Privacy Policy

WELCOME! NovaCollect Global is an international collectibles brand headquartered in the United States, with affiliated entities and subsidiaries operating worldwide (collectively referred to in this notice as “NovaCollect”, “we”, “our”, or “us”). This privacy policy (“Privacy Policy”) governs the NovaCollect Hub website, NovaCollect Hub mobile application (available to users within the US), and NovaCollect Hub Premium membership offering (these products, services, associated content, functionality and related online offerings are collectively named the “Services”). It describes how NovaCollect collects, uses, and discloses your personal information when you: • visit our fan-focused ecommerce platform known as NovaCollect Hub (the “Site”); • view or interact with content and features hosted on the Site; • download and use the NovaCollect Hub mobile app (currently only available, with terms applicable solely to United States users); • reach out to us to learn about or place orders for NovaCollect Hub merchandise; • join our crowdfunding campaigns by committing to pre-order collectibles should the project meet its minimum backer target; • communicate with us via NovaCollect Hub customer support hotline, postal address, or our online consumer help portal;

This Privacy Policy also applies to collection, use and disclosure of your personal information when you interact with us offline in connection with the Services, including fan expos and in-person collector events. NovaCollect Global acts as the data controller for all personal information collected and processed through your use of the Services.

Our EU representative: NovaCollect Europe B.V. De Entrée 240, 1101 EE Amsterdam, Netherlands [email protected]

Our UK representative: NovaCollect UK Limited 4 The Square, Stockley Park, Uxbridge, Middlesex, UB11 1ET, United Kingdom [email protected]

You may contact our Data Protection Officer for DPO-related matters at [email protected].

We encourage you to read this Privacy Policy carefully. If we collect or share Personal Data in ways different from what is outlined here, we will notify you of the intended collection purposes and any parties your data may be shared with, either through real-time notices at the point of data collection or separate notifications.

If you reside in California, Colorado, Connecticut, Utah or Virginia, please also read the “Additional State‑Specific Disclosures” section below. If you are located within the EEA or United Kingdom, please review the “EEA/UK Annex” below.

The Services are not intended for use by individuals under 16 years old in the United States and Canada, nor for persons under 18 years old within the EEA and UK. To understand our privacy practices for our other public-facing websites and mobile applications (some of which are designed for children), please review the corresponding NovaCollect Privacy Policy posted separately.

If you believe we have collected data from an individual under 16 (US/Canada) or under 18 (EEA/UK) in relation to the Services, you may directly request deletion of such information through our online form, email us at [email protected], or use any contact method listed in the Contact Us section below.

The Entertainment Software Rating Board’s Privacy Certified privacy compliance and certification program (“ESRB Privacy Certified”) is approved by the United States Federal Trade Commission (“FTC”) to serve as a Safe Harbor under the Children’s Online Privacy Protection Act (“COPPA”). Participating members may display certification seals to demonstrate compliance with established standards for online personal data collection, use and disclosure under COPPA and other U.S. data privacy laws. This Privacy Policy and the ESRB certification seals displayed on the Site confirm NovaCollect is a valid licensee and participating member of ESRB Privacy Certified.

To safeguard your privacy, we voluntarily adopted this privacy compliance program. The Services have been reviewed and certified by ESRB Privacy Certified to meet established online data handling standards. As a licensee of this program, we are subject to regular audits of the Services and our other online offerings, plus independent enforcement and accountability mechanisms managed by ESRB.

TABLE OF CONTENTS

Background Changes to this Privacy Policy What Information is Collected About Me With Whom Does NovaCollect Share My Information International Transfers of Personal Data How We Safeguard Your Personal Data How Long Do We Keep Your Personal Data What are My Information Choices? State Specific Disclosures and Rights EEA/UK Annex Contact Us

BACKGROUND

We respect our customers’ privacy and take responsibility for securing all your Personal Data. We collect and use certain Personal Data and must ensure such use complies with applicable data protection legislation.

