Privacy Policy

Last updated and effective as of: 22^nd September 2020

Funko, LLC and its subsidiaries (“Funko,” “we,” “our,” or “us”) are committed to providing a fun, entertaining, and safe experience for our customers. This Privacy Policy (“Privacy Policy”) describes how we collect, use, disclose and otherwise process personal information in connection with the Funko.com website, the Funko mobile application and the following product specific websites managed by Funko: www.funko.com, www.funko -shop.com, www.shop.funko.com , www.funkoeurope.com and www.loungefly.com (collectively the “Sites”). This Privacy Policy applies whether you access the Sites through a personal computer, mobile device, or any other means. This Privacy Policy is not, however, a contract and does not create any legal rights or obligations.

Some websites, such as fan operated sites like www.funkofanatics.com, and stores, such as online and physical resellers of our products, use our name or our products in connection with their services, but are not controlled by us. This Privacy Policy does not apply to these separately operated websites and stores, and Funko is not responsible for the privacy practices of these third parties.

Please read this Privacy Policy and our Terms & Conditions (“Terms”) carefully. We will update this Privacy Policy from time to time. When we make changes to this Privacy Policy, we will change the date at the beginning of this Privacy Policy. If we make material changes to this Privacy Policy, we will take appropriate measures to notify you of these changes, such as by prominent posting to our Sites.

REGION-SPECIFIC DISCLOSURES

California: If you are a California resident, please refer to the Privacy Disclosures for California Residents section of this Privacy Policy for additional California-specific privacy disclosures.
Nevada: Chapter 603A of the Nevada Revised Statutes permits a Nevada resident to opt out of future sales of certain covered information that a website operator has collected or will collect about the resident. To submit such a request, please contact us at [email protected].
European Economic Area, United Kingdom or Switzerland: If you are located in the European Economic Area (“EEA”), United Kingdom or Switzerland, or otherwise engage with Funko’s European operations, please see the Privacy Disclosures for the European Economic Area, United Kingdom and Switzerland section of this Privacy Policy for additional European-specific privacy disclosures, including what constitutes your personal information, the lawful bases we rely on to process your personal information, how we use cookies when you access our Sites from the EEA, UK or Switzerland and your rights in respect of your personal information.

Note for Non US Vistors: Personal information may be transferred to, stored and processed in a country other than the one in which it was collected. For example, the Sites are primarily hosted in and provided from the United States. Please note the country to which personal data is transferred may not provide the same level of protection for personal information as the country from which it was transferred.

WHAT IS PERSONAL INFORMATION?

Other than as set out in the Region Specific Disclosures, for the purposes of this Privacy Policy,

“personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual. It does not include information that is deidentified or aggregated such that it is not reasonably capable of being associated with you. This Privacy Policy does not restrict or limit our collection and use of aggregated or deidentified information, and we reserve the right to share such information with potential partners or other third parties without restriction.

PERSONAL INFORMATION WE COLLECT

Personal Information You Give Us: We collect personal information that you provide to us on our Sites, such as when you:

provide your email address to sign up for one of our newsletters (“Newsletters”),
provide your contact information and submission in a survey, sweepstakes, contest, or other promotion,
provide your name, email address and password to create a user account for the Sites (“Account”),

update your Account profile to include your birthday, mobile number, fax number or address,
change your Account currency or notification preferences,
add our products to your online collection or wishlist,
provide us information about your interests, how to contact you and your feedback when you sign up for the Funko Fan Club,
provide your email address, company, shipping address, billing address, phone number and payment information to purchase our products, content, subscriptions (“Subscription”) or services, or
provide us your name, email address, image and custom message in connection with a request, inquiry or comment.

You can choose not to provide us personal information, but you may not be able to access or use portions of the Sites or some of their features as a result.

Purchase and Payment Information: If you purchase any of our products, content or services via the Sites, we may ask you to provide your cardholder name, billing address, credit card number, expiration date, authentication code, check routing number, account number or related information to complete the purchase. Products may be purchased only by persons over the age of 18. The areas of the Sites where you can make purchases are run by our third-party payment processors that accept credit cards and electronic check payments for our customers’ transactions. Our primary payment processors are CyberSource and Authorize.net, payment gateways that processes personal information in accordance with the Payment Card Industry Data Security Standards (“PCI DSS”), which is the bankcard industry’s most stringent security standard. Any information you provide on or through the purchase areas of our Sites are subject to CyberSource’s and Authorize.net’s privacy policy, unless you choose to utilize one of our other identified third-party payment processors (such as PayPal or Amazon Pay).

Personal Information We Collect Automatically: We and our third-party providers automatically collect certain types of personal information when you visit the Sites, including the name of the domain and host from which you access the Internet; the IP address of the computer you are using and the browser and operating system you are using; the date and time you access the Sites; the Internet address of the website from which you linked to the Sites; any search terms you used to find the Sites; your device identifiers and mobile and network information; your general geographic location based on your IP address or more precise location when accessing our Sites through a mobile device; and your actions on the Sites. For more information about these practices, and any choices you may have in relation to its collection, please refer to the Cookies section of this Privacy Policy.

