me directly with any questions, comments and suggestions.

‐ Chris Morton, CEO / cofounder

When you visit Lyst’s websites (“the Sites”) and Lyst's mobile applications and any other platforms Lyst owns or controls and makes available to you (collectively, the “Services”), you access linked pages or blogs, features, content (including any information, text, graphics, photos, lists of items compiled by you, comments, reviews, links, or other materials uploaded, downloaded or appearing on, or linked to the Services) (collectively the “Content”). By granting us access to your personal data for the collection, use, disclosure and retention of your personal information by us, as described in this Notice, we can make the Services even better for you, like showing you more relevant products and making it easier for you to track products you are interested.

Any personal data about our users (the “User” or “you”) provided to or gathered by the Services is controlled by LYST LTD (a company incorporated in England and Wales, with company number 07132083 and with a registered office at of The Minster Building 7th Floor, 21 Mincing Lane, London EC3R 7AG) ("Lyst").

1. What Does This Notice Cover?

This Notice covers Lyst’s treatment of personal data that Lyst gathers when you access the Services and/or use the Content. We explain what information we gather, why we gather it and the choices you have regarding your personal information.

2. What Personal Information Does Lyst Collect?

We may collect two types of data and information from you:

The first type of information is non-identifiable and anonymous information (“Non-personal information”). We are not aware of the identity of the User from which we have collected Non-Personal Information. Non-Personal Information is any unconcealed information which is available to us while Users are using the Sites. Non-personal Information which is being gathered consists of technical information and behavioural information, including, but not limited to, the operating system, type of browser, screen resolution, the period of time the User visited the Site, etc.

The second type of information is individually identifiable information (“Personal Information”).

This information may identify an individual or may be of a private and/or sensitive nature. Personal information which is being gathered consists of any personal details provided consciously and voluntarily by you including name, email, address, IP address and other unique identifiers and any other information you choose to provide to Lyst.

As customers, you do not have any legal obligation to provide any information to Lyst. However, we require certain information from you in order to operate properly, including completing a transaction on your behalf. Login credentials (email and username) enable us to personalize and improve our services. You hereby agree and acknowledge that any Personal Information you do provide to us is provided at your own free will, for the purposes mentioned in this Privacy Notice and that we may keep such Personal Information in a database(s) which will be registered and kept in accordance with applicable laws and regulations.

We retain personal information no longer than is legally permissible and delete personal information when it is no longer necessary for the purposes set out in this Notice.

3. How do we collect information on our users?

a) Personal Data You Provide to Us

We collect Personal Information when you register and open an account with Lyst by completing the registration form. We receive and store any information you enter on the Services or provide to us in any other way. The types of personal data collected may include your full name, email address, IP address, browser information, username, password, home and billing address, shipping address, credit card information and any other information necessary for us to provide the Services, including the usernames and passwords for your accounts and profiles on third-party sites with which the Services interoperates.

We will collect details of transactions you carry out through our Services and of the fulfilment of your orders. If you contact us, we may keep a record of that correspondence.

You can choose not to provide us with certain information, but then you may not be able to take advantage of many of our features (see section 9 below for further information on the choices you have).

b) Personal Data Collected Automatically

a. We receive and store certain types of information whenever you interact with our Sites or use another feature of our Service. In other words, when you are using the Sites we are aware of it and may gather, collect and record the information relating to such usage, either independently or through the help of third-party services as detailed below. Lyst automatically receives and records information on our server logs from your browser including your IP address, certain cookie information (please see our Cookie Policy for further information) and the page you requested.

b. More generally, our Services automatically collect usage information, such as the numbers and frequency of visitors to our Services and its components, similar to user music preference data or to TV ratings that indicate how many people watched a particular show. Lyst only uses this data in aggregate form, that is, as a statistical measure, and not in a manner that would identify you personally. This type of aggregate data enables us to figure out how often customers use parts of the Services or another feature of the Content so that we can make the Services appealing to as many customers as possible, and improve the Content. As part of this use of information, we may provide aggregate information to our partners about how our customers, collectively, use our Content. We share this type of statistical data so that our partners also understand how often people use our Content, so that they, too, may provide you with an optimal online experience. Again, Lyst never discloses aggregate information to a partner in a manner that would identify you personally, unless it needs to in order to complete a transaction on your behalf. Lyst only discloses information to third parties it trusts.

c) E-mail Communications

We often receive a confirmation when you open an email from Lyst if your computer supports this type of program. Lyst uses this confirmation to help us make emails more interesting and helpful. We also compare our customer list to lists received from other companies, in an effort to avoid sending unnecessary messages to our customers.

