AART SPACE LTD operates this store and website, including all related information, content, features, tools, products and services (the "Services"). This Privacy Policy describes how we collect, use, and disclose your personal information when you visit, use, or make a purchase using the Services or otherwise communicate with us. Our Details: • Company Name: AART SPACE LTD • Address: 3rd Floor, 86/90 Paul Street, London, EC2A 4NE, United Kingdom • Email: sales@aartspace.com • Company Number: 16726493 Please read this Privacy Policy carefully. By using the Services, you acknowledge that you have read and understand how we collect, use, and disclose your information.

When we use "personal information," we mean information that identifies or can reasonably be linked to you. We collect the following types of personal information: Information You Provide Contact Details: • Name • Email address • Phone number • Billing address • Shipping address Payment Information: • Credit/debit card details • Payment card information • Transaction details • Payment method preferences Account Information (if you create an account): • Username • Password • Security questions • Account preferences Transaction Information: • Items you view, add to cart, or purchase • Past orders and transactions • Returns, exchanges, or cancellations • Wishlist items Communications: • Messages you send us • Customer support inquiries • Feedback and reviews • Newsletter preferences Information Collected Automatically Device Information: • Browser type and version • Operating system • IP address • Device identifiers • Location data (country/region) Usage Information: • Pages you visit • How long you stay on pages • Links you click • How you navigate our site • Referring website • Date and time of visits Cookies and Tracking: We use cookies and similar technologies. See the "Cookies" section below for details.

We collect personal information from: 1. Directly from you - when you make a purchase, create an account, sign up for emails, or contact us 2. Automatically through our website - through cookies and analytics tools 3. Our service providers - companies that help us operate our business 4. Third parties - such as payment processors and fraud prevention services

We use your personal information to: Provide the Services • Process and fulfill your orders • Arrange shipping and delivery • Process payments and refunds • Create and manage your account • Handle returns and exchanges • Remember your preferences • Send order confirmations and updates • Provide customer support Marketing and Communication • Send you our newsletter (if you opt in) • Share updates about new book releases • Tell you about archive stories and documentation • Send promotional emails (you can unsubscribe anytime) • Show you relevant online advertisements • Recommend products based on your interests Improve Our Services • Understand how people use our website • Analyze shopping patterns and preferences • Test and improve website features • Develop new products and services • Fix technical problems Security and Fraud Prevention • Protect against fraudulent transactions • Detect and prevent unauthorized access • Secure payment processing • Verify your identity when needed • Protect public safety Legal Compliance • Comply with UK tax and accounting laws • Respond to legal requests from authorities • Enforce our terms and conditions • Protect our legal rights • Maintain business records as required by law

