SHEIN's privacy changed

REMOVEDLast Updated: 9th April 2026 Introducti on and Ove rview The SHEIN website (" Site ") and mobile application (" App ") are provided by Infinite Towers Services Limited (" ITSL "), which is the controller of the personal data collected and responsible for processing and protecting such personal data. In this Notice, the terms "SHEIN," "Company", "we", "us" or "our" refer to ITSL. This Privacy Notice (" Notice ") explains how ITSL collects, uses, shares, and processes your Personal Data when you use or access the Site, App, or use any of our services, including any written, electronic, and oral, communication, online and offline, purchases performed, and any other related services we own (collectively the " Services ") . The Notice also describes your rights regarding your personal data and explains how you can contact us to learn more about our data practices or to exercise your rights.

ADDEDSHEIN Privacy Notice EFFECTIVE DATE: 28TH JULY, 2026 INTRODUCTION AND OVERVIEW The SHEIN website (" Site ") and mobile application (" App ") are provided by Infinite Styles Services Co., Limited (" ISSL "), which is the controller of the personal data collected and responsible for processing and protecting such personal data. In this Notice, the terms "SHEIN," "Company", "we", "us" or "our" refer to ISSL. This Privacy Notice (" Notice ") explains how ISSL collects, uses, shares, and processes your Personal Data when you use or access the Site, App, or use any of our services, including any written, electronic, and oral, communication, online and offline, purchases performed, and any other related services we own (collectively the " Services "). The Notice also describes your rights regarding your personal data and explains how you can contact us to learn more about our data practices or to exercise your rights.

Please read our Terms and Conditions and this Notice before accessing or using our Services. If you cannot agree with this Notice or the Terms and Conditions, please do not access or use our Services. Changes to this Notice: SHEIN is required under Data Protection law to ensure that it processes personal data transparently. As the way in which we process personal data may change, we may be obliged to update this Notice accordingly from time to time, to reflect how we are processing your data, and if we make changes, we will notify you by revising the effective date or last modified date at the top of this Notice. If we make significant changes that materially affect your privacy rights, we will provide advanced notice and make that clear on the Site or App, or by some other means of contact such as email, so that you are able to review the changes before you continue to use the Services. Other information: In addition, we may provide you with additional information about the personal data processing practices of specific parts of our Services, via other notices such as e.g. our Cookies Notice or the Terms and Conditions of certain promotions. Such notices may supplement this Notice or provide you with additional choices about how we process your personal information. CONTENTS

REMOVEDClick on the links below to go to a specific section of this Policy. 1. How We Process Your Personal Data > 2. Sharing Your Personal Data > 3. Cookies, Interest-Based Advertising, Ad Choices > 4. Security Precautions > 5. Your Rights > 6. Retention > 7. Third-Party Websites > 8. Children > 9. Transfer of Your Personal Data > 10. Contact Us > 1. How We Process Your Personal Data 1.1 We respect the privacy of the visitors to our digital properties and the users of our products and services, and we are committed to protecting it through our compliance with this Notice. We process personal data when you provide it to us, when we collect it automatically, when it is generated by your use of our Services and when we receive it from other sources. Pursuant to the UK General Data Protection Regulation (EU) 2016/679 ( "GDPR" ), personal data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data does not include data that has been effectively irreversibly anonymized or aggregated so that it can no longer enable us or others, whether in combination with other information or otherwise, to identify you.

ADDEDClick on the links below to go to a specific section of this Notice. • 1. HOW WE PROCESS YOUR PERSONAL DATA > • 2. SHARING YOUR PERSONAL DATA > • 3. COOKIES, INTEREST-BASED ADVERTISING, AD CHOICES > • 4. SECURITY PRECAUTIONS > • 5. YOUR RIGHTS > • 6. RETENTION > • 7. THIRD-PARTY WEBSITES > • 8. CHILDREN > • 9. INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA > • 10. CONTACT US > 1. HOW WE PROCESS YOUR PERSONAL DATA We respect the privacy of the visitors to our digital properties and the users of our products and services, and we are committed to protecting it through our compliance with this Notice. We process personal data when you provide it to us, when we collect it automatically, when it is generated by your use of our Services and when we receive it from other sources. Personal data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data does not include data that has been effectively irreversibly anonymized or aggregated so that it can no longer enable us or others, whether in combination with other information or otherwise, to identify you.

"Processing" of personal data includes the collection, storage, analysis, accessing, sharing, transmitting and deletion of personal data.

ADDEDSome of the personal data we collect from you is necessary for us to provide our Services, for example, we need your name and delivery address to ship your parcel and complete customs formalities and to manage returns, we may need your clothes or shoe size to complete your order, and we need your payment details to process your order. Without this information, we will be unable to enter into or perform our contract with you. The collection of other personal data about you, such as your style preferences or marketing consent, is entirely voluntary: declining to provide it to us will not prevent you from using our Services, though it may limit certain features such as personalised product recommendations. As a global e-commerce platform, SHEIN sells products directly to customers and also connects customers across the European Economic Area with products offered by other international sellers. By using our Services, you benefit from the ability to purchase goods from sellers located outside your country of residence. To fulfil your order, including preparing and packaging your parcel, affixing the necessary shipping labels, completing import and export customs formalities, and delivering the parcel to your chosen address, your personal data will necessarily be transferred to and processed by parties located in other countries, including countries outside the European Economic Area. These transfers are an inherent and essential part of the international purchasing process, and by placing an order with us or with another seller via the Site, you acknowledge that such transfers are required to deliver the Services you have requested. We ensure that all such transfers are carried out in accordance with applicable data protection laws and subject to appropriate safeguards. You will find additional information regarding international data transfers in Section 9 of this Privacy Notice. The table below sets out the categories of personal data about you that we process, the purpose for which each category is processed, the legal basis on which we rely for that processing, and information on our retention practices.

Your name and either an email address or phone number (you may provide both), plus a nickname and password, to register with our Site or App.

REMOVEDTo create your account

ADDED• To create your account • To facilitate management of your account and your access to it. Necessary for the performance of a contract with us or another seller or to take steps at your request prior to entering into a contract with us or another seller. Necessary for compliance with a legal obligation. For as long as your account remains active. You may close your account at any time. Deletion will occur within 5 days except where data is required to process any unfulfilled orders, resolve any unresolved matters, to complete our statutory or contractual obligations to you, or to satisfy legal obligations such as pending litigation and legal and regulatory filing obligations. Email address, phone number and WhatsApp contact details • To send you direct marketing, where you consent. Further details of this processing are available at Section 1.2 of this Notice

Consent

REMOVEDFor as long as your account remains active, plus a reasonable time thereafter to process any unfulfilled orders, resolve any unresolved matters, or to satisfy legal obligations such as pending litigation or legal and regulatory filing obligations. You may close your account at any time. Email address, phone number and WhatsApp contact To send you direct marketing, where you consent. Further details of this processing are available at Section 1.2 of this Notice

For as long as you consent.

