(27/10/2023)

1. Scope of application and general information on data processing
   1. This data protection notice applies to the processing of personal data by Shirthouse Stores GmbH, whose
      address is Höpfigheimer Str. 19, 74321 Bietigheim-Bissingen, Shirthouse Handels GmbH & Co. KG,

      whose address is Peter-Floridan-Gasse 4/2, 7100 Neusiedl am See, Austria, as well as

      Shirthouse Hungary Bt.,Corvin ut. 16, 9023 Gyór, Hungary, as well as Shirthouse Switzerland GmbH,

      whose address is Fashion Fish, Unit One, Parkstrasse 4, 5012 Schönenwerd, Switzerland in their capacity

      as controllers within the

      meaning of Art. 4 GDPR. Information on the processing of personal data communicated to these companies

      voluntarily by email, telephone, post, messenger or comparable communication channels will be

      provided. The respective company on whose behalf the acting natural person is acting in the specific

      case will be responsible. This will be evident from, for example, the email signature of the person

      acting.

   2. Where you have consented to having your data processed jointly by OLYMP Companies or there is some
      other legal basis for the joint processing of your data by these companies, these companies are joint controllers
      within the meaning of Art. 26 GDPR. The general data protection notice, in particular Section 3, applies.
      By "OLYMP Companies" we mean the companies belonging to the OLYMP Group that operate our retail stores

      (OLYMP Stores KG in Germany, Shirthouse Stores GmbH in the Netherlands and Italy, Shirthouse Handels

      GmbH & Co. KG in Austria, Shirthouse Hungary Bt. in Hungary and Shirthouse

      Switzerland GmbH in Switzerland)

      and the companies belonging to the OLYMP Group that operate our

      online stores (OLYMP Digital KG, operates our online store OLYMP.COM).

   3. You can contact our Data Protection Officer by email at datenschutz@olymp.com or by writing to our
      postal address, adding the words: "The Data Protection Office".

   4. The protection of your personal data is important to us, above all for safeguarding your right of privacy in
      connection with the processing and use of this information. Personal data are processed in accordance with the
      provisions of the GDPR.

2. Duration of storage
   Your data will be used only as long as necessary for the existing customer relationship, unless you have
   given us your consent, or we have a legitimate interest in further processing. In these cases, we shall
   process your data until you revoke your consent or object to our legitimate interests. Regardless of the
   foregoing, we shall be obliged under provisions of commercial and fiscal law to store your address
   details, payment details and order details for a period of ten years.

3. Your rights
   1. You have the following rights in relation to us regarding the personal data concerning you:
      – right of access to your personal data,
      – right to rectification or erasure,
      – right to restriction of processing,
      – right to object to processing,
      – right to data portability,
      Please send your written enquiry using the aforementioned contact details.

   2. You also have the right to complain to a data privacy authority about our processing of your personal
      data.

4. Collection and processing of data communicated voluntarily
   1. Where you provide us with personal data by email, telephone, post, messenger or via comparable
      communication channels, this will generally take place on a voluntary basis. Such personal data may
      encompass your surname, first name, email address, postal address and further contact details. These
      data will be used for handling the contractual relationship, for processing your enquiries or orders (the
      legal bases being Art. 6 (1) b) and f) GDPR) and for our own market or opinion research and for our
      own advertising by post (the legal basis being Art. 6 (1) f) GDPR). The data will not be used beyond this.
      In particular, the data will not be passed on to third parties for the purposes of marketing, market
      research or opinion research.

5. OLYMP Companies (please see section 1.2) as joint controllers
   1. For the cases described in subsection 5.2, in which the OLYMP Companies belonging (please see section 1.2) are joint controllers for the data processing, an agreement under Art. 26 (1), sentence 2 GDPR has been concluded. This agreement essentially provides as follows:
      The OLYMP Companies (please see section 1.2) closely collaborate in the course of the processing of customer

      data. This also concerns

      the processing of your personal data. The Parties have jointly defined the purposes and means of this

      processing. Therefore, they are, under Art. 26 GDPR, jointly responsible for the protection of your personal data

      as regards storage, organisation and use.

      In this respect, one of the Parties will collect the data and store the data in the joint customer data pool for

      further use. The Parties will use the data only within the scope permissible by law for handling contracts, taking

      steps prior to entering into a contract, for marketing purposes and/or for analysing and improving their services

      offered.

