Emberly Privacy Policy INTRODUCTION

Privacy Policy and Information for Data Subjects pursuant to Art. 13 and Art. 14 of the EU General Data Protection Regulation. We are committed to protecting and respecting your privacy and security. This Privacy Policy describes the types of information we may collect from you or that you may provide when you visit our website at www.emberly.co.uk or any subdomain thereof (our “website”), as well as our practices for collecting, using, maintaining, protecting, and disclosing that information. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. ​​​By accessing or using the website in any manner, you accept and agree to be bound by this Privacy Policy. If you do not agree with any terms of this Privacy Policy, you may not access or use the website for any purpose. For the purpose of applicable data protection legislation, we, 22 Chancery Lane, London, United Kingdom, WC2A 1LS, are the data controller. This Privacy Policy was last updated on 29 November 2021. Any changes to this Privacy Policy will be communicated on our website. Your continued use of the website after we make changes is deemed to be acceptance of those changes, so please check this policy periodically for updates. This notice applies to: Subscribers; and Other customers. And anyone contacting, visiting or using our: Websites; Facebook & Instagram sites; LinkedIn sites; Pinterest sites; TikTok sites; Twitter sites; and Venues and other premises. If you require further details of our Privacy Policy please read more below. If you have any comments or queries regarding our use of your data, please contact us by email at privacy@emberly.co.uk or by post at 22 Chancery Lane, London, United Kingdom, WC2A 1LS.

WHY WE COLLECT PERSONAL INFORMATION

We process personal data to make, amend and administer subscriptions and class bookings, provide services, process and store payment details, and provide other products and services. We also deal with enquiries, gather customer feedback, undertake market research, and direct marketing, in our legitimate interests to promote our business and improve our service and delivery. On our websites we use third party marketing and analytical cookies plus similar technologies are included in our marketing emails, as explained in our Cookie Policy below. You can reject and block cookies in your browser settings. We monitor social media to respond to comments or complaints about our business and with the permission of the platform owner we may reproduce your comments on our website, on the lawful basis of our legitimate interests. In order to fulfil the above purposes: We disclose your personal data to payment providers, technology providers, insurers, and other specialist professional and technical service providers and advisers, to manage your subscriptions and class bookings, arrange payments, and provide services. We keep your data to enable us to fulfil our contract with you or to provide services, where required by law, to respond to a question or complaint, to obey rules about keeping records, to uphold or protect contractual or legal rights or where it is in your or another party’s vital interests or our legitimate interests. Where we process personal data on the basis of your consent, we will retain it for as long as required for the specified purpose. We also keep your data in line with any statutory limitation periods and for tax, legal or regulatory purposes. We may provide additional information during the subscription sign-up and class booking process and at other points at which we collect your personal data.