Depending on your email notification settings, we may send you instant, daily or weekly "sale alert" updates and other marketing emails that include new products you may be interested in. You can choose to stop getting these updates at any time by opting out for promotional emails using the unsubscribe link in the emails, updating your account settings or through other settings we may provide for this purpose.

d) Mobile Apps

When you download or use apps created by Lyst or its affiliates or subsidiaries and, where applicable, have requested or consented to location services, we may receive information about your mobile device and your location, including a unique identifier for your device. We may use this information to provide you with personalised content and location-based services, such as search results. Most mobile devices allow you to turn off location services. To learn more about what information your device makes available to us, please also check the policies of your device manufacturer or software provider.

4. What About Cookies?

Please see our Cookie Policy for information as to how we use cookies in relation to our Services.

5. Why Do We Collect Information?

Non-personal Information is collected in order to:

• Create aggregated statistical data for research purposes and customisation and improvement of the Sites

Personal Information is collected in order to:

• Operate the Services
• Process payments
• Communicate with you about your orders, as well as products, services and promotional offers
• Administer your accounts and update our records
• Display content and recommend merchandise and services that might be of interest to you
• Improve our Services and platform, prevent or detect abuses of our Services and enable third parties to carry out technical, logistical or other functions on our behalf
• Be able to contact you for the purpose of providing technical assistance, sale reminders and other related information to the Services and collect feedback
• For market research, troubleshooting problems, detecting and protecting against error, fraud or other criminal activity
• To provide to third-party contractors
• For risk control, for fraud detection and prevention, to comply with laws and regulations, and to comply with other legal process and law enforcement requirements
• To enforce Lyst's Terms and Conditions, Privacy Notice and Cookies Policy

6. Where Will We Store Your Personal Data?

The data that we collect from you may be transferred to, and stored at, a destination outside the European Economic Area (“EEA”). It may also be processed and used by staff operating outside the EEA who work for us or by one of our suppliers. Such staff may be engaged in, among other things, the fulfilment of your request, the processing of your payment details and the provision of support services. By submitting your personal data, you agree to this transfer, storing or processing. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this Notice.

All information you provide to us is hosted and stored on Amazon Web Services cloud-based services in Ireland which is also in compliant with ISO27001 standard. For further information on the measures taken by Amazon to protect the security of their servers and your personal data, please see: http://aws.amazon.com/security/. If you are not satisfied with the levels of security offered by our cloud provider, you should restrict the nature and amount of personal data or confidential information which you include in your log data or not use the Services. Any payment transactions will be encrypted using Secure Socket Layer (SSL) technology. Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Services, you are responsible for keeping this password confidential. You must not share a password with anyone.

7. Sharing Information With Third Parties

We share your Personal Information only as described in this Notice and require commercial entities with which we share your Personal Information to agree to keep your information confidential.

a) Lyst Partner Websites We Do Not Control

Lyst works with a variety of merchants (“Lyst Partners”) in order to offer you the widest possible choice of fashion items through the services. We promote and sell the items offered by the Lyst Partners through the Services. When you choose to buy an item, you may be taken directly to their online store. You can easily recognise when a third-party business is associated with your transaction, and we will share your personal data that is related to such transactions with that business. Please note that: (i) the third-party business will use and share your personal data in accordance with its privacy policy; (ii) you should check its policy before completing any transaction involving such third-party business; and (iii) such third-party business is solely responsible for its use and sharing of your personal data.

