Version: 1.0. Effective from: 1 May 2026.

This Notice is issued by Prodigi Group Ltd and applies to the activities of the Group, including its operating companies Prodigi (UK) Ltd, Prodigi BV, Peecho BV, Readymades Framing Ltd, Prodigi USA Inc, Prodigi Global Ltd and Prodigi Platforms Ltd. Where you have contracted with a specific operating company — for example Peecho BV through peecho.com or Readymades Framing Ltd through readymades.co — references in this document to 'Prodigi' should be read as references to your contracting operating company, acting as part of the Group, except where a specific entity is named.

'Prodigi' or 'we' means the Prodigi Group operating company providing the relevant Service to you, on behalf of itself and the wider Group as the context requires. Where the Service is provided through peecho.com, the contracting Group company is Peecho BV. Where the Service is provided through readymades.co, the contracting Group company is Readymades Framing Ltd. In all other cases, unless otherwise specified, the contracting Group company is Prodigi (UK) Ltd.

Capitalised terms used and not defined in this notice have the meaning given in the DPA.

1. How to read this notice

Prodigi operates a distributed global fulfilment network of group companies, third-party production and fulfilment partners, logistics providers and technology providers. To provide the Services, Prodigi may share Merchant Customer Data with the categories of recipients listed in section 3, in the locations listed.

Prodigi limits the data shared with each recipient category to what is reasonably necessary for that recipient to perform its role. For production and delivery in particular, Prodigi typically shares only the limited fulfilment data described in section 2.

Prodigi does not sell Merchant Customer Data and does not use Merchant Customer Data to market directly to Merchant customers.

2. Limited fulfilment data

For production and delivery, Prodigi typically discloses only limited fulfilment data, such as:

• recipient name;

• delivery address;

• contact details where required for delivery or support;

• order details;

• product configuration;

• image or artwork file required to manufacture the product;

• shipping and tracking information.

3. Recipient categories

Some recipients act as subprocessors to Prodigi, while others may act as independent controllers depending on their role, the service provided and applicable law. For example, shipping carriers, payment service providers, tax authorities and professional advisers typically act as independent controllers in respect of the personal data they process for their own purposes. The table below describes both types of recipient where relevant.

4. Production and fulfilment partners

Prodigi engages production and fulfilment partners to manufacture and dispatch orders, particularly in countries where Prodigi does not operate its own production facility. Partners receive only the information reasonably necessary to produce and ship each relevant order.

In line with clause 8.11 of the DPA, Prodigi publishes recipient categories and typical processing locations rather than a public list of named production partners. Production routing changes over time, and partner identity, capacity, capability and routing logic form part of Prodigi’s commercial and operational infrastructure. Where required by applicable Data Protection Laws, or where agreed under an enterprise or strategic platform agreement, further information about the production and fulfilment partners applicable to a Merchant’s orders may be made available subject to confidentiality obligations and reasonable scope limits.

5. International transfers

To provide the Services, Prodigi may transfer Merchant Customer Data internationally between group companies and to subprocessors and fulfilment partners. Where a Restricted Transfer requires appropriate safeguards, Prodigi uses appropriate transfer mechanisms as required by Data Protection Laws. These may include adequacy decisions, the EU Standard Contractual Clauses, the UK International Data Transfer Addendum or Agreement, or another lawful transfer mechanism.

Further information about international transfers is available on request to dpo@prodigi.com.

6. Notice of changes

Prodigi may update this notice from time to time as its business, fulfilment network and service providers evolve. Where required by applicable Data Protection Laws, Prodigi will provide notice of material changes to subprocessors. Notice may be given by updating this page, by email, through the dashboard or by another reasonable method.

Merchants who would like to be notified by email of material changes can subscribe by writing to dpo@prodigi.com.

Merchants may object to a material new subprocessor on reasonable data protection grounds within thirty (30) days of the relevant notice, in accordance with clause 8.8 of the DPA.

7. Contact

Questions or notifications relating to this notice should be addressed to dpo@prodigi.com.