THE TYPE OF PERSONAL INFORMATION WE MAY COLLECT

Personal data or personal information means any information about an individual from which that person can be identified. It does not include data or information where the identifier has been removed (anonymous data). Information about you. We collect personal information from various sources, such as directly from you when you access or use the website. This includes site visits, using our website, or corresponding with us. This includes: Information that you provide by filling in forms on our website, commenting on content on our owned platforms, responding to a survey request, reviewing a class, or participating in public forums, including information provided at the time you subscribe to our services, post comments or material to the website, or request further services. We may also ask you for information when you enter a contest or promotion sponsored by us or when you report a problem with our website; Personal identifiers, such as title, name, postal and email addresses, postcode, contact telephone numbers, and login credentials if you create an Emberly account; Transaction information (if and to the extent that any such payment information constitutes personal data), including credit or debit card information (e.g. credit or debit card number, verification number, postcode, and expiration date), subscription and class booking details, and shipping address of a gift card recipient; Records and copies of your correspondence (including email addresses), if you contact us; Business-to-business information, for corporate customers: job title, business address and business email address; Your search queries on the website; Facebook Page Insights Data. In relation to our Facebook Pages, we may receive Insights Data from Facebook, i.e. aggregated data that can help us to understand how visitors are engaging with our Page, which may be based on personal data collected during your visit to our Page or its contents. In relation to the processing of this personal data only, we are joint controllers with Facebook Ireland Limited. Facebook Ireland Ltd has agreed to take primary responsibility under the GDPR for the processing of Insights Data and to comply with all applicable obligations under the GDPR with respect to the processing of Insights Data, so all requests and queries should be addressed to Facebook Ireland Limited. The Page Insights Controller Addendum sets out our respective responsibilities and is subject to the jurisdiction of the Irish Courts and the laws of Ireland. The Irish Data Protection Commissioner is the lead supervisory authority; and Customer special requests and feedback including complaints, whether via phone call, emails, or online free text fields. Information about others. If you request that your purchase be provided to someone other than yourself (such as a gift recipient), we use the information you provide about the other person to fulfill the shipment. As you navigate through and interact with our website, we may use automatic data collection technologies to collect certain information about your equipment, browsing actions, and patterns, including: Details of your visits to our website, including traffic data, location data, logs, and other communication data and the resources that you access and use on the website; Information about the devices you use to access the website (such as the IP address and type of device, operating system, and web browser); Dates, times, and the duration of your use of the website (including whether you are a repeat or first time visitor to the website); and Information about your online activities over time and across third party websites or other online services (behavioral tracking). Information we collect automatically may be statistical data that does not include personal information. We may maintain or associate any such statistical data with personal information we collect in other ways or receive from third parties. It helps us to estimate our audience size and usage patterns, speed up user experience, and to improve and personalise our services, including enabling us to identify and authenticate users. To the extent that we associate any of this non-personal information with your personal information, we will treat it as personal information under the terms of this Privacy Policy. Technologies we use for automatic data collection may include cookies. A cookie is a small file placed on the hard drive of your computer. Pages of our website and our emails may also contain small electronic files known as web beacons (also referred to as clear gifs, pixel tags, and single-pixel gifs) that permit us, for example, to count users who have visited those pages or opened an email and for other related website statistics (for example, recording the popularity of certain website content and verifying system and server integrity). If you access Emberly through a third party connection or log-in (e.g. through a social network like Facebook or Twitter), you may allow us to have access to and store certain information from your social network profile. This can include your name, gender, profile picture, your “likes” and check-ins, and your list of friends, depending on your settings on such services. If you do not wish to have this information shared, do not use a social networking connection to access Emberly. For a description of how social networking sites handle your information, please refer to their privacy policies and terms of use, which may permit you to modify your privacy settings. You may also have the option of posting your Emberly activities to social networks when you access content (e.g. you may post to Facebook that you enrolled in a class); you acknowledge that if you choose to use this feature, your friends, followers and subscribers on any social networks you have enabled will be able to view such activity. We may receive additional information such as demographic and statistical information from third parties, such as business partners, marketers, researchers, analysts, and other parties that we may attribute to you based on your assignment to certain statistical groups. We use this information to supplement the information that we collect directly from you in order to derive your possible interests and to provide more relevant experiences for you and improve our products, analytics, and advertising. Some content or applications on the website may be served by third-parties, including content and application providers. These third parties may use cookies alone or in conjunction with web beacons or other tracking technologies to collect information about you when you use our website. The information they collect may be associated with your personal information or they may collect information, including personal information, about your online activities over time and across different websites and other online services. They may use this information to provide you with interest-based (behavioral) advertising or other targeted content. We do not control these third parties’ tracking technologies or how they may be used. If you have any questions about any targeted content, you should contact the responsible provider directly.

WHY WE HAVE YOUR PERSONAL INFORMATION

We will only collect personal data where that information is necessary for us to complete one of the listed functions or activities. We use information that we collect about you or that you provide to us, including any personal information: To process orders you place and complete other transactions you have requested, and to maintain a record of your transactions; To provide you with updates and information about classes in which you have enrolled; To provide, operate, and maintain our website; To improve, personalize, and expand our website; To understand and analyse how you use our website; To develop new products, services, features, and functionality; To customise the advertising and content you see on our website; To communicate with you, either directly or through one of our partners, including for customer service, to provide you with updates and other information relating to the website, and for marketing and promotional purposes; To contact you by email, postal mail, or phone regarding Emberly and third party products, services, surveys, research studies, promotions, special events, and other subjects that we think may be of interest to you; To protect against and prevent fraud, unauthorised transactions, claims, and other liabilities, and manage risk exposure, including by identifying potential hackers and other unauthorised users; To send you information you request; To provide you with products and services you request; To respond to your questions and comments and provide customer support; To communicate with you about our products, services, offers, and promotions; To help us better understand your interests and needs through research and reports, in order to operate, evaluate, and improve our business and the products, features, and services we offer; To enforce our agreements with our clients; To comply with applicable legal requirements and industry standards; and For any other purpose for which you provide your consent.

