1.1 We respect the privacy of the visitors to our digital properties and the users of our products and services, and we are committed to protecting it through our compliance with this Notice. We process personal data when you provide it to us, when we collect it automatically, when it is generated by your use of our Services and when we receive it from other sources.

Pursuant to the EU General Data Protection Regulation (EU) 2016/679 ( "GDPR" ), personal data means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Personal data does not include data that has been effectively irreversibly anonymized or aggregated so that it can no longer enable us or others, whether in combination with other information or otherwise, to identify you.

“Processing” of personal data includes the collection, storage, analysis, accessing, sharing, transmitting and deletion of personal data.

Please note: When communicating with us by email or through forms on our Services, or when you publicly share content through our Services, we ask that you please do not send us any sensitive information pertaining to yourself or to others.

1.2 Direct Marketing

SHEIN sends direct marketing via e-mail, SMS, WhatsApp message and push notification. As required under the relevant laws, direct marketing is not sent to you unless you have given your prior consent.

This consent may be given by you via the website or app at account signup or at a later time through the use of the website or app.

You may withdraw your consent at any time, and SHEIN will take steps to ensure you no longer receive direct marketing via that channel. If you withdraw your consent for only one channel, you may continue to receive direct marketing via other channels, until you also withdraw consent for that channel.

Please be aware that there may be a brief delay before your marketing consent status is updated and that you may continue to receive direct marketing messages during that time.

To change your consent status for any of our Direct Marketing Channels, go to your account profile and you will find “Contact Preferences” under the “Other Services” sub-heading. There you can give or withdraw consent to each type of Direct Marketing.

To stop receiving Direct Marketing via email, you may also click “unsubscribe” at the bottom of any marketing email. Please note that some emails from SHEIN may not contain direct marketing and therefore may not contain an “unsubscribe” link.

To stop receiving Direct Marketing via SMS, you may also reply “STOP” to direct a marketing SMS. Please note that some emails from SHEIN may not contain direct marketing and therefore may not accept a STOP reply.

To stop receiving Direct Marketing via WhatsApp, you may also reply “STOP” to a direct marketing WhatsApp. Please note that some WhatsApps from SHEIN may not contain direct marketing and therefore may not accept a STOP reply.

If you choose not to consent to receiving Direct Marketing from SHEIN you may still receive service messages from us. These are essential messages giving you important information about your account and purchases.

A number of means are made available to customers to revoke their consent; via the preference centre on our website, by clicking on the unsubscribe link in marketing emails or by texting “STOP” in response to a direct marketing SMS or WhatsApp.

Message and data rates may apply to all messages sent to and from you. If you have any questions about your telephone package, it is best to contact your mobile operator.

When you provide an email, phone number or WhatsApp contact to us you should ensure that it is your own and that it is correct. Providing the contact details of another person, whether deliberately or inadvertently, may lead to your private account details being disclosed to the true owner of the contact details. In order to protect your account and to avoid inconvenience to third parties, we may be obliged to suspend your account if it appears that the contact details associated with it are not those of the account owner.

SHEIN may also contact you, either for direct marketing or for other purposes, via notifications from the app. You can make changes to how you receive these notifications via the settings on your smart device.

1.3 Product Reviews

When you buy a product from our service, we ask you to complete a review. This is to assist other users who may be considering buying the same product. Although we reward customers with points for posting reviews, whether you do so is entirely at your own discretion, and you may remove your reviews at any time.

You should be aware that your reviews will be accessible to all users of the site. If you post a photograph with the review, you should be aware that you or your surroundings may be recognisable from the photo.

If you post an image of a third party, including your children, you should first obtain their consent to do so. You should be aware that they may have the right to have the photo removed under EU law, including Data Protection law. If a third party asks you to remove a photo of them that you have posted, we recommend that you do so.

We may disclose and share your Personal Data with the parties as described below.

