NuPARE · Privacy Policy

Privacy Policy

Summary

We collect the information you give us (including what you add to your digital wardrobe from photos, receipts and connected email), the information your use of the app generates (including a record of the screens you visit and what you tap, kept for 30 days), and some information from others (such as Stripe and, if you are referred, the person who referred you). We use it to run the marketplace, Resale, subscription, Points, Creator, booking, wardrobe, styling and community features; to keep the platform safe; to meet legal duties such as Seller verification and tax reporting; and, with your permission where the law requires it, to personalise your experience and send you marketing. We store it in Australia (Sydney). Images you use for virtual try-on are processed in the United States. We do not sell it. You can access, correct, delete and take a copy of it, object to and opt out of some uses, and complain to us and to your privacy regulator. Sections 1 to 16 set out the detail; the Regional Annexes at the end state what differs where you live.

1. Who is responsible, and how to reach us

1.1 Controller. Nu Pare Pty Ltd, ACN 698 123 545, of 143 St Georges Terrace, Perth WA 6000, Australia (NuPARE, we, us) is the controller of the personal information described in this Policy: you can reach us at privacy@nupare.com.au or by post at that address.

1.2 Privacy Officer and Data Protection Officer. You can reach our Privacy Officer (who is also our Data Protection Officer for the purposes of the laws that require one, including in Singapore, Malaysia and the EEA) at privacy@nupare.com.au and by post marked "Privacy Officer". We publish their name and title on our Legal Contacts page at nupare.com.au/legal/contacts.

1.3 Representatives. Because we are established in Australia, we are required to appoint representatives in the European Union (under Article 27 of the GDPR) and the United Kingdom (under Article 27 of the UK GDPR). We publish their names and postal addresses on the Legal Contacts page and in Annexes C and D; we do not offer the Service in the EEA or the United Kingdom until those particulars are published there. You may contact them on any matter relating to this Policy. Where the law of another country requires a local representative, the Legal Contacts page names them.

1.4 Others who are responsible for their own use. Stripe, our payment services provider, is independently responsible for the payment information it processes and for the identity and financial information it collects to open your connected account; its privacy policy is linked at checkout and in Settings › Payments. Brand Partners are independently responsible for the information they receive to fulfil your order, to answer your messages and to see you as their customer (section 5.5), within the limits our agreement with them sets. Sellers, Stylists and Care Providers who receive your name and address to fulfil an order or booking are responsible for their own use of it, and our terms with them limit that use to the transaction.

2. Information we collect

2.1 Information you give us.

2.2 Information we collect automatically.

2.3 Information we collect from others. Some countries (including New Zealand, from 1 May 2026) require us to tell you specifically when we collect information about you from someone other than you. We collect: your name, address and contact details from a Seller or Provider when they dispatch to you or complete a booking; your contact details from a member who refers you (we tell you at first contact that we received them from that member, why, and how to have them deleted); payment results, payment-risk scores and connected-account status from Stripe; receipts and order emails from Gmail or Outlook if you connect them, and from retailers who email your NuPARE forwarding address; sign-in information from Apple or Google if you sign in with them (name, email, and an identifier); order and shipment updates from Brand Partners and their systems (Shopify, WooCommerce, BigCommerce) and tracking events from Australia Post and AfterShip; click and sale records from the affiliate networks (Awin, Rakuten Advertising, Commission Factory, Impact) for Creator attribution (click tokens, not your identity); analytics and attribution data from the analytics and advertising partners named in Annex N; business registration, VAT and sanctions-screening results from public registers and screening providers when you sell or provide services; and reports about you from other members, rights holders, trusted flaggers, regulators and law enforcement. We do not buy personal information from data brokers.

2.4 Sensitive information. We collect device location only for the feature you are using and do not store it. Calendar access, if you grant it, reads event titles, times and places only to suggest outfits, and we do not keep the events beyond the suggestion. A photograph you use for virtual try-on is used only to generate an image of you wearing a piece. We do not use it to identify or authenticate you, create, store or compare a face- or body-geometry template from it, or use it for facial recognition or facial analysis; it is not "biometric data" under Article 4(14) of the GDPR or the UK GDPR, which require processing directed at unique identification. Where you live in a state whose biometric law applies to a scan of face or body geometry regardless of purpose (including Illinois, Texas, Washington and Colorado), we treat the image as covered by Annex E.11. Before we process it we give you the separate written notice and obtain the written release that Annex describes. We delete the image and anything derived from it when the try-on is complete, and we do not sell, lease, trade or otherwise profit from it. Our retention and destruction schedule is in Annex R. Our image-generation providers are contractually prohibited from retaining the image, deriving a template from it, or using it for any purpose other than generating your try-on image. We collect a criminal-history result only for Stylists who consent, where lawful. We collect a facial image for identity matching only if you choose that verification method, and the biometric template is held by our verification vendor, not by us, and deleted within 30 days of verification. In Australia a facial image used for identity matching is sensitive information and we collect it only with your express consent, and only where it is reasonably necessary for a verification the law requires. We collect government identity documents only where the law requires Seller or Provider verification. We do not ask for, and ask you not to post, information about your health, religion, ethnicity, sexual orientation or political views; if you include it in content or measurements (for example maternity or adaptive sizing), we use it only to provide the feature you are using and it is covered by Annex E.10 where you live in Washington or Nevada. We do not use special-category or sensitive information for advertising or profiling.