From Third Parties: We may also collect personal information from third parties in order to enhance your experience on our Sites, operate our business, and provide our products and services to you. For example, we may collect personal information from our service providers, such as payment processors, point-of-sale providers, and e-commerce platforms, in order to fulfill your purchases with us. If you choose to interact with us on social media, we may collect personal information about you from your social media account that you make public or share with us, in order to communicate with you and better understand your interests and our services. We may also collect personal information from publicly available sources to supplement the personal information we maintain in our systems.

OUR USE OF PERSONAL INFORMATION

We use personal information we collect to:

Create and maintain your Account or Subscriptions with us;
Facilitate the Funko Fan Club;
Process, fulfill, and ship any Subscription(s), or other products, content or services you purchase or request;
Perform research and analysis about your use of, or interest in, our products, services, Sites or other content;
Communicate with you by email, regular mail, telephone or mobile device about products or services that may be of interest to you either from us or from other third parties;
Develop and deliver our Newsletter to you;
Tailor your user experience;
Develop and display third-party content and advertising tailored to your interests on the Sites;
Develop new and improve existing Sites, products, content and services;
Conduct surveys, sweepstakes, contests and other promotions;
Manage our business;
Develop new products, content and services
Perform functions as otherwise described to you at the time of collection;
Prevent, investigate or provide notice of fraud or unlawful or criminal activity; Enforce and carry out our Terms and other agreements; and • Comply with legal obligations.

OUR DISCLOSURE OF PERSONAL INFORMATION

We disclose personal information in the following ways:

Within Funko, LLC and its subsidiaries for purposes consistent with this Privacy Policy;
With the third party or third parties that perform(s) maintenance and operation of the Sites on our behalf;
With other third parties that perform services or functions on our behalf. For example, we may share personal information with payment processors and shipping providers in order to fulfill your purchases and orders with us. We may also share personal information with third parties who help us to communicate with you about our products and services, including to deliver advertisements and other marketing communications;
In order to comply with laws, statutes or regulations, and to enforce this Privacy Policy, our Terms or other agreements, and to protect our rights and the rights of others;
As required by a court or government agency or to respond to a claim by you or a third party;
As part of or in connection with an actual or potential corporate business transaction, such as a merger, acquisition, joint venture, financing, sale, corporate change or insolvency, bankruptcy or receivership; and
As you may otherwise request or agree.

COOKIES

We and our third-party providers may use (i) cookies or small data files that are stored on your computer and (ii) other, similar technologies, such as web beacons, pixels, embedded scripts, location-identifying technologies and logging technologies (collectively, “cookies”) to automatically collect personal information. For example, our Sites use Google Analytics, a web analytics service provided by Google, Inc. (“Google”), to collect and view reports about the traffic on our online services. You can obtain more information on the use of Google Analytics by visiting Google’s privacy policy here and you can view Google’s currently available opt-out options here .

If you would prefer not to accept cookies, most browsers will allow you to: (i) change your browser settings to notify you when you receive a cookie, which lets you choose whether or not to accept it; (ii) disable existing cookies; or (iii) set your browser to automatically reject cookies. Please note that doing so may negatively impact your experience using our website, as some features and offerings may not work properly or at all. Depending on your device and operating system, you may not be able to delete or block all cookies. In addition, if you want to reject cookies across all your browsers and devices, you will need to do so on each browser on each device you actively use. You may also set your email options to prevent the automatic downloading of images that may contain technologies that would allow us to know whether you have accessed our email and performed certain functions with it.

Please note certain of our third-party providers may directly collect personal information about your online activities over time and across different websites when you use our website for purposes of providing online behavioral or interest-based advertising services to third parties. We support the self-regulatory principles for online behavioral advertising (“Principles”) published by the Digital Advertising Alliance (“DAA”). These Principles allow you to exercise choice regarding the collection of information about your online activities over time and across thirdparty websites for online interest-based advertising purposes. More information about these Principles can be found at www.aboutads.info. If you want to opt out of receiving online interestbased advertisements on your internet browser from advertisers and third parties that participate in the DAA program and perform advertising-related services for us and our advertising partners, please follow the instructions at www.aboutads.info/choices, or http://www.networkadvertising.org/choices/ to place an opt-out cookie on your device indicating that you do not want to receive interest-based advertisements. Opt-out cookies only work on the internet browser and device they are downloaded onto. If you want to opt out of interest-based advertisements across all your browsers and devices, you will need to opt out on each browser on each device you actively use. If you delete cookies on your device generally, you will need to opt out again.

If you want to opt out of receiving online interest-based advertisements on mobile apps, please follow the instructions at http://www.aboutads.info/appchoices.

Please note that when you opt out of receiving interest-based advertisements, this does not mean you will no longer see advertisements from us on our website or third-party websites. It means that the online ads that you do see from DAA program participants should not be based on your interests. We are not responsible for the effectiveness of, or compliance with, any third-parties’ opt-out options or programs or the accuracy of their statements regarding their programs. In addition, third parties may still use cookies to collect information about your use of our online services, including for analytics and fraud prevention as well as any other purpose permitted under the DAA’s Principles.

CHILDREN’S PERSONAL INFORMATION

Our Sites are not directed at children under the age of 13, and we do not knowingly collect personal information directly from children under the age of 13 or from other websites or services directed at children under the age of 13. Consistent with the Federal Children’s Online Privacy Protection Act of 1998 and its rules (“COPPA”), Funko will not knowingly request or collect personal information from any child under age 13 without obtaining the required parental consent.