REMOVEDProfile data, including your style preference, clothing size and body shape, if you voluntarily choose to provide it for personalization purposes. Collection of your "like" records and votes when prompted as to your preference between two items. Where you provide information relating to maternity wear as a product interest, this may constitute sensitive or "special category" personal data. Where you provide information relating to children's products as an interest this may constitute the personal data of the children. Profile data, including your style preference, clothing size and body shape, if you voluntarily choose to provide it for personalization purposes. Collection of your "like" records and votes when prompted as to your preference between two items. Where you provide information relating to maternity wear as a product interest, this may constitute sensitive or "special category" personal data. Where you provide information relating to children's products as an interest this may constitute the personal data of the children. To offer you products based on your stated preferences, via our app an website and, subject to you agreement via direct marketing.

ADDED• Profile data, including your style preference, clothing size and body shape, if you voluntarily choose to provide it for personalization purposes. • Collection of your "like" records and votes when prompted as to your preference between two items. • Where you provide information relating to maternity wear as a product interest, this may constitute sensitive or "special category" personal data. • Where you choose to use our Kid's Profile feature, any information you enter (including an approximate age range and gender) is provided entirely by you in your capacity as an adult user, for the purpose of obtaining personalised product recommendations for children's items. This feature is not intended to collect personal data relating to any child. See Section 8 of this Notice for further details. • To offer you products based on your stated preferences, via our app and website and, subject to your agreement via direct marketing. Consent (see note below regarding special category data)

Until or unless you remove these preferences from your account profile

ADDEDActivity on the site or app, including products browsed, purchased or added to wish lists. • To offer you products based on your interests, via our app and website "Recommender System" and via direct marketing. • Aggregation and analysis for market research and production planning. For the Legitimate Interests of research and development of our services and products and of marketing of products. For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. You may opt out of direct marketing and the Recommender System.

Shipping information: name, postal address, phone number, order number.

REMOVEDTo deliver your purchases or to facilitate marketplace sellers to deliver your purchases.

ADDED• To deliver your purchases from SHEIN or to facilitate marketplace sellers to deliver your purchases.

Necessary for the performance of a contract or to take steps at your request prior to entering into a contract.

REMOVEDFor as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time.

ADDEDFor as long as your SHEIN account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time.

Transaction details: purchases, return and refund details, gift card number

REMOVEDTo process orders and fulfil customer service requests.

ADDED• To process orders, perform our contract with you, and to fulfil customer service requests. For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time.

Payment details - your credit or debit card details, gift card details, account credit, voucher and coupon details, billing address

REMOVEDTo take payment for purchases and to process refunds where goods are returned.

ADDED• To take payment for purchases and to process refunds where goods are returned.

Retained subject to legal requirements and national laws regarding retention of financial records for tax compliance purposes

REMOVEDRetained in order to comply with tax compliance obligations.

ADDED• Retained in order to comply with tax compliance obligations.

Necessary for compliance with a legal obligation. Retained subject to the record keeping requirement imposed by the relevant legislation.

REMOVEDTo handle and resolve legal disputes, for regulatory investigations purpose, and to comply with lawful requests from a competent law enforcement agency or court. For compliance with legal obligations and for the legitimate interest of resolving legal and regulatory matters.

ADDED• To handle and resolve legal disputes, for regulatory investigations purposes, and to comply with lawful requests from a competent law enforcement agency or court. • For compliance with legal obligations and for the legitimate interest of resolving legal and regulatory matters.

Retained until conclusion of the legal or regulatory dispute and any subsequent appeals or reviews. Purchase history

REMOVEDTo recommend products to you which you may like. Aggregation and analysis for market research and production planning. To recommend products to you which you may like. Aggregation and analysis for market research and production planning. For the Legitimate Interest of research and development of our services and products. For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. Aggregated data derived from this personal data is not personal data. Aggregated data derived from this personal data is not personal data.

ADDED• To recommend products to you which you may like. • Aggregation and analysis for market research and production planning. For the Legitimate Interest of research and development of our services and products. Our specific legitimate interest is in understanding customer purchasing behaviour to improve product curation, range planning, and the relevance of recommendations. We have assessed that this interest is not overridden by customer privacy interests, given that: (i) analysis is principally conducted at an aggregated level; (ii) data is not shared with external parties for this specific purpose; and (iii) customers may close their account at any time and object to this processing. • For as long as your account remains active, plus a reasonable time thereafter to resolve any unresolved matters. You may close your account at any time. • Aggregated data derived from this personal data is not personal data.

Location of your IP address

REMOVEDTo tailor your experience by directing you to the correct local website, language and user experience. To estimate delivery time To tailor your experience by directing you to the correct local website, language and user experience. To estimate delivery time For the Legitimate Interest of providing an optimized user experience for the website and app

ADDED• To tailor your experience by directing you to the correct local website, language and user experience. • To estimate delivery time For the Legitimate Interest of providing an optimised user experience for the website and app. Our specific legitimate interest is in directing users to the correct regional store, language, and pricing environment, and in providing accurate estimated delivery times. This processing relies only on IP-level location (not precise geolocation), is limited to the duration of the user session, and is necessary for the basic operation of a global ecommerce platform.

For the duration of your session on the app or website. Your communications with us via various channels, such as email, phone, social media, mail, instant chat, and our customer service platform.

REMOVEDTo respond to your customer service requests, to resolve your queries and to administer your account. The Legitimate Interest of providing customer service and account administration. To handle and resolve legal disputes, for regulatory investigations purpose, and to comply with lawful requests from a competent law enforcement agency or court The Legitimate Interest of engaging with Regulatory Agencies and defending our Legal Interests

ADDED• To respond to your customer service requests, to resolve your queries and to administer your account. The Legitimate Interest of providing customer service and account administration. Our specific legitimate interest is in maintaining accurate records of customer communications to resolve queries and disputes, ensure service continuity, and fulfil our contractual obligations to you. We consider this interest proportionate, given that records are retained only for the period of account activity and a reasonable period thereafter, and that customers retain the right to object. • To handle and resolve legal disputes, for regulatory investigations purposes, and to comply with lawful requests from a competent law enforcement agency or court The Legitimate Interest of engaging with Regulatory Agencies and defending our Legal Interests. Our specific legitimate interest is in preserving evidence and maintaining records necessary to respond to legal claims, regulatory investigations, and enforcement actions. This interest is proportionate, as retention is strictly limited to the duration of the relevant proceedings and any subsequent appeals.

Your Device Information, browser type, operating system, account setting information and login data.

REMOVEDSite and app security, fault analysis, troubleshooting, fraud prevention and risk control. For the Legitimate Interest of securing your account and our site and app, and providing an optimized user experience. Your product Reviews, which may include photos of you. To assist customers who are considering buying the same product. Further details of this processing are available at Section 1.3 of this Notice and our Review Guidance . To assist customers who are considering buying the same product. Further details of this processing are available at Section 1.3 of this Notice and our Review Guidance .

