Privacy Policy

Effective Date: June, 2026

This Privacy Policy describes how Yotpo Ltd. (together with its affiliated companies Yotpo, we, our or us) collects, stores, uses, and discloses your personal data when you interact with us, including when you:

register for and/or use the Yotpo services, including the Yotpo eCommerce marketing platform, products and applications (collectively, Platform);
register for, apply to, join, or participate in Yotpo Sampling or any related testing, product review, survey, feedback, panel, focus group, content, or similar participant program operated by Yotpo alone or together with one or more merchants, brands, retailers, manufacturers, agencies, marketplaces, sponsors or other third parties (Brand Partners) (collectively, the Sampling Services); or
visit or interact with any of our linked websites (including but not limited towww.yotpo.com), participate in any of our events, contact or communicate with us, or interact with any of our online ads and content, emails, sales and marketing channels, integrations or communications under our control (Sites, and together with the Platform and Sampling Services the Services).

Please note, this Privacy Policy applies in situations in which Yotpo processes such personal data as a data controller. It doesnotapply to personal data we process in our role as a data processor on behalf of our Clients (as defined below), as further explained inSection 10below.

Specifically, this Privacy Policy describes our practices regarding:

Data Collection & Processing
Data Uses
Data Location
Data Retention
Data Disclosure
Cookies and Tracking Technologies
Communications
Data Security
Data Subject Rights
Data Controller/Processor
Additional Notice & Contact Details

Please read this Privacy Policy carefully and make sure that you fully understand and agree to it. If you are a Client (as that term is defined in theTerms of Service), please also review theTerms of Servicewhich governs your use of the Platform. If you participate in the Sampling Services, please review theYotpo Sampling Termsthat govern your participation in the Sampling Services.

You are not legally required to provide us with any personal data, and may do so (or avoid doing so) at your own free will.However, please keep in mind that without it, we may not be able to provide you with the full range of our Services or deliver the best user experience when interacting with them. If you prefer not to share your personal data, or to have it processed by us or any of our Service Providers (defined below), please refrain from providing it, visiting or interacting with us including visiting our Sites, or using our Services. You may also submit a request to exercise your rights as explained inSection9below.

1. Data Collection & Processing

We collect and generate the following types of personal data:

(i) Client Data: data relating to identified or identifiable individuals that we collect, process and manage on our Clients behalf, as part of the Platform or the Services. Such data relates to end-users who place purchases on, or otherwise interact with, our Clients online stores.

Yotpo processes Client Data on behalf of, and under the instruction of the respective Client in our capacity as a data processor, in accordancewith our Data Processing Addendumand other commercial agreements with such Client. For more information, please refer to Section 10 below.

Accordingly, this Privacy Policy, which describes Yotpos independent privacy and data processing practices as a data controller, does not apply to the processing of Client Data. If you have any questions or requests regarding Client Data, please contact the relevant Client directly.

(ii) User Data: personal data relating to our Clients Permitted Users and End Users (both as defined in the Terms of Service), including internal focal persons who directly engage with Yotpo concerning their organizational account, e.g., billing contacts and authorized signatories, and users of the Platform on behalf of such Clients, e.g., account administrators and users (together, Users).

We collect and generate the following types of personal data concerning our Users:

User account information: including email address and, when applicable, hashed password;
Profile and contact information: including name, title, team, company, email and phone number, and additional information submitted by a Client or a User;
Payment information:including payment method information (like credit or debit card number, bank account details, IBAN, SWIFT code), contractual and billing details, purchase history and payment preferences.
Platform usage information: includingconnectivity, technical and aggregated usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, locale and language settings used), activity logs, session recordings, and the cookies installed or utilized on their device; and
Direct interactions and communications with us: including recordings and transcripts of calls and emails with us, e.g. for user enablement, support, and training purposes.

