PRIVACY POLICY

www.iconluxurygroup.com

Effective Date: April 5, 2025 | Last Updated: April 5, 2025

1. Introduction

Icon Trade Services LLC, operating as ICON Luxury Group (“ICON,” “we,” “us,” or “our”), is a global distributor of luxury goods headquartered at 230 W 38th Street, Floor 5, New York, NY 10018, United States, with operational facilities in New Jersey (USA) and Prato, Italy.

This Privacy Policy describes how we collect, use, disclose, and safeguard personal information when you visit our website at www.iconluxurygroup.com (the “Website”), communicate with us, or engage with us in a business capacity as a buyer, partner, supplier, or licensee (collectively, “Services”).

We are committed to protecting your privacy and processing your personal data in compliance with applicable data protection laws, including:

The General Data Protection Regulation (EU) 2016/679 (201CGDPR201D), as it applies to individuals located in the European Economic Area (201CEEA201D);
The UK General Data Protection Regulation (“UK GDPR”) and the UK Data Protection Act 2018, for individuals in the United Kingdom;
The California Consumer Privacy Act (Cal. Civ. Code § 1798.100 et seq.) and its amendment, the California Privacy Rights Act (“CCPA/CPRA”), for California residents;
Any other applicable state or national privacy legislation.

By using our Website or Services, you acknowledge that you have read and understood this Privacy Policy.

2. Data Controller and Contact Information

The data controller responsible for your personal information is:

Icon Trade Services LLC

DBA: ICON Luxury Group

230 W 38th Street, Floor 5

New York, NY 10018

United States

Phone: +1 (212) 645-2700

Website: www.iconluxurygroup.com

For all privacy-related enquiries, requests to exercise your rights, or concerns regarding the processing of your personal data, please contact:

Privacy & Data Protection Officer (DPO)

Email: privacy@iconluxurygroup.com

(Please mark the subject line: DATA PRIVACY REQUEST)

3. Personal Information We Collect

We may collect and process the following categories of personal information:

3.1 Information You Provide Directly

Identity data: Full name, job title, company name.
Contact data: Email address, telephone number, mailing address.
Business data: VAT/EIN numbers, trade references, credit applications, product enquiries, order specifications.
Communications: Correspondence, emails, messages submitted through web forms, and meeting notes.
Account credentials: Username and password if you create a portal account.

3.2 Information Collected Automatically

When you visit our Website, we may automatically collect:

Device and technical data: IP address, browser type and version, operating system, device identifiers.
Usage data: Pages visited, time spent on pages, links clicked, referring URLs, search queries.
Cookie and tracking data: See Section 8 (Cookies and Tracking Technologies) below.

3.3 Information from Third Parties

We may receive personal information from:

Business partners, referral networks, and industry directories;
Publicly available sources (e.g., LinkedIn, company websites, trade databases);
Credit reference agencies or due diligence providers (for KYB/KYC compliance purposes);
Our service providers (logistics partners, payment processors, CRM platforms).

4. Legal Basis for Processing (GDPR / UK GDPR)

Where the GDPR or UK GDPR applies, we rely on the following legal bases:

4.1 Contract Performance (Art. 6(1)(b))

Processing is necessary to enter into or perform a contract with you — for example, processing orders, managing accounts, or fulfilling delivery obligations.

4.2 Legitimate Interests (Art. 6(1)(f))

We process your data where it is in our legitimate business interests, provided these interests are not overridden by your rights. This includes:

Direct marketing to existing business contacts;
Network and information security;
Fraud prevention and risk management;
Improving our Website and Services.

4.3 Legal Obligation (Art. 6(1)(c))

We process data where necessary to comply with applicable laws, including tax obligations, customs requirements, anti-money laundering (AML) regulations, and sanctions screening.

4.4 Consent (Art. 6(1)(a))

Where we rely on consent — such as for marketing emails to new contacts, or the use of non-essential cookies — you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.

