PURPOSE OF THIS PRIVACY POLICY

This notice aims to give you information on how LRG Online Ltd collects and processes your personal data through your use of the Secret Sales app for iPhone and iPad, including any data you provide through the app whether you create an account, sign in, purchase a product, use our shopping assistant or visual search, or contact us. The Secret Sales app is currently available for iPhone and iPad, in Great Britain only. We do not currently offer an Android app.
WHO THE APP IS FOR
Anyone can browse the app. To create an account and place an order you must be 18 or over. The app is not directed at children, and nothing in it is targeted at or intended for them. We do not knowingly collect personal data relating to children. If you believe a child has provided us with their personal data, please contact our data privacy manager using the details below and we will delete it. It is important that you read this notice so that you are fully aware of how and why we use your personal data.
CONTROLLER

LRG Online Ltd (also referred to as "LRG", "we", "us" or "our" in this notice) is the controller and responsible for the security of the personal data you provide to us through the app.

LRG trades as "Secret Sales". Secret Sales is a marketplace, through which customers may place orders and contract to purchase products from many different third party brands and suppliers. When you place an order in the app, the contract is made between you and the supplier or brand for the purchase and sale of the goods ordered; as such, the supplier or brand will become a second controller of your personal data, and you should review the supplier's (or brand's) privacy policy for further information as to how your personal data will be managed by them. We tell you who the supplier is at the point of purchase.

At LRG, we have appointed a data privacy manager who is responsible for overseeing questions in relation to this notice. If you have any questions about this notice, including any requests about your legal rights, please contact our data privacy manager at:

Full name of legal entity: LRG Online Ltd Email address: [email protected] Postal address: 22 Charterhouse Square, London, EC1M 6DX

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection issues (www.ico.org.uk). We would, however, appreciate the chance to deal with your concerns before you approach the ICO so please contact us in the first instance.

We keep this notice and our procedures under regular review. This version was last updated in July 2026. If we make significant changes we will tell you in the app or by email.

It is important that the personal data we hold about you is accurate and current. Please keep us informed if your personal data changes by updating your details in the app or by contacting us at the email set out above.

The app may link to third-party websites or applications, including the websites of the brands and suppliers who sell through Secret Sales. Clicking on those links may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy statements. When you leave our app, we encourage you to read the privacy notice of every website you visit.

Personal data means any information about a living individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

Identity Data includes first name, last name, username or similar identifier. Contact Data includes billing address, delivery address, email address and telephone number. Payment Data includes the payment method you used for an order, the last four digits of your card where you paid by card, a payment reference provided by our payment provider, and confirmation of payments, refunds and chargebacks. It does not include your card number, expiry date or security code, which we never receive.

Transaction Data includes details about payments to and from you and other details of orders you have placed in the app. Device Data includes your device model, operating system version, app version, language and region settings, IP address, a device identifier, your push notification token, and — if you allow it — your device's advertising identifier. Usage Data includes information about how you use the app, such as screens and products viewed, searches, items added to your bag or wishlist, and purchases.

Content Data includes what you type into our shopping assistant, photographs you submit to visual search, and anything you tell us when you contact us for support.

Profile Data includes your preferences, interests, feedback and survey responses. Marketing and Communications Data includes your preferences in receiving marketing from us and your communication preferences. Diagnostic Data includes reports generated when the app crashes or hits an error, describing what the app was doing and the state of your device at the time.

We also collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data could be derived from your personal data but is not considered personal data in law as it will not directly or indirectly reveal your identity. If we combine or connect aggregated data with your personal data so that it can identify you, we treat the combined data as personal data which will be used in accordance with this notice.

We do not collect or store your card number, expiry date or security code. All card payments are processed by our payment provider — see "How we use your personal data" below. We do not collect your location. The app does not use your device's location settings, does not ask for them, and has no feature that requires them. We do not collect your contacts, your calendar, your messages, your browsing history outside our app, or your health or fitness data. We do not use facial recognition.

We do not collect any Special Categories of Personal Data about you (this includes details about your race or ethnicity, religious or philosophical beliefs, sex life, sexual orientation, political opinions, trade union membership, information about your health, and genetic and biometric data). Nor do we collect any information about criminal convictions and offences.

Where we need to collect personal data by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you. In this case, we may have to cancel a product or service you have ordered from us, but we will notify you if this is the case at the time.

We use different methods to collect data from and about you including through:

You may give us your Identity, Contact, Profile and Content Data by filling in forms in the app or by corresponding with us. This includes personal data you provide when you:

• create an account in the app, or sign in using an existing account with another provider;
• place an order for goods through the app;
• save items to your bag or wishlist;
• ask our shopping assistant to help you find something;
• submit a photograph to visual search;
• request marketing or push notifications to be sent to you;
• enter a competition, promotion or survey; or
• give us feedback or contact us with an enquiry.