ADDED• Site and app security, fault analysis, troubleshooting, fraud prevention and risk control. For the Legitimate Interest of securing your account and our site and app, and providing an optimised user experience. Our specific legitimate interest is in detecting and preventing fraudulent activity, unauthorised access, and security threats, in order to protect both our customers and the integrity of our platform. This processing is necessary for the secure operation of any large-scale e-commerce service and is proportionate to the security risks involved. Biometric Authentication Enrollment Status • For fraud prevention: To help protect our platform, customers, and business from fraud, abuse, and other unauthorized activities, we may collect information about certain security settings on your device. This may include whether biometric authentication (such as fingerprint recognition or facial recognition) has been enabled on your device. • The information collected is limited to a simple indicator showing whether biometric authentication has been enrolled or enabled on the device (for example, "yes" or "no"). We do not collect, access, store, or process your fingerprint, facial image, voiceprint, or any other biometric template or biometric data. We use this information, together with other device and account signals, to detect suspicious activity, prevent fraud, protect customer accounts, and maintain the security and integrity of our services. We process this device security information for our legitimate interests in preventing fraud, protecting our users, enforcing our terms, safeguarding our platform, and maintaining the security of our services. Your product reviews, which may include photos of you. • To assist customers who are considering buying the same product. • Further details of this processing are available at Section 1.3 of this Notice and our Review Guidance

Consent. For as long as you consent. You may remove a review at any time.

REMOVEDReferral link interaction data (e.g., IP address, device ID, browsing behavior), registration details of invited users. To track referral link usage, administer rewards, and promote the SHEIN App. Consent (for invited users); Legitimate Interests (for referrers). For as long as necessary to administer the Program and comply with legal Your photographic image and, where necessary proofs of your identity. These are processed by a third party and only the positive or negative result of the age check is returned to SHEIN.

ADDEDYour photographic image and, where necessary proofs of your identity. These are processed by a third party and only the positive or negative result of the age check is returned to SHEIN.

To conduct age assurance prior to allowing you to view or purchase certain products, where such restriction to adults is required under the EU Digital Services Act and other applicable national laws. For compliance with legal obligations. For as long as is required to conduct the age verification process, with instant deletion of the data thereafter. Customer-service chat content (de-identified before AI review) Quality assessment of customer-service interactions; training AI quality models; improving accuracy of service-quality evaluations

REMOVEDLegitimate Interests

ADDEDLegitimate Interests. Our specific legitimate interest is in maintaining and continuously improving the quality, accuracy, and consistency of our customer service operations, including through the use of AI-assisted quality assessment tools. We have assessed that this interest is not overridden by customer privacy interests, given that: (i) chat content is de-identified before any AI or human review; (ii) personal identifiers are removed prior to processing; and (iii) customers may object to this processing at any time.

Stored only as long as necessary for quality-assessment cycles; AI training data stored in de-identified form; user can object at any time

REMOVEDSHEIN operates a Refer-a-Friend Reward Program to encourage existing users to invite friends to register on the SHEIN App. Referrers generate a referral link that does not contain personal data and may share it with friends. When an invited friend clicks the link and registers, SHEIN collects certain personal data directly from the new users, including identifiers and technical data, to track referral success, allocate rewards, and send marketing communications (subject to consent). Referrers do not provide any personal data about their friends to SHEIN.

ADDED1.1. NOTE ON SPECIAL CATEGORY PERSONAL DATA Where your style preferences include maternity wear, the processing of such data may constitute processing of special category personal data under Article 9 GDPR . In addition to your consent under Article 6(1)(a) GDPR , we rely on your explicit consent under Article 9(2)(a) GDPR for this processing. You may withdraw your explicit consent at any time by removing the relevant preferences from your account profile. If you decline to provide this information, we will not be able to offer maternity-related product recommendations.

Please note: When communicating with us by email or through forms on our Services, or when you publicly share content through our Services, we ask that you please do not send us any sensitive information pertaining to yourself or to others.

REMOVED1.2 Direct Marketing

ADDED1.2. NOTE ON DIRECT MARKETING

SHEIN sends direct marketing via e-mail, SMS, WhatsApp message and push notification. As required under the relevant laws, direct marketing is not sent to you unless you have given your prior consent. This consent may be given by you via the website or app at account signup or at a later time through the use of the website or app. You may withdraw your consent at any time, and SHEIN will take steps to ensure you no longer receive direct marketing via that channel. If you withdraw your consent for only one channel, you may continue to receive direct marketing via other channels, until you also withdraw consent for that channel. Please be aware that there may be a brief delay before your marketing consent status is updated and that you may continue to receive direct marketing messages during that time.

REMOVEDTo change your consent status for any of our Direct Marketing Channels, go to your account profile and you will find "Contact Preferences" under the "Other Services" sub-heading. There you can give or withdraw consent to each type of Direct Marketing.

ADDEDTo change your consent status for any of our Direct Marketing Channels, go to your account profile and you will find "Contact Preferences" under the "Other Services" subheading. There you can give or withdraw consent to each type of Direct Marketing.

To stop receiving Direct Marketing via email, you may also click "unsubscribe" at the bottom of any marketing email. Please note that some emails from SHEIN may not contain direct marketing and therefore may not contain an "unsubscribe" link.

REMOVEDTo stop receiving Direct Marketing via SMS, you may also reply "STOP" to direct a marketing SMS. Please note that some emails from SHEIN may not contain direct marketing and therefore may not accept a STOP reply. To stop receiving Direct Marketing via WhatsApp, you may also reply "STOP" to a direct marketing WhatsApp. Please note that some WhatsApps from SHEIN may not contain direct marketing and therefore may not accept a STOP reply.

If you choose not to consent to receiving Direct Marketing from SHEIN you may still receive service messages from us. These are essential messages giving you important information about your account and purchases.

REMOVEDA number of means are made available to customers to revoke their consent; via the preference centre on our website, by clicking on the unsubscribe link in marketing emails or by texting "STOP" in response to a direct marketing SMS or Whatsapp.

Message and data rates may apply to all messages sent to and from you. If you have any questions about your telephone package, it is best to contact your mobile operator. When you provide an email, phone number or WhatsApp contact to us you should ensure that it is your own and that it is correct. Providing the contact details of another person, whether deliberately or inadvertently, may lead to your private account details being disclosed to the true owner of the contact details. In order to protect your account and to avoid inconvenience to third parties, we may be obliged to suspend your account if it appears that the contact details associated with it are not those of the account owner. App Notifications SHEIN may also contact you, either for direct marketing or for other purposes, via notifications from the app. You can make changes to how you receive these notifications via the settings on your smart device.

REMOVED1.3 Product Reviews

ADDED1.3. PRODUCT REVIEWS

When you buy a product from our service, we ask you to complete a review. This is to assist other users who may be considering buying the same product. Although we reward customers with points for posting reviews, whether you do so is entirely at your own discretion, and you may remove your reviews at any time. You should be aware that your reviews will be accessible to all users of the site. If you post a photograph with the review, you should be aware that you or your surroundings may be recognisable from the photo.

REMOVEDIf you post an image of a third party, including your children, you should first obtain their consent to do so. You should be aware that they may have the right to have the photo removed under EU and UK law, including Data Protection law. If a third party asks you to remove a photo of them that you have posted, we recommend that you do so.

ADDEDIf you post an image of a third party, including your children, you should first obtain their consent to do so. You should be aware that they may have the right to have the photo removed under applicable law, including Data Protection law. If a third party asks you to remove a photo of them that you have posted, we recommend that you do so.