b) Klarna checkout

For payments made on Lyst via Klarna checkout, we use a third party payment process provider called Klarna. In order to pay for items via Klarna checkout you must contract with Klarna directly for their payment services. Your transaction with Klarna is subject to Klarna’s terms and conditions. Klarna is solely responsible for its use and sharing of your personal data, and you should carefully review Klarna’s privacy policy before completing a transaction via Klarna checkout. Klarna’s full terms and conditions are available to view here and its Privacy Policy is available here.

c) Stripe

For certain transactions made via our Integrated Checkout, we also use a third party payment process provider called Stripe (please see section 7(ix) below). Please note that we will share your personal data with Stripe that is related to such transactions and Stripe may collect personal data from you directly via cookies or other means in order to process such transactions. Stripe does not sell or rent your personal Information to marketers or third parties. Please note that Stripe may transfer, process and store your personal data that it collects outside of EU member states. Stripe has certified that it adheres to the Safe Harbor Privacy Principles agreed upon by the U.S. and the E.U. The Safe Harbor certification for Stripe, Inc. can be viewed on the U.S. Department of Commerce’s Safe Harbor Web Site. Your personal data may be subject to disclosure by Stripe as required by applicable law. You can find out more about how Stripe collects and uses your personal data by clicking https://stripe.com/gb/privacy if you are a UK customer or https://stripe.com/us/privacy if you are a US customer, or by selecting the relevant privacy policy for your country by following these links. By using the Services and making payments through the Services, you are agreeing to Stripe's use of your personal data in accordance with their privacy policy.

d) Other Third Parties

We may share your personal data with selected third parties including advertisers and advertising networks that require the data to select and serve relevant adverts to you and others. We do not disclose information about identifiable individuals to our advertisers, but we may provide them with aggregate information about our users (for example, we may inform them that 500 men aged under 30 have clicked on their advertisement on any given day). We may also use such aggregate information to help advertisers reach the kind of audience they want to target (for example, women in SW1). We may make use of the personal data we have collected from you to enable us to comply with our advertisers' wishes by displaying their advertisement to that target audience.

We may also share your personal data to analytics and search engine providers that assist us in the improvement and optimisation of our site. We have implemented the Google Analytics Demographics and Interest Reporting feature. Click here for information on opting out of Google Analytics features.

e) Agents

We employ other companies and people to perform tasks on our behalf and need to share your information with them to provide products or services to you. Unless we tell you differently, Lyst’s agents do not have any right to use personal data we share with them beyond what is necessary to assist us.

f) User Profiles and Other Information You Post

User profile information including your username, name, email address, and other information you enter (“User Submissions”) may be displayed to other users to facilitate user interaction within the Services and allow you to follow other users, and them to follow you. Email addresses are used to add new User Submissions to user profiles and to communicate through User Submissions. Any personal data or content that you voluntarily disclose online (on discussion boards, in messages and chat areas, through reviews in product pages, etc.) become publicly available and can be viewed, collected and used by others. Any images, captions, physical descriptions, personal interests or other content that you submit to the Services may be redistributed through the Internet and other media channels, and may be viewed by the general public.

Please be aware that whenever you voluntarily post information to public areas on the Services or any other public forums, such information can be accessed by the public.

g) Communication in Response to User Submissions

As part of the Services, you will receive from Lyst email and other communication relating to your User Submissions. You acknowledge and agree that by posting such User Submissions, Lyst may send you email and other communication that it determines in its sole discretion relate to your User Submissions. Lyst may need to provide you with certain communications, such as service announcements and administrative messages. These communications are considered part of the Services and your Lyst account, which you may not be able to opt-out from receiving.

h) Business Transfers

In some cases, we may choose to buy or sell assets. In these types of transactions, customer information is typically one of the business assets that are transferred. Moreover, if Lyst, or substantially all of its assets were acquired, or in the unlikely event that Lyst goes out of business or enters bankruptcy, customer information would be one of the assets that is transferred to or acquired by a third party. You acknowledge that such transfers may occur, and that any acquirer of Lyst may continue to use your Personal Information as set forth in this Notice.