Definitions used in this Privacy Policy: User(s) or You: users accessing the Site, the US-only NovaCollect Hub mobile app, or any individual whose Personal Data we collect and use in connection with the Services. Personal Data: any information relating to an identified or identifiable living individual. An identifiable person may be recognized directly or indirectly, especially through identifiers such as name, identification number, location data, online identifiers, or one or more factors unique to that individual’s physical, physiological, genetic, mental, economic, cultural or social identity.

This Privacy Policy does not apply to information NovaCollect collects through other channels. For clarity, this Policy excludes NovaCollect’s other websites; NovaCollect mobile apps (other than the US NovaCollect Hub mobile app); additional online services including our social media channels; and third-party websites, apps and online platforms we may link to. Your use of external third-party websites or applications is governed by their own privacy policies and terms of service. We recommend reviewing those third-party documents before submitting personal information. Back to top

CHANGES TO THIS PRIVACY POLICY

We recommend reviewing this Privacy Policy each time you access or use the Services to stay informed of our Personal Data collection, usage and disclosure practices. We may make minor revisions to this Privacy Policy at any time, and update the date at the top of this document to signal revisions. Where we implement material changes, we will notify you either by sending an email to your most recently provided address, or posting a prominent notice of the changes on the Site. Back to top

WHAT INFORMATION IS COLLECTED ABOUT ME

Information That You Provide

Many products and services available on the Site require us to obtain Personal Data to fulfill and deliver the Services. This occurs when you: Create an account or subscribe to the Services; Place or request a product order; Submit product ratings, reviews or questions; Back crowdfunded collectibles through our campaign platform; Enter contests, events or promotional activities; Send enquiries, feedback or contact NovaCollect Hub Customer Service; Complete online surveys; Subscribe to newsletters and marketing alerts; Share website content with friends; Communicate with us via the Services in other ways.

If you decline to provide required Personal Data, you may be unable to access the Services or certain features. Depending on how you interact with our Services, we and our service providers collect and process these categories of Personal Data:

• Identity Data: first name, last name, username or unique identifier, date of birth
• Contact Data: billing address, delivery address, email address and phone number
• Financial Data: bank account details, payment card information and other payment-related data
• Transaction Data: payment records, order information, details of products you purchase
• Basket Data: items added to your shopping basket and purchase status
• Technical Data: IP address, login credentials, browser type, time zone and location, browser plugins, operating system, platform and device ID
• Usage Data: information about how you browse and interact with the Site and Services, product searches and browsing history
• Marketing and Communication Data: your preferences for receiving marketing content from us and our partners, communication settings, records of marketing messages sent and your interactions with them
• Profile Data: your interests and preferences, competition entries, survey feedback, username and password, order history and product preferences

We may also receive information about you from other NovaCollect Hub users. For example, if another user refers you to our Services or orders items shipped to your address. We use this information only to fulfill that user’s request and will not send unrelated marketing communications unless you separately consent.

Information that We Collect or Generate About Your Use of Services

When you visit the Site or use our Services, we collect and generate usage and interaction data:

• Records of products and services purchased on the Site. We collect Transaction, Usage and Profile Data to maintain your purchase history and understand user behaviour, helping us deliver personalised, improved experiences.
• Contact and support interaction history. We collect Contact, Usage and Profile Data to provide secure, efficient customer support and verify your satisfaction with our products and platform.
• Content activity data if you publish content on the Site. We collect Usage and Profile Data for content you post. You may optionally upload images, photos and other materials that may qualify as Personal Data.

Information Collected Automatically From You

While you use the Services, we automatically collect information about your visit (collectively “Online User Activity”). When browsing our Site, we capture your computer’s Internet Protocol (“IP”) address to support internal platform operations. Additional data collected by us and our service providers includes operating system, access timestamps, browser type, and the URL of the site you visited before navigating to our Services.