Use of Customer Service Chats for Quality Assessment and Training of AI Models

REMOVED1.4 CustomerService Chat Quality Assessment: When you contact our customer-service team through chat, we process the content of your communications to provide assistance and resolve your queries. In addition, we also use de-identified versions of these chat interactions to assess the quality and accuracy of responses provided by our customer-service representatives . This assessment is carried out using both human review and AI-powered. These tools help us measure service quality, identify areas for improvement, and train our internal service-quality models. Legal Basis: We process de-identified chat content for these quality-improvement purposes based on our legitimate interest in maintaining and improving the quality of our customer-service operations, ensuring consistent service standards, and enhancing your experience. You may exercise your right to object to this processing at any time Human Review: Certain chat transcripts may also be reviewed by trained customer-service personnel located in specific jurisdictions (including China and the Philippines) for the purpose of validating AI outputs and ensuring quality accuracy. Access is strictly controlled and subject to data-minimisation and confidentiality safeguards. DeIdentification Measures: Before any chat is used for AI analysis, we remove personal identifiers such as your name, phone number, address, email, order numbers, and any other identifiable elements. We continuously monitor and improve our de-identification processes. Your Options: You may choose to opt out of having your chat content used for these quality-assessment purposes. If you opt out, your chat records will not be processed for AI or manual quality-control activities. 2. Sharing Your Personal Data

ADDED1.4. CUSTOMER SERVICE CHAT QUALITY ASSESSMENT When you contact our customer-service team through chat, we process the content of your communications to provide assistance and resolve your queries. In addition, we also use de-identified versions of these chat interactions to assess the quality and accuracy of responses provided by our customer-service representatives . This assessment is carried out using both human review and AI-powered quality assessment tools. These tools help us measure service quality, identify areas for improvement, and train our internal service-quality models. 1.5. LEGAL BASIS We process de-identified chat content for these quality-improvement purposes based on our legitimate interest in maintaining and improving the quality of our customer-service operations, ensuring consistent service standards, and enhancing your experience. You may exercise your right to object to this processing at any time. 1.6. HUMAN REVIEW Certain chat transcripts may also be reviewed by trained customer-service personnel located in specific jurisdictions (including China and the Philippines) for the purpose of validating AI outputs and ensuring quality accuracy. Access is strictly controlled and subject to data-minimisation and confidentiality safeguards. For further information on International transfers of personal data, please see Section 9 . 1.7. DE-IDENTIFICATION MEASURES Before any chat is used for AI analysis, we remove personal identifiers such as your name, phone number, address, email, order numbers, and any other identifiable elements. We continuously monitor and improve our de-identification processes. 1.8. YOUR OPTIONS You may choose to opt out of having your chat content used for these quality-assessment purposes. If you opt out, your chat records will not be processed for AI or manual quality-control activities. 2. SHARING YOUR PERSONAL DATA

We may disclose and share your Personal Data with the parties as described below.

REMOVEDA. Within Our Corporate Organization . ITSL is a part of a corporate organization that has several legal entities, business processes, management structures, and technical systems. These entities provide services to each other and the provision of such services may require the processing of personal data. We may share your personal data with our related group companies and, in some cases, other affiliates of our corporate group for business maintenance and personalization continuity purposes, for instance, so that you may enjoy a personalized user experience across our digital properties, to provide you with the Services, or to take actions based on your requests or preferences. B. Third Party Sellers. Our Website and App is a Marketplace, where other sellers, including sellers from the SHEIN group, sell products. When you purchase from a third-party seller on our Site and App and the third-party seller will ship the products to you directly, we will share your personal data (user ID, name, email address and other contact and shipping information) with them so that they may respond to you or fulfil your order and provide your personal data to their service providers in order to ship the products to you. Independently from us, the third-party seller is the controller of such personal data and responsible for any processing that they perform after we have shared this personal data with them, including compliance with any limitations imposed by our agreement with them. C. Service Providers . We may share your personal data with the following types of third-party service providers as set out in the table below:

ADDEDA. Within Our Corporate Organization . ISSL is a part of a corporate organization that has several legal entities, business processes, management structures, and technical systems. These entities provide services to each other and the provision of such services may require the processing of personal data. We may share your personal data with our related group companies and, in some cases, other affiliates of our corporate group for business maintenance and personalization continuity purposes, for instance, so that you may enjoy a personalized user experience across our digital properties, to provide you with the Services, or to take actions based on your requests or preferences. B. Third Party Sellers . Our Website and App is a Marketplace, where other sellers, including sellers from the SHEIN group, sell products. When you purchase from a third-party seller on our Site and App and the third-party seller will ship the products to you directly, we will share your personal data (user ID, name, email address and other contact and shipping information) with them so that they may respond to you or fulfil your order and provide your personal data to their service providers in order to ship the products to you. Independently from us, the third-party seller is the controller of such personal data and responsible for any processing that they perform after we have shared this personal data with them, including compliance with any limitations imposed by our agreement with them. C. Service Providers . We may share your personal data with the following types of third-party service providers as set out in the table below:

IT system and software service provider Website hosting services (including cloud storage), mobile app or software optimization services, customer relationship management software, email service providers, or system maintenance services. Payment service provider Third-party payment processing services. Marketing and advertising services Assistance in reaching potential new customers across multiple communications channels, or sharing with affiliated companies that promote our products on their websites. Order fulfillment service provider Provision of logistics, warehousing and distribution services, return and exchange services, and order status notification services for your purchased items. Customer service provider Assistance with customer services and support. Fraud prevention and information security service provider Identity verification, fraud prevention, or credit risk reduction services to protect our website/app and our business. Professional Advisors Including lawyers, consultants and accountants and other providers of expert advice. Other Service providers selected by you Other third parties, such as size recommendations and fit prediction services providers, if you have chosen to help us provide you with product recommendations.

REMOVEDAI Quality-Assessment Service Providers: We use third-party AI providers, including ChatGPT, to assist with automated analysis of de-identified customer-service chat content. These providers process only de-identified text, and we take steps to ensure that the information we share does not contain personal identifiers.

ADDEDAI Quality-Assessment Service Providers: We use third-party AI providers, including ChatGPT, to assist with automated analysis of de-identified customer-service chat content. These providers process only de-identified text, and we take steps to ensure that the information we share does not contain personal identifiers.

We strive to ensure that our third-party service providers can only use your data for the contractual purposes for which it was provided to them and to the extent necessary for such purposes, in accordance with our written instructions (where they act as our data processors).

REMOVEDD. To Maintain Legal and Regulatory Compliance . We have the right to disclose your personal data for compliance with a legal obligation, or when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, request from a regulator, or any other legal process served on us. We also may disclose your information where we reasonably believe that the disclosure is necessary to enforce our agreements or policies, or if we believe that disclosure will help us protect the rights, property, or safety of the Company or our customers. E. Co-Branded Services a nd Features . Portions of our Services may be offered as part of co-branded services and features. We will share your personal information with our co-branded partners based on your voluntary use of or participation in a co-branded service or feature. The co-branded partners will be identified on the co-branded feature or service, along with an applicable co-branded partner's privacy policy. Use of your personal information by a co-branded partner will be subject to a co-branded partner's privacy policy. If you wish to opt-out of a co-branded partner's future use of your personal information, you will need to contact the co-branded partner directly. F. Consent . We may disclose your personal information for any purpose with your consent. G. Corporate Transactions . We may disclose personal information-including account information, Wallet balance or points information-to a buyer, prospective buyer, corporate affiliate, or other successor based on our legitimate interests in the event of a merger, divestiture, restructuring, reorganization, dissolution, or sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding in which personal information held by us about our Services users is among the assets transferred. You acknowledge and agree to our assignment or transfer of rights to your personal information. H. Refer A Friend . We may share referral-related data with marketing and analytics service providers to operate and improve the Refer-a-Friend Reward Program. These providers are contractually bound to process data only for the specified purposes and in accordance with our instructions.

