Privacy Policy

Last updated: 28th September 2026

Introduction

This Privacy Policy (“Privacy Policy”) explains how Ample Technologies Private Limited (“Ample”, “we”, “us” or “our”) collects, uses, stores, shares and otherwise processes personal data when you access or use the LEGO® Licensed Website in India, currently accessible at LEGO®.in (“Licensed Website”), create an account, purchase or pre-book products, contact customer support, participate in permitted promotions or otherwise interact with the Licensed Website.

Ample Technologies Private Limited is the officially licensed website partner of The LEGO® Group in India and operates the Licensed Website as an independent retailer under licence from LEGO® Singapore Pte. Ltd. (“LEGO®”). Ample acts as an independent seller of products purchased through the Licensed Website and is not an agent of The LEGO® Group.

Ample is responsible for processing personal data collected by it through the Licensed Website in accordance with applicable data protection laws, including the Digital Personal Data Protection Act, 2023 (“DPDP Act”) and rules made thereunder, as and when applicable.

Please read this Privacy Policy carefully to understand how your personal data is processed.

By accessing the Licensed Website, you acknowledge that you have read and understood this Privacy Policy. Where processing of your personal data requires your consent under applicable law, such consent will be sought separately through an appropriate affirmative action. Your mere access to or continued use of the Licensed Website will not, by itself, constitute consent for processing activities for which consent is required under applicable law.

Personal data we may collect

• Identity data: Name, date of birth or age-related information where required.

• Contact data: Email address, telephone number, billing address and delivery address.

• Account data: Account details, login-related information and account preferences.

• Transaction and order data: Products purchased or pre-booked, order history, orders placed, fulfilled, returned or cancelled, invoices, refunds and transaction-related information.

• Payment-related data: Payment method and payment status and other payment-related information received from or processed through authorised payment service providers.

• Delivery data: Delivery address, delivery status, tracking information and store pick-up information.

• Customer service data: Enquiries, complaints, grievances, feedback and communications with customer support.

• Preference and interaction data: Product preferences, survey responses, communication preferences and interactions with the Licensed Website.

• Device and technical data: IP address, browser type, device identifiers, operating system and security/log information.

• Cookie and usage data: Pages visited, time spent, interactions with the Licensed Website and other information collected through cookies and similar technologies.

How we collect personal data

We may collect personal data:

• directly from you when you create an account, place an order or pre-booking, provide delivery or billing details, contact us, submit feedback or otherwise interact with the Licensed Website;

• automatically through the Licensed Website and permitted cookies and similar technologies;

• through our customer service and grievance redressal channels;

• from payment gateways, logistics providers and other authorised service providers involved in processing or fulfilling your transaction;

• from LEGO® or relevant entities of The LEGO® Group where necessary for an agreed functionality or service and where such disclosure and processing is permitted under applicable law; and

• from other authorised third parties where such third party is lawfully permitted to provide the information to us and we are permitted to process it.

Why we process your personal data

We may process your personal data for the following specified purposes:

• creating, administering and securing your customer account;

• processing and fulfilling purchases and pre-bookings;

• processing payments and verifying transaction status;

• arranging shipment, delivery or store pick-up;

• processing cancellations, returns, replacements and refunds;

• providing order confirmations, invoices, delivery notifications and other transactional communications;

• responding to customer enquiries, complaints and grievances;

• providing after-sales and product-related support;

• preventing, detecting and investigating fraud, misuse, unauthorised activity and security incidents;

• maintaining, securing and improving the functionality and performance of the Licensed Website;

• conducting analytics and preparing reports relating to the operation and performance of the Licensed Website;

• complying with applicable legal, regulatory, tax, accounting and compliance requirements;

• providing personalised experiences, recommendations or marketing communications where permitted under applicable law and, where required, based upon your consent;

• facilitating services, reporting and other arrangements with LEGO® as described in this Privacy Policy; and

• such other purposes as may be specifically notified to you at or before collection of your personal data and, where required, after obtaining your consent.

We will process personal data only for the purpose for which it was collected or for another purpose permitted under applicable law.

Sharing of personal data with LEGO®

The Licensed Website is operated by Ample under licence from LEGO®. As part of this arrangement, certain information relating to customers and the operation of the Licensed Website may be shared with or made accessible to LEGO® Singapore Pte. Ltd. and/or relevant entities of The LEGO® Group, subject to applicable law.

Depending upon the relevant processing activity, such information may include:

• name and contact information;

• information relating to orders placed, fulfilled, returned or cancelled;

• transaction-related information;

• website interaction and usage information; and

• other information relating to your interaction with the Licensed Website where necessary for a specified and disclosed purpose.

