1. PEPE JEANS PRIVACY POLICY

This Privacy Policy has been developed taking into account the following regulations:

• Regulation (EU) 2016/679of the European Parliament and of the Council, of 27 April 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter, the GDPR).
• Organic Law 3/2018 , of 5 December, on Data Protection and digital rights (hereinafter, LOPDGDD).
• (Hereinafter, the “Data Protection Regulation”).

This Privacy Policy is applicable to the processing of personal data that Pepe Jeans, S.L. carries out through the website [suspicious link removed] (hereinafter, the “Site”). We recommend careful reading before using the Site or providing us with your personal data through it.

The objective of this Privacy Policy is to inform natural persons who provide their personal data through the Site about the specific aspects related to the processing of their data, the purposes of the processing, the contact details to exercise their rights, the data retention periods, and security measures, among other points.

INFORMATION TO THE USER

Who is the controller of your data?

In terms of data protection, PEPE JEANS, S.L. (hereinafter, “PEPE JEANS”) must be considered the Data Controller in relation to the processing identified in this policy.

The identification details of the owner of this website are listed below:

• Data Controller: PEPE JEANS, S.L.
• Postal address: Carretera Laureà Miró 403-405. 08980 Sant Feliu de Llobregat, Barcelona, Spain
• E-mail: privacy@pepejeans.com

The data subject may contact the Data Controller with any questions or needs they may have regarding data protection.

What categories of data are processed?

All information collected by PEPE JEANS will be processed fairly, lawfully, and transparently.

Likewise, the data requested in each of the processing activities carried out will consist only of those strictly essential to fulfill the intended and informed purpose in each case. Thus, your collected data will be adequate, relevant, and not excessive in relation to the purposes for which they are processed in each case. Therefore, your personal data will be collected for specified, explicit, and legitimate purposes, and not subsequently processed in a manner incompatible with those purposes. Furthermore, they will be updated whenever necessary.

Within the scope of the different processing activities carried out by PEPE JEANS, the following types of data are collected:

• Identification and contact data.
• Payment data.
• Personal characteristics.
• Information on your purchase preferences.
• Other information you wish to share with us in your communications or requests.
• Image captured through video surveillance cameras.

WHERE DOES THE PERSONAL DATA COME FROM?

As a general rule, personal data is always collected directly from its owner (when you contact us through our channels, when you register as a PEPE JEANS user, when you purchase a product through the Site, or when you subscribe to receive our commercial communications).

However, if, in certain exceptions, the data is collected through third parties, entities, or services other than the data subject, this fact will be transmitted to the data subject through the informative clauses contained in the different means of collecting information and within a reasonable period or in the first communication made to the data subject.

FOR WHAT PURPOSES DO WE PROCESS PERSONAL DATA?

In general terms, personal data is processed for the following purposes:

• User registration management: The information you provide us in the registration form will be processed for the management of users on our platforms and for the management of the loyalty program. For this purpose, we will process your name and surname(s) and your e-mail address. After registration, and if you make a purchase, you can consult your order history, redeem gift cards or discount vouchers, wish lists, ratings, or alerts, if you voluntarily configure them.
• Management, fulfillment, and execution of the purchase contract: Specifically, personal data will be used for the formalization of the purchase contract; for the management of transaction payment; to contact you in case of any incident related to your order; for the management of billing and delivery of tickets and purchase invoices; for the management of returns of purchased products; to inform you about the availability of the requested products; and/or for the management of coupons or gift cards that you use on the website or in our stores. For this purpose, we will process your name and surname(s), e-mail address, telephone number, billing address, information about the transaction, the chosen payment method, and the necessary banking information for payment. Additionally, we will process the information you wish to add in requests related to your order.
• Sending commercial advertising communications and our newsletter: We may send you, via electronic means, our newsletter or other commercial communications related to our products, benefits, promotions, abandoned cart communications, or events related to products you have previously purchased. For this purpose, we will process your name and surname(s) and your contact details. We may store certain information about the products you purchased through our e-commerce platform to send you personalized commercial communications based on your preferences and to inform you about products that may be of interest to you.
• Contests: You can participate and register for the contests we organize through the Site or in our stores. For this purpose, we will process the personal data specifically indicated in the regulations of the respective contest.
• Contact: In order to respond to your request, we will process the essential data, which generally corresponds to contact data (e-mail) and data related to your order or the incident you communicate to us, as well as to respond to any request you make to us through the contact forms available on the Site. We may request additional information, if necessary, to handle your requests.
• If you contact us via WhatsApp, please note that we may see your profile photo or status, unless you have configured this tool to prevent them from being visible to us. This information is part of the WhatsApp interface and is not related to the purpose for which we process your data when you send us a message through that application. For this reason, we will not use your WhatsApp photo or status under any circumstances.
• When using social networks to transmit your questions to us, avoid entering personal data; remember that we have no control over the data entered on these platforms, so we advise you to carefully read the privacy policies of the social network through which you interact.


