PRIVACY POLICY OF NOVA POST US

Last Update: 08.08.2025.

I. GENERAL INFORMATION

II. CONTACT INFORMATION

III. APPLICABLE LAW ON PERSONAL DATA PROTECTION AND CONFIDENTIALITY OBLIGATION

IV. PERSONAL INFORMATION PROTECTION

V. RIGHTS OF USERS AS TO THEIR PERSONAL DATA AND HOW TO EXERCISE THEM

1. 1
   GENERAL LIST OF RIGHTS
2. 2
   RIGHTS FOR USERS RESIDING IN CALIFORNIA
3. 3
   RIGHTS FOR USERS RESIDING IN DELAWARE
4. 4
   HOW TO EXERCISE RIGHTS
5. 5
   HOW AND WHEN WE ARE EXPECTED TO HANDLE YOUR REQUEST

VI. CHILDREN’S PRIVACY

VII. PERSONAL DATA CATEGORIES. PURPOSES OF THEIR PROCESSING

VIII. DISLOSURE OF DATA

1. 1
   GENERAL RULES ON DATA DISCLOSURE
2. 2
   DISCLOSURE OF PERSONAL INFORMATION FOR A BUSINESS PURPOSE
3. 3
   SALE OR SHARE OF PERSONAL INFORMATION

IX. STORAGE PERIOD AND DATA DELETION

X. COOKIES. INFORMATION ON DATA AUTOMATICALLY COLLECTED THROUGH THE WEBSITE

XI. COMPLAINTS

XII. CHANGES TO THIS POLICY

I. GENERAL INFORMATION

1. 1
   This privacy and use of cookies policy is a set of rules for the processing of personal data and collection of cookies (“Policy”) by NOVA POST US INC. with its registered office at 303 FIFTH AVENUE, SUITE 1101, NEW YORK, NY, UNITED STATES, 10016, identification number 7540147 (“NOVA POST” or "Controller”, or “Company”), including:

   • on the https://novapost.com/uk-us/ website (“Website”),
   • as well as any other services the Company offers from time to time via its Website, or otherwise, unless there are specific privacy policies available in the respective service, (together – the “Services”).
2. 2
   This Policy defines what data we collect about consumers who use our Services and about other individuals whose personal data we process in the framework of our Services provision and other activities, including candidates for work. This Privacy Policy also applies to personal data processing and communication on social media accounts of the Company (e.g. Facebook, LinkedIn), via phone, e-mail, or letter, how we use it and who we share it with. The Policy also describes the measures we take to protect your personal data.
3. 3
   To avoid any doubt, this Policy is addressed to all persons who visit the Services, contact the Controller (by phone, e-mail or letter, or social media), who are employees, associates or representatives of the Controller's contractors, as well as customers using the Services of the Controller (“Users”).

II. CONTACT INFORMATION

1. 1
   Users can contact the Controller in the following way:

   • by letter to the following address: 303 FIFTH AVENUE, SUITE 1101, NEW YORK, NY, UNITED STATES, 10016,
   • or via e-mail: dpo@novapost.com.
2. 2
   Personal data (also referred to as personal information) is any information relating to an identified or identifiable natural person. The scope of this type of data includes, among others, name, surname, postal address, internet protocol address, telephone number and e-mail address. Information that cannot be traced back to an identified or identifiable person (such as statistical data) is not considered personal data. Please keep in mind that de-identified data or publicly available information is excluded from personal information.
3. 3
   Before using the Services of the Company, the User should read this Policy. The purpose of the document is, inter alia, to inform the Users about the way their personal data is collected, handled, and protected under the applicable law.

III. APPLICABLE LAW ON PERSONAL DATA PROTECTION AND CONFIDENTIALITY OBLIGATION

NOVA POST is subject to the provisions of the applicable:

1. A.
   US federal laws related to data protection, such as the FTC Act, CAN-SPAM Act, and
2. B.
   state comprehensive privacy laws, such as California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Delaware Personal Data Privacy Act (DPDPA), if and where applicable;
3. C.
   as well as other relevant national data protection legislation.