(iii) Sampling Data: personal data relating to individuals who agree to theYotpo Sampling Termsand register for, apply to, or participate in the Sampling Services as testers, reviewers, panelists, creators, survey respondents, or other participants (Sampling Participants).

We collect and generate the following types of personal data concerning Sampling Participants:

Participant account information: including email address, username, and, when applicable, hashed password or similar credentials used to access the Services.
Profile, contact, and shipping information: including name, email address, phone number, mailing address, birthday or age range, gender, social media handles, household details, clothing sizes, and other information you choose to submit when creating an account or via campaign participation.
Survey and eligibility information: including screening responses, product preferences, demographic details, education, interests, hobbies, buying habits, product usage information, and other information we use to verify your profile, update your registration details, and assess your eligibility for surveys, panels, reviews, or other campaign opportunities.
Review, survey, and panel content: including ratings, reviews, survey answers, comments, testimonials, suggestions, questions, photos, videos, feedback, and opinions you submit through or in connection with the Sampling Services.
Campaign and fulfillment information: including campaign applications, invitations, selections, participation status, reimbursement status, gift card or points fulfillment details, and records relating to completion of campaign requirements.
Platform usage information: including connectivity, technical and aggregated usage data, such as user agent, IP addresses, device data (like type, OS, device ID, browser version, locale and language settings), activity logs, session information, general location inferred from IP address, and the cookies and similar technologies installed or utilized on the relevant device.
Social media and third-party platform information: if you connect with us or a campaign through social media or another third-party platform, or if a campaign asks you to post, tag, mention, or otherwise interact on such a platform, we may receive information made available to us through that interaction, subject to the settings and policies of the relevant platform.
Direct interactions and communications with us: including recordings and transcripts of your calls, emails, form submissions, support requests, chats, survey follow-up, and other communications with us concerning the Services.

(iv) Prospect Data: data relating to our Clients, visitors of our website, participants at our events, and any other prospective client who visits or otherwise interacts with any of our Services (Prospects).

We collect and generate the following types of personal data concerning Prospects:

Website usage information: including connectivity, technical and aggregated usage data, such as user agent, IP addresses, device data (like type, OS, device id, browser version, locale and language settings used), activity logs, session recordings, and the cookies and pixels installed or utilized on the relevant device;
Contact information: including name, contact and business details, our communications with such Prospects, as well as any needs, preferences, attributes, and insights relevant to our active or potential engagement;
Direct interactions and communications with us: including recordings and transcripts of your calls, emails, form submissions and interactions with us via our website chat feature, e.g. for support, feedback, training purposes, etc.

(v) Business Contact Data: contact, contractual and billing details concerning our service providers, suppliers or partners, or individuals who are employed by them, to the extent their personal data has been shared with us in our capacity as a data controller (e.g., for billing and invoicing purposes and when managing business relationships) (Business Contacts).

We collect and generate the following types of personal data concerning our Business Contacts:

Contact and profile information: including name, email address, phone number, company, position, country, and any expressed, presumed or identified needs, preferences, attributes and insights relevant to our engagement with you or your organization;
Financial and billing information: including contractual and billing details, billing address, payment method information (like credit or debit card number, bank account details, IBAN, SWIFT code), receipts (to the extent they contain any personal data), purchase history and payment preferences;
Direct interactions and communications with us: including recordings and transcripts of your phone and video conference calls, emails, form submissions and chats with us, letters and other correspondence (e.g., for training, record-keeping, and legal-related purposes).

We collect such data either automatically, through your interaction with us or with our Services, or through third party services, social media, analytics tools, events we organize or participate in, and other business initiatives.

For the purposes of the California Consumer Privacy Act (CCPA), specifically in the last twelve (12) months, we have collected the following categories of personal information: Identifiers; Commercial Information; Customer Record Information; Internet or other electronic network activity information; Geolocation Data; Audio, Electronic, or Similar Information; Characteristics of Protected Classifications under California or Federal Law (to the extent voluntarily provided through participation in the Sampling Services), and Inferences. We do not use or disclose sensitive personal information as defined in the CCPA.