If accessing the Services from a mobile device, we may record device make and model, mobile carrier, OS version, device language, mobile browser version, plus non-personal analytics and statistical usage metrics including downloads, user counts, sessions, usage frequency and retention.

We use multiple technologies to collect Online User Activity data:

• Cookies: small data files stored on your computer or mobile device by a website. Cookies help us and our vendors improve the Services, remember your preferences, enable security features, identify popular platform areas, count visits, measure campaign performance and deliver personalised content and ads. For more information about cookies and disabling them, see “What are my information choices?” below. Our standalone Cookie Notice contains further details.
• Clear GIFs: also known as web bugs or web beacons. These small electronic images embedded on web pages, emails or advertisements can place or read cookies. They are often used alongside cookies to track browser activity on a device. We use Clear GIFs to gather statistics, count visits, evaluate campaign effectiveness, personalise content and ads, and confirm whether recipients have opened and acted on emails.
• Log Files: log website activity and compile browsing statistics. These entries help NovaCollect measure visitor volume, platform usage frequency, pages visited and related behavioural data.
• Service Use Analytics and Telemetry: we may deploy analytics tools and providers to understand user interactions in pseudonymised form, to aggregate trend data, differentiate user groups, improve our website and app, fix bugs and refine future product offerings.
• Marketing Retargeting: if you opt into email alerts or newsletters, we may send promotional messages about products and services you have shown interest in.

We may combine data collected via these technologies with other information you provide, for the purposes laid out within this Privacy Policy.

Information Collected from Other Sources

We may obtain Personal Data from external sources and combine it with data collected through the Services. For instance, if the Site supports social media integration or we partner with social platforms for advertising, we may access certain Personal Data subject to your platform privacy settings and authorisation rules: your name, account details, friend connections and engagement with our brand content.

Beyond social platforms, other sources of information include:

• Partners delivering co-branded services or running marketing and advertising campaigns on our behalf;
• Publicly available information and public domain datasets;
• Third-party service providers handling ecommerce, payments, technical support and product delivery. Back to top

WITH WHOM DOES NOVACOLLECT SHARE MY INFORMATION

We may share your Personal Data with these categories of recipients:

1. NovaCollect group companies: entities within our corporate group providing data processing support, such as maintaining Site functionality, strengthening platform security or processing personal information in line with this Privacy Policy.
2. Third-party agents, consultants and service providers working on our behalf who require access to your Personal Data to deliver services. Our vendors include:
   • Payment service providers processing Identity, Contact and Financial Data to handle payments;
   • Data analytics providers processing Identity, Transaction, Technical and Usage Data to analyse platform performance and guide improvements;
   • Marketing and advertising agencies processing Identity, Technical and Usage Data to run campaigns;
   • Technical service providers processing Technical and Usage Data for platform support for us and users.

We contractually prohibit these vendors from retaining, using or disclosing your Personal Data for purposes outside our agreed services. All vendors must uphold data protection obligations and preserve confidentiality, security and integrity of the Personal Data they receive.

3. Business and advertising partners, who in some cases independently decide how to process information:
   • Delivery partners using Identity and Contact Data to ship your purchased goods;
   • Third-party platforms where sharing Personal Data is necessary to complete your requests, for example when you choose to share information on social media via our platform integrations.
4. Law enforcement, regulators, government bodies, courts or other authorised third parties where we reasonably believe disclosure is necessary or appropriate: (i) to comply with applicable law or legal process and respond to lawful official requests; (ii) protect NovaCollect’s rights, property, employees, agents, users and other parties, including enforcing our agreements and terms of service, and defend against fraudulent, abusive or unlawful platform use; (iii) protect the safety of NovaCollect, users and any individual or organisation.
5. Actual or potential buyers (and their representatives and advisors) in connection with proposed or completed sale, merger, asset sale, bankruptcy, restructuring, financing or acquisition of all or part of our business. We will require purchasers to use your Personal Data only for the purposes described within this Privacy Notice.
6. Any other party, when you consent to the disclosure, including scenarios where we notify you of the intended sharing method and you provide your Personal Data and consent.