ADDEDD. To Maintain Legal and Regulatory Compliance . We have the right to disclose your personal data for compliance with a legal obligation, or when we believe that disclosure is necessary to protect our rights and/or comply with a judicial proceeding, court order, request from a regulator, or any other legal process served on us. We also may disclose your information where we reasonably believe that the disclosure is necessary to enforce our agreements or policies, or if we believe that disclosure will help us protect the rights, property, or safety of the Company or our customers. E. Co-Branded Services and Features . Portions of our Services may be offered as part of co-branded services and features. We will share your personal information with our co-branded partners based on your voluntary use of or participation in a co-branded service or feature. The co-branded partners will be identified on the co-branded feature or service, along with an applicable co-branded partner's privacy policy. Use of your personal information by a co-branded partner will be subject to a co-branded partner's privacy policy. If you wish to opt-out of a cobranded partner's future use of your personal information, you will need to contact the co-branded partner directly. F. Consent . We may disclose your personal information for any purpose with your consent. G. Corporate Transactions . We may disclose personal information-including account information, Wallet balance or points information-to a buyer, prospective buyer, corporate affiliate, or other successor based on our legitimate interests in the event of a merger, divestiture, restructuring, reorganization, dissolution, or sale or transfer of some or all of our assets, whether as a going concern or as part of bankruptcy, liquidation, or similar proceeding in which personal information held by us about our Services users is among the assets transferred. You acknowledge and agree to our assignment or transfer of rights to your personal information.

Please note that we may disclose, without restriction, aggregated or anonymized information about the users of our Services, which is information that does not identify any specific individual.

REMOVED3. Cookies, Interest-Based Advertising, Ad Choices 3.1 What are cookies?

ADDED3. COOKIES, INTEREST-BASED ADVERTISING, AD CHOICES 3.1. WHAT ARE COOKIES?

A cookie is a small text file that a website stores on your computer or mobile device when you visit the site. First party cookies are cookies set by the website you're visiting. Only that website can read them. In addition, a website might potentially use external services, which also set their own cookies, known as third-party cookies. Persistent cookies are cookies saved on your computer and that are not deleted automatically when you quit your browser. Session cookies are deleted when you quit your browser.

REMOVEDEvery time you visit our websites, you will be prompted to accept or refuse cookies. The purpose is to enable the site to remember your preferences (such as user name, language, etc.) for a certain period of time. That way, you don't have to re-enter them when browsing around the site during the same visit.

ADDEDWhen you visit our websites for the first time, you will be prompted to accept or refuse cookies. The purpose is to enable the site to remember your preferences (such as user name, language, etc.) for a certain period of time. That way, you don't have to re-enter them when browsing around the site during the same visit. You can change your preferences at any time by clicking on the "manage cookies" link at the bottom of every page or delete cookies using the tool provided by your browser.

Cookies can also be used to establish anonymised statistics about the browsing experience on our sites.

REMOVED3.2 How can you control SHEIN's use of cookies?

ADDED3.2. HOW CAN YOU CONTROL SHEIN'S USE OF COOKIES?

When you land on our website, you will be presented with a cookie management tool, which asks for your consent to deploy several types of cookies. You can use this tool to give or withdraw your consent to the use of these cookies. If you do not make a choice using the tool, the website will deploy only strictly necessary cookies (see below). If you wish to change the preference you made via the cookie management tool, you should click on "manage cookies" at the bottom of the web page. This will recall the cookie management tool for you to make new choices.

REMOVED3.3 How do we use cookies?

ADDED3.3. HOW DO WE USE COOKIES?

Currently, there are five types of cookies that may be generated as you browse our site:

REMOVEDStrictly Necessary Cookies, Performance Cookies, Functional Cookies, Targeting Cookies, and Social Media Cookies

ADDEDStrictly Necessary Cookies, Performance Cookies, Functional Cookies, Targeting Cookies and Social Media Cookies

A. Strictly Necessary Cookies . These cookies are essential for you to browse the website and use its features, such as accessing secure areas of the site. Cookies that allow web shops to hold your items in your cart while you are shopping online are an example of strictly necessary cookies, as are cookies which protect the site against malicious attacks. Because these cookies are necessary to the functioning of the website, the cookie management tool does not allow you to decline them. However, you can use your browser settings to disable them. These cookies are critical to the efficient working of the site. If you choose to disable these cookies from this site, the functionality of the site may be greatly reduced.

REMOVEDB. Performance Cookies.

ADDEDB. Performance Cookies .

These cookies collect information about how you use a website, like which pages you visited and which links you clicked on. None of this information can be used to identify you. It is all aggregated and, therefore, anonymized. Their sole purpose is to improve website functions. This includes cookies from third-party analytics services as long as the cookies are for the exclusive use of the owner of the website visited. Statistical information is used in reports and to improve our site. For example, we have used analytics data to add, remove or change features of the site based on how popular they are with users.

REMOVEDthe numbers of visitors to individual pages; when pages were visited; how long users stayed on the page; the IP address of the user of the website; the page they came from; technical data about the device being used to browse the site (such as browser and operating system version, and display size) - we use this data to ensure that the technology our site uses is appropriate for the majority of our users, and how best to display the site for users who have less capable browsers.

We track, for example: the numbers of visitors to individual pages; when pages were visited; how long users stayed on the page; the IP address of the user of the website; the page they came from; technical data about the device being used to browse the site (such as browser and operating system version, and display size) - we use this data to ensure that the technology our site uses is appropriate for the majority of our users, and how best to display the site for users who have less capable browsers. Because these cookies are not strictly necessary to the functioning of the website, the cookie management tool allows you to decline them at any time. However doing so may impede our ability to offer customers the best experience. C. Functional Cookies . These cookies allow a website to remember choices you have made in the past, like what language you prefer, whether you have accepted cookies, what regional store you should be directed to, or what your user name and password are so you can automatically log in.

REMOVEDBecause these cookies are not strictly necessary to the functioning of the website, the cookie management tool allows you to decline them at any time. However, doing so may impede your enjoyment of the website.

ADDEDBecause these cookies are not strictly necessary to the functioning of the website, the cookie management tool allows you to decline them at any time. However doing so may impede your enjoyment of the website.

D. Targeting Cookies . These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly personal information, but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.

REMOVEDBecause these cookies are not strictly necessary to the functioning of the website, the cookie management tool allows you to decline them at any time. However, doing so may result in you seeing less relevant online advertising.

ADDEDBecause these cookies are not strictly necessary to the functioning of the website, the cookie management tool allows you to decline them at any time. However doing so may result in you seeing less relevant online advertising.