2. Data Uses

We use personal data for the following purposes and in reliance on the lawful bases noted in the chart below:

User Data
Purpose	Legal basis for processing
To facilitate, operate, and provide our Services.	Legitimate Interest Performance of a Contract
To authenticate the identity of our Users and Sampling Participants, and to allow them to access our Services.	Legitimate Interest Performance of a Contract
To provide assistance and support.	Legitimate Interest Performance of a Contract
To evaluate, test and monitor our Services, diagnose or fix problems and bugs, as well as develop new features, technologies, and improvements to the Services.	Legitimate Interest
To gain a better understanding of how individuals use and interact with our Sites and Services, and how we can improve their and others user experience, and continue improving our products, offerings and the overall performance of our Services.	Consent (where applicable) Legitimate Interest
To verify and update Sampling Participant profiles, evaluate screening responses, determine eligibility for reviews, surveys, panels, or other campaigns, and match Sampling Participants to relevant opportunities.	Legitimate Interest Performance of a Contract
To publish, display, syndicate, distribute, or otherwise make available reviews, ratings, testimonials, photos, videos, survey summaries, and similar submissions collected via the Sampling Services, on our own Sites, or on Brand Partner websites, retailer sites, social media, or other channels.	Legitimate Interest Performance of a Contract
To facilitate and optimize our marketing campaigns, ad management and sales operations, and to manage and deliver advertisements for our products and services more effectively, including on other websites and applications. Such activities allow us to highlight the benefits of using our Services, and thereby increase engagement and overall satisfaction with our Services. This includes contextual, behavioral and interests-based advertising based on activity, preferences or other data available to us or to our business partners.	Consent (where applicable) Legitimate Interest
To explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences.	Legitimate Interest Performance of a Contract
To contact you with general or personalized service-related messages, as well as promotional messages that may be of specific interest to them.	Consent (where applicable) Legitimate Interest
To facilitate, sponsor and offer certain events, contests and promotions.	Legitimate Interest Consent
To publish your feedback and submissions to our Sites, public forums and blogs.	Legitimate Interest Consent
To support and enhance our data security measures, including for the purposes of preventing and mitigating the risks of fraud, error or any illegal or prohibited activity.	Legitimate Interest Performance of a Contract
To create aggregated data, inferred non-personal data or anonymized or pseudonymized data (de-identified data), which we or our business partners may use to provide and improve our respective services, conduct research, or for any other purpose.	Legitimate Interest Performance of a Contract
To enforce our agreements, resolve disputes, and protect our business interests and the interests and rights of third parties.	Legitimate Interest
To comply with court orders and warrants, prevent misuse of the Services, and take any action in any related legal dispute and proceeding.	Legitimate Interest Legal obligations
To comply with applicable laws and regulations.	Legitimate Interest Legal obligations

If you reside in or are using the Services in a territory governed by privacy laws under which Consent is the only or most appropriate lawful basis for the processing of personal data (in general, or specifically with respect to the types of personal data you expect or elect to submit or have processed via the Services), your acceptance of this Privacy Policy will be deemed your consent to the processing of your personal data for all purposes detailed in this Privacy Policy, unless applicable law requires a different form of consent. If you wish to revoke such consent, please contact us atprivacy@yotpo.com.

3. Data Location

We and our authorized Service Providers (defined below) maintain, store and process personal data in the United States of America, Israel, the United Kingdom, European Union, Australia, the Philippines, and other locations, as reasonably necessary for the proper performance and delivery of our Services, or as may be required by law.

While privacy laws may vary between jurisdictions, Yotpo is committed to protecting personal data in accordance with this Privacy Policy and customary industry standards, and such appropriate lawful mechanisms and contractual terms requiring adequate data protection, regardless of any lesser legal requirements that may apply in the jurisdiction to which such data is transferred.