2.5 If you do not provide information. You cannot create an account without a name, email address and age confirmation; you cannot buy without a delivery address and payment method; you cannot sell, provide services or earn commission without the verification information the law requires (and if you do not provide it we must suspend those activities and, in some countries, withhold payouts). Everything else is optional and we tell you so when we ask.

2.6 App permissions. The app asks for these permissions, each for the purpose stated and each optional: Photos (to add pieces and receipts to your wardrobe and to post); Camera (to photograph pieces, receipts and care labels, to post, and to broadcast live); Microphone (voice search and live broadcasts); Speech recognition (voice search, processed on your device); Location when in use (the weather for outfit suggestions and nearby Providers; not stored); Calendar (outfit suggestions for upcoming events); Notifications (order, booking, message and safety alerts, and marketing only if you opt in). You can change any permission in your device settings; the feature that needs it will not work without it, and nothing else is affected.

3. Why we use your information, and on what legal basis

Where the law of your country requires a legal basis for each use (as in the EEA, the UK, Switzerland, Korea, Singapore and elsewhere), this table states it. "Contract" means the use is necessary to perform our contract with you; "legal obligation" means a law requires it; "legitimate interests" means the use is necessary for our or a third party's legitimate interests, which are stated, and we have assessed that your interests do not override them (you can ask us for a copy of that assessment); "consent" means we ask you first and you can withdraw at any time.

We do not use your personal information to set individualised prices. We do not sell your personal information for money. We do not share it with Brand Partners or Creators for their own marketing without your separate consent.

4. Automated decisions, profiling and AI

3.9A The analytics beacon and cookies. Every page on nupare.com.au loads a small analytics beacon that records the page, the referrer, the user agent and an approximate location derived from the network address, whether or not you have an account. We use it to understand how the site is used and to keep it working. Where the law of your country requires consent before a non-essential cookie or similar technology is set, we ask for it through a consent banner before setting one, we set only strictly necessary cookies until you answer, and we make refusing as easy as accepting. Annex N is our Cookie and Tracking Policy and lists what is set, by whom and for how long.

4.1 Decisions made entirely by automated means. The following decisions can be made by our systems without a person: blocking a payment or listing that matches a high-confidence fraud or prohibited-item signal; placing a temporary hold on a payout pending review; removing content that matches known illegal material; crediting, expiring and adjusting Points; attributing a purchase to a Creator; personalised ranking; size and fit recommendations; AI stylist outfit suggestions; Smart Pricing adjustments to a Resale price where you have opted in; rate limits; and releasing a Resale payment when the claim window closes without a claim. These use your transaction history, device and usage signals, listing and message content, and (for attribution) link and cookie data. They can affect your access to funds, your ability to sell or post, and what you see. In every case you can ask for a person to review the decision (section 9.6), we tell you when the decision affects you, and we do not base any such decision on special-category or sensitive information.

4.2 Decisions where automation assists a person. Account suspension and termination, Resale Protection and Provider complaint outcomes, Creator commission reversals, reclassification of a Seller as a business, moderation of reported content, and appeals are decided by a person using information and recommendations produced by our systems.

4.3 Profiling. We build a profile of your preferences from your activity to personalise ranking and recommendations, and, with consent where required, for marketing. The main parameters, and how to turn personalised ranking off, are in the Terms (clause 3.9). We do not profile for advertising anyone we know to be under 18, and we do not use special categories of data in profiling.

4.4 AI features. Our AI features use the information you give the feature (a search query, a photo of a piece for a listing, your measurements) and, for recommendations, your activity. We do not store outputs beyond what is needed to provide the feature and improve it. We do not use your photographs, messages or content to train generative AI models, other than to evaluate and improve the specific feature you used them with, and we do not share them with model providers for their own training. Where an AI feature interacts with you directly, we tell you it is automated.

4.5 Regional rules. Annexes A (Australia, from 10 December 2026), C (UK), D (EEA), E (California, from 1 January 2027), F (Quebec) and J (Korea) set out additional rights and disclosures about automated decisions where you live.

5. Who we share information with

5.1 Other members, to complete a transaction. Your name and delivery address go to the Seller of an item you buy; a buyer's name and address go to you when you sell; your name, the service booked and, for in-person sessions, the session address go to a Provider after the booking is confirmed. Members must use that information only for the transaction. Your handle, profile photo, reviews, listings, looks, posts, reads, episodes and Creator content are visible to other members and, unless your account is private, to the public and to search engines; stories are visible to the audience you choose; live broadcasts are visible to those who join; circle Organisers see who is in their circle; gathering Organisers receive ticket holders' names; your presence is shown to members you follow and who follow you unless you turn it off. A partner Stylist you grant access to sees the parts of your wardrobe you allow, for the time you allow, and you can see every time they looked.

5.2 Published Seller information. Where the law requires (currently the EEA under the Digital Services Act, the United States under the INFORM Consumers Act for high-volume Sellers, and countries whose consumer laws require trader identification), we publish a business Seller's name, address, contact details and registration numbers on their listings. Where the law requires, we disclose a Seller's or Provider's identity, address and phone number to a buyer or customer who has a claim against them (for example in Japan and Korea).