Please note that we may disclose, without restriction, aggregated or anonymized information about the users of our Services, which is information that does not identify any specific individual.

A cookie is a small text file that a website stores on your computer or mobile device when you visit the site.

First party cookies are cookies set by the website you’re visiting. Only that website can read them.

In addition, a website might potentially use external services, which also set their own cookies, known as third-party cookies.

Persistent cookies are cookies saved on your computer and that are not deleted automatically when you quit your browser.

Session cookies are deleted when you quit your browser.

Every time you visit our websites, you will be prompted to accept or refuse cookies. The purpose is to enable the site to remember your preferences (such as user name, language, etc.) for a certain period of time. That way, you don’t have to re-enter them when browsing around the site during the same visit.

Cookies can also be used to establish anonymised statistics about the browsing experience on our sites.

When you land on our website, you will be presented with a cookie management tool, which asks for your consent to deploy several types of cookies. You can use this tool to give or withdraw your consent to the use of these cookies. If you do not make a choice using the tool, the website will deploy only strictly necessary cookies (see below).

If you wish to change the preference you made via the cookie management tool, you should click on “manage cookies” at the bottom of the web page. This will recall the cookie management tool for you to make new choices.

Currently, there are five types of cookies that may be generated as you browse our site:

Strictly Necessary Cookies, Performance Cookies, Functional Cookies, Targeting Cookies and Social Media Cookies

You can delete all cookies that are already on your device using the settings in your browser. This will remove all cookies from all websites you have visited. Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).

Be aware though that you may also lose some saved information (e.g. saved login details, site preferences).

In addition to using the cookie management tool, you can set most modern browsers to prevent any cookies being placed on your device, but you may then have to manually adjust some preferences every time you visit a site/page, and some services and functionalities may not work properly at all (e.g. profile logging-in).

We may use third-party service providers to monitor and analyse the use of our Services. Presently, we use Google Analytics. Google Analytics is a web analytics service that tracks and reports Site traffic. For more information on the privacy practices of Google, please visit the Google Privacy & Terms web page: https://policies.google.com/privacy?hl=en. Google Analytics Opt-out Browser Add-on provides visitors with the ability to prevent their data from being collected and used by Google Analytics, available at: https://tools.google.com/dlpage/gaoptout

If Google Analytics is structured to collect personal data, the cookie banner on our Site will provide you the opportunity to consent to Google Analytics and the data controller will be Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. We have implemented Google Analytics with the “AnonymizeIP” function, which makes sure that your IP address will be shortened before it is sent to servers in the U.S. Exceptionally, the shortening may take place after such transfer to the U.S. Google uses this data to evaluate your use of our Services, to compile reports on activities on our online services and to provide us with other services related to Site, App and internet use.

We also use remarketing services to advertise on third-party websites to you after you visited our Services. For this purpose, visitors are grouped by certain actions on our Services, e.g., by the duration of a visit. This enables us to understand your preferences and to show you personalized advertising even if you are currently surfing on another website that also participates in the Google advertising network.

We use the following tools and services for these purposes: Google Ads remarketing service is provided by Google. You can opt-out of this by visiting the Google Ads Settings page: https://www.google.com/settings/ads .

If Google Ads is structured to collect personal data, the data controller will be Google Ireland Ltd., Gordon House, Barrow Street, Dublin 4, Ireland. .

Bing Ads is a service operated by Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland. Please read Microsoft’s privacy statement for more information on how Microsoft processes your information https://privacy.microsoft.com/en-US/ . When you access our Site via advertisements on Bing Ads, a cookie is set on your computer. In addition, a Universal Event Tracking tag is integrated on our Site. This is a code that, in combination with the cookie, stores data about the use of the Site, e.g. length of time spent on the Site, areas accessed, and ads used to reach the Site. In addition, Microsoft may track your usage patterns across multiple of your electronic devices through so-called cross-device tracking. The information collected is transferred to a Microsoft server in the United States. If Bing Ads is structured to collect personal data, the cookie banner on our Services will provide you the opportunity to consent to Bing Ads. .