Yotpo Ltd. is headquartered in Israel, and Yotpo UK Limited is established in the UK. Both jurisdictions are considered by the European Commission, the Swiss Federal Data Protection and Information Commissioner (FDPIC), and the UK Secretary of State to offer an adequate level of protection for the personal data of residents of the EEA, Switzerland and the UK, respectively. We transfer personal data from the EEA, Switzerland and the UK to Israel on this basis. For data transfers from the EU, Switzerland or the UK to countries which are not considered to offer an adequate level of data protection, we and the relevant data exporters and importers have entered into Standard Contractual Clauses as approved by the European Commission, FDPIC and the UK Information Commissioners Office (ICO). You can request a copy of the applicable SCCs by contacting us as indicated inSection 11below.

Yotpo Inc. complies with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF) as set forth by the U.S. Department of Commerce and will be further liable in cases of onward transfers of your personal data to third parties (including our Service Providers).

Yotpo Inc. has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework Principles (EU-U.S. DPF Principles) with regard to the processing of personal data received from the European Union in reliance on the EU-U.S. DPF, and from the United Kingdom (and Gibraltar) in reliance on the UK Extension to the EU-U.S. DPF.

Yotpo Inc. has certified to the U.S. Department of Commerce that it adheres to the Swiss-U.S. Data Privacy Framework Principles (Swiss-U.S. DPF Principles) with regard to the processing of personal data received from Switzerland in reliance on the Swiss-U.S. DPF.

If there is any conflict between the terms in this policy and the EU-U.S. DPF Principles and/or the Swiss-U.S. DPF Principles, the Principles shall govern for personal data transferred under the DPF. To learn more about the Data Privacy Framework (DPF) program, and to view our certification, please visit https://www.dataprivacyframework.gov/

4. Data Retention

We retain your personal data for as long as it is reasonably necessary to maintain and expand our relationship and provide you with our Services and offerings; to comply with our legal and contractual obligations; or to protect ourselves from any potential disputes (e.g., as required by laws applicable to log-keeping, records and bookkeeping, and in order to have proof and evidence concerning our relationship, should any legal issues arise), all in accordance with our data retention policy. Please note that except as required by applicable law or our specific agreements with you, we will not be obligated to retain your personal data for any particular period, and we are free to securely delete it or restrict access to it for any reason and at any time, with or without notice to you.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorized use or disclosure of your personal data, the purposes for which we process your personal data and the applicable legal requirements.

If you have any questions about our data retention policy, please contact us by email atprivacy@yotpo.com.

5. Data Disclosure

We may disclose your personal data to certain third parties and other recipients in accordance with this Privacy Policy and as described below:

Legal Compliance: In exceptional circumstances, we may disclose or allow government and law enforcement officials access to your personal data, in response to a subpoena, search warrant or court order (or similar requirement), or in compliance with applicable laws and regulations. Such disclosure or access may occur if we believe in good faith that: (a) we are legally compelled to do so; (b) disclosure is appropriate in connection with efforts to investigate, prevent, or take action regarding actual or suspected illegal activity, fraud, or other wrongdoing; or (c) such disclosure is required to protect our legitimate business interests, including the security or integrity of our products and services.
Service Providers: We engage selected third party companies and individuals to perform services complementary to our own. Such service providers include hosting and server co-location services, communications and content delivery networks (CDNs), data and cyber security services, billing and payment processing services, fraud detection and prevention services, web and mobile analytics, data enrichment, email and/or SMS distribution and monitoring services, call, session or activity recording and analysis services, remote access services, performance measurement, data optimization and marketing services, social and advertising networks, content providers, email, voicemails, support and customer relationship management systems, website chat services, and our legal, financial and compliance advisors (collectively, Service Providers). These Service Providers may have access to your personal data, depending on each of their specific roles and purposes in facilitating and enhancing our Services, and may only use such data for such limited purposes as determined in our agreements with them.
Partnerships: We engage selected business and channel partners, resellers, distributors and providers (collectively, Partners)of professional services related to our Services, which allow us to explore and pursue growth opportunities by facilitating a stronger local presence and tailored experiences for you. In such circumstances, we maydiscloserelevant contact, business and usage details with the respective Partner, to allow them to engage with you for such purposes. If you directly engage with any of our Partners, please note that any aspect of that engagement which is not directly related to the Services and directed by Yotpo is beyond the scope of Yotpos Terms and Privacy Policy, and may therefore be governed by the partners terms and privacy policy.
Event Sponsors:If you attend an event or webinar organized by us, or download or access an asset on our Sites related to such an event, webinar or other activity involving third party sponsors or presenters, we maydiscloseyour personal data to them. If required by applicable law, you may consent to suchdisclosurevia the registration form or by allowing your attendee badge to be scanned at a sponsor booth. In these circumstances, your personal data will be subject to the sponsors privacy statements. If you do not wish your personal data to bedisclosed, you may choose to not opt-in via event/webinar registration or elect to not have your badge scanned, or you can opt out in accordance withSection9below.
Brand Partners: If you register to or participate in the Sampling Services, and apply for a campaign offered as part of the Sampling Services, we may disclose relevant personal data to our network of participating Brand Partners, such as profile or screening details, mailing and delivery information, campaign participation status, reimbursement or incentive information, and your reviews, ratings, survey responses, opinions, photos, videos, and similar submissions. Brand Partners will act as independent businesses and will process such personal data for their internal business purposes (such as campaign fulfillment, product evaluation, and marketing), in accordance with their own privacy notices. We disclose such information to Brand Partners in connection with your participation in the Sampling Services. Reviews, ratings, testimonials, photos, videos, or other submissions made via the Sampling Services may be made publicly available on the Services, on a Brand Partner website, on a retailer website, on social media, or in other channels related to applicable campaigns or our business.
Sharing your Feedback or Recommendations: If you submit a public review or feedback, note that we may (at our discretion) store and present your review on our sites and in our Services. If you wish to remove your public review, please contact us atprivacy@yotpo.com.
Clients and other Users: Our Clients have access to any personal data we process on their behalf in our capacity as a data processor or a service provider, as well as to personal data relating to their Users, as it relates to use of our Services. Client administrator(s) or other users of the same account may access User Data on behalf of the Client, and will be able to monitor, process and analyze the personal data contained therein. This includes situations in which you may contact us for help in resolving an issue specific to a team of which you are a member (and which is managed by the same Client).
Protecting Rights and Safety: We may disclose personal data with others if we believe in good faith that this will help protect the rights, property, or personal safety of Yotpo, you, or any members of the general public.
YotpoSubsidiaries and Affiliated Companies: We may disclose personal data internally within our group of companies, for the purposes described in this Privacy Policy. In addition, should Yotpo or any of its subsidiaries or affiliates undergo any change in control or ownership, including by means of merger, acquisition or purchase of substantially all or part of its assets, personal data may be disclosed or transferred to the parties involved in such an event. If we believe that such a change in control might materially affect your personal data then stored with us, we will notify you of this event and the choices you may have via email or a prominent notice on our Services.

For the avoidance of doubt, we may disclose your data in additional situations, pursuant to your explicit approval, if we are legally obligated to do so, or if we have successfully rendered such data non-personal, non-identifiable and anonymous. We may transfer, disclose or otherwise use non-personal and non-identifiable data at our sole discretion and without the need for further approval.

For the purpose of the CCPA, in the last 12 months, we have disclosed Identifiers; Internet or other electronic network activity information; Geolocation Data; Commercial Information; Customer Record Information; Audio, Electronic or Similar Information; and Inferences to the third parties listed above.