E. Social Media Cookies . These cookies are set by a range of social media services that we have added to the site to enable you to share our content with your friends and networks. They are capable of tracking your browser across other sites and building up a profile of your interests. This may impact the content and messages you see on other websites you visit. Because these cookies are not strictly necessary to the functioning of the website, the cookie management tool allows you to decline them at any time. If you do not allow these cookies you may not be able to use or see these sharing tools.

REMOVED3.4 Removing cookies from your device You can delete all cookies that are already on your device using the settings in your browser. This will remove all cookies from all websites you have visited. Be aware though that you may also lose some saved information (e.g., saved login details, site preferences). Be aware though that you may also lose some saved information (e.g. saved login details, site preferences). 3.5 Blocking cookies

ADDED3.4. REMOVING COOKIES FROM YOUR DEVICE You can delete all cookies that are already on your device using the settings in your browser. This will remove all cookies from all websites you have visited. Be aware though that you may also lose some saved information (e.g. saved login details, site preferences). 3.5. BLOCKING COOKIES

In addition to using the cookie management tool, you can set most modern browsers to prevent any cookies being placed on your device, but you may then have to manually adjust some preferences every time you visit a site/page, and some services and functionalities may not work properly at all (e.g. profile logging-in).

REMOVED3.6 Analytics We may use third-party service providers to monitor and analyse the use of our Services. Presently, we use Google Analytics . Google Analytics is a web analytics service that tracks and reports Site traffic. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en . Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics, available at: https://tools.google.com/dlpage/gaoptout

ADDED3.6. ANALYTICS We may use third-party service providers to monitor and analyse the use of our Services. Presently, we use Google Analytics . Google Analytics is a web analytics service that tracks and reports Site traffic. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: Google Privacy & Terms . Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics, available at: Google Analytics Opt-out Browser Add-on

If Google Analytics is structured to collect personal data, the cookie banner on our Site will provide you the opportunity to consent to Google Analytics and the data controller will be Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. We have implemented Google Analytics with the "AnonymizeIP" function, which makes sure that your IP address will be shortened before it is sent to servers in the U.S. Exceptionally, the shortening may take place after such transfer to the U.S. Google uses this data to evaluate your use of our Services, to compile reports on activities on our online services and to provide us with other services related to Site, App and internet use.

REMOVED3.7 Behavioural Remarketing

ADDED3.7. BEHAVIOURAL REMARKETING

We also use remarketing services to advertise on third-party websites to you after you visited our Services. For this purpose, visitors are grouped by certain actions on our Services, e.g., by the duration of a visit. This enables us to understand your preferences and to show you personalized advertising even if you are currently surfing on another website that also participates in the Google advertising network.

REMOVEDWe use the following tools and services for these purposes: Google Ads remarketing service is provided by Google. You can opt-out of this by visiting the Google Ads Settings page: https://www.google.com/settings/ads .

ADDEDWe use the following tools and services for these purposes: Google Ads remarketing service is provided by Google. Where required by law, we obtain your consent via the Cookie Banner. You can opt-out of this by visiting the Google Ads Settings page: Google Ads Settings .

If Google Ads is structured to collect personal data, the data controller will be Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland.

REMOVEDBing Ads is a service operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Please read Microsoft's privacy statement for more information on how Microsoft processes your information https://privacy.microsoft.com/en-US/ . When you access our Site via advertisements on Bing Ads, a cookie is set on your computer. In addition, a Universal Event Tracking tag is integrated on our Site. This is a code that, in combination with the cookie, stores data about the use of the Site, e.g., length of time spent on the Site, areas accessed, and ads used to reach the Site. In addition, Microsoft may track your usage patterns across multiple of your electronic devices through so-called cross-device tracking. The information collected is transferred to a Microsoft server in the United States. If Bing Ads is structured to collect personal data, the cookie banner on our Services will provide you the opportunity to consent to Bing Ads. Facebook Ads. Using Facebook Business Tools , we may show you interest-based ads when you use Facebook. To change your preferences or opt out of personalization for ads served by Facebook, you can visit Facebook Ads Preferences in addition to the Your Choices section below. We may also show ads to audiences who share similar characteristics to yours. To this end, a list of email addresses is irreversibly hashed encrypted and uploaded or transmitted from our site, and Facebook compares the hashed data with its users, generating a lookalike audience and deleting the uploaded list. We don't have access to the identity of anyone in the "lookalike" audience, unless they choose to click on one of our ads. 3.8 Other Tracking Technologies

ADDEDBing Ads is a service operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Please read Microsoft's privacy statement for more information on how Microsoft processes your information Microsoft Privacy Statement . When you access our Site via advertisements on Bing Ads, a cookie is set on your computer. In addition, a Universal Event Tracking tag is integrated on our Site. This is a code that, in combination with the cookie, stores data about the use of the Site, e.g. length of time spent on the Site, areas accessed, and ads used to reach the Site. In addition, Microsoft may track your usage patterns across multiple of your electronic devices through so-called cross-device tracking. The information collected is transferred to a Microsoft server in the United States. If Bing Ads is structured to collect personal data, the cookie banner on our Services will provide you the opportunity to consent to Bing Ads. Facebook Ads. Using Facebook Business Tools, we may show you interest-based ads when you use Facebook. Where required, we obtain your consent via the Cookie Banner before the processing starts. To change your preferences or opt out of personalization for ads served by Facebook, you can visit Facebook Ads Preferences in addition to the Your Choices section below. We may also show ads to audiences who share similar characteristics to yours. To this end, a list of email addresses is irreversibly hashed and encrypted and uploaded or transmitted from our site, and Facebook compares the hashed data with its users, generating a lookalike audience and deleting the uploaded list. We don't have access to the identity of anyone in the "lookalike" audience, unless they choose to click on one of our ads. 3.8. OTHER TRACKING TECHNOLOGIES

We may also use Tracking Technologies to collect "clickstream" data, such as the domain name of the service providing you with Internet access, your device type, IP address used to connect your computer to the Internet, your browser type and version, operating system and platform, the average time spent on our Site, webpages viewed, content searched for, access times and other relevant statistics, and assign unique identifiers to the device or other credentials you use to access the Site for the same purposes. Pages of our Site may also use Java scripts, which are code snippets embedded in various parts of websites and applications that facilitate a variety of operations including accelerating the refresh speed of certain functionality or monitoring usage of various online components; entity tags, which are HTTP code mechanisms that allow portions of websites to be stored or "cached" within your browser to accelerate website performance; and HTML5 local storage, which allows data from websites to be stored or "cached" within your browser to store and more quickly retrieve data in HTML5 pages when the website is revisited.

REMOVED3.9 Location Information

ADDED3.9. LOCATION INFORMATION

You may be able to adjust the settings of your device so that information about your physical location is not sent to us or third parties by (a) disabling location services within the device settings; or (b) denying certain websites or mobile applications permission to access location information by changing the relevant preferences and permissions in your mobile device or browser settings.

REMOVED4. Security Precautions We maintain reasonable physical, electronic, and procedural safeguards designed to guard your personal data from unauthorized processing, use or disclosure. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information. We also require our service providers to provide privacy and security controls to protect data shared with them in order to perform services.

ADDED4. SECURITY PRECAUTIONS We maintain reasonable physical, electronic, and procedural safeguards designed to guard your personal data from unauthorised processing, use or disclosure. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorised access to or disclosure of your information. We also require our service providers to provide privacy and security controls to protect data shared with them in order to perform services.