Facebook Ads. Using Facebook Business Tools , we may show you interest-based ads when you use Facebook. To change your preferences or opt out of personalization for ads served by Facebook, you can visit Facebook Ads Preferences in addition to the Your Choices section below. We may also show ads to audiences who share similar characteristics to yours. To this end, a list of email addresses is irreversibly hashed encrypted and uploaded or transmitted from our site, and Facebook compares the hashed data with its users, generating a lookalike audience and deleting the uploaded list. We don't have access to the identity of anyone in the "lookalike" audience, unless they choose to click on one of our ads. .

We may also use Tracking Technologies to collect "clickstream" data, such as the domain name of the service providing you with Internet access, your device type, IP address used to connect your computer to the Internet, your browser type and version, operating system and platform, the average time spent on our Site, webpages viewed, content searched for, access times and other relevant statistics, and assign unique identifiers to the device or other credentials you use to access the Site for the same purposes.

Pages of our Site may also use Java scripts, which are code snippets embedded in various parts of websites and applications that facilitate a variety of operations including accelerating the refresh speed of certain functionality or monitoring usage of various online components; entity tags, which are HTTP code mechanisms that allow portions of websites to be stored or “cached” within your browser to accelerate website performance; and HTML5 local storage, which allows data from websites to be stored or “cached” within your browser to store and more quickly retrieve data in HTML5 pages when the website is revisited.

You may be able to adjust the settings of your device so that information about your physical location is not sent to us or third parties by (a) disabling location services within the device settings; or (b) denying certain websites or mobile applications permission to access location information by changing the relevant preferences and permissions in your mobile device or browser settings.

We maintain reasonable physical, electronic, and procedural safeguards designed to guard your personal data from unauthorized processing, use or disclosure. Our security measures include industry-standard physical, technical, and administrative measures to prevent unauthorized access to or disclosure of your information. We also require our service providers to provide privacy and security controls to protect data shared with them in order to perform services.

The Internet is not an absolutely secure environment, and we cannot guarantee that your personal data will be secure. We therefore strongly recommend that you use a unique, complex password to help us ensure the security of your account. We also strongly recommend that you do not share your password with others or re-use passwords on our Services that you use on other sites or apps, as doing so increases the likelihood of your being the victim of a credential stuffing attack or other malicious cyber behavior. If you feel that the security of your account or personal data has been compromised, please immediately contact us at our dedicated Privacy Center or as otherwise described in the "Contact Us" section below.

You have certain rights relating to processing of your personal data by us arising from Chapter 3 of the General Data Processing Regulation (“GDPR”). These rights include: .

You have the right to certain information relating to processing of your personal data by us. This Privacy Statement, along with other relevant publicly available documents, provides this information.

You have the right to obtain a copy of personal data which we may hold about you. You should note that we are bound to retain data for no longer than is necessary, and that certain data may therefore have been deleted by the time a request for access is made, in line with the retention practices outlined in this notice.

You have the right to have any inaccurate personal data corrected or updated.

You have the right to have your data deleted when it is no longer required by us for a lawful purpose, as outlined in this Notice. Where data still needs to be kept, e.g., for a legal obligation or for legitimate business purposes the Right to Erasure does not yet apply.

You have the right to have processing of data restricted;

You have the right to obtain a copy of certain personal data in a commonly used, machine readable format. This right is limited to data which;

We provide such personal data in Excel Spreadsheet format.

You have the right to object to the processing of your personal data which is done for the purposes of a legitimate interest or in the public interest or in exercise of official authority vested in us as data controller. Where you object, we must either demonstrate compelling legitimate grounds for the processing, or cease it.

You have the right to object to processing for direct marketing purposes. This right can be exercised by opting out of direct marketing using the means provided.

Where a decision is made based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, you will be notified of the outcome and given the opportunity to obtain human intervention by SHEIN, to express your point of view and to contest the decision.