We work with trusted companies to help operate our business: Shopify (E-commerce Platform) Our store is hosted on Shopify. They collect and process information about your use of our Services to provide and improve their platform. Shopify may use data from your interactions with our store, along with other merchants, to provide enhanced features. What Shopify collects: • Your purchases and browsing on our store • Device and browser information • Your interactions with our store Your rights regarding Shopify: You can exercise certain privacy rights at the Shopify Privacy Portal: https://privacy.shopify.com/en Shopify's Privacy Policy: https://www.shopify.com/legal/privacy Klaviyo (Email Marketing) We use Klaviyo to manage our newsletter and marketing emails. When you sign up for emails, we share: • Your email address • Your name (if provided) • Your purchase history • Products you've viewed • Email engagement (opens, clicks) What we send via Klaviyo: • Updates about new book releases and availability • Stories from Steve Lazarides' archive • Information about cultural events and documentation • Occasional promotional offers How to unsubscribe: Click "Unsubscribe" at the bottom of any marketing email. Klaviyo's Privacy Policy: https://www.klaviyo.com/legal/privacy Xero (B2B Invoicing and Accounting) For wholesale and corporate customers, we use Xero to: • Generate and send invoices • Process NET 30/60 payment terms • Maintain financial records • Track business transactions What we share with Xero: • Business name and contact details • Invoice and payment information • Transaction history Xero is used only for B2B customers (bookstores, educational institutions, corporate buyers). Xero's Privacy Policy: https://www.xero.com/uk/about/legal/privacy/ Crunch Accountants (Financial Management) We use Crunch Accountants for bookkeeping and financial compliance. They access: • Transaction data for accounting purposes • VAT and tax information • Financial reports Crunch does not have direct access to your personal contact information beyond what appears on invoices and receipts. Crunch's Privacy Policy: https://www.crunch.co.uk/privacy-policy Payment Processors We use secure payment processors (such as Stripe, PayPal) to handle transactions. Your payment information goes directly to them and is not stored on our servers. Analytics and Advertising Google Analytics: We use Google Analytics to understand how visitors use our website. Opt out: https://tools.google.com/dlpage/gaoptout We use Crisp, a customer messaging platform provided by Crisp IM SAS (France), to manage support conversations. When you interact with our chat, Crisp may process data such as your IP address, device information, and messages you send. Data is stored securely in the European Union (Netherlands and Germany). Crisp is fully GDPR‑compliant and acts as our Data Processor. Chatbox cookies are only used to maintain the conversation session and are not used for tracking. Temporary session data is automatically deleted if no conversation is started. For more details, consult the Crisp Privacy Policy: https://crisp.chat/en/privacy/" Facebook Pixel: We use Facebook Pixel to show relevant ads and measure campaign effectiveness. Manage preferences: https://www.facebook.com/settings?tab=ads Other Service Providers • Shipping Companies - to deliver your orders • Cloud Storage - to securely store data • Customer Support Tools - to provide better service • Fraud Prevention - to protect against fraudulent transactions All third-party providers are contractually required to protect your information and use it only for the purposes we specify.

We use cookies (small text files) and similar technologies to improve your experience. Types of Cookies We Use Essential Cookies (Always Active): • Keep you logged in • Remember items in your cart • Enable checkout and payment • Maintain security Analytics Cookies: • Understand how visitors use our site • Measure website performance • Identify technical issues Marketing Cookies (With Your Consent): • Show you relevant ads • Measure ad campaign effectiveness • Personalize content Managing Cookies You can control cookies through your browser settings: • Chrome: Settings > Privacy and Security > Cookies • Firefox: Settings > Privacy & Security > Cookies • Safari: Preferences > Privacy > Cookies Disabling cookies may affect website functionality.

We share your personal information in limited circumstances: With Service Providers We share information with companies that help us operate, including: • Shopify (hosting) • Klaviyo (email) • Xero (B2B invoicing) • Crunch (accounting) • Payment processors • Shipping companies • Analytics providers For Business Purposes We may share information: • In connection with a merger, sale, or acquisition • To comply with legal obligations • To respond to lawful requests from authorities • To enforce our terms and conditions • To protect our rights and prevent fraud With Your Consent We'll share information with third parties when you direct us to or give us permission. We Do NOT: • Sell your personal information to third parties • Share your information for others' marketing without consent • Provide access to your data beyond what's necessary for services

Security Measures We protect your information using: • SSL/TLS encryption for data transmission • Secure cloud storage with encryption • Limited access to authorized personnel only • Regular security audits and updates • Secure password policies • Two-factor authentication options Please note: No security measures are perfect. We cannot guarantee absolute security. Use secure internet connections and don't share your account credentials. How Long We Keep Data Transaction Records: 7 years (UK tax and accounting requirements) Marketing Email Lists: Until you unsubscribe or request deletion Account Information: Until you request account deletion, then 30 days Website Analytics: 26 months (Google Analytics default) Customer Support Communications: 3 years after resolution Cookies: Based on cookie type (session to 2 years) After retention periods end, we securely delete or anonymize your information.