IV. PERSONAL INFORMATION PROTECTION

1. 1
   NOVA POST takes reasonable measures to establish, implement, and maintain administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data and to secure personal data during both storage and use from unauthorized acquisition. This is done by applying technical and organizational measures appropriate to the nature of the personal data processed.
2. 2
   All notifications regarding the protection of personal data are registered and explained in detail and analyzed in accordance with applicable law.

V. RIGHTS OF USERS AS TO THEIR PERSONAL DATA AND HOW TO EXERCISE THEM

1. 1
   GENERAL LIST OF RIGHTS

Based on the applicable law, consumers may have rights that they can exercise. Whether the User is in a particular US state or not, the general approach of the Company is to respect their rights with regard to their personal data. Note that in some cases we are not required to completely comply with the User’s request, for example, because such rights may be conditional, or because the request would require the Company to reveal trade secrets, or because we have to balance the rights of a particular person against the Company’s rights and obligations to process personal data, to protect the rights and freedoms of others, or otherwise comply with the law.

Anyway, the User has the following rights:

1. A.
   Right to be informed: the Company informs the Users about the categories of personal data to be collected, the purposes for collecting it, whether the information will be sold or shared, which information and with whom, the length of time the Company intends to retain each category of personal information, including sensitive personal information, or if that is not possible, the criteria used to determine such period, as well as how the User may exercise their rights. This is done through this Policy and other policies and notices provided through our Services;
2. B.
   Know/Access: receive the information and have access to data concerning them. This includes both the mere confirmation that the Company processes personal data, or the details about such data.
3. C.
   Correct: rectify User’s personal data that are incorrect and update such data.
4. D.
   Delete: request the deletion of User’s personal data. The Company may maintain a record of deletion requests to prevent deleted data to be later processed or sold, to comply with laws, or for other permissible purposes under the applicable law. The Company may also refuse to completely satisfy your request if this proves impossible or involves disproportionate effort, or if it is necessary for the Company to maintain the User’s personal data in order to:

   1. a)
      Detect security incidents, protect against malicious, deceptive, fraudulent, or illegal activity; or prosecute those responsible for that activity.
   2. b)
      Debug to identify and repair errors that impair existing intended functionality.
   3. c)
      Comply with legal obligation.
   4. d)
      Otherwise, use personal data, internally, in a lawful manner that is compatible with the context in which the User provided the information.
5. E.
   Data portability: request to receive a copy of User’s personal data in a portable and readily usable format, allowing them to transfer their data to different institutions or companies. In some states, this is applicable only where the processing is carried out by automated means.
6. F.
   Opt-out: opt out of the sale or sharing of User’s personal data (such as through targeted advertising and profiling, depending on the applicable law). This could be done by:

   1. a)
      emailing us to dpo@novapost.com,
   2. b)
      exercising choices on cookie banner or changing settings in accordance with cookies section COOKIES. INFORMATION ON DATA AUTOMATICALLY COLLECTED THROUGH THE WEBSITE;
   3. c)
      sending us a direct request for opt-out via a separate web page.
7. G.
   Withdraw consent: In the case the basis for data processing is the consent of the data subject, this person has the right to withdraw consent at any time (such as in case of cookies – through the cookie banner settings). In all other cases, except for cookies, the declaration of withdrawal of consent is made by providing the Company by e-mail or postal delivery, in accordance with the data provided, a statement in this regard. Receiving of such a declaration does not affect the lawfulness of the prior processing of personal data.
   
   Withdrawal of consent is ineffective to the extent necessary for the proper provision of services or provisions of an ongoing contract, including complaint proceedings. In this case, the withdrawal of the above-mentioned consent becomes effective upon resignation from services, termination of the contract or complaint process.
   