If you are a parent or legal guardian and purchase a Subscription or Gift Subscription for or on behalf of your child, naming your child as the Subscription or Gift Subscription recipient, you agree that Funko may collect, store, use and process your child’s personal information for the purposes described above and in accordance with this Privacy Policy. If we learn that a user under 13 years of age has submitted personal information through or using one of the Sites without his or her parent or legal guardian’s consent, we will take reasonable measures to obtain consent by contacting the child’s parent or legal guardian if possible and shall, if consent cannot be or is not obtained, take reasonable measures to delete such information from our databases and not use such information for any purpose (except where necessary to protect the safety of the child or otherwise as required by law). If we obtain the required consent from the parent or guardian of a child under 13, we will only ask for personal information that is reasonably necessary for the child to redeem his or her Subscription, Gift Subscription and/or product ordered and will store such personal information for only as long as reasonably necessary to fulfill these purposes.

The parent or legal guardian who has consented to a child providing personal information to one or more of the Sites may later view the child’s personal information and correct or remove the information, in whole or in part; instruct us to discontinue all use of the child’s personal information and/or not to communicate further with the child; or revoke or modify the consent, by contacting us at [email protected] and including the child’s name and email address and the parent or guardian’s name and email address. Please visit http://www.ftc.gov/privacy/privacyinitiatives/childrens.html for information from the Federal Trade Commission about protecting children’s privacy online.

PERSONAL INFORMATION CORRECTIONS AND UPDATES

You may request to view your personal information, or delete or modify incorrect parts thereof by emailing us at [email protected]. Please note that we may be required to decline your deletion request, or only honor your deletion request after a certain period of time, for business or legal reasons. In response to a deletion request, we may delete the personal information or deidentify/aggregate the personal information so that it can no longer be reasonably connected to you. When we delete any information, it will be deleted from the active database, but may remain in our archives. We reserve the right and may be required by law to verify the identity of any person making a request to access, modify or delete personal information; provided, however, that we will have no liability of any kind resulting from false or erroneous requests by you or any change or deletion made in accordance with your request.

THIRD PARTY WEBSITES AND STORES

Some websites, such as fan operated sites like www.funkofanatics.com, and online stores, such as resellers of our products, may use our name or our products in connection with their services. In addition, the Sites may contain links to other websites or stores.

We do not control, are not responsible for, and make no representations whatsoever regarding such other websites or stores, or the products and services offered by or through such third-party websites or stores, even those with which Funko may have an affiliation. If you decide to access such third-party websites or stores, you do so at your own risk. You should carefully review the privacy policy and terms of any such website or store.

The Sites may also include YouTube videos, social media features, such as the Facebook Like button, and widgets, such as the “Share This” button or interactive mini-programs that run on the Sites. Your interactions with these features are also governed by the privacy policy of the company providing it.

COMMUNICATIONS PREFERENCES

Where you provide your email address to Funko through the Sites, we may send you commercial emails in order to deliver the Newsletter, to provide you with more information about available products you have purchased, and to provide you with updates, special offers, and other information, including but not limited to Site updates. You may unsubscribe from these commercial emails or from receiving our Newsletter at any time by clicking on the “unsubscribe” link included in any email or by contacting Funko via email at [email protected] or at the mailing address provided below. If you request to opt out of promotional communications, please note that we may continue to send you non-promotional communications via telephone or email, such as communications related to any business we may have with you or other transactional emails.

CONTACT US

We take your privacy seriously, and invite you to contact us at the address below with any questions or concerns you may have regarding this Privacy Policy or our collection, storage, and use of your personal information:

Funko, LLC

Attention: Legal Department

2802 Wetmore Avenue Everett, WA 98201

[email protected]

PRIVACY DISCLOSURES FOR CALIFORNIA RESIDENTS

This section applies to you if you are a resident of the state of California and provides additional information about how we collect, use, disclose and otherwise process personal information of individual residents of the state of California within the scope of the California Consumer Privacy Act of 2018 (“CCPA”). In addition to our personal information processing activities relating to our Sites, this section also addresses our personal information processing activities offline, such as in connection with our California-based retail store.

For purposes of this section, “personal information” means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. It does not include information that is made publicly available from government records, that is deidentified or aggregated such that it is not capable of being associated with you, or that is otherwise excluded from the CCPA’s scope. This section also does not apply to information relating to our employees, contractors, applicants and other personnel.

COLLECTION AND USE OF PERSONAL INFORMATION

In the last 12 months, we have collected the following categories of personal information:

Identifiers, such as name, Account email address and password, IP address and other unique personal identifiers;
California Customer Records (Cal. Civ. Code § 1798.80(e)), such as email address, telephone number, fax number, billing address, shipping address, birthday (month/day), currency or notification preferences, responses to interest-based questions, Funko Fan Club membership and payment information (such as cardholder name, billing address, credit card number, expiration date, authentication code, check routing number, account number or related information);
Commercial Information, such as products, content, Subscriptions or services purchased, added to your cart or of interest to you, as well as products added to your online collection or wishlist;
Internet/Network Information, such as log data (including IP address, date and time of access, device information) and clickstream data (such as your actions on the Sites);
Geolocation Data, such as your general geographic location based on your IP address or more precise location when accessing our Sites through a mobile device;
Sensory Information, such as audio recordings, photographs and video footage you choose to provide, or we otherwise record as permitted by law;
Professional/Employment Information, such as your company name;
Other Personal Information, such as your entries in surveys, sweepstakes, contests or other promotions, and the feedback or custom message you provide in connection with a request, inquiry or comment directly to us or through a third-party platform (such as social media);

Inferences, such as deriving products of interest from other personal information we have collected about you.