The Internet is not an absolutely secure environment, and we cannot guarantee that your personal data will be secure. We therefore strongly recommend that you use a unique, complex password to help us ensure the security of your account. We also strongly recommend that you do not share your password with others or re-use passwords on our Services that you use on other sites or apps, as doing so increases the likelihood of your being the victim of a credential stuffing attack or other malicious cyber behavior. If you feel that the security of your account or personal data has been compromised, please immediately contact us at our dedicated Privacy Center or as otherwise described in the "Contact Us" section below.

REMOVED5. Your Rights You have certain rights relating to processing of your personal data by us arising from Chapter 3 of the UK General Data Processing Regulation ("GDPR").. These rights include: . 5.1 Right to Information You have the right to certain information relating to processing of your personal data by us. This Privacy Statement, along with other relevant publicly available documents, provides this information. 5.2 Right of Access

ADDED5. YOUR RIGHTS You have certain rights relating to processing of your personal data. These rights include: 5.1. RIGHT TO INFORMATION You have the right to certain information relating to processing of your personal data by us. This Privacy Notice, along with other relevant publicly available documents, provides this information. 5.2. RIGHT OF ACCESS

You have the right to obtain a copy of personal data which we may hold about you. You should note that we are bound to retain data for no longer than is necessary, and that certain data may therefore have been deleted by the time a request for access is made, in line with the retention practices outlined in this notice.

REMOVEDData collected through the Refer-a-Friend Reward Program is retained only for as long as necessary to administer the Program and comply with applicable legal obligations. ss5.3 Right to Rectification

ADDED5.3. RIGHT TO RECTIFICATION

You have the right to have any inaccurate personal data corrected or updated.

REMOVED5.4 Right to Erasure ("The Right to be Forgotten")

ADDED5.4. RIGHT TO ERASURE ("THE RIGHT TO BE FORGOTTEN")

You have the right to have your data deleted when it is no longer required by us for a lawful purpose, as outlined in this Notice. Where data still needs to be kept, e.g., for a legal obligation or for legitimate business purposes the Right to Erasure does not yet apply.

REMOVED5.5 Right to Restriction of Processing

ADDED5.5. RIGHT TO RESTRICTION OF PROCESSING

You have the right to have processing of data restricted; While we verify the accuracy of your data or correct it if necessary; If the processing is unlawful and you request restriction of the processing rather than erasure of the personal data; If we no longer need the personal data for the purposes of the processing, but you require us to retain it for the establishment, exercise or defence of legal claims; and While we consider an objection made by you under your Right to Object.

REMOVED5.6 Right to Data Portability

ADDED5.6. RIGHT TO DATA PORTABILITY

You have the right to obtain a copy of certain personal data in a commonly used, machine readable format. This right is limited to data which; Was provided to us by you; Is processed by us on the basis of consent or a contract; and Is processed by automated means. We provide such personal data in Excel Spreadsheet format.

REMOVED5.7 Right to Object

ADDED5.7. RIGHT TO OBJECT

You have the right to object to the processing of your personal data which is done for the purposes of a legitimate interest or in the public interest or in exercise of official authority vested in us as data controller. Where you object, we must either demonstrate compelling legitimate grounds for the processing, or cease it. You have the right to object to processing for direct marketing purposes. This right can be exercised by opting out of direct marketing using the means provided. You have the right to object at any time to the use of your customer-service chat content for our service-quality assessment, including processing carried out by AI or human reviewers for training and quality-improvement purposes. If you object, we will stop processing your chat content for these purposes and will exclude your data from our quality-control workflows.

REMOVED5.8 Right regarding Automated Decision Making

ADDED5.8. CONSENT WITHDRAWAL Where we process your personal data on the basis of your consent, you have the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of any processing carried out prior to your withdrawal, nor does it affect processing carried out on a different legal basis. We do our best to make withdrawing your consent as easy as giving it, and we continually seek to implement and improve the technical mechanisms available to you for this purpose as technology evolves. The mechanisms currently available are described in the relevant sections of this Notice. 5.9. RIGHT REGARDING AUTOMATED DECISION MAKING

SHEIN notes that where it conducts Age Assurance prior to allowing you to access or purchase certain products where such restriction to adults is required under the EU Digital Services Act and other applicable national laws, that this processing may constitute Automated Decision Making. Because this processing is authorised by EU Member State law, the requirement to provide the opportunity to obtain human intervention, to express your point of view and to contest the decision is not applicable. Further information regarding this processing will be provided to you prior to it occurring.

REMOVEDWhere other decisions are made based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, you will be notified of the outcome and given the opportunity to obtain human intervention by SHEIN, to express your point of view and to contest the decision. 5.9 Exercise of your Personal Data Rights To exercise your rights, you may make updates within your customer account on the Site or App, or you may contact us through our dedicated Privacy Center .

ADDEDWhere other decisions are made based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you, you will be notified of the outcome and given the opportunity to obtain human intervention by SHEIN, to express your point of view and to contest the decision. In particular, SHEIN may use automated decision-making to suspend or restrict your account where our systems detect unusual activity or a high rate of product returns. For example, where your return history significantly exceeds normal patterns, automated systems may restrict your ability to make further returns or, in certain cases, suspend your account in accordance with our Fair Use Policy for Returns. Because such decisions may significantly affect your access to our Services, you have the right to obtain human intervention, to express your point of view, and to contest the decision by contacting us through our Privacy Center or as described in the "Contact Us" section below. In addition, our product recommendation features use automated profiling based on your browsing activity, purchase history, stated preferences, and (where provided) Kid's Profile information. This profiling does not produce legal effects but is used to personalise the products displayed to you. The key inputs used are your on-platform activity and voluntary preferences; the output is a ranked selection of products presented to you. This processing does not constitute decision-making under Article 22 GDPR . You may limit this personalisation at any time by adjusting your account preferences or by exercising your right to object as described in Section 5.7 of this Notice. 5.10. EXERCISE OF YOUR PERSONAL DATA RIGHTS To exercise your rights, you may make updates within your customer account on the Site or App, or you may contact us through our dedicated Privacy Center.

In some cases we may require additional information from you to help us identify the data you require. We may request that you provide additional information necessary to confirm your identity as the Data Subject, where there is a reasonable doubt in this regard. In the case of certain manifestly unfounded or excessive requests, we reserve the right to decline a request or to charge a reasonable administrative fee.

REMOVEDWe will respond to your request within 30 days of receiving it, except for requests which by reason of their complexity or number may take up to three months to fulfil. In such cases we will notify you of any such delay within one month of receipt of the request, together with the reasons for the delay. The rights apply to all personal data processed by SHEIN, including data collected through promotional activities such as the Refer-a-Friend Reward Program.

ADDEDWe will respond to your request within one month of receiving it. Where requests are complex or numerous, we may extend this period by a further two months (three months in total). In such cases we will notify you of any such extension within one month of receipt of the request, together with the reasons for the extension.

You should be aware that all of the above rights are subject to certain restrictions and limitations. Where such a restriction or limitation applies to one of your requests, we will notify you.