   Despite the effective withdrawal of consent to the processing of data, the Company is entitled to process them to the extent necessary for:

   • pursuing claims related to the concluded contract;
   • fulfillment of the legal obligation incumbent on the Company;
   • performance of a task realized in the public interest or in the exercise of public authority vested in the Company;
   • purposes resulting from legitimate interests realized by the Company or by a third party, except where these interests are overridden by the interests or fundamental rights and freedoms of the data subject.
8. H.
   Right to non-discrimination: this is the right to non-discriminatory treatment for exercising the User’s privacy rights. The Company will not discriminate against any User who addressed the Company with the User’s request to exercise their rights under this section, by offering them different pricing or services, or by providing them with a different level or quality of services, based solely upon such request.
9. I.
   Right to appeal: If the Company denies the User’s request to exercise their rights, the User can appeal that decision. Appeals should be directed to the contacts indicated in Section CONTACT INFORMATION hereof. The User shall include the date and location of the original request, a reference to the record that was denied, and their name and return address. If your appeal is denied, the Company will provide instructions on how to contact the respective agencies to submit a complaint if required by the applicable law.

1. 2
   RIGHTS FOR USERS RESIDING IN CALIFORNIA

The User who is the consumer under the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), in addition to the rights mentioned above, has the right to:

1. A.
   Know/Access - request the Company to disclose:

   • the categories of personal information it has collected about that consumer;
   • the categories of sources from which the personal information is collected;
   • the business or commercial purpose for collecting, selling, or sharing personal information;
   • the categories of third parties to whom the business discloses personal information;
   • the specific pieces of personal information it has collected about that consumer;
   • the categories of personal information that the business sold or shared about the consumer and the categories of third parties to whom the personal information was sold or shared, by category or categories of personal information for each category of the third-party parties to whom the personal information was sold or shared; and
   • the categories of personal information that the business disclosed for a business purpose, and for each category identified, the categories of third parties to whom it disclosed that particular category of personal information, including for a business purpose.
2. B.
   Opt out of the sharing of personal information for cross-context behavioral advertising. For the ways to opt out, please see subsection Opt-out of section GENERAL LIST OF RIGHTS.
3. C.
   Know and limit use of sensitive personal information, which includes the right to:

   • Be informed about if the Company collects sensitive personal information, the categories of sensitive personal information to be collected and the purposes for which the categories of sensitive personal information are collected or used and whether such information is sold or shared.
   • Request the Company to limit the use or disclosure of sensitive personal information to only that which is necessary to provide the Services, as is reasonably expected by an average consumer. Please note that certain exceptions outlined in the law may apply, such as, when the collection and processing of sensitive personal information is necessary to verify or maintain the quality or safety of our Services.
     
     For the purposes of this clause, sensitive personal information that we could use in some cases shall mean:
   • Social Security or passport number (collected only in case of client claims).
   • Account log-in in combination with any required security or access code, password, or credentials allowing access to an account.
   • Precise geolocation.
   • Contents of a consumer’s mail, email, and text messages unless the business is the intended recipient of the communication.
     

1. 3
   RIGHTS FOR USERS RESIDING IN DELAWARE

The User who is the consumer under the Delaware Personal Data Privacy Act (DPDPA), in addition to the rights mentioned in section GENERAL LIST OF RIGHTS, has the right to:

1. A.
   Opt out of the processing of personal information for targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. For the ways to opt out, please see subsection Opt-out of section GENERAL LIST OF RIGHTS above.
2. B.
   Freely give, deny or withdraw consent for the processing of sensitive personal information. Please note that certain exceptions outlined in the law may apply, such as, but not limited to, when the collection and processing of sensitive personal information is necessary for the provision of the Services specifically requested by the consumer.

For the purposes of this clause, sensitive personal data that we could use in some cases shall mean:

• Precise geolocation data with precision and accuracy within a radius of 1 750 feet.

1. 4
   HOW TO EXERCISE RIGHTS

In connection with the submitted requests, NOVA POST may request additional information – to make sure you are a person who has a right to exercise the respective rights. We will only use such personal data provided in a verifiable User’s request to verify your identity or authority to make the request.