We collect this information directly from you, from your browser or device when you interact with our Sites, from third-party service providers, such as payment processors, point-of-sale vendors, and e-commerce platforms, from third-party platforms such as social media websites and from other publicly available sources. For more information about the personal information we collect and how we collect it, please refer to the Personal Information We Collect section of this Privacy Policy.

We collect personal information from and about you for a variety of purposes. For example, we use personal information to create and maintain your Accounts and Subscriptions with us; to communicate with you; to facilitate, process and fulfill orders you place with us or the services you request; to conduct surveys, sweepstakes, contests and other promotions; to provide in-store features, such as our photobooths; to analyze and improve the use of our Sites; to deliver marketing communications and personalized and non-personalized advertising, and to improve our products and services. For more information about our use of personal information, please refer to the Our Use of Personal Information section of this Privacy Policy.

DISCLOSURE AND “SALE” OF PERSONAL INFORMATION

We share personal information with third parties for business purposes or we may sell your personal information to third parties, subject to your right to opt-out of those sales (please refer to the Your California Privacy Rights section below). The categories of third parties to whom we disclose your personal information may include our subsidiaries, our service providers that perform services or functions on our behalf, marketing providers, and certain third parties where you have provided consent or where we are required by law.

As is common practice among companies that operate online, we also allow certain third-party providers to collect information about consumers directly through our websites and other online services for purposes of analyzing and optimizing our services, delivering ads, providing content and ads that are more relevant, measuring statistics and the success of ad campaigns, and detecting and reporting fraud. To the extent this practice is interpreted to constitute a “sale” under the CCPA, please refer to the Submitting Requests section below regarding your right to opt-out.

For more information about how we share personal information, please refer to the Our Disclosure of Personal Information section of our Privacy Policy.

YOUR CALIFORNIA PRIVACY RIGHTS

As a California resident, you may be able to request to exercise the following rights in relation to the personal information about you that we have collected (subject to certain limitations at law):

Right to Know: You have the right to request any or all of the following information relating to your personal information we have collected and disclosed in the last 12 months, upon verification of your identity:

The specific pieces of personal information we have collected about you;
The categories of personal information we have collected about you; o The categories of sources of the personal information;
The categories of personal information that we have disclosed to third parties for a business purpose, and the categories of recipients to whom this information was disclosed;
The categories of personal information we have sold about you (if any) and the categories of third parties to whom the information was sold; and
The business or commercial purposes for collecting or, if applicable, selling personal information about you.

The Right to Request Deletion: You have the right to request the deletion of personal information we have collected from you, subject to certain exceptions.
The Right to Opt-Out of Personal Information Sales: You have the right to direct us not to sell personal information we have collected about you to third parties. If you are under the age of 16, you have the right not to have your information sold, unless you, or your parent or guardian, affirmatively authorize such sales (the “Right to Opt-In”).

You also have the right to be free from discrimination for exercising these rights. However, please note that if the exercise of these rights limits our ability to process personal information (such as in the case of a deletion request), we may no longer be able to provide you our products and services or engage with you in the same manner.

In addition, if you have an established customer relationship with us for personal, family or household purposes, you may also have the right under California’s “Shine the Light” law to request:

A list of the categories of certain personal information that we have disclosed to third parties during the immediately preceding calendar year for the third parties’ direct marketing purposes; and
The names and addresses of all such third parties.

SUBMITTING REQUESTS

To Exercise Your Right to Know, Right to Deletion or “Shine the Light” Right. To exercise your right to know, right to deletion or “Shine the Light” right, please submit a request specifying the right you wish to exercise by:

Emailing [email protected] with the subject line “California Rights Request”

We may need to verify your identity before processing your request, which may require us to request additional personal information from you or require you to log into your account (if applicable). We will only use personal information provided in connection with your request to review and process your request.

In certain circumstances, we may decline or limit your request, particularly where we are unable to verify your identity or locate your information in our systems, or as permitted by law.

To Exercise Your Right to Opt-Out of Personal Information Sales. To initiate your request to opt out of personal information sales, please click the link below to email us at [email protected] with the subject line “California Sale Opt-Out.” To the extent our third-party advertising and analytics providers’ collection of information from users of our web sites and other online services constitutes a “sale” under the CCPA, please refer to the Cookies section of this Privacy Policy for more information about the choices and opt-out options you have in relation to those practices. By visiting www.privacyrights.info or www.optout.privacyrights.info, you can also opt out from “sales” of this type of personal information by businesses that participate in the DAA’s CCPA Opt-Out Tool. To make opt-out requests related to mobile apps on your device for businesses participating in the DAA’s CCPA App-based Opt-Out Tool, you can download the appropriate app at www.youradchoices.com/appchoices.

Do Not Sell My Personal Information

PRIVACY DISCLOSURES FOR THE EUROPEAN ECONOMIC AREA, UNITED KINGDOM AND SWITZERLAND

While we are primarily based in the United States, Funko maintains operations in Europe and may direct our services to individuals located in the European Economic Area (“EEA”), United Kingdom and Switzerland, including through our European-specific Sites like www.funkoeurope.com (collectively, our “European Services”). The following disclosures (“Privacy Disclosures”) apply to our processing of personal data in connection with our European Services.

