Privacy Policy ANKORSTORE platform

1. Introduction

Ankorstore takes the protection of its users’ personal data seriously.

This policy has been drafted to inform you transparently about the data and information collected, how it is used, and your rights.

Ankorstore may modify this policy at any time due to changes in our operations or new legal and regulatory requirements. We commit to notifying you of any significant changes (via email or notification in your Account). Unless stated otherwise, modifications take effect upon publication. The current applicable version is always the one published on the Platform.

Any capitalized terms not defined in this policy have the meaning given to them in the applicable General Terms and Conditions (if you are a Brand or if you are a Retailer ).

The data controller is ANKORSTORE SAS, registered with the Paris Trade and Companies Register under no. 852 870 658, with its registered office at 101 rue de Sèvres, 75006 Paris, France.

2. How does Ankorstore collect your data?

Your personal data is collected and processed by Ankorstore during your registration and throughout your use of the Platform. This data is collected in several ways:

• Directly provided by you: e.g., during your registration and use of the Platform; or when you fill in a form made available by a Brand via our Services, for example at a trade fair, an event, or from the Brand’s Ankorstore store

• Automatically through cookies, third-party integrations, and similar technologies: e.g., when you interact with our emails and advertisements, when you access the Platform or a Brand’s Ankorstore store via a QR code, a link, a widget, or any other redirection tool associated with that Brand, in particular to identify the source of your visit and, where applicable, to link your Account to that Brand’s network. To learn more about our use of cookies, consult our cookie policy:

• Other sources, including our affiliates and business partners, public sources, social networks, or transmitted by other users (e.g., referral programs) including Brands who may transmit to us or collect via MyNetwork the professional contact details of their prospects or clients

3. What data does Ankorstore process?

We have listed below examples of the types of data that Ankorstore may process about you, detailing the associated context:

Note: When certain data is essential for executing our Services or complying with our legal obligations, you will be informed, and if refused, you acknowledge that we will not be able to provide the Services concerned.

4. Why are your data collected (purposes and legal basis)?

Ankorstore processes your personal data for several reasons (referred to as processing purposes), each based on legal grounds. The table below provides an overview.

4. Who has access to your personal data?

Potential recipients who may access your data are:

• Ankorstore subsidiaries, employees and collaborators (e.g., service providers and subsidiary employees) strictly within their missions

• Other Platform Users when certain of your data is made public (e.g., average response time, reviews left/received, rating obtained), or when using Messaging (message content, read receipts, account administrator's first and last name), Brands when their Products have been added to a Retailer's cart. When a Retailer adds a Product to their wishlist or similar feature, the relevant Brand may be notified in their Account after a certain period (only the reference of the relevant Product(s) and the store name are visible to the Brand, who may then contact the Retailer solely via Ankorstore Messaging). Reorder suggestions displayed to Retailers are not shared with the relevant Brands. Some of this information may also be used to manage network relationships via MyNetwork, as described below.

• Platform users in your network, in particular via MyNetwork, (pre-existing relationship) can see, for example, your eligibility for certain benefits, if you’ve subscribed to Ankorstore+, and contact data provided during registration. A network relationship may arise, in particular, from a pre-existing commercial relationship, from your being added as a prospect or client by a Brand in MyNetwork, from a form you filled in for a Brand, from scanning a QR code, from clicking a link or widget made available by a Brand, or from a redirection to the Platform from the Brand’s website or other associated channel. When you already have an Ankorstore Account, or when you subsequently create an Ankorstore Account after being added as a Brand’s prospect/client or after accessing the Platform via a channel associated with that Brand, we may link you to that Brand’s MyNetwork network. If you do not yet have an Ankorstore Account, no Account is automatically created solely because of your addition to MyNetwork, a QR code scan, a link or widget click, or a redirection from a Brand’s website.

• Service providers involved in providing the services used:

  • Carriers responsible for delivering your orders

  • Our Payment Service Provider: Stripe (Stripe Payments Europe, Ltd.)

  • Our Payment Partner where applicable: Aria SAS, 5, rue Pleyel, 93200 Saint-Denis, acting in its own name or in the name and on behalf of a securitization vehicle

  • Our fraud prevention provider: Ravelin Technology Ltd.

These companies process your data independently as separate data controllers. Consequently, we recommend consulting their own privacy policies.