You also may designate an authorized agent to exercise your rights on your behalf. For authorized agents, please contact us with any evidence that you have been authorized by the respective User.

Keep in mind that for some US states such as California, you may only make a verifiable consumer request for access or data portability twice within a 12-month period.

Also, in the exercising of the rights under section RIGHTS OF USERS AS TO THEIR PERSONAL DATA AND HOW TO EXERCISE THEM, there could be other exceptions than the indicated above. If for any reason, the Company decides not to satisfy your request, the Company will explain the reason.

1. 5
   HOW AND WHEN WE ARE EXPECTED TO HANDLE YOUR REQUEST

We will respond to your request without undue delay, within the timeframe required by applicable law (for most of the US states this is up to 45 days). If we need more time, we will explain the reasons and how much time we need. If we deny your request, we will also explain the reasons (you may then contact the relevant authority to submit a complaint).

We do not charge a fee to process your request unless such request is manifestly unfounded or excessive. In such cases, we may charge a reasonable fee or refuse to act on the request. In either case, we will communicate our choices and explain the reasons behind them.

VI. CHILDREN’S PRIVACY

We do not knowingly collect personal data through our Services from persons under the age of 18. If you believe anyone under age 18 has provided personal information to us, please contact us as indicated in the section CONTACT INFORMATION of this Policy, and we will work to erase it.

VII. PERSONAL DATA CATEGORIES. PURPOSES OF THEIR PROCESSING

1. 1
   See below the complete list and categories of information, namely, what personal information about you we collect and how we use it:

1. 2
   To avoid any doubts, for the purposes of US laws such as the CCPA/CPRA, below is the categorization of data the Company processes:

   1. A.
      Identifiers: sender/recipient surname, first name, phone number, email address; delivery address; parcel number; account name (social media); IP address, user ID (website visitors); recruitment: name, contact details, application documents.
   2. B.
      Commercial information: delivery confirmation; content and price of products; sent messages (related to transactions); services provided (accounting documents); social media: reviews, ratings, post interactions.
   3. C.
      Geolocation data: GPS data of parcel receipt/delivery.
   4. D.
      Internet/Network activity: website visitor activity (operating system, cookies, log entries); social media: follow history, post distribution/reactions.
   5. E.
      Audio/Visual information: audio: call recordings (operator name, call metadata); video: recording date/time.
   6. F.
      Professional/Employment information: legal entity representatives: position, company affiliation; recruitment: interview notes, work permits, LinkedIn data.
   7. G.
      Sensitive personal information: Social Security Number (SSN) from accounting documents or in case of claims; financial data: bank account numbers, payment details (accounting).
   8. H.
      Inferences: social media: propensity scores (e.g., engagement likelihood).
2. 3
   Keep in mind that in some cases, the data is also processed for the purposes such as solvency control, compliance programs or sanctions.

VIII. DISLOSURE OF DATA

1. 1
   GENERAL RULES ON DATA DISCLOSURE

NOVA POST may disclose personal data:

1. A.
   to companies that are directly and/or indirectly owned or controlled by the same ultimate beneficial owners as NOVA POST within Ukraine or the European Union or outside it to ensure provision and support of the Services;
2. B.
   to companies who are contractors and service providers (e. g. transport partners, operating parcel collection points or parcel lockers) within Ukraine or the European Union or outside it for the purpose of delivering parcels from the sender to the addressee;
3. C.
   to entities that are subject to a contract for the provision of services for NOVA POST or on behalf of NOVA POST (contractors and service providers), in particular IT service providers used for storage of data;
4. D.
   banks and payment operators in order to perform the transaction (including payments made using the codes);
5. E.
   other persons or organizations based on applicable law, law enforcement officers and authorities to comply with national security requirements or as part of a legal process to protect property, or to pursue an investigation of a violation of NOVA POST principles and policies, unauthorized access or use of NOVA POST equipment, or any other illegal activity.

