Privacy Statement

Personal information collection, use and disclosure occurs with consent or as permitted by law. Consent form depends on circumstances and information sensitivity. Consent may be expressed or implied based on context and sensitivity level.

Some personal information is provided directly when creating MiniFriend Rewards accounts, subscribing to marketing, contacting the company, or purchasing products. You may decline providing certain information, though this may limit service availability. Other information is collected automatically during site visits or service interactions. Information may also be obtained from third-party providers.

Consent is typically sought at collection time. For new purposes not previously identified, consent will be requested before use. You may withdraw consent to collection, use or disclosure anytime by contacting the company using provided contact information. Identity proof may be required before implementing withdrawal. In some cases, withdrawal may prevent service provision.

When interacting with Miniso in stores or online, personal information is collected in various ways. Not all categories apply to every individual.

Products and Services

For product and service users, information may be collected through purchase, exchange, return, event participation, or rewards account registration. This may include:

• Name, phone number, email address, age, gender, shipping address, postal address, contact information
• Username, password, authentication and security credentials
• Credit card information, debit card information, payment information, delivery information
• In-store video monitoring video and images
• Log data and usage information relating to product and service use

Website

For visitors to miniso-ca.com and related websites, information may be collected from activities and interactions, including:

• Technical and device information about website use
• Internet protocol (IP) address, browsing history, search history, device, browser and operating system information, location, time zone setting, visit date and time
• "Cookies" — small data files transferred to computers that record preferences, access frequency, registration information, and page view frequency

Other Interactions

For individuals interacting in-person, by phone, email, social media, or otherwise (including prospective customers, newsletter subscribers, or survey respondents), collected information may include name, email address and contact information.

We collect Device Information using:

• "Cookies" — data files placed on devices containing anonymous unique identifiers
• "Log files" — tracking actions on the Site, collecting IP address, browser type, Internet service provider, referring/exit pages, date/time stamps
• "Web beacons", "tags", and "pixels" — electronic files recording browsing information

Personal information may be used for purposes such as:

• Providing products and services and supporting their use
• Improving experience with products and services
• Providing access and maintaining MiniFriend Rewards loyalty program
• Personalizing experience by monitoring, analyzing and auditing Site interactions
• Improving shopping experience through personalized recommendations, targeted advertising and content
• Contacting regarding products and services
• Monitoring, fixing and improving products and services
• Developing new products and services
• Analyzing needs and activities to better serve customers
• Conducting business, product and service research and analysis
• Responding to inquiries and customer service requests
• Collecting opinions and comments regarding products and services
• Providing information about promotional offers, products and services that may be of interest
• Investigating legal claims and complying with applicable laws

Personal information is used for purposes with obtained consent and other purposes permitted or required by applicable law. The company does not use collected information for third-party product and service advertising and does not sell collected information.

Third-party service providers perform various services including e-commerce, shipping, payment processing, technical support, hosting, data storage, marketing, advertising, research, analytics and site/product/service improvement.

When providing information to third-party service providers, the company requires they maintain confidentiality and security. They are also required to use information only for limited purposes provided. When service providers no longer need information, the company requires they dispose of it. In some circumstances, service providers may retain aggregated, anonymized or statistical information.

Personal information may be shared with Miniso affiliated companies and subsidiaries for outlined purposes. Additionally, information may be used and disclosed when believed permitted, necessary or appropriate: (a) under applicable laws; (b) to comply with legal process; (c) to respond to public and government authority requests; (d) to enforce product and service agreement terms; (e) to protect company operations or those of affiliates; (f) to protect company rights, privacy, safety or property; (g) sharing with Miniso-controlled affiliates and subsidiaries outside Canada (such as China) for lawful purposes; (h) sharing with third-party service providers employed to perform functions; or (i) to pursue available remedies or limit potential damages.

Products are introduced through email and SMS advertising. Personal information may be used to provide targeted and personalized advertisements on the Site. To opt out of marketing-related communications, click the "unsubscribe" link at any email bottom, opt-out of SMS by texting STOP to the SMS number used, or exit the WhatsApp group.

You can opt out of certain targeted advertising using these links:

• Facebook
• Google
• Instagram
• TikTok
• Bing

Miniso's website recognizes browser privacy settings including DNT and Global Privacy Controls. The company will endeavor to respond to opt-out requests promptly, taking at least ten (10) business days.

Personal information is used, disclosed or retained only as long as necessary to fulfill collection purposes and as permitted or required by law. Information is kept for providing Miniso Services and fulfilling requirements, or for other legitimate purposes such as legal obligation compliance, dispute resolution, and valid agreement enforcement. Actual retention periods vary by personal information category.

Physical, organizational, contractual and technological security measures have been implemented to protect personal information from loss, theft, unauthorized access, disclosure, copying, use or modification. Secure processing measures include Secure Socket Layer (SSL) encryption when transmitting sensitive personal information (such as payment information) over the Internet. The company currently holds certification to ISO/IEC 27001:2013 and ISO/IEC 27701:2019.

Despite outlined measures, no information transmission or storage method is 100% secure or error-free, so absolute security cannot be guaranteed. If you believe your interactions are no longer secure, please contact the company immediately.

Steps are taken to ensure personal information is kept as accurate, complete and up-to-date as reasonably necessary. You may make written requests to access, update, correct or delete any collected personal information, or challenge its accuracy or completeness. If you successfully demonstrate information is inaccurate or incomplete, the company will amend it as required.

Personal information may be stored and processed in any country with company facilities or third-party service providers, including China, Singapore and USA with cloud-based storage. As a result, information may be transferred to countries outside your residence country, which may have different data protection rules. If you do not want information transferred to, processed, accessed, or maintained outside Canada, contact the company immediately to delete information or refrain from service access or use.

This Privacy Statement applies only to company products and services. It does not extend to third-party websites or products or services. The company does not assume responsibility for third-party privacy practices and encourages reviewing all third-party privacy policies prior to using their websites or products or services.

The company does not intend websites or online services for use by anyone under age 14 and does not knowingly collect personal information from individuals under 14. Parents or guardians with privacy practice questions should contact the company. At any time, parents or guardians can request stopping use, collection and disclosure of their children's personal information as well as deleting collected information.

This Privacy Statement is current as of the "updated" date at the page top. The company may modify this Privacy Statement periodically. When changes are made, they become immediately effective when published in a revised Statement on the website unless otherwise noted. By continuing to submit personal information or use services after publishing or communicating change notices, you consent to information collection, use and disclosure as set out in the revised Privacy Statement.

All comments, questions, concerns or complaints regarding personal information or privacy practices should be sent to our Privacy Officer:

Attention: Privacy Officer
Address: 5775 Yonge Street, Suite 520, Toronto, ON, M2M 4J1
By e-mail: legal@miniso.ca