i) Protection of Lyst and Others and a Transfer in the Ownership of Lyst

We may release personal data when we believe in good faith that release is necessary to comply with the law, regulation or legal request; enforce or apply our conditions of use and other agreements; or protect the rights, property, or safety of Lyst, our employees, our users, or others. This includes exchanging information with other companies and organizations for fraud protection and credit risk reduction. You agree that we may also share your data with entities where Lyst is engaged in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction or proceeding that involves the transfer of the information described in this Notice.

j) Integrated Checkout

We allow you to purchase items from multiple different Lyst Partners via the Services through our Integrated Checkout service. Lyst Partners that are part of our Integrated Checkout marketplace (please see the terms and conditions for more information on the Integrated Checkout service) promote and market their items to you through the Services. Purchases made using our Integrated Checkout Service are processed either:

i. by the Lyst Partner using information that you provide to us, or

ii. by a third party payment process provider called Klarna (please see the terms and conditions for more information on Klarna and the Integrated Checkout service).

When you make a purchase through our Integrated Checkout services using Klarna checkout, you will transact with Klarna directly for their payment services and provide your payment details directly to Klarna to enable them to process payment for your order. Your details may be used by Klarna in accordance with Klarna’s privacy policy. Klarna is solely responsible for its use and sharing of your personal data. You should carefully review Klarna’s privacy policy before completing a transaction using Klarna checkout. Klarna’s privacy policy can be viewed here.

Further when you make a purchase through our Integrated Checkout services, we will share your personal data that is related to such transactions with the relevant Lyst Partner from whom you have purchased the item(s), but only using our secure systems. These details will be encrypted and used to process card transactions transactions and/or the orders which you have initiated. The details we provide may be used by the Lyst Partner, along with other personal data, as set forth in such Lyst Partners’ privacy policies for a number of purposes, including, without limitation, for keeping you up to date with their latest products, developments, and trends. Lyst Partners are solely responsible for their use and sharing of your personal data, and you should carefully review their privacy policies before completing a transaction on our Integrated Marketplace.

We require our partners to honor your opt-out requests if you elect to stop receiving marketing e-mails. Please be advised that you cannot opt-out of receiving emails related to your transactions. If, for whatever reason, your opt-out request is not honored, please let us know and we will attempt to resolve the issues.

We may also share your data with Lyst Partners in connection with certain promotions and competitions. These will be subject to additional rules and conditions which will be made available at the time of any such competition or promotion. You should carefully review the rules and conditions relating to such competitions and promotions.

k) With Your Consent

By using the Services, you consent to our sharing of personal data for the above purposes.

l) Affiliates

We may share some or all of your personal data with any of our parent companies, subsidiaries, joint ventures, or other companies under common control with us.

For the avoidance of doubt, Lyst may transfer and disclose Non-personal information to third parties at its own discretion.

8. Is Personal Information About Me Secure?

The personal data in the Lyst account you have with us is protected by a password for your privacy and security. You need to ensure that there is no unauthorised access to your account and personal data by selecting and protecting your password appropriately and limiting access to your computer and browser by signing off after you have finished accessing your account. You are responsible for safeguarding the password that you use to access the Services and for any activities or actions under your password. Lyst encourages you to use “strong” passwords (passwords that use a combination of upper and lower case letters, numbers and symbols) with your account. Lyst cannot and will not be liable for any loss or damage arising from your failure to comply with the above requirements.

Unfortunately, the transmission of information via the Internet is not completely secure. Lyst endeavors to protect personal data but Lyst cannot guarantee the security of your data transmitted to our Services. Unauthorised entry or use, hardware or software failure, and other factors, may compromise the security of user information at any time. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our platform; any transmission of data is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

9. What About Links To Third Party Websites?

The Services contain links to other sites. Lyst is not responsible for the privacy policies and/or practices on other sites. When linking to another site you should read the privacy policy stated on that site. This Notice only governs information collected on the Services.