AUTOMATICALLY FROM YOUR DEVICE - As you use the app, we automatically collect Device Data, Usage Data and Diagnostic Data. We collect this through software development kits (SDKs) built into the app, which perform a similar function to cookies on a website. The providers of those SDKs are listed under "Disclosure of your personal data" below.

THIRD PARTIES We receive Device Data and Usage Data from our attribution provider, Branch, which tells us which of our advertising campaigns led you to install the app. We receive Transaction Data from our payment provider confirming that payments have succeeded, and from the suppliers who fulfil your orders.

We will only use your personal data when the law allows us to. Most commonly, we will use your personal data in the following circumstances:

Where we need to perform the contract we are about to enter into or have entered into with you. We will share your personal data with the supplier or brand you have ordered a product from, as this is necessary for the performance of that contract.

Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests. We make sure we consider and balance any potential impact on you before we process your personal data for our legitimate interests, and you can ask us how we have done so.

Where we need to comply with a legal obligation.

We rely on your consent for marketing messages, push notifications about sales and offers, and for the use of your device's advertising identifier. You can withdraw consent at any time.

We never receive or store your card number, expiry date or security code. Card payments are processed by Stripe, who hold those details on their own systems under their own terms. If you pay with Apple Pay, your card details are handled by Apple and are not shared with us.

When you complete an order we keep a record of the payment method you used, the last four digits of your card if you paid by card, and a payment reference from our provider. We use the payment reference to process refunds and to resolve disputed or fraudulent payments. We use the payment method to manage your order and to understand which payment methods our customers prefer. We keep these records to meet our accounting and tax obligations.

The app does not let you save a card for future purchases. We hold nothing that would allow us to charge you again — no stored card and no reusable payment token. Every purchase requires you to enter your payment details, or to authorise the payment through Apple Pay.

Where you choose to pay with Klarna, we pass your contact and order details to Klarna so they can assess whether you qualify for their payment methods and tailor those methods for you. Klarna processes that data in line with its own privacy notice at https://www.klarna.com/international/privacy-policy/

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us if you need details about the specific legal ground we are relying on where more than one ground has been set out below. The lawful bases below are the position LRG has taken on its own processing. They should be confirmed as part of legal review.

CHANGE OF PURPOSE

We will only use your personal data for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If you wish to get an explanation as to how the processing for the new purpose is compatible with the original purpose, please contact us. If we need to use your personal data for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.

We may share your personal data with the parties set out below for the purposes set out in the table above.

When you buy something, we share the personal data needed to fulfil your order with the brand or supplier selling that item. They become a second controller of that data and their own privacy notice applies.

The following providers process personal data on our behalf. They act on our instructions, are subject to a duty of confidentiality, and are not permitted to use your personal data for their own purposes.

Crash and error reports sent to Firebase Crashlytics include your customer number, so that if you contact us about a problem our support team can find the matching error. They do not include your name or email address.

We use our own internal systems to manage accounts, orders and product information. These are operated by LRG rather than by a third party, and the providers who host and support that infrastructure process personal data on our behalf under the same obligations as the providers listed above.

We may also share your personal data with professional advisers (including lawyers, bankers, auditors and insurers) where this is in our legitimate interests; with HM Revenue & Customs, regulators and other authorities where they require reporting of processing activities; and with third parties to whom we may choose to sell, transfer or merge parts of our business. If a change happens to our business, the new owners may use your personal data in the same way as set out in this notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law.

Two features in the app use artificial intelligence. Both are provided by Google's Gemini service.

You can describe what you are looking for in your own words and our assistant will help find matching products.

Our shopping assistant is an AI, not a human colleague. What you type is sent to Google's Gemini service, which interprets your request so that we can search our catalogue for matching products.

The assistant only sees what you type into it. We do not pass it your name, your email address or your order history. We do not store your conversations, and nobody at Secret Sales reads them. Google retains what you send for up to 55 days for the sole purpose of detecting misuse of its service, and does not use it to train or improve its AI models.

Please do not share sensitive personal information with the assistant — it only needs to know what you are shopping for.

Our support chat is a separate service, handled by people and described under "Disclosure of your personal data" below. Conversations are not passed between the two.

You can take or upload a photograph to find similar products. The image is sent to Gemini, which works out what the item is and returns a description we use to search our catalogue.

Your photograph is not stored on our systems. Google retains it for up to 55 days for the sole purpose of detecting misuse of its service, and does not use it to train or improve its AI models.

We ask for access to your camera or photo library only when you use this feature, and only for this purpose. You can decline, and the rest of the app will work normally. You can change this permission at any time in your device settings.

We do not use photographs you submit to identify you, and we do not use facial recognition.