5.3 Service providers (processors). We use providers to host and run the Service, process payments and verify identity, deliver items, send email, push and SMS, provide customer-support tools, analytics, fraud detection, content moderation, and professional advice. They act on our instructions under written contracts that require them to protect your information and use it only for our purposes. The current list of categories and, for the principal providers, names and locations, is in Annex O.

5.4 Payment provider. Stripe receives the information needed to process payments and to open and verify a connected account for Sellers, Providers, Creators and Organisers, and is independently responsible for that.

5.5 Brand Partners. A Brand Partner receives your name, delivery address and order details to fulfil an order you place with it, and your messages when you message it. A Brand Partner can also see, for its own customers, your name, handle, suburb and state, number of orders, spend, units and first and last order dates, so it can serve you; on the Index plan it also sees aggregated wardrobe insights that do not identify anyone. A Brand Partner may use this information only to fulfil and service your orders and, under the data-sharing terms of our agreement, may not use it to market to you unless you consent separately, and must delete it when it is no longer needed for those purposes.

5.6 Tax authorities, regulators and law enforcement. We disclose Seller and Provider information to tax authorities as section 3 describes; we respond to lawful requests from courts, regulators, police and safety authorities; and we report suspected stolen goods, fraud, child safety matters and product-safety incidents where the law requires or permits.

5.7 Rights holders. If you list an item that is the subject of an infringement notice, we may disclose your name and contact details to the rights holder where the law requires or a court orders it.

5.8 Corporate transactions. If we sell or reorganise our business, your information may be transferred to the successor, who must honour this Policy; we tell you before that happens and you may close your account.

5.9 With your consent. We share your information in any other case only with your consent.

6. Where your information goes

6.1 Locations. We are based in Australia and our systems run in Amazon Web Services' Sydney region (Australia), including the text models we use (Claude on Amazon Bedrock). We ask for Australian and Asia-Pacific endpoints wherever the provider offers them, and we tell you that some model identifiers are cross-region: where a request is served outside Australia we rely on the safeguards in section 6.2, and we do not represent that every text request is processed only in Australia. Photographs and body figures used for virtual try-on and for the images we generate are generated, not merely analysed, outside Australia: they are processed in the United States by Stability AI in Oregon and by OpenAI, and by Google (Gemini), and are cached in the United States. Generating an image from your photograph creates and stores a new image, which is a more substantial use than analysis, and we describe it that way so that you can assess it. Part 12A of the Terms explains what those images are and who owns them. Other providers process information in the United States and, depending on the provider, the European Union, the United Kingdom, Singapore and Japan: Stripe (payments), Google (Firebase Analytics, website analytics, Gmail connection, sign-in), Microsoft (Outlook connection, Teams invitations for Stylist sessions), Apple (push notifications, sign-in), Australia Post and AfterShip (tracking), Brave (search grounding for AI answers), the affiliate networks (click tokens only), and our support and email providers. Information also goes to the country where a member, Brand Partner or Provider you transact with is located. The current list is in Annex O.

6.2 Safeguards. Where information is transferred from a country whose law restricts transfers, we use the mechanism that law recognises: for the EEA, the European Commission's standard contractual clauses (2021) with a documented transfer impact assessment, and, for United States providers certified under the EU–US Data Privacy Framework for the relevant data, that Framework, with the clauses as a fallback; for the UK, the International Data Transfer Agreement or the UK Addendum, with a transfer risk assessment, and the UK Extension to the Data Privacy Framework where available; for Switzerland, the clauses with the Swiss amendments; for Australia, the steps required by Australian Privacy Principle 8; for New Zealand, the requirements of Information Privacy Principle 12; for Singapore and Malaysia, contractual obligations providing a comparable standard of protection; for Japan and Korea, the information and consents in Annexes H and J; for Saudi Arabia, the standard contractual clauses approved by the Saudi Data and Artificial Intelligence Authority with a risk assessment; and for Quebec, a privacy impact assessment and written agreement under section 17 of the Act respecting the protection of personal information in the private sector. You can ask us for a copy of the relevant safeguards at privacy@nupare.com.au.

6.3 Government access. Information stored in another country may be accessible to the courts, law enforcement and national security authorities of that country under its laws. We assess that risk in our transfer assessments and we challenge requests that we consider unlawful or over-broad.

7. How we protect information

We protect your information with organisational measures (a designated Privacy Officer, staff confidentiality obligations, role-based access, privacy and security training, vendor due diligence, incident-response and business-continuity plans); human measures (background screening of staff with access to verification data, and access reviews); physical measures (data centres with certified physical security, no verification documents held on paper); technical measures (encryption in transit and at rest, multi-factor authentication for staff, logging and monitoring, vulnerability management and penetration testing, segregation of verification and payment data, and automated deletion at the end of retention periods for most records, with manual review and purge where automation is not yet in place, as the Data Retention Schedule sets out); and, for information handled in a foreign country, an assessment of that country's legal environment and contractual safeguards with the provider. No system, and no transmission over the internet, is perfectly secure, and we cannot guarantee the security of information you choose to publish on the Service or send to another member, a Brand Partner or a Provider, or of a device, network or email account that you control. We ask you to keep your login details safe, to use the security features we offer, and to tell us at once if you think your account has been compromised. This paragraph describes the limits of what any provider can promise; it does not reduce our obligations under the privacy or consumer law of your country, or our liability under clause 15.2 of the Terms of Service.