Funko UK, LTD is the data controller responsible for the processing of personal data in connection with our European Services. This means that we determine and are responsible for how your personal information is used.

Personal Data: When we use the term “personal data” in this section, we mean information relating to an identified or identifiable natural person.

PERSONAL DATA WE COLLECT FROM YOU WHEN YOU USE THE FUNKO EUROPEAN SERVICES, AND HOW WE USE IT

We collect the categories of personal data that you voluntarily submit directly to us when you use the European Services, as set forth in our Privacy Policy under the section entitled Personal Information We Collect.

The table at Annex 1 sets out in detail the categories of personal data we collect about you and how we use that information when you use the European Services, as well as the legal basis which we rely on to process the personal information and recipients of that personal information.

INFORMATION WE COLLECT ABOUT YOU AUTOMATICALLY

We also automatically collect personal information indirectly about how you access and use the European Services, and information about the device you use to access the European Services. For example, we may collect:

information about the features you use and the pages you view on the European Services;
information about your device (such as your IP address, device identifier, device type, model and manufacturer); and
information about your usage patterns (such as how often you use the Funko European Services and your language settings).

We use this information to provide you the features and functionality of the European Services, to monitor and improve the European Services and to develop new services.

The table at Annex 2 sets out further information about the categories of personal information we collect about you automatically and how we use that information. The table also lists the legal basis which we rely on to process the personal information and recipients of that personal information.

We may link or combine the personal information we collect about you and the information we collect automatically.

We may anonymise and aggregate any of the personal information we collect (so that it does not directly identify you). We may use anonymised information for purposes that include testing our IT systems, research, data analysis, improving the Funko European Services. We may also share such anonymised and aggregated information with others.

HOW LONG WILL WE STORE YOUR PERSONAL INFORMATION

We will usually store the personal information we collect about you for no longer than necessary for the purposes set out in Annex 1 and Annex 2, in accordance with our legal obligations and legitimate business interests.

The criteria used to determine the period for which personal information about you will be retained varies depending on the legal basis under which we process the personal information:

Legitimate Interests. Where we are processing personal information based on our legitimate interests, we generally will retain such information for a reasonable period of time based on the particular interest, taking into account the fundamental interests and the rights and freedoms of data subjects.
Consent. Where we are processing personal information based on your consent, we generally will retain the information until you withdraw your consent, or otherwise for the period of time necessary to fulfil the underlying agreement with you or provide you with the applicable service for which we process that personal information.
Contract. Where we are processing personal information based on contract, we generally will retain the information for the duration of the contract plus some additional limited period of time that is necessary to comply with law or that represents the statute of limitations for legal claims that could arise from the contractual relationship.
Legal Obligation. Where we are processing personal information based on a legal obligation, we generally will retain the information for the period of time necessary to fulfil the legal obligation.
Legal Claim. We may need to apply a “legal hold” that retains information beyond our typical retention period where we face threat of legal claim. In that case, we will retain the information until the hold is removed, which typically means the claim or threat of claim has been resolved.

In all cases, in addition to the purposes and legal bases, we consider the amount, nature and sensitivity of the personal information, as well as the potential risk of harm from unauthorised use or disclosure of your personal information.

RECIPIENTS OF PERSONAL INFORMATION

In addition to the recipients listed in Annexes 1 and 2, we may also share your personal information with the following (as required in accordance with the uses set out in Annexes 1 and 2):

Service providers and advisors: we may share your personal information with third party vendors and other service providers that perform services for us or on our behalf, which may include providing professional services, such as legal and accounting services, mailing, email or chat services, fraud prevention, web hosting, or providing analytic services.
Affiliates. Other companies owned by or under common ownership as Funko, including our subsidiaries (i.e., any organisation we own or control) and our ultimate holding company (i.e., any organisation that owns or controls us) and any subsidiaries it owns. These companies will use your personal information in the same way as we can under these Privacy Disclosures.
Purchasers and third parties in connection with a business transaction: your personal information may be disclosed to third parties in connection with a transaction, such as a merger, sale of assets or shares, reorganisation, financing, change of control or acquisition of all or a portion of our business.
Law enforcement, regulators and other parties for legal reasons: we may share your personal information with third parties as required by law or if we reasonably believe that such action is necessary to (i) comply with the law and the reasonable requests of law enforcement; (ii) detect and investigate illegal activities and breaches of agreements, including our Terms; and/or (iii) exercise or protect the rights, property, or personal safety of Funko, its users or others.

MARKETING AND ADVERTISING

From time to time we may contact you with information about our services, including sending you marketing messages and asking for your feedback on our services.

Most marketing messages we send will be by email. For some marketing messages, we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.

We will only send you marketing messages if you have given us your consent to do so. You can withdraw your consent at a later date by clicking on the unsubscribe link at the bottom of our marketing emails.

STORING AND TRANSFERRING YOUR PERSONAL INFORMATION

Security. We implement appropriate technical and organisational measures to protect your personal information against accidental or unlawful destruction, loss, change or damage. All personal information we collect will be stored by our cloud hosting provider on secure servers. We will never send you unsolicited emails or contact you by phone requesting credit or debit card information or national identification numbers.