Social Sharing Features

The Services (including functionality supplied by our service providers) may include social sharing widgets and integrated tools, enabling you to share your platform activity with external social platforms and vice versa. Use of these features may allow information to be shared with your contacts or the public, governed by your settings on the third-party platform. Refer to the privacy policies of those third-party providers for details of their data collection and processing.

Linking to External Sites, Applications and Other Online Services

We provide links and embedded tools to external websites and applications to show supplementary content and allow you to interact with third-party platforms you use. These external services are not operated or controlled by NovaCollect. Your use of those platforms is governed by their own privacy policies and terms of service, and we recommend reviewing them before submitting personal data. Back to top

INTERNATIONAL TRANSFERS OF PERSONAL DATA

NovaCollect is a global enterprise headquartered in the United States, with customers and operations across the world. Accordingly, we collect and transfer Personal Data internationally. This means your Personal Data may be transferred to countries outside your residence, which may have different data protection laws.

Our website servers are hosted in the United States. Our group entities, vendors and partners operate in the US and other territories. Your Personal Data may therefore be processed in the United States and other locations. We ensure cross-border transfers comply with legal requirements and maintain adequate protection. For EEA and UK users, see safeguards for cross-border transfers in the EEA/UK Annex below. You can request further information on our safeguards via the contact details at the end of this document. Back to top

HOW WE SAFEGUARD YOUR PERSONAL DATA

We maintain internal controls and policies to protect information systems and defend your Personal Data from loss, misuse, unauthorised access, disclosure, alteration and destruction. Our safeguards include industry-standard data encryption and restricting access to Personal Data only to employees performing legitimate business tasks.

When you contact NovaCollect support about your account, orders or personal data, we may request identifying information to verify your identity. This ensures only you or your authorised representatives can access your Personal Data. If you create an account protected by a password, you are responsible for keeping that password secure and confidential.

We regularly review and update our security procedures to adopt new technologies and improved protection methods. Please note that no security system is completely infallible. If a data breach occurs and we determine notification is reasonably required by applicable law, we will notify affected users. Back to top

HOW LONG DO WE KEEP YOUR PERSONAL DATA

The retention period for your Personal Data depends on multiple criteria. We retain your Personal Data where we have an ongoing legitimate business need, such as delivering requested products and services, meeting tax, accounting and legal obligations, or conducting business administration.

In some cases, we must retain your data after account deletion for legal reasons. Retention duration varies based on data type, collection purpose and applicable legal requirements. Examples:

• We retain data when required by law, such as court orders, ongoing tax obligations, or contest winner records, which may be kept longer after account deletion.
• We preserve records to handle complaints and support enquiries, for example if you report damaged goods after deleting your account.
• We retain records of data subject access requests for one year after submission to demonstrate handling if complaints arise.
• Data relevant to ongoing litigation or regulatory investigations will be stored until the matter concludes.

Once no legitimate business or legal reason remains to process your Personal Data, we delete or anonymise it. Where deletion is not immediately feasible (such as backup archives), we securely isolate your Personal Data and stop further processing until deletion can be completed. Back to top

ANALYTICS AND ADVERTISING

We use analytics and advertising tools. Region-specific details about these tools are available in your localised Cookie Policy. To manage your choices for analytics, interest-based advertising and matched ads, read our Cookie Policy, adjust preferences via our cookie management tool, or continue reading the “What are my information choices” section.

Website and Mobile Analytics

We use analytics services including Google Analytics and Google advertising tags to understand how visitors access and use our Services. These tools use cookies, web beacons and other tracking technologies to collect traffic data. The collected data commonly includes IP address, internet service provider, browser type, time spent on pages, clicked links and advertisements viewed. We use this information to improve our Services, identify popular features and count visitor volumes.