8. How long we keep information

We keep information for as long as needed for the purpose we collected it, and then for as long as the law requires. The main periods are:

Where this table and the Data Retention Schedule in the Platform Policies differ, the shorter period applies.

| Screen and tap trail | 30 days | Diagnostics and product improvement | | Forwarded email (raw) | 30 days | Wardrobe import | | Imported wardrobe evidence (subject, date, fields) | Life of the piece in your wardrobe | Provenance for the piece | | Body figures for try-on | Until you delete them or your account is erased | Reuse without re-upload | | Data export link | 8 days | Your download | | Partner Stylist access log | Life of the grant plus 3 years | Your record of who looked | | Moderation decisions, reports, appeals | 3 years | Transparency reporting; repeat-breach assessment; regulatory requests | | In-person booking records and safety reports | 7 years | Safety; legal claims | | Criminal-history results (Stylists) | Result only, while the Stylist is active, then deleted; the report itself is not retained | Data minimisation | | Consent and marketing preferences | While your account is open and for 3 years after (so we can honour your opt-out) | Evidence of consent (subscription consents: term plus 3 years) | | Age-assurance evidence | Result only; evidence deleted within 30 days | Data minimisation | | Analytics (Firebase, website) | 26 months, or de-identified; website traffic beacon 180 days | Improvement | | Crash and performance reports (MetricKit) | 90 days | Diagnostics | | Support and complaints | 3 years from closure | Follow-up and legal claims | | Legal claims and holds | Until the matter is closed | Establishing and defending claims | | Security, sign-in and admin audit logs | 12 months (sign-in); 3 years (administrative actions) | Security; breach investigation; accountability | | Photographs you upload for virtual try-on | Deleted by us and by the image provider on completion of the try-on; not retained | Data minimisation | | Record of privacy requests and our responses | 3 years from closure | Accountability | | Data breach register | 5 years (Canada: at least 24 months) | Accountability |

Where a period above is shorter than the law of your country requires, or longer than that law allows, the law's period applies.

9. Your rights

9.1 What you can ask for. Wherever you live, you can ask us to: tell you whether we hold personal information about you and give you access to it and a copy; correct it; delete it; give you a copy in a structured, machine-readable format (portability); restrict how we use it; object to a use based on legitimate interests, including profiling; opt out of direct marketing at any time; withdraw a consent at any time (without affecting what we did before); and have a person review a significant automated decision. Some countries give you further rights, listed in the Annexes.

9.2 How to ask. You can make a request at Settings › Privacy, by email to privacy@nupare.com.au, or by post. In Settings › Privacy you can request a download of your data (the link works for 8 days), delete your account (which takes effect after a 30-day grace period, during which you can change your mind) and manage your consents yourself. You can also ask through an authorised agent; we verify that the agent has your authority. We do not charge for requests unless they are manifestly excessive, in which case we may charge a reasonable fee or decline and tell you why.

9.3 Verification. We verify that a request comes from you (or your agent) using information on your account and, where necessary, by asking you to confirm through your account email. We do not ask for more than we need.

9.4 Timing. We respond within one month in the EEA, UK and Switzerland (extendable by two further months for complex requests, with notice); 45 days in the United States (extendable by 45 days with notice); 30 days in Australia, Canada, Singapore and Japan; 20 working days in New Zealand; 40 days in Hong Kong; 10 days in Korea; 21 days in Malaysia; and, elsewhere, within the shorter of 30 days and the period the law of your country requires. If we need longer we tell you why.

9.5 Limits. We may refuse or limit a request, and may keep and use information, where the law allows or requires it: to comply with a legal obligation (tax, anti-money-laundering, marketplace-verification, product-safety, content-moderation and transparency-reporting records); to complete a transaction you have started or to administer a claim, return, chargeback or payout; to establish, exercise or defend a legal claim, including one that has not yet been brought where we reasonably expect it; to prevent, detect or investigate fraud, counterfeiting or misuse of the Service; to protect the safety of a person; to keep the record we need to honour your opt-out or deletion request; where granting the request would disclose another person's personal information or our confidential or legally privileged information; or where a request is manifestly unfounded or excessive. Where we refuse a request in whole or part, we tell you why and how to complain and appeal.

9.6 Human review of automated decisions. If an automated decision described in section 4.1 significantly affects you, you can ask at Settings › Help › Appeal a decision or by email for a person to review it, tell you the main factors, and let you make your case. We respond within 10 business days where practicable.

9.7 No discrimination. We do not treat you differently for exercising a privacy right, except that a feature that needs the information you have asked us to delete may no longer work.

10. Marketing and communications

10.1 Service messages. We send transactional and service messages (order confirmations, dispatch, payout notices, booking confirmations, Insider reminders, safety notices and changes to terms) to everyone with an account; these are not marketing and you cannot opt out of them while your account is open.