1. 2
   DISCLOSURE OF PERSONAL INFORMATION FOR A BUSINESS PURPOSE

We disclose personal data for business purposes: primarily to perform our contract for parcels delivery; also – for analytics and to ensure the Services work as intended, to fix errors, to protect the Services from attacks etc. In the preceding twelve (12) months, we have disclosed for a business purpose personal information from categories:

1. A.
   Identifiers.
2. B.
   Commercial information.
3. C.
   Geolocation data.
4. D.
   Internet/Network activity.
5. E.
   Audio/Visual information.
6. F.
   Professional/Employment information.
7. G.
   Sensitive personal information.
8. H.
   Inferences.

1. 3
   SALE OR SHARE OF PERSONAL INFORMATION

“Sell” means selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s personal information by the business to another business or a third party for monetary or other valuable consideration.

“Share” means sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating a consumer’s personal information by the business to a third party for cross-context behavioral advertising.

Generally, we do not sell, trade or otherwise transfer to outside parties any personally identifiable information. This does not include trusted third parties or subcontractors who assist us in operating our Services, conducting our business, or servicing the Users. Thus, we share this information in terms of CCPA/CPRA and might sometimes “sell” it within the meaning of the applicable law. Such trusted parties may have access to personally identifiable information on a need-to-know basis and will be contractually obliged to keep your information confidential.

The list of parties to whom we “sell” or “share” data within the meaning of the CCPA/CPRA and similar applicable state laws is limited to those indicated in the subsection Third-Party Cookies of section COOKIES. INFORMATION ON DATA AUTOMATICALLY COLLECTED THROUGH THE WEBSITE below. The categories of information shared are personal information from category “Identifiers” and “Internet/Network activity”. To opt out of the sale/share of your information, check the RIGHTS OF USERS AS TO THEIR PERSONAL DATA AND HOW TO EXERCISE THEM section above, or use cookies management settings as described below in COOKIES. INFORMATION ON DATA AUTOMATICALLY COLLECTED THROUGH THE WEBSITE section.

IX. STORAGE PERIOD AND DATA DELETION

1. 1
   NOVA POST processes personal data only for the time necessary to achieve the purpose for which they were collected. The period of data storage is determined based on the following requirements:

   1. A.
      operational requirements: the period in which the information is necessary to provide the Services;
   2. B.
      legal requirements: the period in which NOVA POST is required to store data for a specified period of time to comply with the law;
   3. C.
      legitimate interests of NOVA POST: the period in which data is processed for the purpose of their implementation, in particular to establish and pursue possible claims in connection with the Services provided.
2. 2
   Archived data is available only to authorized employees. After the expiry of the period authorizing data storage, they are permanently deleted.
3. 3
   For storage periods, please see the table below:

X. COOKIES. INFORMATION ON DATA AUTOMATICALLY COLLECTED THROUGH THE WEBSITE

1. 1
   Using websites may be associated with the use of cookies by NOVA POST servers. Cookies are Internet data, in particular text files, which are stored on the end device (computer, mobile phone, tablet) of the User. They contain the name of the website of their origin, their unique number and the time of storage on the end device. Cookies are used to provide the Controller with statistical information about the visits of Users, the activity of Users and the way of using the Service. They allow customization of content and services according to the User's preferences.
2. 2
   As to our use of cookies, see the most important information below:

   1. A.
      Information received. The cookie mechanism is not used to obtain any information about Users, except for information about their behavior on the pages of the Website. However, each time the User accesses the Website, the data is saved in a log file. The scope of temporarily stored data includes:

      1. a)
         the IP number of the computer from which the query was received;
      2. b)
         domain name;
      3. c)
         date and time of access;
      4. d)
         http response code;
      5. e)
         visited pages;
      6. f)
         name and version of the operating system;
      7. g)
         browser name and version;
      8. h)
         screen resolution
   2. B.
      Our Website uses two main types of cookies: session cookies and persistent cookies. Session cookies are temporary files that are stored on the Website User's end device until the user logs out, leaves the Website or closes the software (web browser). Persistent cookies are stored on the Website User's end device for the time specified in the cookie settings or until they are deleted by the Website User.
   3. C.
      By their functions, the Website uses such types of cookies:

      • "Necessary" cookies to enable the use of services available on the Website, such as authentication cookies used for services that require authentication on the Website, cookies used to ensure security, such as are used to detect authentication fraud on the Website;
      • "Functional and analytical" cookies that allow "remembering" settings selected by the User and personalize the User interface, for example, regarding the User's selected language or region, font size, appearance of the website and allow collecting information about how to use the Website pages, etc.;
      • "Advertisement" cookies that allow Website Users to provide advertising content that is more relevant to their interests.
   4. D.
      By their ownership, the Website uses first-party (used by our Company) and third-party cookies (used by third-party providers).

      • Third-Party Cookies. “Advertisement” and “analytical” cookies placed on the end device of the Website User may come from the Controller's partners and be used for analytical and marketing purposes. Detailed information on this can be found in the privacy policy of each partner. Our placing of such cookies could mean we are “selling” or “sharing” personal information with such partners within the meaning of some US states laws. The Controller uses the following analytical and marketing tools provided by partners:

        1. a)
           Google Ads and Google DoubleClick – files used by Google to configure advertising in its services, for example in the search engine or to display advertising on the Internet, more information: Google Advertising Services. Our use of such third party cookies could be regarded as sale/share of your personal information.
        2. b)
           Facebook pixels – files used to match advertising on Facebook services to the individual preferences of the recipient, more information: Facebook Cookies Policy. Our use of such third party cookies could be regarded as sale/share of your personal information.
        3. c)
           Google Tag Manager – files used to experiment with advertisement efficiency of websites, more information: Google Data privacy and security. Our use of such third party cookies generally could not be regarded as sale/share of your personal information.
        4. d)
           Google Analytics – files used to analyze how users use the website, create statistics and reports, more information: Google Analytics security and privacy principles. Our use of such third party cookies could be regarded as sale/share of your personal information.
        5. e)
           HotJar – files used for Website analytics and user interaction. Our use of such third party cookies generally could not be regarded as sale/share of your personal information.
        6. f)
           YouTube – files used to track the views of embedded videos on YouTube pages, to store the user's video preferences and some other similar features related to YouTube videos (where they are embedded on the Website). Our use of such third party cookies could be regarded as sale/share of your personal information.
   5. E.
      Cookie banner and blocking of cookies. When you first visit the Website, you will be shown information about the use of cookies. You can always opt-out from not necessary cookies or opt-in back by changing the cookie settings in your browser or changing settings on the banner itself. If you configure the cookie banner available or browser settings so that cookies are not accepted, except for mandatory ones, no data will be saved on your computer. Information stored in cookies will not be sent to NOVA POST. Keep in mind that limiting the use of cookies may affect some of the functionalities available on the Website.
   6. F.
      Do Not Track. Under the California laws, a “Do Not Track” (DNT) privacy setting notifies websites and services that the user does not want certain information about their webpage visits collected over time or across different websites or online services. We do not respond to or honour DNT signals or similar "do not track" mechanisms transmitted by web browsers because there is no agreed industry standard. However, you have the option to opt out, and we respect certain technologies like the “Global Privacy Control” (GPC), depending on the state you reside in. GPC is a browser-based signal that allows you to communicate your privacy preferences automatically. If you enable GPC in your browser or via an extension, it sends a signal to us indicating that you do not want your personal data sold or shared. We respect this signal and will honor your opt-out preferences as required by applicable privacy laws. To enable GPC, please check your browser settings or install a compatible extension.

XI. COMPLAINTS

If you have a complaint about the manner in which NOVA POST have handled your data please submit it in writing, providing as much detail as possible, using the contact details at Section CONTACT INFORMATION of this Policy above. NOVA POST will work with you to resolve any issues without delay.

XII. CHANGES TO THIS POLICY

Any changes NOVA POST may make to this Policy in the future will be posted on the Website. The new terms (especially material changes) may be displayed on-screen and you may be required to read and accept them to continue your use any / all of NOVA POST Services.