Depending on where you live, you have rights regarding your personal information: Rights Available to Everyone Right to Access: Request a copy of the personal information we hold about you. Right to Correct: Request correction of inaccurate information. Right to Delete: Request deletion of your personal information (subject to legal requirements). Right to Object: Object to certain types of processing, including marketing. Communication Preferences: Unsubscribe from marketing emails anytime. You'll still receive transactional emails about your orders. Additional Rights for UK/EU Residents (GDPR) If you're in the UK or European Economic Area, you also have: Right to Restriction: Request we limit how we process your information. Right to Data Portability: Receive your data in a portable format to transfer elsewhere. Right to Withdraw Consent: Withdraw consent for processing at any time (doesn't affect prior processing). Right to Lodge a Complaint: Contact your local data protection authority. Legal Basis for Processing: • Contract Performance: To fulfill orders and provide services • Legitimate Interests: To improve services, prevent fraud, market our products • Consent: For optional marketing emails and cookies • Legal Obligations: To comply with tax, accounting, and legal requirements How to Exercise Your Rights Email: sales@aartspace.com Post: AART SPACE LTD 3rd Floor, 86/90 Paul Street London, EC2A 4NE United Kingdom We'll respond within 30 days. For complex requests, we may extend this to 60 days and will notify you. We may need to verify your identity before processing requests. We won't discriminate against you for exercising your rights.

Your information may be transferred to and processed in countries outside the UK and EEA, including: • United States (Shopify, Klaviyo servers) • Australia (Xero servers) When we transfer data internationally, we use: • European Commission Standard Contractual Clauses • UK International Data Transfer Agreement • Other approved transfer mechanisms These safeguards ensure your information receives adequate protection.

Our Services are not intended for children under 16. We don't knowingly collect information from children under 16. If you're under 18, please get parent or guardian consent before using our Services. If we discover we've collected information from a child under 16, we'll delete it immediately. If you believe we've collected information from a child, contact us at sales@aartspace.com.

Our website may link to third-party websites (social media, partner sites, etc.). This Privacy Policy doesn't apply to those sites. We're not responsible for the privacy practices of third-party websites. Please review their privacy policies before providing information.

We may update this policy to reflect: • Changes in our practices • New legal requirements • Service improvements • New features or services When we make changes: • We'll update the "Last updated" date • We'll notify you via email for significant changes • We'll provide at least 30 days' notice for material changes • Your continued use after changes means you accept the updated policy Previous versions: Available upon request at sales@aartspace.com

For Privacy Questions or to Exercise Your Rights: Email: sales@aartspace.com Post: AART SPACE LTD 3rd Floor, 86/90 Paul Street London, EC2A 4NE United Kingdom Data Controller: AART SPACE LTD UK Data Protection Authority: Information Commissioner's Office (ICO) Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF United Kingdom Website: https://ico.org.uk Phone: 0303 123 1113 (UK) / +44 1625 545 745 (International) EU Data Protection Authorities: If you're in the EEA, find your local authority: https://edpb.europa.eu/about-edpb/board/members_en

If you're a California resident, you have specific rights: Right to Know: What personal information we collect, use, disclose, or sell. Right to Delete: Request deletion of your personal information. Right to Opt-Out: We don't sell personal information, but you can opt out of targeted advertising. Right to Non-Discrimination: We won't discriminate for exercising your rights. Authorized Agent: You may designate someone to make requests on your behalf. Contact: sales@aartspace.com to exercise California privacy rights.

We collect: Name, email, address, payment details, browsing behavior We use it to: Process orders, send updates, improve our service, comply with law We share with: Shopify, Klaviyo (email), Xero (B2B), Crunch (accounting), payment processors, shipping companies Your rights: Access, delete, correct, port, object, unsubscribe Questions? sales@aartspace.com By using our Services, you acknowledge that you have read and understood this Privacy Policy. This privacy policy is written in plain English to help you understand how we handle your information. If you have questions, we're here to help: sales@aartspace.com