10.2 Marketing. We send marketing email, push notifications and SMS only where the law of your country allows. In most countries we ask for your consent first, using a separate, unselected option; in the UK and a few other countries we may email you about our own similar products after a purchase unless you opt out. Marketing SMS always requires your separate express consent. Push notifications are sent for the kinds of event you turn on at Settings › Notifications; marketing pushes are off until you turn them on. Every marketing message tells you how to unsubscribe, and we honour opt-outs within 5 business days (within 10 business days in the United States and Canada as the law allows, though our standard is 5). You can change every channel at Settings › Notifications.

10.3 Advertising on other platforms. We do not currently show NuPARE advertising to you on other platforms using your personal information, and we do not disclose identifiers or hashed contact details to advertising networks or data brokers for that purpose. If we introduce it, we will update this Policy and the register in Annex N before it starts, ask for your consent where the law requires it, and make it controllable at Settings › Privacy › Advertising, through your device's advertising settings and, in the United States, through the "Your Privacy Choices" link and the Global Privacy Control signal, which we honour in any event.

10.4 Referrals. If a member refers you, we send one message that identifies the referring member, says why you are receiving it and how to have your details deleted; we send no further messages unless you join.

11. Cookies, SDKs and tracking

Annex N to this Policy (our Cookie and Tracking Policy, also published at nupare.com.au/legal/privacy#annex-n) lists every cookie, software development kit and similar technology we use on the website and in the app, who provides it, what it does, how long it lasts, and how to control it, and explains how consent works in your country. Strictly necessary technologies run without consent; everything else runs only with your consent where your country requires it, and you can change your choice at any time at Settings › Privacy › Cookies and tracking.

12. Children

The Service is for people aged 16 and over, or the higher minimum age set for your country in Schedule 1 to the Terms. We do not knowingly collect personal information from anyone under the minimum age. For members under 18 we set the most protective settings by default: private account, presence off, no advertising based on profiling, and no direct messages from members they do not follow. These defaults apply from the date stated on the Age Assurance Statement; before that date, you can set each of them yourself at Settings › Privacy. We do not use the information of members under 18 for targeted advertising, and we do not sell or share it. The protections of the Australian Children's Online Privacy Code, the UK Age Appropriate Design Code, Article 28 of the EU Digital Services Act and the US state minors' provisions apply. We use the age-assurance measures described in our Age Assurance Statement (Policy 8 in Schedule 6 to the Terms, published at nupare.com.au/legal/age-assurance), which states which measures are in operation in your country, and we keep only the result. If we learn that an account belongs to a person under the minimum age, we close it and delete the information. If you are a parent or guardian and you believe a child has an account, you may tell us at privacy@nupare.com.au. We do not profile for advertising, or serve advertising based on profiling, to anyone we know to be under 18.

13. Data breaches

Where we suspect an eligible data breach we complete an assessment within 30 days. Where we believe on reasonable grounds that a breach of security affecting your personal information is likely to result in serious harm, we notify the Information Commissioner and you as soon as practicable, unless remedial action removes that likelihood. We tell you without undue delay, explaining what happened, what information was involved, what we are doing and what you can do. We notify the privacy regulator where the law requires (for example within 72 hours in the EEA, the UK, Korea, Malaysia and Saudi Arabia; within 3 days in Singapore; as soon as practicable in Australia, New Zealand and Canada; and within the periods the Annexes describe).

14. Changes to this Policy

We may update this Policy to reflect changes in the law, the Service or our practices. We tell you at least 30 days before a material change takes effect, by email and in the app, and we ask for your consent where a change would use your information for a new purpose that requires it. Every version and its effective date is at nupare.com.au/legal/privacy.

A change that does not affect your rights (correcting a typographical error, or adding a sub-processor of a kind already described) may be made without that notice and is recorded in the version history. Where a change does not require your consent, it takes effect on the date we state. This Policy is a notice about how we handle personal information and is not a contract, except where Schedule 1 to the Terms of Service says otherwise for your country: your continued use of the Service is therefore not your agreement to anything for which the law requires consent.

15. Complaints

If you have a concern about how we handle your personal information, contact our Privacy Officer at privacy@nupare.com.au or through Settings › Privacy › Make a complaint. We acknowledge every complaint within 2 business days, investigate it, and give you a written response within 30 days. If you are not satisfied, you can complain to the privacy regulator where you live; the Annexes name them. In the UK the Information Commissioner may decline to consider a complaint that has not first been raised with us.

16. Business contacts

If you work for a brand, retailer, media outlet, agency or other business with which we deal, we hold your business contact details (name, role, employer, work email and phone, and notes of our dealings) in our relationship system. We obtain them from you, from your employer, from public sources (company websites, professional networks) and from business-data providers. We use them to manage our commercial relationships and to contact you about NuPARE's services for brands, on the basis of our legitimate interests (and, where required, your consent). We keep them while the relationship or prospect is live and for 2 years after our last contact. Where the law requires us to tell you within a month that we obtained your details from a source other than you, we do so by email at first contact. You may object or ask us to delete them at any time at privacy@nupare.com.au. The rest of this Policy applies to you with the necessary changes.