5. How We Use Your Personal Information

We use your personal information for the following purposes:

To process enquiries, orders, and business transactions;
To manage and administer our client and partner relationships;
To communicate with you regarding products, services, pricing, and logistics;
To send marketing communications about our luxury goods portfolio, new collections, licensed brand launches, and industry news (where permitted);
To carry out due diligence, credit checks, and Know Your Business (KYB) verification;
To comply with legal, regulatory, customs, tax, and AML obligations;
To detect, prevent, and investigate fraud, security threats, or misuse of our Services;
To improve our Website performance, user experience, and service offerings;
To enforce our contractual terms and exercise or defend legal claims.

6. Disclosure of Personal Information

We do not sell your personal data. We may share your personal information with the following categories of recipients:

6.1 Service Providers and Processors

Third parties who process data on our behalf and under our written instructions, including:

IT infrastructure and cloud hosting providers;
CRM platforms and marketing automation tools;
Logistics, warehousing, and freight partners (New Jersey, USA and Prato, Italy);
Payment processors and banking institutions;
Credit reference and compliance screening agencies.

6.2 Business Partners and Licensors

We may share limited information with brand licensors (e.g., Scotch & Soda, Cavalli Class, Champion, Cole Haan, Ted Baker, Thomas Pink) solely as necessary to fulfil licensing, sourcing, or distribution obligations.

6.3 Legal and Regulatory Authorities

We may disclose your information to competent authorities where required by applicable law, court order, or regulatory requirement, including customs, tax, and sanctions compliance authorities in the United States, EU, and United Kingdom.

6.4 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of assets, personal data may be transferred to the acquiring entity, subject to equivalent privacy protections.

7. International Data Transfers

ICON Luxury Group operates internationally, with offices and warehousing facilities in the United States and Italy, and commercial relationships spanning multiple continents. Your personal data may be transferred to, and processed in, countries outside your country of residence, including the United States.

Where transfers from the EEA or UK involve countries not deemed adequate by the European Commission or the UK ICO, we rely on appropriate safeguards, which may include:

Standard Contractual Clauses (SCCs) approved by the European Commission or the UK International Data Transfer Agreement (IDTA);
Binding Corporate Rules, where applicable;
Other derogations under Art. 49 GDPR where necessary for the performance of a contract.

You may request a copy of the relevant safeguards by contacting us at the address in Section 2.

8. Cookies and Tracking Technologies

Our Website uses cookies and similar tracking technologies (pixels, beacons, scripts) to enhance your experience, analyse traffic, and support our marketing activities.

8.1 Types of Cookies We Use

Strictly Necessary Cookies: Essential for the Website to function (e.g., session management, security). These cannot be disabled.
Analytics Cookies: Allow us to measure Website performance and visitor behaviour (e.g., Google Analytics). Activated only with your consent.
Marketing & Targeting Cookies: Used to deliver relevant advertising. Activated only with your consent.
Functionality Cookies: Remember your preferences (language, region) to personalise your experience.

You may manage your cookie preferences at any time via our Cookie Preference Centre or through your browser settings. Disabling certain cookies may affect Website functionality.

9. Data Retention

We retain personal information only for as long as necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our key retention criteria include:

Business contact and transactional records: up to 7 years after the close of a business relationship, in compliance with US and EU tax and accounting obligations;
KYB/AML compliance records: up to 5 years from the end of the business relationship, per applicable anti-money laundering regulations;
Marketing contact data: until you unsubscribe or withdraw consent, or 3 years of inactivity, whichever comes first;
Website log and usage data: up to 13 months;
Legal claims data: for the duration of applicable statutes of limitations.

When data is no longer required, it is securely deleted or anonymised.

10. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal information:

10.1 Rights Under GDPR / UK GDPR (EEA & UK Residents)

Right of Access (Art. 15): Obtain confirmation of and a copy of the personal data we hold about you.
Right to Rectification (Art. 16): Request correction of inaccurate or incomplete data.
Right to Erasure (Art. 17): Request deletion of your personal data where there is no lawful basis for continued processing.
Right to Restriction (Art. 18): Request that we limit the processing of your data in certain circumstances.
Right to Data Portability (Art. 20): Receive your data in a structured, commonly used, machine-readable format.
Right to Object (Art. 21): Object to processing based on legitimate interests, including direct marketing.
Rights in Relation to Automated Decision-Making (Art. 22): Not to be subject to solely automated decisions that produce significant legal effects.