International Transfers of your Personal Information. The personal information we collect may be transferred to and stored in countries outside of the jurisdiction you are in where we and our third party service providers have operations. If you are located in the EEA, United Kingdom or Switzerland, your personal information may be processed outside of those regions, including in the United States.

In the event of such a transfer, we ensure that: (i) the personal information is transferred to countries recognised as offering an equivalent level of protection; or (ii) the transfer is made pursuant to appropriate safeguards, such as standard data protection clauses adopted by the European Commission.

If you wish to enquire further about these safeguards used, please contact us using the details set out at the end of these Privacy Disclosures.

YOUR RIGHTS IN RESPECT OF YOUR PERSONAL INFORMATION

In accordance with applicable privacy law, you have the following rights in respect of your personal information that we hold:

Right of access. You have the right to obtain:

confirmation of whether, and where, we are processing your personal information;
information about the categories of personal information we are processing, the purposes for which we process your personal information and information as to how we determine applicable retention periods;
information about the categories of recipients with whom we may share your personal information; and
a copy of the personal information we hold about you.

Right of portability. You have the right, in certain circumstances, to receive a copy of the personal information you have provided to us in a structured, commonly used, machine-readable format that supports re-use, or to request the transfer of your personal data to another person.
Right to rectification. You have the right to obtain rectification of any inaccurate or incomplete personal information we hold about you without undue delay.
Right to erasure. You have the right, in some circumstances, to require us to erase your personal information without undue delay if the continued processing of that personal information is not justified.
Right to restriction. You have the right, in some circumstances, to require us to limit the purposes for which we process your personal information if the continued processing of the personal information in this way is not justified, such as where the accuracy of the personal information is contested by you.
Right to withdraw consent. There are certain circumstances where we require your consent to process your personal information. In these instances, and if you have provided consent, you have the right to withdraw your consent. If you withdraw your consent, this will not affect the lawfulness of our use of your personal information before your withdrawal.

You also have the right to object to any processing based on our legitimate interests where there are grounds relating to your particular situation. There may be compelling reasons for continuing to process your personal information, and we will assess and inform you if that is the case. You can object to marketing activities for any reason.

You also have the right to lodge a complaint to your local data protection authority. If you are based in the European Union, information about how to contact your local data protection authority is available here . If you are based in the UK or Switzerland, your local data protection authorities are the UK Information Commissioner's Office (https://ico.org.uk/global/contact -us/) and the Swiss Federal Data Protection and Information Commissioner

(https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact/address.html).

If you wish to exercise one of these rights, please contact us using the contact details at the end of these Privacy Disclosures.

Due to the confidential nature of data processing we may ask you to provide proof of identity when exercising the above rights. This can be done by providing a scanned copy of a valid identity document or a signed photocopy of a valid identity document.

COOKIES AND SIMILAR TECHNOLOGIES USED ON OUR EUROPEAN SERVICES

Our European Services uses cookies and similar technologies such as pixels and Local Storage Objects (LSOs) like HTML5 (together "cookies") to distinguish you from other users of our European Services. This helps us to provide you with a good experience when you browse our European Services and also allows us to monitor and analyse how you use and interact with our European Services so that we can continue to improve our European Services. It also helps us and our advertising partners to determine products and services that may be of interest to you, in order to serve you targeted advertisements.

Cookies are pieces of code that allow for personalisation of our European Services experience by saving your information such as user ID and other preferences. A cookie is a small data file that we transfer to your computer's hard disk for record-keeping purposes.

We use the following types of cookies:

Strictly necessary cookies. These are cookies that are required for the operation of our European Services. They include, for example, cookies that enable you to log into secure areas of our European Services.
Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our European Services when they are using it. This helps us to improve the way our European Services works, for example, by ensuring that users are finding what they are looking for easily.
Functionality cookies. These are used to recognise you when you return to our European Services. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
Targeting cookies. These cookies record your visit to our European Services, the pages you have visited and the links you have followed. We will use this information to make our European Services and the advertising displayed on it, and the marketing messages we send to you more relevant to your interests. We may also share this information with third parties who provide services to us for this purpose.
Third party cookies. Please be aware that advertisers and other third parties may use their own cookies tags when you click on an advertisement or link on our European Services. These third parties are responsible for setting out their own cookie and privacy policies.

Please see Annex 3 for more information about the cookies we use on the European Services.

Other than strictly necessary cookies, which are required for the operation of our European Services, we will only place cookies on your device if you give us your consent to do so.

Most browsers also allow you to change your cookie settings to block certain cookies. Depending on your mobile device and operating system, you may not be able to delete or block all cookies. Please note that if you choose to refuse all cookies you may not be able to use the full functionality of our European Services. These settings will typically be found in the "options" or "preferences" menu of your browser. In order to understand these settings, the following links may be helpful, otherwise you should use the "Help" option in your browser for more details.

If you would like to find out more about cookies and other similar technologies, please visit www.allaboutcookies.org or the Network Advertising Initiative's online sources at www.networkadvertising.org . We and our third-party partners may also use cookies and tracking technologies for advertising purposes.

Please note that deleting or blocking cookies may not be effective for all types of tracking technologies, such as Local Storage Objects (LSOs) like HTML5.