17. Definitions

"Personal information" means information that relates to an identified or identifiable individual, including information from which an individual can be singled out, and includes "personal data" and equivalent terms in the laws of the countries in which we operate. Terms used in this Policy have the meaning given in the Terms of Service.

Regional Annexes

Each of Annexes A to M applies to you if you live in the country named, and adds to (and where inconsistent, overrides) sections 1 to 16. Annexes N to R follow them and also form part of this Policy.

Further Annexes

Annexes N to R apply to everyone. Annex N is our Cookie and Tracking Policy. Annexes O to R reproduce, as part of this Policy, the pages that particular laws require us to publish at their own addresses.

Annex N: Cookie and Tracking Policy

This Annex is our Cookie and Tracking Policy. It forms part of this Policy and is also published on its own page. Where the law of your country requires a separate cookie notice, this Annex is that notice.

N.1 What this Annex covers

This Annex explains the cookies, software development kits (SDKs), pixels, local storage, device identifiers and similar technologies (together, tracking technologies) that we use on nupare.com.au and in the NuPARE app for iOS and Android, who provides them, what they do, how long they last, and how you control them. It applies alongside the main body of this Policy. Where this Annex refers to "cookies" it includes every tracking technology, in the app as well as on the website.

N.2 The four categories

Strictly necessary. These are needed to run the Service: keeping you logged in, remembering your basket and checkout state, security and fraud prevention, load balancing, recording your cookie choices, and (on the website) the consent banner itself. They run without consent because the Service does not work without them. You can block them in your browser or device, but the Service will not function.

Functional. These remember choices you make, such as language, currency, size and display preferences, and the state of the app between sessions. In the EEA and Quebec these run only with your consent; in the UK they run unless you opt out, as the Privacy and Electronic Communications Regulations (as amended by the Data (Use and Access) Act 2025) allow, and we give you a simple means to do so.

Analytics and performance. These tell us how the Service is used, which screens and features are popular, where errors occur, and how fast pages load, so we can improve it. In the EEA, Quebec, Korea and Saudi Arabia these run only with your consent; in the UK, analytics used solely to improve the Service run unless you opt out; elsewhere they run with notice and an opt-out.

Advertising and attribution. These measure whether our advertising on other platforms led you to NuPARE, attribute purchases to Creator links, and, with your consent, show you NuPARE advertising on other platforms based on your activity. They run only with your consent everywhere consent is required, and in the United States you can opt out under your state's law, including through the Global Privacy Control, which we honour. The app does not use Apple's App Tracking Transparency framework because it does not track you across other companies' apps and websites.

N.3 The register

The register below lists each tracking technology in use on the effective date of this Policy, on the website (nupare.com.au) and in the app. The live register, updated whenever a technology is added or removed, is at nupare.com.au/legal/privacy#register and in the app at Settings › Privacy › Cookies and tracking, and forms part of this Annex. "First party" means operated by us; "third party" means operated by the provider named.

App (iOS)

The app declares no tracking under Apple's App Tracking Transparency framework: it does not link your data with third-party data for advertising and does not ask for the tracking permission. The app does not include Crashlytics; crash reports come to us through MetricKit.

Website (nupare.com.au)

N.4 How consent works where you live

What runs today. In Australia and other countries whose law permits it, analytics technologies run with notice and an opt-out: Firebase Analytics is on by default and can be turned off at Settings › Privacy › Analytics; the screen and tap trail runs whenever you use the app and is deleted after 30 days and erased with your account; website analytics run by default and can be turned off at the "Cookie settings" link. Advertising and attribution technologies run only when you follow a Creator's affiliate link, and we run no advertising audience or conversion measurement. In countries whose law requires prior consent (the EEA, the UK for advertising technologies, Quebec, Korea, Saudi Arabia and others listed below), nothing beyond strictly necessary technologies runs until you agree; the settings below describe how we apply that by country. On the website we determine which configuration applies from the country your connection appears to come from, before any non-essential technology is set or read, using consent-mode regional defaults set to "denied" for the EEA, the United Kingdom, Switzerland and Quebec; in the app we use the country of your account and, before you have one, your app-store storefront. If we cannot determine your country, we apply the strictest configuration and nothing beyond strictly necessary technologies runs until you choose. The consent mechanisms described for each country below are in operation from the effective date of this Annex; the register at nupare.com.au/legal/privacy#register records the date each country's configuration went live.

EEA and Switzerland. On first use we show a banner with "Accept all", "Reject all" and "Manage choices" given equal prominence. Nothing other than strictly necessary technologies runs until you choose. Scrolling, continuing to browse or closing the banner is not consent. You can change or withdraw your choice at any time, as easily as you gave it, at Settings › Privacy › Cookies and tracking or the "Cookie settings" link in the website footer. We ask again after 6 months (France) or 24 months (rest of the EEA), or when we add a technology in a category you have not consented to. We do not offer a "consent or pay" choice.