We will take care to maintain appropriate safeguards to ensure the security, integrity and privacy of the information you have provided us with. We encrypt your information to protect it from unauthorised use. In addition, we will take reasonable steps to ensure that third party business partners' to whom we transfer any data will provide sufficient protection of that personal data.

To help ensure that your shopping experience is safe, simple, and secure, we use Secure Socket Layer (SSL) technology.

10. What Personal Data Can I Access?

Lyst allows you to access the following information about you for the purpose of viewing, and in certain situations, updating that information: your name; user email address; username and password; profile picture; bio; website; user preferences; zip- and/or post-codes, billing address, and payment information.

The information you can access will change as the Services change.

If you are a registered user of Lyst, you can change or delete any saved payment card details and add or edit shipping and billing address information.

In the UK the General Data Protection Regulation (the "GDPR") gives you the right to access information held about you. For any request or question regarding obtaining a copy of personal data we hold relating to you, and/or correction or deletion of your personal data, and/or object to any processing of your personal data, you can submit a Subject Access Request by filling in the form below and send it to us at gdpr@lyst.com.. We will respond to your access and/or correction request within 30 days.

However, please note that although your Personal Information may be removed from our databases, Lyst will retain the anonymous information contained in the data you provided, and such information will continue to be used by us for statistical purpose.

11. Data Retention

After a request from a User to delete any data, an automated process will begin that permanently deletes the relevant data. Once begun, this process cannot be reversed and data will be permanently deleted. Any data which is not deleted shall be kept in an anonymized manner.

As a registered User you can always view, access, change and delete your information by logging into your account.

Similarly, Lyst collects and retains usage data, other metadata and statistical information concerning the use of the Service are not subject to the deletion procedures in this Notice and may be retained by Lyst. Some data may be retained also on our third party service providers’ servers.

12. What Choices Do I Have?

As set out above, you can always opt not to disclose information, even though it may be needed to take advantage of the Services.

You are able to add or update certain information on pages, such as those listed in section 10. “What Personal Data Can I Access” above. When you update information, however, we often maintain a copy of the unrevised information in our records.

Once Lyst accounts are activated, you may request deletion of your account by following the instructions at the Account Settings section of the Services. Please note that some information may remain in our records after deletion of your account.

When you register for an account at our Services, you consent to receive certain email or other communications from us; if you do not wish to receive any such communications, you should not register for an account at our Services. We may also use your data to provide you with information about products and services which may be of interest to you, directly or on behalf of one of our business partners. You can however change the type and frequency of the emails you receive from us at any time by changing your email settings here or by unsubscribing from such emails.

Most mobile devices provide users with the ability to disable location services. These controls are usually located in the device's settings menu. Please contact your mobile service carrier or device manufacturer if you have questions about how to disable your device's location services.

Please note that if you choose not to receive legal notices from us, such as this Notice, those legal notices will still govern your use of the Services, and you are responsible for reviewing such legal notices for changes.

13. Children

We do not knowingly market or sell products for purchase by children. The Services are not designed for use by children under 13 years old. Children under 13 are not allowed to register with or use the Services, or submit personal data through the Services. We do not knowingly collect personal data from anyone under the age of 13. If we discover that we have collected personal information from a child under 13, we will delete that information immediately.

14. Changes To This Notice

Lyst reserves the right to change this Notice from time to time. Use of information we collect now is subject to the Notice in effect at the time such information is used. If we make substantial changes in the way we use personal data, we will notify you by posting an announcement on our Services or sending you an email. Otherwise, all other changes to this Notice are effective as of the stated “Last Revised” date and your contined use of the Site and/or Services after the Last Revisited date will constitute acceptance of, and agreement to be bound by, those changes.

15. Questions Or Concerns

If you have any questions or concerns regarding privacy on our Services or the Content, please send us a detailed message here. We will make every effort to resolve your concerns. If your questions or concerns are not answered online, you may write to us at The Minster Building 7th Floor, 21 Mincing Lane, London EC3R 7AG.

This Agreement has been drawn up in the English language. In case of discrepancies between the English text version of this Agreement and any translation, the English version shall prevail.

Last Revised: 3 December 2018