Such information may be processed for purposes including:

• administration and operation of the Licensed Website;

• reporting concerning the performance of the Licensed Website;

• analytics;

• improvement of customer experience;

• security, fraud prevention and compliance; and

• other specific purposes communicated to you and permitted under applicable law.

Where LEGO® or another LEGO® Group entity proposes to use your personal data for its own direct marketing purposes or another purpose requiring consent under applicable law, such processing will be undertaken only where the requisite consent or other basis permitted under applicable law is available.

The contractual arrangements between Ample and LEGO® do not limit your rights under applicable data protection laws.

Other parties with whom we may share personal data

In addition to LEGO® as described above, we may disclose personal data, where necessary and permitted under applicable law, to:

• payment gateways, banks and payment aggregators;

• logistics, courier and fulfilment providers;

• technology, hosting, cloud, cybersecurity and website service providers;

• customer service providers;

• professional advisers, auditors and consultants;

• Ample group entities where necessary for providing or supporting the relevant service;

• government authorities, courts, regulators or law-enforcement authorities where required under applicable law; and

• any other person where you have consented to the disclosure or the disclosure is otherwise permitted or required under applicable law.

Service providers processing personal data on our behalf are required to process such personal data in accordance with applicable contractual requirements and data protection obligations.

Cross-border transfer of personal data

Certain recipients of personal data, including LEGO® Singapore Pte. Ltd., relevant entities of The LEGO® Group and/or authorised service providers, may be located outside India. Accordingly, personal data collected through the Licensed Website may be transferred to, stored in or accessed from countries outside India.

Any such transfer, storage or access will be undertaken in accordance with applicable Indian data protection laws and any restrictions or requirements prescribed by the Government of India concerning the transfer of personal data outside India.

Where applicable, Ample will implement appropriate contractual, organisational and technical measures in connection with such processing.

Marketing communications

We may send you marketing and promotional communications regarding products, offers or services only where permitted under applicable law and, where consent is required, after obtaining your consent.

Marketing consent will be obtained separately from your acceptance of the Terms & Conditions applicable to purchases through the Licensed Website.

You may withdraw your marketing consent or unsubscribe at any time through the unsubscribe mechanism provided in the relevant communication or through another mechanism made available by us.

Withdrawal of marketing consent will not prevent us from sending transactional or service-related communications that are necessary in connection with your account, orders, payments, deliveries, returns, refunds, customer-service requests or other transactions.

Where your personal data is proposed to be shared with or used by LEGO® or another LEGO® Group entity for its own direct marketing activities requiring consent under applicable law, the requisite consent will be obtained before such processing.

Cookies and similar technologies

The Licensed Website may use cookies and similar technologies for functionality, security, analytics, personalisation and other permitted purposes.

Where required under applicable law, non-essential cookies and similar technologies, including those used for analytics, personalisation or advertising, will be deployed only after obtaining the required consent.

Cookies and technologies that are strictly necessary for the operation, security or functionality of the Licensed Website may be used as permitted under applicable law.

You may manage or withdraw your applicable cookie preferences through the cookie settings or preference mechanism available on the Licensed Website.

Further information concerning cookies used on the Licensed Website is available in our Cookie Notice.

Children’s personal data

The online purchasing and account facilities available through the Licensed Website are intended for persons who are 18 years of age or above and legally competent to enter into a contract.

We do not knowingly collect or process personal data of children for account creation, online purchasing, profiling, behavioural monitoring or targeted advertising.

Where any feature, promotion, activity or digital experience specifically involves a person below 18 years of age and requires processing of that child's personal data, we will comply with applicable requirements concerning verifiable consent of the child's parent or lawful guardian and other requirements applicable to children's personal data before undertaking such processing.

We will not undertake tracking or behavioural monitoring of children or targeted advertising directed at children except to the extent expressly permitted under applicable law.

A parent or lawful guardian who believes that a child's personal data has been provided to us inappropriately may contact us using the details provided below.

LEGO® account and loyalty programmes

Ample's customer account and/or loyalty programme, where offered, is separate from any account or loyalty programme operated by The LEGO® Group unless expressly stated otherwise.

Where the Licensed Website enables customers to use a LEGO® Account to log in, link accounts or access another LEGO®-related functionality, we will provide appropriate information concerning the personal data exchanged between Ample and LEGO®, the purposes of such processing and any choices available to you before such functionality is activated, where required under applicable law.

How we protect personal data

We implement appropriate technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss, misuse or destruction.