Interest‑Based Advertising

We collaborate with agencies, ad networks and technology providers to serve ads for our products across external websites and mobile applications. These partners use cookies, web beacons and tracking technologies to collect data about your visits to websites and apps including our Services. Using first and third-party cookies, they gather IP address, browser information, visited pages, time spent, clicked links and purchase events. Partners track your activity over time and across devices to deliver interest-targeted ads and relevant content.

Matched Ads

Third-party websites and applications may display NovaCollect ads targeted to visitors who have used our Services or users similar to our existing customers. This may be achieved by uploading customer lists to partner platforms or embedding partner pixels on our Site. The partner then matches shared identifiers between datasets. For example, we may use social media pixels and share email addresses for custom audience campaigns. We may also work with partners to deliver matched ads based on their own user databases. Back to top

WHAT ARE MY INFORMATION CHOICES

Regarding Accounts

If you hold an account with the Services, you may review and update your saved contact and address information at any time by logging into your account or contacting NovaCollect Hub Customer Support.

To fully remove your account data and delete your information, submit a request using our Online Form. If you email Customer Care, please include the name of our platform and your account email address for identity verification. If you saved checkout information for ordering, send your request to NovaCollect Hub Customer Support. Contact details are listed below. We aim to respond promptly. Please note we may retain certain data as described in “How Long Do We Keep Your Personal Data”.

Regarding Ratings, Reviews and Questions You Post

If you wish to remove product ratings, questions or reviews you published on the Site, send a request using our contact information. Please note some records may be retained in line with our data retention rules outlined earlier.

Regarding Promotional Communications

You will receive promotional communications only if you opt in through the Services. If you subscribed to marketing from another NovaCollect ecommerce site, marketing communications will be delivered via NovaCollect Hub. You may opt out of promotional emails and mailings at any point: you can decline marketing during account creation, checkout or when submitting contact details; unsubscribe by clicking the unsubscribe link within marketing emails; or contact NovaCollect Hub Customer Support.

Opting out of marketing does not stop transactional or service-related messages, such as account alerts, order confirmations, crowdfunding campaign updates and other operational communications.

Regarding Cookies

You may adjust cookie preferences anytime via the Cookies Settings link. Removing or rejecting certain cookies may reduce functionality or disable parts of the Services. Refer to our Cookie Notice for full details.

Additional Choices Regarding Analytics and Interest Based Advertising

Google provides an opt-out tool for Google Analytics data collection at tools.google.com/dlpage/gaoptout. Many of our advertising partners participate in the Digital Advertising Alliance (DAA) or Network Advertising Initiative (NAI). To learn more and opt out of targeted advertising from participating companies: visit www.aboutads.info/choices for DAA; https://www.networkadvertising.org/choices for NAI.

Opt-out only stops selected participants from serving targeted ads, and does not eliminate all advertising. To opt out of matched ads, contact us under the Contact Us section and specify your request, and we will notify relevant partners to stop matched ads based on our shared data. You can also contact those partners directly.

On mobile devices, you may limit behavioural advertising tracking: enable “Limit Ad Tracking” (iOS) or “Opt out of Ads Personalization” (Android). This opt-out only applies to that specific device or browser. NovaCollect cannot guarantee the effectiveness of third-party opt-out programmes or their statements.

Your browser may send a Do Not Track (DNT) signal indicating you do not wish your activity tracked. Some browsers and extensions support Global Privacy Control (GPC) to opt out of certain data processing. You can learn more about GPC at https://globalprivacycontrol.org. Our systems currently cannot recognise or respond to DNT headers. If our Site detects a GPC signal, we treat it as a “Do Not Sell” request to restrict sale or sharing of Personal Data for targeted advertising, subject to local applicable law. Back to top

U.S. STATE‑SPECIFIC DISCLOSURES AND RIGHTS

This section applies to residents of California, Colorado, Connecticut, Utah, or Virginia. We may expand these disclosures for additional states in the future. The California Consumer Privacy Act (CCPA, as amended) and other referenced state privacy laws (collectively “State Privacy Laws”) grant consumers extra rights, including access, correction and deletion of personal information (subject to exceptions), plus the right to opt out of sale/sharing of personal data, third-party targeted advertising and other activities where applicable.