• Our service providers acting according to our instructions for service provision, known as processors:

  • Platform hosting

  • Mailing services (transactional and marketing emails, SMS, MyNetwork campaigns)

  • Various solutions used daily by our teams (call and SMS tools, office suite, analysis tools, financial management, FAQ and customer service management)

  • Our provider supplying Ankorlogistics services (from warehouse stock management to order preparation)

  • Our partners handling received customer reviews

The use of your data by these processors and their responsibility are contractually regulated in accordance with regulations.

• Various external service providers Ankorstore may use: lawyers, accountants, statutory auditors, auditors... All bound by confidentiality obligations

• Authorized third parties: in certain cases, Ankorstore may be required to communicate certain data to authorities in application of law or court decisions (e.g., customs, tax services, police)

5. MyNetwork and linking of a Retailer to a Brand’s network

MyNetwork is a tool made available to Brands to enable them to manage their professional network of Retailers, prospects, or clients. A Brand may add contacts to MyNetwork, or enable their addition through features made available by Ankorstore, such as a form, a QR code, a link, a widget, or a redirection from the Brand’s website or other associated channel.

If you do not have an Ankorstore Account, no Account is automatically created solely because of your addition to MyNetwork, a QR code scan, a link or widget click, or a redirection from a Brand’s website. If you subsequently create an Ankorstore Account, or if you already have an Ankorstore Account, we may match your Account with the relevant Brand’s network where a piece of information or a source identifier enables us to establish this link.

This matching may enable the Brand to access, within their Account, certain information associated with your Ankorstore Account and your activity in relation to that Brand, under the conditions described in this policy.

6. How long does Ankorstore retain your personal data?

In accordance with applicable regulations, your data will be retained for the strictly necessary duration for the purposes for which it was collected. And when necessary, for the duration allowing Ankorstore to meet its legal obligations (e.g., accounting, tax obligations). Where certain information about a Retailer is made visible to a Brand in their Account (e.g., the wishlist or cart), this visibility is time-limited in accordance with the parameters of the relevant feature.

Where you are linked to a Brand’s MyNetwork network, certain information may remain visible to that Brand in accordance with MyNetwork settings, applicable retention periods, and the exercise of your rights. Information relating to certain one-off interactions, such as adding a Product to a wishlist or to a cart, may be visible for a limited period in accordance with the parameters of the relevant feature.

7. Profiling and automated decision-making

To ensure Platform security, we and our partners may conduct profiling leading to automated decision-making.

Profiling by our fraud prevention partner affects order acceptance or rejection. For example, this helps us detect fraud or identity theft cases. Based on the assigned trust score, our system automatically accepts or rejects the concerned order.

Profiling by our Payment Partner allows them to estimate repayment capacity. Based on this, our Payment Partner will automatically decide whether to offer payment terms for the concerned Order. They use purchase history on the Platform, data related to previous repayments and existing outstanding amounts if applicable, combined with other publicly available information or obtained from their own partners. For more details, please consult their privacy policy.As these decisions are made without human intervention, in accordance with regulations, we remind you that you have the right at any time to request human intervention for decision review, obtain explanations about it, or simply share your viewpoint. You can exercise these rights by contacting us at the address below. Furthermore, certain Platform features may rely on automated analysis of your activity, in particular your Order history, in order to personalise your experience or display useful suggestions in your Account. For example, we may display reorder suggestions to Retailers where their Order history indicates that they regularly order certain Products. These suggestions are purely informational, do not give rise to any automatic Order, are not shared with the relevant Brands, and do not produce any legal or similarly significant effect.

8. What are your rights over your data?

As provided by applicable regulations, data subjects have rights of access, rectification, erasure, and data portability. Individuals also have rights to object, withdraw consent, and restrict processing. All these rights are exercised under the conditions and limits provided by applicable regulations. Where your data has been added to or used by a Brand in MyNetwork, certain requests relating to the origin of the collection, the legal basis used by the Brand, communications sent by the Brand, or the deletion of your data from that Brand’s network may fall within the responsibility of the relevant Brand. Where your request concerns your Ankorstore Account, your linkage to a Brand, or information made visible via the Platform, you may contact us at the address below.

If you have a question about how your data is processed, or if you wish to exercise one of your rights, you can contact our team at data.privacy@ankorstore.com. We will strive to provide the clearest and most complete response possible, within the timeframes and procedures provided by regulations.

Finally, if you believe your rights have not been respected, you always have the possibility to contact the National Commission for Information Technology and Civil Liberties (CNIL).

Current version May 2026