BASIS FOR PROCESSING INFORMATION

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are: We have a contractual obligation. We use your information when you enter into a contract with us (e.g. taking out an Emberly membership) so we can: process your membership; provide you with classes; take payment; and provide you with customer support. We have a legitimate business interest. To conduct market research and analysis which helps improve and customise our products and services. For our marketing purposes, unless your consent is required for such marketing. To send you customer service emails including membership and class confirmations and reminders. To prevent or detect unlawful behaviour, to protect or enforce our legal rights or as otherwise permitted by law. Your consent. You are able to remove your consent at any time. You can do this by contacting privacy@emberly.co.uk. To deliver tailored advertising and marketing communications on our websites and apps (see our Cookie Policy below for more information).

HOW WE STORE YOUR PERSONAL INFORMATION

Your information is stored in our secure servers. Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to us; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. Data is only accessible to staff who require access for work and staff are trained to ensure that your data is secure. We will only use and store information for so long as it is required for the purposes it was collected for. How long information will be stored for depends on the information in question and what it is being used for. If you request to be removed from our contact database, we will remove you from the database but will keep a record of your request to be removed. We continually review what information we hold and delete what is no longer required.

COOKIES

To collect the information outlined above, we and our service providers use internet server logs, cookies, tracking pixels, and other similar tracking technologies. We use these technologies in order to offer you a more tailored experience in the future, by understanding and remembering your particular browsing preferences. Cookies are small data files that are stored on your computer or mobile device when you access our site. As we adopt additional technologies, we may also gather information through other methods. Please note that you can change your settings to notify you when a cookie is being set or updated or to block cookies altogether. Please consult the “Help” section of your browser for more information (e.g., Internet Explorer; Google Chrome; Mozilla Firefox; or Apple Safari). You can also manage the use of Flash technologies, including flash cookies and local storage objects, with the Flash management tools available at Adobe’s website. Please note that by blocking, disabling, or managing any or all cookies, you may not have access to certain features or offerings of the Services. For more information about our use of cookies, please see our Cookie Policy.