To exercise any of these rights, contact us at privacy@iconluxurygroup.com. We will respond within 30 days (extendable by a further 60 days for complex requests). We may ask you to verify your identity before actioning your request.

You also have the right to lodge a complaint with your local supervisory authority:

EU residents: Contact your national Data Protection Authority (DPA). A list is available at: https://edpb.europa.eu/about-edpb/board/members_en
UK residents: Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF — www.ico.org.uk

10.2 Rights Under the CCPA/CPRA (California Residents)

California residents have the following rights:

Right to Know: Request disclosure of the categories and specific pieces of personal information collected, the sources, the business purpose, and the categories of third parties with whom we share information.
Right to Delete: Request deletion of your personal information, subject to certain exceptions.
Right to Correct: Request correction of inaccurate personal information.
Right to Opt-Out of Sale or Sharing: We do not sell or share personal information for cross-context behavioural advertising. If this practice changes, we will update this policy and provide an opt-out mechanism.
Right to Limit Use of Sensitive Personal Information: Where we process sensitive personal information, you have the right to limit its use to purposes permitted by law.
Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

To submit a verifiable consumer request, contact us at privacy@iconluxurygroup.com or call +1 (212) 645-2700. Only you, or a person legally authorised to act on your behalf, may make a verifiable consumer request related to your personal information.

11. Data Security

We implement appropriate technical and organisational security measures to protect your personal information against unauthorised access, accidental loss, destruction, or disclosure. These include:

Encryption of data in transit using TLS/SSL protocols;
Access controls and role-based permissions for staff;
Secure data storage with reputable cloud infrastructure providers;
Regular security assessments and staff training on data protection;
Incident response procedures for data breach detection and notification.

However, no method of transmission over the internet or method of electronic storage is 100% secure. We cannot guarantee absolute security, and you provide information at your own risk.

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected individuals and relevant supervisory authorities as required by applicable law.

12. Children’s Privacy

Our Website and Services are directed exclusively at business professionals. We do not knowingly collect, use, or disclose personal information from individuals under the age of 16 (or under 13 in the United States). If we become aware that we have inadvertently collected information from a minor, we will promptly delete it. If you believe a minor has provided us with personal data, please contact us immediately at privacy@iconluxurygroup.com.

13. Third-Party Links and Services

Our Website may contain links to third-party websites, platforms, or services, including our licensed brand partners, logistics platforms, and industry directories. This Privacy Policy does not apply to such third-party sites. We encourage you to review the privacy policies of any third-party sites you visit. We are not responsible for the privacy practices or content of external sites.

14. Marketing Communications

We may send you commercial communications about ICON Luxury Group’s products, services, upcoming collections, trade events, and new brand partnerships where you have:

An existing business relationship with us and we are contacting you about similar goods/services (soft opt-in); or
Provided explicit consent to receive marketing from us.

You may unsubscribe from marketing communications at any time by:

Clicking the “Unsubscribe” link in any marketing email;
Emailing us at privacy@iconluxurygroup.com with the subject line “UNSUBSCRIBE”;
Contacting us by telephone at +1 (212) 645-2700.

Operational and transactional communications (e.g., order confirmations, invoices, contract notices) are not subject to marketing opt-outs and will continue to be sent as necessary.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, applicable law, or business operations. The updated policy will be posted on our Website with a revised “Last Updated” date. Where changes are material, we will provide notice by email or a prominent notice on the Website prior to the change becoming effective.

Your continued use of our Website or Services following the posting of an updated Privacy Policy constitutes your acknowledgement of the updated terms.

16. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact:

ICON Luxury Group — Privacy Office

Icon Trade Services LLC

230 W 38th Street, Floor 5

New York, NY 10018, United States

Email: privacy@iconluxurygroup.com

Telephone: +1 (212) 645-2700

Website: www.iconluxurygroup.com