Privacy Notice (UAE).

This UAE Privacy Notice ("UAE Privacy Notice") is issued by Metacircles Technologies Private Limited ("Culture Circle", "we", "us") and describes how we collect, use, disclose, and safeguard personal data of UAE Customers when they access the Culture Circle UAE storefront at culture-circle.com/ae. This UAE Privacy Notice operates alongside Culture Circle's global Privacy Policy. To the extent of any conflict in respect of UAE Customers, this UAE Privacy Notice prevails.

a) This UAE Privacy Notice applies to UAE Customers and to any individual whose personal data is processed by Culture Circle in connection with a UAE Order or a UAE-side interaction with the Platform. b) Culture Circle is established in India. Personal data of UAE Customers is processed in India and on cloud infrastructure described in clause 4. c) Where applicable, this UAE Privacy Notice is intended to be consistent with UAE Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (the "UAE PDPL") and with India's Digital Personal Data Protection Act, 2023.

Culture Circle processes UAE Customer personal data on one or more of the following lawful bases: a) Performance of a contract (placing and fulfilling an Order, providing customer support). b) Compliance with a legal obligation (tax, customs, anti-money-laundering, regulatory disclosures). c) Legitimate interests (fraud prevention, platform security, analytics in aggregated form). d) Consent (for marketing communications, optional cookies, and any processing not covered by the bases above). The UAE Customer may withdraw consent at any time by writing to customersupport@culture-circle.com. Withdrawal does not affect processing already carried out lawfully.

a) Identity and contact data: name, email, phone number, delivery address. b) Order and transactional data: order history, payment instrument metadata (last four digits, card brand — full card number is held by Razorpay International, not by Culture Circle), refunds, returns, communications with support. c) Device and usage data: IP address, browser type, device identifiers, pages viewed, search queries, referrer URL, session duration. d) Marketing preferences: opt-in / opt-out status for email, SMS, WhatsApp. e) Optional account data: gender, date of birth, size preferences, brand preferences (only if the UAE Customer voluntarily provides them).

a) UAE Customer personal data is transferred to and processed in India and on cloud infrastructure operated by Google Cloud Platform in the asia-south1 region. b) The UAE has not, as of the effective date of this Notice, declared India as a country with adequate data-protection standards under the UAE PDPL. The UAE Customer's consent to this cross-border transfer is obtained at the point of placing an Order. c) Culture Circle implements industry-standard technical and organisational safeguards (encryption in transit, access controls, audit logging) to protect personal data during and after transfer.

Culture Circle shares personal data with the following categories of third-party processors, only to the extent necessary for the stated purpose: a) Razorpay International — payment processing. Receives card / bank metadata necessary to process the transaction. b) ShipGlobal — logistics and importer-of-record services. Receives name, phone, full delivery address, and order contents necessary for shipment and customs clearance. c) WebEngage — transactional and marketing communications (email, SMS, WhatsApp). Receives email, phone, and order metadata. d) Google Analytics 4 — anonymised usage analytics. Receives device identifiers, page-view events, and aggregated metrics. e) GrowthBook and LaunchDarkly — feature-flag and A/B-testing services. Receive anonymised user identifiers only. f) Google Cloud Platform — infrastructure hosting (asia-south1). Each processor is bound by contractual data-processing terms requiring confidentiality, security, and limited use of personal data to the purposes specified.

Culture Circle retains UAE Customer personal data only for as long as necessary for the purposes set out in this Notice or as required by applicable law. Indicative retention periods: a) Transactional records (orders, invoices, refunds): 7 years (consistent with Indian and UAE accounting / tax norms). b) Customer-support communications: 3 years from last contact. c) Marketing-consent records: until consent is withdrawn, plus a 24-month audit trail. d) Anonymised analytics: indefinite (no longer personal data once anonymised). e) Account data: until the UAE Customer requests deletion under clause 7.

Subject to applicable law, the UAE Customer has the right to: a) Access the personal data Culture Circle holds about them. b) Rectify inaccurate or incomplete personal data. c) Request erasure of personal data (subject to retention obligations under clause 6). d) Withdraw consent at any time (clause 2). e) Object to or restrict certain types of processing. f) Receive their personal data in a portable format. g) Lodge a complaint with the UAE Data Office or the relevant UAE supervisory authority. To exercise any of these rights, the UAE Customer may write to customersupport@culture-circle.com with the subject line "UAE Data Subject Request" and a copy of a government-issued identity document for verification. Culture Circle will respond within 30 days.

Culture Circle does not knowingly collect personal data from individuals under 18 years of age. Where Culture Circle becomes aware that personal data of a minor has been collected without verifiable parental consent, that data will be deleted promptly. Parents or guardians who believe a minor has provided personal data may contact customersupport@culture-circle.com.

Culture Circle uses cookies and similar technologies to operate the Platform, remember preferences, secure transactions, and measure usage in aggregate. For v1 of the UAE storefront, the cookie set is the same as the global Platform. A granular UAE-specific cookie-consent banner with separate categories (necessary, functional, analytics, marketing) is planned in a subsequent release. Until that banner is deployed, the UAE Customer can manage cookies through their browser settings. Disabling necessary cookies may affect Platform functionality.

In the event of a personal data breach affecting UAE Customers, Culture Circle will notify affected individuals and, where required, the relevant UAE supervisory authority within 72 hours of becoming aware of the breach, in line with UAE PDPL norms.

Culture Circle may update this UAE Privacy Notice from time to time. Material changes will be notified by email or by prominent notice on the Platform. The "Effective from" date at the top of this Notice indicates when it was last revised.

For privacy-related queries or grievances: Grievance Officer, Culture Circle Email: customersupport@culture-circle.com Acknowledgement SLA: 48 hours Resolution SLA: 15 days from receipt