THIRD PARTY PROVIDERS

Without limiting the foregoing, we may also employ third party companies and individuals to facilitate our website and to process data, perform website-related services, or to assist us in analysing how our services are used (collectively, “third party providers”). These third party providers may have access to your personal information for purposes of performing these tasks on our behalf, and may have the right to retain and use personal information or other information through performance of these tasks in accordance with the terms of the applicable third party provider’s privacy policy. We advise you to review the privacy policies of the third party providers, but note that we have no control over and assume no responsibility for the content, privacy policies, or practices of any third party providers, their sites or services. Third party providers may include, but are not limited to, the following: Payment Processors. We use third party providers (currently Stripe) to process certain payment transactions via the website. Your payment card details are not stored by the website. If you provide payment information to Stripe in order to facilitate payment processing, your payment card details are encrypted and securely stored by our third party payment processors. You can learn more about Stripe’s privacy practices at https://stripe.com/en-gb/privacy. Mailchimp. We use third party providers (currently Mailchimp) for email marketing and for the management of our membership database. You can learn more about Mailchimp’s privacy practices at https://mailchimp.com/legal/privacy/. Google Analytics. Google Analytics is an independent web analytics service offered by Google that tracks and reports website traffic. Google uses the data collected to track and monitor the use of our website. This data is shared with other Google services. Google may use the collected data to contextualise and personalise the ads of its own advertising network. You can learn about Google’s privacy practices at https://www.google.com/intl/en/policies/privacy. You may opt out of the aggregation and analysis of data collected about you on our website by Google Analytics by downloading the Google Analytics opt-out browser add-on, available at https://tools.google.com/dlpage/. Please note that if you opt out, analytics companies other than Google Analytics may continue to aggregate and analyse data collected about you on the website. Google Tag Manager (“GTM”) is a Tag Management System that allows JavaScript and HTML tags to be quickly deployed and updated on our website for tracking and analytics. We use GTM on our website to include Google Analytics. If you have performed deactivation, GTM takes this deactivation into account. For more information about GTM’s privacy practices please refer back to https://www.google.com/intl/en/policies/privacy, and find terms of use at https://www.google.com/analytics/tag-manager/use-policy. Social media advertising. We use third party advertising platforms, such as Facebook, Google, Twitter, Instagram, etc. to send you messages that are targeted at you, based on your behaviour and browsing pattern, at specific times and locations, to increase the efficiency of our advertising campaigns. In order to do this, we share your Personal Data with our agency partners as well as social media platforms. We use third party solutions such as Google Analytics and Facebook Business Manager tools to help us do a better job at targeting our campaigns and messages for our consumers. Social media platforms will attempt to match your profile in their database to determine the optimal time and place (the page you are browsing) to show you an advertisement from Emberly. We also need to analyse necessary information to understand the impact of our campaigns. If you don’t accept that we track you for this purpose, you will still see Emberly advertisements on social media platforms and other third party platforms at random. Please also read the privacy notice on the social media platforms to understand how your personal data is used by them for this purpose. Google Ads. You can learn about Google’s privacy practices at https://www.google.com/intl/en/policies/privacy. Facebook. You can learn about Facebook’s privacy practices at https://www.facebook.com/privacy/explanation. You can also view your Facebook Ad Preferences under your Facebook settings. LinkedIn. You can learn about LinkedIn’s privacy practices at https://www.linkedin.com/legal/privacy-policy. You can also manage your preferences under your LinkedIn settings. TikTok. You can learn about TikTok’s privacy practices at https://www.tiktok.com/legal/privacy-policy-eea?lang=en. Twitter. You can learn about Twitter’s privacy practices at https://twitter.com/en/privacy. You can learn more about how to opt out of Twitter’s targeted advertising by visiting https://help.twitter.com/en/safety-and-security/privacy-controls-for-tailored-ads.

YOUR DATA PROTECTION RIGHTS

Under data protection law, you have rights including: The right to ask us for copies of your personal information The right to ask us to rectify personal information you think is inaccurate The right to ask us to complete information you think is incomplete The right to ask us to erase your personal information in certain circumstances The right to ask us to restrict the processing of your personal information in certain circumstances The right to object to the processing of your personal information in certain circumstances The right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you. Please contact us at privacy@emberly.co.uk if you wish to make a request.

DISCLAIMERS

Every effort is made to ensure that the information provided on this website, and in this Privacy Statement, is accurate and up-to-date, but no legal responsibility is accepted for any errors or omissions contained herein. We cannot accept liability for the use made by you of the information on this website or in this Privacy Policy, nor do we warrant that the supply of the information will be uninterrupted. All material accessed or downloaded from this website is obtained at your own risk. It is your responsibility to use appropriate anti-virus software. This Privacy Policy applies solely to the data collected by us, and therefore does not also apply to data collected by third party websites and services that are not under our control. Furthermore, we cannot be held responsible for the Privacy Policies on third party websites, and we advise users to read these carefully before registering any personal data.

DATA BREACHES

We will report any unlawful data breach of this website’s database, or the database(s) of any of our third party data processors, to all relevant persons and authorities within 72 hours of the breach if it is apparent that personal data stored in an identifiable manner has been stolen.

CONTACT US

If you have any concerns or complaints about the ways in which your personal information has been handled as a result of you using this website, you can contact us at privacy@emberly.co.uk. Alternatively, you have the right to complain to the Information Commissioner’s Office (ICO) if you are unhappy with how we have used your data. The ICO’s address: Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk

COOKIE POLICY

A cookie consists of a small text file sent by a web server to a web browser and stored by the browser. The information is then sent back to the server each time the browser requests a page from the server. This enables the web server to identify and track the web browser. Our website may place and access certain first party cookies on your computer or device. First party cookies are those placed directly by us and are used only by us. They are widely used in order to make websites work, or work in a better, more efficient way. They can do this because websites can read and write these files, enabling them to recognise you and remember important information that will make your use of a website more convenient (e.g. by remembering your user preferences). We have carefully chosen these cookies and have taken steps to ensure that your privacy and personal data is protected and respected at all times. In some circumstances, we may work with third parties to provide services on our website. Third party advertisers and other organisations may use their own cookies to collect information about your activities on our website and/or the advertisements you have clicked on. For more details, please refer to the relevant section above. We do not control these cookies and to disable or reject third party cookies, please refer to the relevant third party’s website. These cookies are not integral to the functioning of our site and your use and experience of our site will not be impaired by refusing consent to them. All cookies used by and on our site are used in accordance with current cookie law. Certain features of our site depend on cookies to function. Cookie law deems these cookies to be “strictly necessary”. Your consent will not be sought to place these cookies, but it is still important that you are aware of them. You may still block these cookies by changing your internet browser’s settings, but please be aware that our site may not work properly if you do so. We have taken great care to ensure that your privacy is not at risk by allowing them. We use the following types of cookie on our websites: Strictly necessary. These cookies are essential for certain features of our websites to work, for example when you make payments. These cookies do not record identifiable personal information and we do not need your consent to place these cookies on your device. Without these cookies some services you have asked for cannot be provided. Performance or Analytics. These cookies are used to collect anonymous information about how you use our website, including determining the source and amount of traffic to pages on our website. For example, performance cookies show us which are the most frequently visited pages on the website, allow us to see the overall patterns of usage on the website, help us record any difficulties you have with the website and show us whether our advertising is effective or not. In some cases we use trusted third parties to collect this information for us which may include recording your use of our websites but they only use the information for the purposes explained. By using our websites, you agree that we can place these types of cookies on your device. Functionality. These cookies are used to provide services or remember settings to enhance your visit, e.g. text size or other preferences. The information these cookies collect is anonymous and does not enable us to track your browsing activity on other websites. Some functionality cookies may also be strictly necessary cookies, but not all necessarily fall into that category. All of these features help us to improve your visit to the website. By using our websites, you agree that we can place these types of cookies on your device. Targeting or Advertising. It is important for us to know when and how often you visit our site, and which parts of it you have used (including which pages you have visited and which links you have visited). This information helps us to better understand you and, in turn, to make our site and advertising more relevant to your interests. Some information gathered by targeting cookies may also be shared with third parties, to deliver adverts more relevant to you and your interests. They are also used to limit the number of times you see an advertisement as well as help measure the effectiveness of the advertising campaign. Information contained in these cookies is anonymous and doesn’t contain your personal information. To find out more about cookies used for targeting and advertising visit www.youronlinechoices.com and www.networkadvertising.org, contact us at privacy@emberly.co.uk for further information about the trusted third parties we use, or see Other Service Providers above. Opting out of third party targeting or advertising cookies does not necessarily mean that you will not see our advertising on third party websites, only that this advertising will not be targeted to you through the use of third party cookies. If you’d prefer to restrict, block or delete cookies from Emberly and our third party advertisers, or any other website, you can use your browser to do this. If you choose to disable all cookies we cannot guarantee the performance of our websites and some features may not work as expected. The links below provide instructions on how to control cookies in all mainstream browsers: Google Chrome: https://support.google.com/chrome/answer/95647?hl=en-GB Microsoft Internet Explorer: https://support.microsoft.com/en-us/kb/278835 Microsoft Edge: https://support.microsoft.com/en-gb/products/microsoft-edge (please note that there are no specific instructions at this time, but Microsoft support will be able to assist) Safari (macOS): https://support.apple.com/kb/PH21411?viewlocale=en_GB&locale=en_GB Safari (iOS): https://support.apple.com/en-gb/HT201265 Mozilla Firefox: https://support.mozilla.org/en-US/kb/enable-and-disable-Cookies-website-preferences Android: https://support.google.com/chrome/answer/95647?co=GENIE.Platform%3DAndroid&hl=en (please refer to your device’s documentation for manufacturers’ own browsers) This privacy notice does not cover the links within this site linking to other websites. We encourage you to read the privacy statements on the other websites you visit. We may alter this cookie policy at any time. Any such changes will become binding on you on your first use of our site after the changes have been made. You are therefore advised to check this page from time to time. In the event of any conflict between the current version of this cookie policy and any previous version(s), the provisions current and in effect shall prevail unless it is expressly stated otherwise.