6. Cookies and Tracking Technologies

We and our Service Providers use cookies, pixels, tags and other technologies to provide and monitor our Services and Sites, to ensure that they perform properly, to analyze our performance and marketing activities, and to personalize your experience. Such cookies and similar files or tags may also be temporarily placed on your device. Certain cookies and other technologies serve to recall personal data, such as an IP address, as indicated by you. To learn more about our practices concerning cookies and tracking, please see ourCookie Policy. You may also use the Cookie Settings feature available in our footer depending on your location and activity on our Services, as applicable.

While we do not change our practices in response to a Do Not Track signal in the HTTP header from a browser or mobile application, you can manage your cookie preferences, including whether or not to accept them and how to remove them, through your browser settings. Please bear in mind that disabling cookies may complicate or even prevent you from using the Services.

We also use the web analytics tool Google Analytics. This tool helps us understand users behavior on our Services, including by tracking page content, and click/touch, movements, scrolls and keystroke activities. Further information about the privacy practices of our analytics service provider is available at: www.google.com/policies/privacy/partners. Further information about your option to opt-out of this analytics service is available at:https://tools.google.com/dlpage/gaoptout.

Please note that if you get a new computer, install a new browser, erase or otherwise alter your browsers cookie file (including upgrading certain browsers), you may also clear the opt-out cookies installed once you opt out, so an additional opt-out will be necessary to prevent additional tracking.

7. Communications

We engage in service and promotional communications, through email, phone, SMS and notifications.

Service Communications: We may contact you with information regarding our Services. For example, we may send you notifications (through any means available to us) of changes or updates to our Services or legal terms, billing issues, log-in attempts or password reset notices, etc. Please note that you will not be able to opt out of receiving certain service communications which are integral to your use (like password resets or billing notices).

Promotional Communications: We may also notify you about new features, additional offerings, events, special opportunities or any other information of a promotional nature we think you will find valuable. We may provide such notices through any of the contact means available to us (e.g. phone, mobile or email), through the Services, or through our marketing campaigns on any other sites or platforms.

You can typically control your communications and notifications settings from your Yotpo user profile settings, or otherwise in accordance with the instructions included in the communications sent to you. If you do not wish to receive promotional communications, you may notify us at any time by sending an email to:privacy@yotpo.com, changing your communications preferences in your user profile settings,or by following the unsubscribe, stop, opt-out or change email preferences instructions contained in the promotional communications you receive.

8. Data Security

To protect your personal data held with us, we use industry-standard physical, procedural and technical security measures, including encryption as appropriate. However, please be aware that regardless of any security measures used, we cannot and do not guarantee the absolute protection and security of any personal data stored with us or with any third parties as described inSection 5above. To learn more, please visit ourSecurity page.

9. Data Subject Rights

Individuals have rights concerning their personal data under applicable law, including the EU or UK General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Such rights may include, to the extent applicableto you according to the laws that apply to you, the right:(i) to know/request access to personal data (specific pieces of personal data collected; categories of personal data collected; categories of sources from whom the personal data was collected; purpose of collecting personal data; categories of third parties to whom we have disclosed personal data), (ii) to request rectification or erasure of personal data held with Yotpo, (iii) to restrict or object to such personal datas processing (including the right to direct us not to sell your personal data for targeted advertising), (iv) to port such personal data, or (v) to equal services and prices. To exercise any of these rights you may have, please contact us by email at:privacy@yotpo.com.You may also have the right to lodge a complaint with your local data protection authority.

To the extent applicable to you, you may also designate an authorized agent, in writing or through a power of attorney, to request to exercise your privacy rights on your behalf. The authorized agent may submit a request to exercise these rights by emailing us.

Please note that when you ask us to exercise any of your rights under this policy or applicable law, we may need to ask you to provide certain credentials to make sure that you are who you claim you are (to avoid disclosure to you of personal data related to others) and to provide further information to better understand the nature and scope of data for which you request access. Such additional data will be then retained by us for legal purposes (e.g. as proof of the identity of the person submitting the request, or proof of request fulfillment).