United Kingdom. Strictly necessary and functional technologies run with a clear notice. Our own screen and tap trail and our app analytics run on an opt-out basis, as the Privacy and Electronic Communications Regulations, as amended by the Data (Use and Access) Act 2025, allow for statistics used solely to improve the service. You can switch each of them off at any time at Settings › Privacy › Analytics and Settings › Privacy › Screen and tap trail, and we tell you so when you first open the app. We rely on that exemption for Firebase Analytics only on the basis that our contract with Google prohibits Google from using the data for its own purposes; if that ceases to be the case we will move Firebase Analytics to consent in the United Kingdom. Website analytics and all advertising and attribution technologies run only with your consent. The banner offers "Accept", "Reject" and "Manage choices" with equal prominence.

Quebec. Before any technology that can identify, locate or profile you runs, we tell you and how to deactivate it, and we obtain your consent, requested separately, for anything beyond strictly necessary. "Refuse all" is as prominent as "Accept all". The banner is in French.

Rest of Canada. We show a layered notice at first use and an easy, immediate opt-out for advertising and analytics. Advertising based on your activity is never a condition of using the Service and is not used for anyone we know to be under 18.

United States. We show a notice at collection. Advertising and attribution technologies that involve "selling" or "sharing" personal information, or "targeted advertising", can be turned off at the "Your Privacy Choices" link and at Settings › Privacy › Advertising, and we honour the Global Privacy Control and other opt-out preference signals recognised by your state's law. Residents of states that require it can opt in rather than out; where the law requires opt-in, we ask.

Australia and New Zealand. We show a notice at first use; analytics run by default and can be turned off (the screen and tap trail can be turned off at Settings › Privacy › Screen and tap trail, is deleted after 30 days in any event, and is erased with your account). We run no advertising technologies that single you out.

Japan. Before any information is transmitted from your device to a third party, we show (on first launch and on the website) the information required by Article 27-12 of the Telecommunications Business Act: what is transmitted, to whom, and for what purpose, in plain Japanese, with a toggle to turn off each non-essential technology. Where a third party will link an identifier to you, we confirm your consent as the Act on the Protection of Personal Information requires.

Korea. This Policy states how automated collection devices operate and how to refuse them (Annex J.5). We separate app permissions into mandatory and optional. Advertising technologies run only with your separate consent.

Singapore, Hong Kong and Malaysia. We show a notice at first use with a categorised table and an opt-out for analytics and advertising; advertising identifiers are treated as personal data and used for behavioural advertising only with your consent.

UAE and Saudi Arabia. Non-essential technologies run only with your consent, and the notice is in Arabic and English.

N.5 How to control tracking

In the app. Settings › Privacy › Analytics turns Firebase Analytics off; Settings › Privacy › Screen and tap trail turns the trail off; Settings › Privacy › Cookies and tracking shows every category and, in countries where consent applies, lets you change it. Deleting your account erases the trail, analytics identifiers and device registry.

On the website. The "Cookie settings" link in the footer reopens your choices. Your browser's privacy settings let you block or delete cookies; blocking strictly necessary cookies will stop the Service working. Sending a Global Privacy Control signal from your browser opts you out of sale, sharing and targeted advertising where your state's law recognises it, and we treat it as an objection to advertising technologies everywhere.

Affiliate links. When you follow a Creator's affiliate link, the network named on the link records the click; the Creator Standards (Policy 6 in Schedule 6 to the Terms) explain how commission is attributed.

Email. Our marketing emails contain a pixel that tells us whether the email was opened. You can block it by turning off image loading in your email client, and you can stop marketing email altogether at Settings › Notifications or the unsubscribe link in every message.

N.6 Do Not Track

We honour the Global Privacy Control signal as described above. We do not currently respond to the older "Do Not Track" browser setting, for which there is no agreed standard.

N.7 Changes

We update this Annex and the register whenever we add or remove a tracking technology. Material changes are notified in the app and, where a new technology needs your consent, we ask for it before it runs.

Annex O: Sub-processors

This Annex lists our principal sub-processors. It forms part of this Policy and is also published, and kept current between versions of this Policy, at nupare.com.au/legal/subprocessors (the live page).

Changes to this Annex are announced 30 days in advance on the live page and by email to business users, who may object.

Annex P, Korea: 개인정보 처리위탁 및 국외이전 현황 (nupare.com.au/kr/entrustment · nupare.com.au/kr/transfer)

처리위탁 현황 (개인정보 보호법 제26조, 제30조). 당사는 서비스 제공을 위하여 아래와 같이 개인정보 처리업무를 위탁하고 있으며, 수탁자가 개인정보를 안전하게 처리하도록 관리·감독합니다.

국외이전 현황 (개인정보 보호법 제28조의8). 당사는 호주 법인으로서 회원의 개인정보를 아래와 같이 국외로 이전합니다. 이전을 원하지 않는 경우 계정 생성을 거부할 수 있으나, 이 경우 서비스(호주에서 운영)를 이용할 수 없습니다. 계약 이행에 필요한 이전은 제28조의8 제1항 제3호에 따라 본 페이지에 고지합니다.

이전 거부 및 문의: privacy@nupare.com.au. 본 현황은 변경 시 즉시 갱신하며, 개인정보 처리방침 부록 J에서 링크합니다.