REMOVED5.10 Complaints

ADDED5.11. COMPLAINTS

If you believe we have infringed or violated your privacy rights, please contact us at our dedicated Privacy Center so that we may attempt to resolve any issues to your satisfaction.

REMOVEDUnder GDPR you also have the right to lodge a complaint or raise a concern with a Data Protection Supervisory Authority. The relevant authority for such complaints in respect of SHEIN is

ADDEDUnder GDPR you also have the right to lodge a complaint or raise a concern with a Data Protection Supervisory Authority. ISSL is established in Ireland and the lead supervisory authority for the purposes of supervision of compliance with the GDPR is the Irish Data Protection Commission (details below). However, if you are located in another EU Member State, you may also lodge a complaint with the supervisory authority in your country of residence.

The Data Protection Commission 6 Pembroke Row Dublin 2 D02 X963

REMOVEDIreland www.dataprotection.ie

ADDEDIreland Data Protection Commission

With respect to your personal data processed by a third party seller on our Site and App as an independent controller, to exercise your rights under the applicable law, you may contact the third party seller directly.

REMOVED6. Retention

ADDED6. RETENTION

We will retain your personal Data, including any correspondence you have with us, only for as long as is necessary for the purposes set out in this Notice, including retaining Personal Data in order to comply with our legal obligations, to resolve disputes, for information security purposes, and to enforce our legal rights, terms, and policies.

REMOVED7. Third-Party Websites

ADDED7. THIRD-PARTY WEBSITES

Our App or Site may contain links to third-party sites. This Notice does not apply to those third-party sites. We recommend that you read the privacy statements of any other sites that you visit as we are not responsible for the privacy practices of those sites.

REMOVED8. Children

ADDED8. CHILDREN

In order to use this site you must be at least 18 years old. SHEIN doesn't sell products for purchase by children. We may sell children's products for purchase by adults. If you're under 18, you may use SHEIN only with the involvement of a parent or guardian. If you are under 18, SHEIN may process some of your personal data: Product reviews: A parent or other adult who buys an item for you may take a photo of you and post it as part of a review of that product. Parents are advised not to post photos where the child's face is identifiable.

REMOVEDChildren's Profiles : A parent or other adult may add a profile for you to their own personal profile. This allows them to tell us what kinds of products they like to buy for you. We use this information to recommend other products to them which we think they might like to buy for you. To create this profile, we need to know the approximate age of the child (i.e. what month and year the child was born in) and whether the child is a girl or a boy. We also ask the parent to affirm that they have the legal authority to post the information being provided. The parent or guardian will also be asked to create a nickname for the profile. To best protect the privacy interests of the child, you should not use the child's name.

ADDEDMy Kid's Profiles: If you shop for a child, you can add a Kids' Profile to your existing account to receive personalized product recommendations. We do not intend to collect personal information about children, to set up the profile, we only ask for the child's approximate age (month and year of birth) and gender. You will be asked to create a nickname for the profile; we recommend you do not use the child's real name. The profile is visible to you only. You can update or delete your Kids' Profile at any time through your account settings. The Kids' Profile exists solely within your own account and is intended only to help us show you product recommendations that may be suitable for the child you shop for. It is not designed to collect, store, or process personal data relating to the child beyond the limited information described above.

This profile will only be visible to the person who creates it.

REMOVED9. Transfer of Your Personal Data SHEIN Customer Data for UK customers is stored within the UK and largely processed within the UK and the EU. However, like all global online retailers, in order to serve customers all over the world, it is necessary for SHEIN to access data internationally. When a customer makes a purchase from SHEIN or a SHEIN Marketplace seller, their order and shipping information needs to be provided to the warehouse in order for the order to be fulfilled. As many SHEIN products are shipped from China, this necessitates the transfer of this data to China. This type of data transfer is permitted under GDPR (Article 49 (1) (b)) as being necessary for the performance of SHEIN's contract with the customer, and is subject to appropriate safeguards. For other internal transfers of personal data among SHEIN affiliates, SHEIN has in place a Global Intra Group Data Transfer Agreement which includes the relevant Special Contractual Clauses as required under GDPR 10. Contact Us If you have questions or concerns regarding any information in this Privacy Policy, please contact us at our dedicated Privacy Center . Our UK Data Protection Officer can be contacted via the email address below or via our postal address below in writing:

ADDED9. INTERNATIONAL TRANSFERS OF YOUR PERSONAL DATA When you place an order with us, we need to share certain information about you with our affiliated SHEIN Group companies, trusted service providers, logistics partners, carriers and other business partners so that we can process, prepare, ship and deliver your order. For example, your name, delivery address and other order details may need to be shared so that a shipping label can be printed, customs formalities can be completed (where applicable), your parcel can be handled by warehouses and delivery providers, and customer support can assist you if needed. Section 2 of this Notice deals with disclosures of your personal data in greater detail. Because we operate a global business, some of the companies to which your personal data is disclosed are located, or access your personal data, outside the European Economic Area ("EEA"), including in China, Colombia, Egypt, Morocco, Indonesia, Philippines, Singapore or the US. The purposes of these transfers vary depending on the processing activity carried out on your personal data and the personal data needed for that service. For example, certain transfers to locations outside of the EEA may be necessary to process, prepare, ship and deliver your order, manage returns, provide customer support, support fraud prevention and risk management functions and to otherwise provide our Services and to perform our contractual obligations, while other transfers may relate other purposes described in this Notice. The types of recipients of your personal data located outside the EEA, or accessing your personal data from outside the EEA, are described in Section 2 of this Notice, dealing with disclosures to third parties. Whenever we transfer your personal data internationally, we take appropriate steps to protect it. Where an adequacy decision of the European Commission applies to the destination country to which your personal data may be transferred, we rely on that decision as the transfer mechanism. Where there is no adequacy decision of the European Commission, where required under the GDPR , we rely on the European Commission's Standard Contractual Clauses (SCCs) as the primary transfer mechanism. Where we rely on SCCs for transfers to countries that are not covered by an adequacy decision, we assess whether the law and practices of the destination country may affect the effectiveness of those safeguards, and we implement supplementary measures where necessary. A copy of the applicable SCCs or a summary of the safeguards in place can be obtained by contacting us at privacy@sheingroup.com . If you would like more information about the countries to which your personal data may be transferred or the safeguards we apply, please contact us using the details in Section 10 (Contact Us) below. 10. CONTACT US If you have questions or concerns regarding any information in this Privacy Notice, please contact us at our dedicated Privacy Center. Our EU Data Protection Officer can be contacted via the email address below or via our postal address below in writing:

Data Protection Officer

REMOVEDInfinite Towers Services Limited 7-9 Ram Place, Hackney London E9 6LL England

ADDEDInfinite Styles Services Co. Limited The Sidings, 4th Floor Grand Canal Quay Dublin 2, D04 E7K8, Ireland,

Email: privacy@sheingroup.com Privacy settings center When you visit any website, it may store or retrieve information on your browser, mostly in the form of cookies. This information might be about you, your preferences or your device and is mostly used to make the site work as you expect it to. The information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies. Click on the different category headings to find out more and change our default settings. However, blocking some types of cookies may impact your experience of the site and the services we are able to offer. More information Manage Consent Preferences Cookie List