• Surveys: For conducting customer service and/or product quality surveys, carried out by the Controller or by any of the companies in the Controller's group. With the aim of improving these services, we will process your personal data to obtain information about our products or about the attention provided by our customer service.
• Prevention, detection, and repression of illegitimate activities or activities contrary to the terms of use, or that endanger information security or PEPE JEANS: We may process your personal data to detect and prevent any type of abuse in the use of our services, as well as fraudulent activities, denial of service attacks, spam sending, unauthorized access to our users' accounts, as well as any other practice that is contrary to the General Conditions of Use of PEPE JEANS or that endangers the security of information or the integrity of PEPE JEANS, being able to cancel accounts that are contrary to the law or our Terms and Conditions. For this purpose, we may process your identification data (e.g., IP address and other technical information) and contact details, your payment data, and other information that you voluntarily decide to include in your communications with us.
• Video surveillance (applicable to stores or showrooms): If you remain within the recording field of the video surveillance cameras installed in our facilities, your image will be recorded. The purpose of this processing is to ensure the safety of people, property, and facilities. Informative notices have been included in all establishments where this video surveillance is carried out, and there are no hidden cameras.
• Notwithstanding the above, all the purposes for which each of the processing activities are carried out are described in the informative clauses incorporated in each of the data collection channels.
• your payment data, and other information that you voluntarily decide to include in your communications with us.
• Video surveillance (applicable to stores or showrooms): If you remain within the recording field of the video surveillance cameras installed in our facilities, your image will be recorded. The purpose of this processing is to ensure the safety of people, property, and facilities. Informative notices have been included in all establishments where this video surveillance is carried out, and there are no hidden cameras.

WHAT IS THE LEGAL BASIS FOR DATA PROCESSING?

As a general rule, prior to the processing of personal data, PEPE JEANS will process personal information based on the following grounds for legitimization:

• Compliance with legal and regulatory obligations: by way of example and not limitation, the following will apply: the General Law for the Defense of Consumers and Users, General Tax Law, Corporate Income Tax Law, Audit Law, VAT Law, Civil Code, Commercial Code, as well as the existence of a specific law or regulation that authorizes or requires the processing of the data subject's data.
• Execution of a Contract: for the prior management of a contracted service or product, development of the execution of a contract, or subsequent management derived from such operations.
• Consent: the processing of your data will be based on your consent when you contact us through the channels made available for this purpose, given that you do so voluntarily. Also when you subscribe to receive commercial communications (by clicking on a box in the subscription to the newsletter or to other commercial communications in another contact form), as well as when you sign up to participate in a contest (by clicking on a box, on an "I accept" button, or through the signing of the corresponding document). Additionally, we inform you that we will only use personal information under the terms of this Privacy Policy and, as a rule, we will request your consent for uses for purposes other than those for which you initially granted them.
• Legitimate interest: data processing based on the controller's legitimate interest will be established, mainly, for the sending of commercial communications or events about products or services similar to those contracted, in cases where there is a prior contractual relationship between you and PEPE JEANS. Also for the prevention of illegal activities or others related to the security of PEPE JEANS. Likewise, PEPE JEANS also has a legitimate interest in processing data for video surveillance purposes, based on guaranteeing the safety of people, property, and facilities. For more information on the balancing of interests analysis carried out to legitimize these processing activities, you can request it through privacy@pepejeans.com.

2. HOW LONG DO WE PROCESS PERSONAL DATA?

Personal data is processed for the time necessary to fulfill the purpose for which it was collected:

• While the provision of the service is maintained.
• While your requests are being addressed and, if necessary, to carry out the respective follow-up of them.
• In the case of sending commercial communications based on your consent, while you are interested in receiving these communications and remain subscribed to our distribution lists. If commercial communications are sent based on a prior contractual relationship, we will keep your information while the relationship is in force.
• In the case of contests, your information will be stored for the duration of the contest.
• Images collected through video surveillance cameras will be kept for a maximum period of thirty (30) days, after which they will be automatically deleted, without the blocking obligation indicated in the previous paragraph being applicable. Exceptionally, recordings may be kept for a longer period if a security incident is detected or there are indications of the practice of a crime, being held until their resolution or requirement by the competent authorities.

Once the established period criteria are met, the data will be canceled. This cancellation will result in the blocking of the data, being kept only at the disposal of Public Administrations, Judges, and Courts, to address possible liabilities arising from the processing, for the prescription period of these; once this period ends, the information will be destroyed.

3. WITH WHOM DO WE SHARE PERSONAL DATA?

PEPE JEANS may communicate your personal data, in relation to the aforementioned purposes, to:

Essential service providers to provide you with our services: (e.g., computer hosting companies or with the entity AWWGroup, S.L., which provides us with operational and business-related services). In any case, these entities have signed a confidentiality agreement and will only process your personal data following our instructions and never for their own purposes or for purposes other than the provision of their services to PEPE JEANS.

Public Authorities:

We may share data and any other information in our possession or to which we can access through our systems with the competent public authorities when there is a legal obligation to do so, as well as when necessary, for example, when the objective is to prevent or repress the abuse of services or fraudulent activities through our website. In these cases, the personal data you provide us will be stored and made available to administrative or judicial authorities.