TRACKING TECHNOLOGIES USED IN OUR EMAILS

Our emails may contain tracking pixels that identify if and when you have opened an email that we have sent you, how many times you have read it and whether you have clicked on any links in that email. This helps us measure the effectiveness of our marketing email campaigns, make the emails we send to you more relevant to your interests and to understand if you have opened and read any important administrative emails we might send you.

Most popular email clients will allow you to block these pixels by disabling certain external images in emails. You can do this through the settings on your email client – these generally give you the option of choosing whether emails will display "remote images", "remote content" or "images" by default.

Some browsers also give you the option of downloading and installing extensions that block pixels and other tracking technologies.

CHANGES TO THESE PRIVACY DISCLOSURES

We may update these Privacy Disclosures from time to time and so you should review this page periodically. When we change these Privacy Disclosures in a material way, we will update the "last modified" date at the end of these Privacy Disclosures. Changes to these Privacy Disclosures are effective when they are posted on this page.

NOTICE TO YOU

If we need to provide you with information about something, whether for legal, marketing or other business-related purposes, we will select what we believe is the best way to get in contact with you. We will usually do this through email or by placing a notice on the European Services. The fact that we may send notices to you will not stop you from being able to opt out of certain types of contact as described in this privacy policy.

OUR POLICY TOWARDS CHILDREN

The European Services are not directed at children. If you become aware that your child has provided us with personal information, without your consent, then please contact us using the details below so that we can take steps to remove such information as quickly as possible.

CONTACTING US

If you have any questions, comments and requests regarding these Privacy Disclosures, please contact us at [email protected] or:

Funko UK, LTD

Attention: Legal Department

21 Holborn Viaduct

London, United Kingdom, EC1A 2DY [email protected]

These Privacy Disclosures were last modified on 22^nd September 2020.

ANNEX 1 – PERSONAL INFORMATION YOU PROVIDE TO US

Category of Personal Information	How we may use Personal Information	Legal Basis for Processing	Recipients of Personal Information
Contact information, such as first name, last name and email address.	We may use this information to set up and authenticate your account on the European Services.	The processing is necessary for the performance of a contract with you and to take steps prior to entering into a contract with you, namely our Terms of Service.	We may share this information with Worldpay AP Ltd and Paypal (Europe) Ltd in order to identify you so that you can make and receive payments through the European Services. We may share this information with Affiniv, Shopify and Global-e to process an e commerce transaction. We may also share your persona information with Wunderkind and Listrak to send you marketing communications. We may also share this information with LINK Mobility and WhatsApp in order to maintain communications with you
	We may use this information to communicate with you, including sending service-related communications.	The processing is necessary for the performance of a contract with you, namely our Terms of Service.
	We may use this information to deal with enquiries and complaints made by or about you relating to the European Services.	The processing is necessary for our legitimate interests, namely administering the European Services, and for communicating with you effectively to respond to your queries or complaints.
	We may use this information in connection with providing surveys, sweepstakes, contests, or other promotions, including sending you marketing communications in accordance with your preferences.	We will only use your personal information in this way to the extent you have given us consent to do so.
Your account information such as your full name, email, password, birthday, address.	We may use this information to create your account on the European Services.	The processing is necessary for the performance of a contract with you.	We may share this information with Affiniv, Shopify and Global-e to process an e commerce transaction.
	We use this information to deal with enquiries and complaints made by or about you relating to the European Services.	The processing is necessary for our legitimate interests, namely for communicating with our members effectively to respond to any queries or complaints.
Payment and transaction information. When you make a purchase, we may collect information such as your credit card, payment authentication code, billing address, and other information such as date and time of your transaction.	We may use this information to process your orders through the European Services.	The processing is necessary for the performance of a contract.	We may share this information with Worldpay AP Ltd and Paypal (Europe) Ltd in order to identify you so that you can make and receive payments through the European Services.
	We may use this information to verify your identity in connection with the detection and prevention of fraud or financial crime.	The processing is necessary for our and third partiers' legitimate interests, namely the detection and prevention of fraud and financial crime.
Approximate Location information. When you visit our European Services, we may collect information about your location. This information may be derived from WiFi positioning or your IP address.	We may use information to present the European Services to you on your device.	The processing is necessary for performance of a contract with you.
	We may use this information to localise features of the European Services.	The processing is necessary for our legitimate interest, namely localising features of the European Services and tailoring the European Services so that it is more relevant to our users.
	We may use this information to determine content that may be of interest to you.	The processing is necessary for our legitimate interests, namely tailoring the European Services so that it is more relevant to you.
Chat, comments and opinions. When you contact us directly, e.g. by email or phone we will record your comments and opinions.	We may use this information to address your questions, issues and concerns.	The processing is necessary for our legitimate interests, namely communicating with you and responding to queries, complaints and concerns.	We may share any information you provide to us when you contact u with Zendesk, Inc. the provider of our customer support platform, in order to process any customer support queries you might submit to us.
	We may use this information to improve the European Services.	The processing is necessary for our legitimate interests (to develop and improve our service).
Information received from third parties, such as social networks. If you interact with us through a social network, we may receive information from the social network such as your name, profile information, and any other information you permit the social network to share with third parties.The data we receive is dependent on your privacy settings with the social network.	We may use this information to reshare content created through the use of the European Services	The processing is necessary for our legitimate interests (to develop our service and inform our marketing strategy)
	We may use this information to authenticate you and allow you to access the European Services.	The processing is necessary for the performance of a contract with you.
Your preferences, such as preferences set for notifications, marketing communications, how the European Services is displayed and the active functionalities on the European Services.	We use this information to provide notifications, send news, alerts and marketing communications and provide the European Services in accordance with your choices.	The processing is necessary for our legitimate interest, namely ensuring the user receives the correct marketing and other communications, and that this is displayed in accordance with the user's preferences.	We may also share your personal information with Listrak
	We use this information to ensure that we comply with our legal obligation to send only those marketing communications to which you have consented.	The processing is necessary for compliance with a legal obligation to which we are subject.