Notice of Collection

Over the past 12 months, we and our service providers collected the categories of personal information described within this Policy for the Services, as defined under State Privacy Laws: Identifiers (name, address, email, IP address, account ID); Customer records including phone, billing address, payment card details; Commercial information including purchase history and platform engagement; Internet activity data including browsing history, browser type and language and automatically collected data; Geolocation data; Inferences about your interests, preferences and favourite brands and products.

Full details on collected data and sources are found in the “What information is collected about me” section. NovaCollect does not conduct cross‑context behavioural advertising as defined under the CPRA. Residents of certain states may still opt out of some advertising technology activities under State Privacy Laws. See the Right to Opt‑Out section below. When you opt out, NovaCollect will stop sharing your information with advertising partners for targeted ads.

Right to Opt‑Out

Under applicable State Privacy Law, you may opt out of sale of your Personal Data to third parties at any time. Submit your opt-out request for advertising technologies used on the Services via our Online Form.

Right to Access or Delete Your Information

You have the right to request access to and receive a copy of: categories of personal information we hold about you; categories of sources from which data was collected; categories of personal data disclosed for business purposes or sold; categories of third parties receiving data for business use or sale; business purposes for collecting or selling data; specific personal data we hold on you.

You may also request deletion of your personal information (subject to exceptions) and correction of inaccurate Personal Data. To exercise these rights, submit requests by calling our toll-free number (800) 255‑5516, using our Online Form or emailing [email protected]. Please specify the right you wish to exercise and scope of your request.

We aim to confirm receipt of your request within 10 business days. We may require identity verification information and send confirmation emails requiring your response before processing your application. We may reject requests if identity cannot be verified. Due to our privacy safeguards, sometimes we lack sufficient personal data to verify identity and complete access/correction/deletion requests. We aim to fulfil requests within 45 days, extendable for another 45 days if needed. Opt-out requests can also be submitted by calling (800) 255‑5516 or emailing [email protected]. We do not knowingly sell or share Personal Data of minors under 16 years of age.

Authorized Agent

You may appoint an authorised agent to submit requests on your behalf. We require written proof of authorisation and will verify your identity directly with you.

Appeals

If your privacy request is denied, you may submit an appeal to us at [email protected]. Please describe the grounds of your appeal and your concerns. We aim to reply promptly. If your appeal is rejected, you may raise concerns with your state Attorney General’s office.

Minors

We do not knowingly sell or share personal information of individuals under 16 years of age to third parties.

Right to Non‑Discrimination

You have the right to exercise your privacy rights without facing discriminatory treatment. We will not discriminate against users who exercise these rights.

California Residents SHINE THE LIGHT

Since 2005, California Civil Code Section 1798.83 permits California residents to request details of our disclosure of personal data to third parties for direct marketing purposes. If you have questions about this disclosure policy, contact: NovaCollect Global Attn: Hub Platform Administrator 1027 Newport Avenue, Mailstop A906 Pawtucket, RI 02861 (800) 255‑5516 Back to top

EEA/UK ANNEX

This annex provides additional disclosures for residents of the United Kingdom and European Economic Area.