In case of corporate transaction: In case of merger, acquisition, sale of all or part of its assets, or any other type of corporate transaction involving a third party, we may share, disclose, or transfer user data to the successor entity (even during the pre-transaction phase).

To third parties after aggregation or anonymization: we may disclose or use aggregated or anonymized data (i.e., data that cannot be linked to an identified or identifiable natural person) for any purpose.

To third parties with your consent or another legal basis: In case we wish to share data with third parties outside the scope of this Privacy Policy, we will always request your consent or inform you of this fact and the basis that legitimizes it.

3. ARE INTERNATIONAL TRANSFERS CARRIED OUT?

We refer to "international data transfers" when dealing with transfers of personal data outside the European Economic Area.

Some of our service providers are located in countries outside the EU. International data transfers may result in a lower level of protection than that provided by the Data Protection Regulation. However, at PEPE JEANS, we have taken steps to ensure that such transfers do not result in a lower level of protection for your personal data.

In this regard, service providers outside the EU have a valid mechanism for international transfers established in the Data Protection Regulation (e.g., having an adequacy decision from the competent authorities, having signed the European Commission's Standard Contractual Clauses, or being certified under the EU-U.S. Data Privacy Framework). Therefore, the use of these providers will not imply a lower level of protection of your personal data than you would obtain if providers based in the EU were used.

3. WHAT RIGHTS CAN YOU EXERCISE?

In accordance with European regulations, the rights you have are as follows:

• Right of access: Right to request information from the controller of a file on whether their personal data is being processed.
• Right of Rectification: Right that allows the affected person to request the modification of data that is inaccurate or incomplete.
• Right to Object: Right to object to a specific processing of your personal data or request the cessation of the same.
• Right to Automated Individual Decision-Making: Right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.
• Right to Restriction: Right to suspend the processing of the user's personal data in certain cases, as established in the applicable regulations.
• Right to Erasure or "Right to be Forgotten" Right to the erasure of the data subject's personal data, as established in the applicable regulations.
• Right to Data Portability: Right to request the data controller to provide the personal data in a structured and clear format for transmission to another controller.
• Right to lodge a complaint with the competent control authority, if you consider that the processing does not comply with current regulations.
• Right to unsubscribe from commercial communications: Remember that, at any time, you can object to receiving this type of communication by sending an e-mail to privacy@pepejeans.com. You can also choose not to receive this service by following the instructions indicated at the end of the body of each electronic communication we send.

3. HOW CAN YOU EXERCISE YOUR RIGHTS?

Data subjects may exercise the indicated rights. In this regard, you can exercise your rights through the following means:

• E-mail to privacy@pepejeans.com. We may, in certain occasions, need to request additional information (such as a copy of an identification document or another form of identification) to verify your identity.

We inform you that, in case the data subject considers that their rights have been harmed, they can lodge a complaint with the Spanish Data Protection Agency (www.aepd.es).

PEPE JEANS will attend to your request as soon as possible, taking into account the deadlines provided for in the data protection regulations.

3. WHAT COULD BE THE CONSEQUENCES OF NOT PROVIDING THE INFORMATION?

The data requested in the established fields marked with an asterisk (*) or those provided in the documents or means where the information is given, are those strictly necessary in relation to the purpose for which they are collected, either for the provision of an ideal service to the data subject, due to a legal obligation imposed on the data controller, or as a necessary requirement to enter into a contract, with the inclusion of data in the other fields being voluntary.

If all the data is not provided, it is not guaranteed that the information and services provided will fully meet your needs.

Therefore, in the event that the required data is not provided or if it is done incorrectly or incompletely, it will not be possible to attend to your request, making it totally impossible to provide you with the requested information or to carry out the contracting of the services.

Likewise, the user guarantees that the information transmitted in any of the forms is true, accurate, and corresponds to their own data of which they are the owner.

The services offered are not intended for minors under 14 years of age; otherwise, it is warned that the possible liabilities that may arise as a consequence of the use of our platforms will be the responsibility of the minor's parents or guardians.

3. SECURITY MEASURES

The security measures adopted by the e-commerce are those required in accordance with the provisions of Article 32 of the GDPR.

In this regard, PEPE JEANS, taking into account the state of the art, the costs of implementation, and the nature, scope, context, and purposes of the processing, as well as the risks of varying likelihood and severity for the rights and freedoms of natural persons, has established appropriate technical and organizational measures to ensure the level of security appropriate to the existing risk.

In any case, PEPE JEANS has implemented sufficient mechanisms to:

• Ensure the permanent confidentiality, integrity, availability, and resilience of processing systems and services.
• Restore the availability and access to personal data quickly, in the event of a physical or technical incident.
• Regularly verify, assess, and evaluate the effectiveness of the technical and organizational measures implemented to guarantee the security of the processing.

3. CHANGES TO THIS PRIVACY POLICY

Eventually, this Privacy Policy may be revised in order to reflect changes in current legislation, update the procedures for collecting and using personal information, the emergence of new services, or the exclusion of others. These changes will be effective from their publication on the website, so it is important that you regularly review this Privacy Policy in order to stay informed about the changes made.