Your device has an advertising identifier — on iPhone and iPad this is Apple's Identifier for Advertisers, or IDFA. We use it to understand which of our advertising campaigns led you to install the app, so that we can measure whether our advertising is working and spend our marketing budget sensibly. This is handled for us by Branch, an attribution provider.

Because this involves linking activity in our app to advertising you saw elsewhere, iOS asks for your permission the first time you open the app. If you choose "Ask App Not to Track", we do not use your device's advertising identifier for this purpose.

You can change your mind at any time in Settings › Privacy & Security › Tracking on iOS.

We do not sell your personal data. We do not share your details with data brokers. We do not upload lists of our customers' email addresses or device identifiers to advertising networks in order to target you in other companies' apps, or to find people similar to you.

The analytics and product testing we carry out — described in the table above — uses our own information about how you use our own app. We do not combine it with information about you gathered from other companies' apps or websites for advertising purposes.

PROMOTIONAL OFFERS FROM US

We may use your Identity, Contact, Device, Usage and Profile Data to form a view on what we think you may want or need, or what may be of interest to you. This is how we decide which products, services and offers may be relevant for you (we call this marketing).

You will receive marketing communications from us if you have requested them or purchased goods through Secret Sales and you have not opted out.

PUSH NOTIFICATIONS

If you allow notifications, we use a device token provided by Apple to send you messages. The token identifies your device rather than you personally, but we link it to your account so that the messages are relevant.

We send two kinds of notification. Order notifications keep you updated on purchases you have made. Marketing notifications tell you about sales and offers, and we only send these if you have opted in.

You can opt in or out of marketing notifications in the app, and you can turn notifications off entirely in your device settings. Turning off marketing notifications will not stop essential messages about orders you have placed.

We will get your express opt-in consent before we share your personal data with any third party for their own marketing purposes.

You can ask us to stop sending you marketing messages at any time by adjusting your preferences in the app, by following the opt-out links on any marketing message sent to you, or by contacting us.

Where you opt out of receiving marketing messages, this will not apply to personal data provided to us as a result of a purchase or other transaction.

Several of the providers listed above are based outside the United Kingdom, principally in the United States. This means your personal data is transferred outside the UK.

Whenever we transfer your personal data out of the UK, we ensure a similar degree of protection is afforded to it by relying on the safeguards approved for use in the UK.

Most of the US providers listed above are certified under the UK Extension to the EU–US Data Privacy Framework, which the UK government has approved as providing adequate protection for personal data transferred from the UK. Where a provider is not certified, or a particular transfer is not covered by its certification, our contract with that provider incorporates safeguards approved for use in the UK — the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses — which require the provider to protect your personal data to the standard required under UK law.

The Gemini service we use for our AI features does not currently offer UK-only processing, so information you send to our shopping assistant or visual search is processed outside the UK.

Where you order goods from a supplier based outside the UK or EEA, your personal data may be sent to that supplier, who is a second controller of it. You should read that supplier's privacy notice carefully.

You can ask us for details of the safeguards we have in place by contacting our data privacy manager.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We limit access to your personal data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

Data sent between the app and our systems is encrypted in transit.

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

In some circumstances we will anonymise your personal data so that it can no longer be associated with you, in which case we may use this information indefinitely without further notice to you.

Under certain circumstances, you have rights under data protection laws in relation to your personal data. You have the right to:

Request access to your personal data (commonly known as a "data subject access request"). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it.

Request correction of the personal data that we hold about you. This enables you to have any incomplete or inaccurate data we hold about you corrected, though we may need to verify the accuracy of the new data you provide. You can update most of your details yourself in the app.

Request erasure of your personal data. This enables you to ask us to delete or remove personal data, including information from an account you used to sign in with another provider, where there is no good reason for us continuing to process it.

Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you want to object. You also have the right to object where we are processing your personal data for direct marketing purposes.

Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data.

Request the transfer of your personal data to you or to a third party, in a structured, commonly used, machine-readable format.

Withdraw consent at any time where we are relying on consent to process your personal data. This will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain features to you, and we will tell you if that is the case.

To exercise any of these rights, please contact us at [email protected], or use the options in the app.

You can delete your account from within the app. When you do, we delete your profile, your saved preferences, your wishlist and your marketing records.

We are required by law to keep basic records of orders and payments for six years, so those records are retained for that period and then deleted.

Deleting the app from your device does not delete your account or the data we hold. To delete your account you need to use the account deletion option in the app, or contact us.

Separately from the rights above, you can withdraw permission for notifications, camera and photo library access, and use of your device's advertising identifier at any time in your device settings.

You will not have to pay a fee to access your personal data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal data. This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask for further information in relation to your request to speed up our response.

We try to respond to all legitimate requests within 28 days, but we will always endeavor to complete your request sooner. Occasionally it could take us longer than 28 days if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.