ANNEX 2 – PERSONAL INFORMATION COLLECTED AUTOMATICALLY

Category of Personal Information	How we may use it	Legal basis for the processing	Recipients of Personal Data
Approximate location information. Other than information you choose to provide to us, we do not collect information about your precise location. Your device’s IP address may however help us determine an approximate location.	We may use information you provide to us about your location to monitor and detect fraud or suspicious activity in relation to your Funko account.	The processing is necessary for our legitimate interests, namely to protect our business and your account from fraud and other illegal activities.	We may share this information with the following: Google LLC, which provides our analytics platforms, in order to help us understand how visitors use our Website. We may share this information with Affiniv, Shopify and Global-e to process an e-commerce transaction.
	We may use this information to tailor how the European Services is displayed to you (such as the language in which it is provided to you).	The processing is necessary for our legitimate interest, namely tailoring our service so that it is more relevant to our users.
Information about how you access and use the European Services. For example, how frequently you access the European Services, the time you access the European Services and how long you use it for, the approximate location that you access the European Services from, the site from which you came and the site to which you are going when you leave our website, the website pages you visit, the links you click, whether you open emails or click the links contained in emails, whether you access the European Services from multiple devices, and other actions you take on the European Services.	We may use information about how you use and connect to the European Services to present the European Services to you on your device.	The processing is necessary for our legitimate interests, namely to tailor the European Services to the user.
	We may use this information to determine products and services that may be of interest to you for marketing purposes.	The processing is necessary for our legitimate interests, namely to inform our direct marketing.
	We may use this information to monitor and improve the European Services and business, resolve issues and to inform the development of new products and services.	The processing is necessary for our legitimate interests, namely to monitor and resolve issues with the European Services and to improve the European Services generally.
Log files and information about your device. We also collect information about the tablet, smartphone or other electronic device you use to connect to the European Services. This information can include details about the type of device, unique device identifying numbers, operating systems, browsers and applications connected to the European Services through the device, your mobile network, your IP address and your device’s telephone number (if it has one).	We may use information about how you use and connect to the European Services to present the European Services to you on your device.	The processing is necessary for our legitimate interests, namely to tailor the European Services to the user.
	We may use this information to monitor and improve the European Services and business, resolve issues and to inform the development of new products and services.	The processing is necessary for our legitimate interests, namely to monitor and resolve issues with the European Services and to improve the European Services generally.

ANNEX 3 – COOKIES

Cookie Name	Type of cookie	How long does the cookie stay on my device?	Purpose of the cookie
secure_session_id	Strictly Necessary	Session	These cookies are associated with Shopify's hosted merchant platform and are used in connection with providing the European Services,including as they related to creating an account and placing an order.
Cart	Strictly Necessary	1 Month
Secure_customer_sig	Strictly Necessary	20 Years
storefront_digest	Strictly Necessary	Session
GlobalE_Data	Strictly Necessary	72 Hours	These cookies are associated with Global-e’s hosted merchant platform and are used in connection with providing the European Services, including as they related to creating an account and placing an order.
GlobalE_Welcome_Data	Strictly Necessary	72 Hours
GE_CART_TOKEN	Strictly Necessary	72 Hours
GloablEIsOperated	Strictly Necessary	2 Years
_cfduid	Strictly Necessary	8 Months
forterToken, Ftr_ncd	Strictly Necessary	5 Years
cid	Strictly Necessary	End of Session
GlobalE_Tags_Data	Analytics/performance	End of session	These cookies are associated with Global-e’s analytics suite and are used to collect information about how visitors use the European Services.
GlobalE_CT_Data	Analytics/performance	72 Hours
_landing_page	Analytics/performance	13 days	These cookies are associated with Shopify's analytics suite and are used to collect information about how visitors use the European Services.
_orig_referrer	Analytics/performance	13 days
_s	Analytics/performance	1 day
_shopify_fs	Analytics/performance	2 years
_shopify_s	Analytics/performance	3 day
_shopify_sa_p	Analytics/performance	30 minutes
_shopify_y	Analytics/performance	2 years
_y	Analytics/performance	1 year
_ga	Analytics/performance	2 years	These cookies are used to collect information about how visitors use our website. We, and our platform provider Global-e, use the information to compile reports and to help us improve the website. You can learn more about Google’s practices at http://www.google.com/policies/privacy/partners and view its currently available opt-out options at https://tools.google.com/dlpage/gaoptout
_gid	Analytics/performance	1 day
__gat	Analytics/performance	1 minute
Paypal Cookies	Strictly Necessary and Analytics/performance	Various	If you use paypal to pay for your order the paypal service will use the cookies listed here: https://www.paypal.com/uk/webapps/mpp/ua/cookie-full