Annex Q, Japan: 外国における個人情報の保護に関する制度 (nupare.com.au/jp/kaigai)

個人情報保護法第28条第2項および規則第17条に基づき、当社が個人データを提供する外国の制度について、個人情報保護委員会の公表資料を参照して以下のとおりお知らせします。当社は、いずれの提供先についても、提供先が講ずる措置（契約による同法相当の義務、当社プライバシーポリシー第7条の安全管理措置）を確認しています。

各提供先の名称、所在国および連絡先は nupare.com.au/legal/subprocessors に掲載しています。本ページは制度の変更に応じて更新します。お問い合わせ: privacy@nupare.com.au

Annex R: Biometric Data Retention and Destruction Policy (United States), nupare.com.au/legal/biometrics

This Annex is our Biometric Data Retention and Destruction Policy. It forms part of this Policy, is also published on its own page at nupare.com.au/legal/biometrics, and is given under the Illinois Biometric Information Privacy Act (740 ILCS 14/15(a)), the Texas Capture or Use of Biometric Identifier Act, Washington's biometric identifier law (RCW 19.375) and Colorado's biometric provisions (C.R.S. 6-1-1314), and applies to every resident of a state whose law treats a scan of face or body geometry as a biometric identifier regardless of the purpose of collection.

What we collect and why. We may process an image that a state law treats as a biometric identifier in two situations only: (1) a photograph you choose to upload for virtual try-on, which we use solely to generate an image of you wearing a piece; and (2) a facial image you choose to submit for identity matching during Seller, Provider or age verification, which our identity-verification vendor compares with your identity document. We do not use either image to identify you in other content, to build a face or body template for recognition, to track you, or for any purpose other than the one you chose.

Notice and release. Before we process such an image we tell you in writing, on the screen where you upload it, that a biometric identifier may be collected, the specific purpose, and the length of time for which it is retained, and we obtain your written release, recorded with a timestamp. You may decline; the feature is then unavailable and nothing else about your account changes.

Retention and destruction schedule. We destroy a try-on photograph and any geometry derived from it when the try-on image has been generated, and in any event within 24 hours; we keep the generated image (which is not a biometric identifier) in your wardrobe until you delete it. A facial image submitted for identity matching, and any template derived from it, is destroyed by our vendor within 30 days of the verification result and is never transmitted to us. In every case, destruction occurs no later than the earlier of the date on which the purpose for collection has been satisfied and 3 years after your last interaction with us. Destruction means permanent deletion from active systems and, for backups, expiry under our standard backup rotation within 35 days.

No sale, lease or profit; disclosure. We do not sell, lease, trade or otherwise profit from your biometric identifiers or biometric information. We disclose them only to the vendor performing the function you chose, under a contract that prohibits any other use, or where required by law or a valid warrant or subpoena.

Security. Biometric identifiers are stored and transmitted using at least the standard of care in our industry and in a manner at least as protective as that used for other confidential and sensitive information, including encryption in transit and at rest and access limited to the systems performing the function.

Contact. privacy@nupare.com.au; postal address on the Legal Contacts page. This Annex is reviewed annually and whenever a listed process changes.

Separately published notice

The following notice is published as a standalone page at nupare.com.au/legal/consumer-health-data, with its own link in the footer of our homepage, because the laws under which it is given require that it not be combined with this Policy. It is reproduced here for completeness.

Consumer Health Data Privacy Policy (Washington, Nevada, Connecticut): nupare.com.au/legal/consumer-health-data

This policy is published under the Washington My Health My Data Act (RCW 19.373), Nevada SB 370 and the consumer health data provisions of the Connecticut Data Privacy Act. It is linked from the footer of our homepage and is separate from our Privacy Policy, as those laws require.

Categories of consumer health data we collect. NuPARE is a fashion platform and does not offer health services. The only information we hold that may be "consumer health data" is information you choose to give us that reveals a physical characteristic for the purpose of fit: body measurements and body figures you create for sizing and virtual try-on, and the maternity or adaptive-sizing preferences you may select. We do not collect, infer or derive information about health conditions, treatments, reproductive or sexual health, gender-affirming care, or biometric data for health purposes, and we do not use geofencing around any health-care facility.

Sources and purposes. We collect this information only from you, only when you enter it, and only to recommend sizes, generate try-on images and filter listings by fit. We do not use it for advertising, profiling or ranking, and we do not share it for any purpose.

Sharing. We share body figures and measurements only with the processors that generate your try-on image (named on our sub-processor page at nupare.com.au/legal/subprocessors), under contracts that prohibit any other use, and with a Stylist only where you have granted that Stylist access to your wardrobe and only for the duration of the grant. We do not sell consumer health data and will not do so without the separate, signed authorisation those laws require.

Your rights. You may confirm whether we collect or share consumer health data about you, access it, obtain a list of the third parties and affiliates with whom we have shared it, withdraw consent, and have it deleted, by emailing privacy@nupare.com.au or at Settings › Privacy. We respond within 45 days (extendable once by 45 days where reasonably necessary, with notice). If we deny a request, you may appeal by replying to our response; we decide the appeal within 45 days and tell you how to contact the Attorney General of your state if you are not satisfied. We do not discriminate against you for exercising these rights.

Retention. We keep body figures and measurements until you delete them or your account is erased, and they are deleted from our processors' systems when each try-on is complete.

Contact. privacy@nupare.com.au; postal address on the Legal Contacts page.