We may redact from the data that we will make available to you, any personal data or confidential information related to others.

In compliance with the EU-U.S. DPF, and the UK Extension of the EU-U.S. DPF and the Swiss-U.S. DPF Principles, Yotpo Inc. commits to resolve complaints about our collection or use of your personal data. EEA, UK and Swiss individuals with inquiries or complaints regarding our Data Privacy Framework compliance should submit inquiries todpo@yotpo.com. If you do not receive timely acknowledgment of your DPF Principles-related complaint from us, or if we have not addressed your DPF Principles-related complaint to your satisfaction, Yotpo Inc. has further committed to cooperate with EU Data Protection Authorities (DPAs), the UK Information Commissioners Office (UK ICO), and the Swiss Federal Data Protection and Information Commissioner (FDPIC) to independently address complaints that we have been unable to resolve.

Please note that under certain conditions (as described under the DPF Principles Yotpo adheres to) you can invoke a binding arbitration by delivering a notice to Yotpo Inc. viadpo@yotpo.com. Please also note that Yotpo Inc. is subject to the investigatory and enforcement powers of the Federal Trade Commission (FTC).

10. Data Controller/Processor

Certain data protection laws and regulations, such as the EU GDPR, UK GDPR or the CCPA, typically distinguish between two main roles for parties processing personal data: the data controller (or under the CCPA, business), who determines the purposes and means of processing; and the data processor (or under the CCPA, service provider), who processes the data on behalf of the data controller (or business). Below we explain how these roles apply to our Services, to the extent such laws and regulations apply.

Yotpo is the data controller of Yotpo Prospect Data, User Data, Sampling Data, and Business Contact Data. With respect to such data, we assume the responsibilities of data controller (solely to the extent applicable under law) as set forth in this Privacy Policy. In such situations, our Service Providers processing such data will assume the role of data processor.

Yotpo is the data processor of Client Data, which we process on behalf of our Client (who is the data controller of such data) and in accordance with its reasonable instructions, subject to our Terms, our Data Processing Addendum (to the extent applicable) and other commercial agreements with such Client. Our Service Providers, who process such Client Data on our behalf, are the sub-processors of such data.

Our Clients are solely responsible for determining whether and how they wish to use our Services, and for ensuring that all individuals using the Services on their behalf or at their request, as well as all individuals whose personal data may be included in Client Data processed through the Services, have been provided with adequate notice and given informed consent to the processing of their personal data, where such consent is necessary or advised, and that all legal requirements applicable to the collection, use or other processing of data through our Services are fully met by the Client. Our Clients are also responsible for handling data subject rights requests under applicable law.

If you would like to make any requests or queries regarding personal data we process as a data processor on our Clients behalf, including accessing, correcting or deleting your data, please contact the Client directly.

11. Additional Notices

Updates and Amendments: We may update and amend this Privacy Policy from time to time by posting an amended version on our Services. The amended version will be effective as of the date it is published. We will provide prior notice if we believe any substantial changes are involved via any of the communication means available to us or via the Services. After such notice period, all amendments shall be deemed accepted by you.

Opt out of Sale/Sharing for Targeted Advertising

Under some US data protection laws, like the CCPA, our disclosure of certain internet activity and device information with third parties through cookies may be considered a sale or sharing of personal information for targeted advertising. We do so in pursuit of the business and commercial purposes described in Section 2 above.

For the purposes of the CCPA, in the last 12 months we have sold or shared Internet or Other Electronic Network Activity Information, Geolocation Data, and Commercial Information with our analytics and advertising partners and service providers.

You may opt out of all cookies that may result in a sale and/or sharing of your personal information in the following ways:

Click the Do not sell or share my personal data button in the cookie banner (depending on your location), or in the cookie settings link on the website footer, then click the Save settings button.
Set theGlobal Privacy Control(GPC) for each participating browser system that you use to opt out of the use of third party Advertisement Analytics or other cookies (instructions on how to download and use GPC are available here).