To exercise your rights, you may make updates within your customer account on the Site or App, or you may contact us through our dedicated Privacy Center .

In some cases we may require additional information from you to help us identify the data you require. We may request that you provide additional information necessary to confirm your identity as the Data Subject, where there is a reasonable doubt in this regard. In the case of certain manifestly unfounded or excessive requests, we reserve the right to decline a request or to charge a reasonable administrative fee.

We will respond to your request within 30 days of receiving it, except for requests which by reason of their complexity or number may take up to three months to fulfil. In such cases we will notify you of any such delay within one month of receipt of the request, together with the reasons for the delay.

You should be aware that all of the above rights are subject to certain restrictions and limitations. Where such a restriction or limitation applies to one of your requests, we will notify you.

If you believe we have infringed or violated your privacy rights, please contact us at our dedicated Privacy Center so that we may attempt to resolve any issues to your satisfaction. You also have the right to lodge a complaint with your data protection authority (more details on data protection authorities and their contact info can be found at https://ec.europa.eu/info/law/law-topic/data-protection/reform/what-are-data-protection-authorities-dpas_en).

With respect to your personal data processed by a third party seller on our Site and App as an independent controller, to exercise your rights under the applicable law, you may contact the third party seller directly.

We will retain your personal Data, including any correspondence you have with us, only for as long as is necessary for the purposes set out in this Notice,including retaining Personal Data in order to comply with our legal obligations, to resolve disputes, for information security purposes, and to enforce our legal rights, terms, and policies.

Our App or Site may contain links to third-party sites. This Notice does not apply to those third-party sites. We recommend that you read the privacy statements of any other sites that you visit as we are not responsible for the privacy practices of those sites.

In order to use this site you must be at least 18 years old. SHEIN doesn’t sell products for purchase by children. We may sell children's products for purchase by adults. If you're under 18, you may use SHEIN only with the involvement of a parent or guardian.

If you are under 18, SHEIN may process some of your personal data:

Product reviews: A parent or other adult who buys an item for you may take a photo of you and post it as part of a review of that product. Parents are advised not to post photos where the child’s face is identifiable.

Children’s Profiles: A parent or other adult may add a profile for you to their own personal profile. This allows them to tell us what kinds of products they like to buy for you. We use this information to recommend other products to them which we think they might like to buy for you.

To create this profile, we need to know the approximate age of the child (i.e. what month and year the child was born in) and whether the child is a girl or a boy. We also ask the parent to affirm that they have the legal authority to post the information being provided. The parent or guardian will also be asked to create a nickname for the profile. To best protect the privacy interests of the child, you should not use the child’s name.

This profile will only be visible to the person who creates it.

SHEIN Customer Data for European customers is stored in Europe and largely processed in Europe. However, like all global online retailers, in order to serve customers all over the world, it is necessary for SHEIN to access data internationally.

When a customer makes a purchase from SHEIN or a SHEIN Marketplace seller, their order and shipping information needs to be provided to the warehouse in order for the order to be fulfilled. As many SHEIN products are shipped from China, this necessitates the transfer of this data to China. This type of data transfer is permitted under Data Protection Legislation as being necessary for the performance of SHEIN’s contract with the customer, and is subject to appropriate safeguards.

For other internal transfers of personal data among SHEIN affiliates, SHEIN has in place a Global Intra Group Data Transfer Agreement which includes the relevant Special Contractual Clauses as required under GDPR.

If you have questions or concerns regarding any information in this Privacy Policy, please contact us at our dedicated Privacy Center .

Our EU Data Protection Officer can be contacted via the email address below or via our postal address below in writing:

Data Protection Officer

Infinite Styles Services Co. Limited

1-2 Victoria Buildings,

Haddington Road,

Dublin 4,

Dublin,

D04 XN32,

Ireland,

Email: privacy@sheingroup.com