Depending upon the nature of the processing, such measures may include:

• access controls and authentication measures;

• encryption, masking or other appropriate data-protection measures;

• monitoring and logging;

• cybersecurity and fraud-prevention controls;

• backup and recovery arrangements;

• security incident management procedures; and

• contractual safeguards with service providers processing personal data on our behalf.

Access to personal data is limited to persons who require such access for legitimate and authorised purposes and is subject to appropriate confidentiality and security requirements.

You are responsible for maintaining the confidentiality of your account credentials and should promptly notify us if you suspect unauthorised access to or use of your account.

How long we retain personal data

We retain personal data only for as long as necessary to fulfil the specified purpose for which it was collected or processed or for such longer period as may be required or permitted under applicable law.

Retention periods may differ depending upon the category of personal data, nature of the transaction and applicable legal, regulatory, tax, accounting or dispute-resolution requirements.

When the specified purpose is no longer being served and retention is not otherwise required or permitted under applicable law, the relevant personal data will be erased or anonymised in accordance with applicable law and our internal retention requirements.

Transfer of data on expiry or termination of the licensed website arrangement

If Ample's right to operate the Licensed Website expires or is terminated, certain personal data associated with the Licensed Website may, where permitted under the applicable contractual arrangements and applicable law, be transferred or made available to LEGO® Singapore Pte. Ltd. and/or relevant entities of The LEGO® Group.

Any such transfer, including cross-border transfer, and subsequent processing will be undertaken only to the extent permitted under applicable data protection laws and consistent with the privacy notices provided to you and consents obtained from you, where required.

Where applicable law requires further notice or consent for such transfer or subsequent processing, such requirements will be complied with before the relevant processing takes place.

Consent and withdrawal of consent

Where processing of personal data is based on your consent, such consent will be obtained through clear and affirmative action in accordance with applicable law.

Where required under the DPDP Act, consent will be free, specific, informed, unconditional and unambiguous and will signify your agreement to the processing of personal data for the specified purpose.

You may withdraw your consent at any time through the mechanism provided for that purpose or by contacting us using the details below.

The process for withdrawing consent will be comparable in ease to the process through which consent was provided.

Upon withdrawal, we will cease processing based upon such consent and cause our processors, where applicable, to cease such processing, unless continued processing is required or otherwise permitted under applicable law.

Withdrawal of consent does not affect the lawfulness of processing undertaken before such withdrawal.

Withdrawal may affect our ability to provide a particular service or functionality where processing of the relevant personal data is necessary to provide that service or functionality.

Your rights

Subject to applicable law, including the DPDP Act and rules made thereunder, you may have the right to:

• Access / information: obtain information concerning the personal data being processed by us, processing activities undertaken and the identities/categories of persons with whom such personal data has been shared, as applicable under law;

• Correction, completion and updating: request correction of inaccurate or misleading personal data, completion of incomplete personal data and updating of your personal data;

• Erasure: request erasure of personal data in circumstances permitted under applicable law;

• Withdrawal of consent: withdraw consent where processing is based on consent;

• Grievance redressal: raise a grievance concerning our processing of your personal data; and

• Nomination: nominate another individual to exercise your rights in accordance with applicable law in the event of your death or incapacity.

The exercise of these rights is subject to applicable legal conditions, limitations and exemptions.

To exercise your rights, please contact us using the details provided under Grievance Redressal below.

Grievance redressal

If you have any questions, concerns or grievances regarding this Privacy Policy or the processing of your personal data, please contact:

Grievance officer

Ample Technologies Private Limited

4th Floor, NCC Windsor, Airport Road

Bengaluru – 560064, India

Email: [●]

Contact number: [●]

We will acknowledge and address grievances within the timelines prescribed under applicable law.

Where available under applicable law, you may approach the competent data protection authority after availing the grievance redressal mechanism provided by Ample.

Changes to this privacy policy

We may update this Privacy Policy from time to time to reflect changes in our processing activities, services, contractual arrangements or applicable law.

The latest version of this Privacy Policy will be published on the Licensed Website together with its effective or last updated date.

Where a material change affects the manner in which your personal data is processed, we will provide appropriate notice as required under applicable law. Where processing for a new purpose requires consent, such consent will be obtained separately and will not be inferred merely from your continued use of the Licensed Website.

Contact us

For questions regarding this Privacy Policy or our processing of personal data, you may contact:

Ample Technologies Private Limited

4th Floor, NCC Windsor, Airport Road

Bengaluru – 560064, India

Support email: buildwithus@lego.in

Support number: 07965081983

Support hours: 9:30 AM to 10:00 PM daily

For general customer-service matters relating to orders placed through the Licensed Website, you may contact us through the customer-support details displayed on the Licensed Website.