Sampling Data

If you register for or participate in the Sampling Services, our disclosure of certain personal information to our network of Brand Partners may be considered a “sale” and/or sharing of personal information under the CCPA. We do so in pursuit of the business and commercial purposes described in Section 2 above.

For the purposes of the CCPA, in the last 12 months we have “sold” and/or shared Identifiers, Customer Record Information, Commercial Information, and Inferences to our Brand Partners in connection with the Sampling Services.

You may opt out of the “sale” of your Sampling Data by submitting a request by emailing us at privacy@yotpo.com with the subject line “Opt-Out of Sampling Services Sale/Sharing. Please note that as a core functionality of the Sampling Services requires sharing your profile and eligibility data with our Brand Partners, if you opt out, we may be unable to continue providing you with access to the Sampling Services or future campaign opportunities.

If you have any questions or would like to exercise your rights under the CCPA, you can contactprivacy@yotpo.com.

Sampling Services

External Links: While our Services may contain links to other websites or services, we are not responsible for their privacy practices. We encourage you to pay attention when you leave our Services for the website or application of such third parties, and to read the privacy policies of each website and service you visit. This Privacy Policy applies only to our Services.

Third-Party Platforms: Please note that certain campaigns offered as part of the Sampling Services (including initial campaign advertisements and sign-up links) may involve third-party websites, retailers, marketplaces, social media services, review platforms, survey tools, payment providers, shipping providers, or other third-party products or services. Your use of and interaction with any such third-party platform is governed by that third partys terms and policies, not this Privacy Policy, and we are not responsible for their content, functionality, security, availability, or independent data practices.

Our Services are not designed to attract children: Our Services are not designed to attract children who are underage according to data protection laws in their respective jurisdictions. We do not knowingly or intentionally collect personal data from such underage children and do not wish to do so, and we request that anyone underage refrains from providing their personal data to us. If you believe that we might have any such data, please contact us atprivacy@yotpo.com. If we are made aware that a person who is underage according to the law applicable to them is using the Services, we will attempt to prohibit and block such use and will make all necessary efforts to delete any personal data stored with us with regard to that child, except where retention is required for legal purposes. For the purposes of the CCPA, Yotpo does not knowingly sell or share the personal information of individuals under the age of 16.

Data Protection Officer: Yotpo has appointed PrivacyTeam Ltd. as our Data Protection Officer, for monitoring and advising on Yotpos ongoing privacy compliance and serving as a point of contact on privacy matters for data subjects and supervisory authorities. If you have any comments or questions regarding our Privacy Policy, if you have any concerns regarding your Privacy or if you wish to make a complaint about how your personal data is processed by Yotpo, you can contactprivacy@yotpo.comordpo@yotpo.com.

EU Representative: SMSBump Ltd., a Yotpo company situated in Bulgaria, has been designated as Yotpos representative in the European Union for data protection matters pursuant to Article 27 of the GDPR. SMSBump may be contacted on matters related to the processing of personal data of individuals in the EU. To make such an inquiry, please send an email toprivacy@yotpo.com.

UK Representative: Yotpo UK Limited has been designated as Yotpos representative in the United Kingdom for data protection matters pursuant to Article 27 of the UK GDPR. Yotpo UK may be contacted only on matters related to the processing of personal data of individuals in the UK. To make such an inquiry, please send an email toprivacy@yotpo.com.

Database Controller: For the purposes of Israels Protection of Privacy Law, Yotpo Ltd. serves as the Database Controller for personal data processed in connection with this Privacy Policy that originates from Israel, and can be contacted atprivacy@yotpo.com.

Questions, concerns or complaints: If you have any comments or questions regarding our Privacy Policy, or if you have any concerns regarding your personal data held with us, please contact us at:privacy@yotpo.com.