Your Rights

You have the following rights relating to your Personal Data. To exercise any of these rights, submit a request via our Online Form or use contact information listed under Contact Us:

• Right to receive information about processing activities and access your Personal Data we store;
• Right to withdraw consent for future processing at any time. Withdrawal will not invalidate processing lawfully completed before withdrawal, nor processing relying on other lawful bases such as legal obligations. In some cases we must retain data to meet legal requirements;
• Right to receive your Personal Data in a structured, commonly used, machine-readable format, or request transfer to another controller where technically feasible (limited to Personal Data you directly provided to us);
• Right to request correction of inaccurate or incomplete Personal Data;
• Right to request erasure of your Personal Data (including account deletion) in certain circumstances. We may still retain data where legally permitted;
• Right to object to processing or request restriction of processing in certain circumstances. We may refuse where we hold valid legal grounds;
• If processing for direct marketing, you may object to such processing at any time;
• Right to opt out of marketing communications at any time;
• Right to lodge a complaint with a data protection supervisory authority.

What is NovaCollect’s Legal Basis for Processing Personal Data?

We always rely on a valid legal basis for each processing activity. The applicable basis depends on the type of Personal Data and processing context. We list processing purposes, data categories and lawful bases below. In many cases we rely on legitimate interests where those interests are reasonable for you to expect as part of our business operations and do not override your fundamental rights and freedoms.

表格

Purpose/Activity	Type of data	Lawful basis for processing including basis of legitimate interest
To provide you with access to the Site, its content and functionalities, including registering you as a new customer and providing you with access to your account	(a) Identity(b) Contact	(a) Performance of a contract with you(b) Otherwise (where we do not have a relevant contract with you), it is necessary for our legitimate interests (in providing access to the Site and related functionality to Site visitors)
To process and deliver your order including:(a) Manage payments, fees and charges(b) Send you order confirmations and invoices	(a) Identity(b) Contact(c) Financial(d) Transaction(e) Basket(f) Marketing and Communications	(a) Performance of a contract with you
To collect and recover money owed to us	(a) Identity(b) Contact(c) Financial(d) Transaction(e) Marketing and Communications	(a) Necessary for our legitimate interests (to recover debts due to us)
To enable you to back a crowdfunded product	(a) Identity(b) Contact(c) Financial	(a) Performance of a contract with you
To manage our relationship with you which will include:(a) Notifying you about changes to our terms or privacy policy(b) Sending you technical notices, updates, security alerts, and support and administrative messages(c) Responding to your comments, questions, and requests and providing customer service	(a) Identity(b) Contact(c) Profile(d) Usage(e) Marketing and Communications	(a) Normally our legal basis will be in order to perform our contract with you(b) On occasion, our legal basis might be that it is necessary to comply with a legal obligation such as obligations under UK GDPR to notify you about security incidents in certain circumstances
To study how customers use our products/services, understand feedback on products/ services (including where you opt to take part in a survey)	(a) Identity(b) Contact(c) Profile(d) Usage(e) Marketing and Communications(f) Transaction(g) Basket	(a) Necessary for our legitimate interests (to study how customers use our products/services, to develop them and grow our business)
To enable you to partake in a prize draw, competition	(a) Identity(b) Contact(c) Profile(d) Usage(e) Marketing and Communications(f) Transaction(g) Basket	(a) Performance of a contract with you
To administer and protect our business and this website (including troubleshooting, data analysis, testing, system maintenance, support, reporting, technical security and hosting of data)	(a) Identity(b) Contact(c) Technical(d) Transaction(e) Basket	(a) Generally our legal basis is that this is necessary for our legitimate interests (for running our business, provision of administration and IT services, network security, to prevent fraud and in the context of a business reorganisation or group restructuring exercise)(b) In some circumstances our legal basis may be that it is necessary to comply with a legal obligation (e.g. anti‑fraud legislation and our obligations under UK GDPR to maintain appropriate technical and organisational security measures)
To operate and improve the Services, including by linking or combining your Personal Data with other information we get from our service providers or other parties, or information related to your interactions with other NovaCollect sites or online services	(a) Identity(b) Contact(c) Profile(d) Usage(e) Technical(f) Transaction(g) Basket