      As part of their joint responsibility under data protection law, the OLYMP Companies (please see section 1.2)

      have agreed upon which of them will comply with which duties under the GDPR. In particular, this concerns

      exercise of the data subjects' rights and compliance with the duties to inform under Articles 13 and 14 GDPR.

      The OLYMP Companies (please see section 1.2) shall make available to you, as the

      data subject, the information required pursuant to Articles 13 and 14 of the GDPR in a precise, transparent,

      comprehensible and easily accessible form in clear and simple language free of charge. Essentially, the

      information

      will be made available by means of this data protection statement. The Parties will, without delay, mutually

      inform

      each other of legal positions asserted by data subjects. They will make available to each other all information

      necessary for answering any requests for

      information. Data privacy rights may be asserted in relation to both Parties. The Parties have agreed that you,

      as the data subject, will receive the information from the body where the rights were asserted.

   2. "Extended shop counter" (Instore Order)
      You have the possibility of using our so-called "extended shop counter" (Instore Order) at our local OLYMP

      stores. This enables us to offer you at our local OLYMP stores, via a digital platform, further goods in addition to

      those available in the store and to thus enhance your shopping experience. We process the personal details that

      you provide when placing an order exclusively for the purpose of executing and processing your order.

      Depending on whether you opt for delivery to a local shop or for home delivery, we require various details,

      which you may enter using a form. Such fields are simply so-called “mandatory fields”, which are indicated by an

      “*”.

      If you use the extended counter (Instore Order) in an OLYMP store in Austria,

      Shirthouse Handels GmbH & Co. KG, contactable at the postal at the postal address Peter-Floridan-Gasse

      4/2, 7100 Neusiedl am See, Austria, processes your personal data as the responsible party. The legal basis for

      this is Art. 6 p. 1 lit. b of the GDPR. If you conclude a purchase via the extended counter (Instore Order),

      Shirthouse Handels GmbH & Co. KG becomes your contractual partner.

      If you use the extended counter (Instore Order) in an OLYMP store in Italy, France or the Netherlands,

      Shirthouse Stores GmbH, contactable at the postal address Höpfigheimer Strasse 19, 74321 Bietigheim-

      Bissingen, Germany, will process your personal data as the responsible party. The legal basis for this is Art. 6

      p. 1 lit. b of the GDPR. If you conclude a purchase via the extended counter (Instore Order), Shirthouse Stores

      GmbH becomes your contractual partner.

      If you use the extended counter (Instore Order) in an OLYMP store in Hungary, Shirthouse Hungary Bt.,

      contactable at the postal address Corvin u. 16, 9023 Gyor, Hungary, processes your personal data as the

      responsible party. The legal basis for this is Art. 6 p. 1 lit. b of the GDPR. If you conclude a purchase via the

      extended counter (Instore Order), Shirthouse Hungary Bt. becomes your contractual partner.

      When registering for the extended counter (Instore Order), you also have the option of consenting (Art. 6 p. 1 lit.

      a of the GDPR) to marketing communications via email, telephone and SMS. The OLYMP Companies (please

      see section 1.2)

      are responsible for these communications and the associated processing of your personal data, regardless of

      where you use the extended counter (Instore Order). Consent is voluntary and can be revoked at any time using

      the contact details provided above or by post to OLYMP, reference: Datenschutzbeauftragter

      (Data Protection Officer), Höpfigheimer Straße 19, 74321 Bietigheim-Bissingen, Germany, or by email to

      datenschutz@olymp.com

6. "Click & Reserve"
   As part of our “Click & Reserve” feature, your details will be forwarded to the store you have chosen. The legal basis
   for this is processing of your reservation is Art. 6, para. 1, sub-para. b. of the GDPR. Once your reservation has been
   completed, these details will be deleted again. Your details will remain within the OLYMP Group.

7. "Stock transfer"
   For the transfer of an item requested by you, that is not in stock in your store, from another store to your store, your
   data will be processed to process the transfer and deleted again after the transfer has been processed; the legal
   basis is Art. 6, para. 1, sub-para. b. of the GDPR.

8. "Personal Shopping"
   When making an appointment by telephone, we need your first name, last name, e-mail address and telephone
   number to process the appointment. This data is deleted after four weeks.

9. Passing-on of personal data to third parties
   In principle, we shall not pass on to third parties any personal data that you communicate to us. Such
   data will be passed on only
   – within the scope of consent granted by you,
   – to commissioned subcontractors in the course of the processing of your enquiries or orders or in
   the course of use of our services; these subcontractors (e.g. transport companies) will only
   receive the data necessary for carrying out such order and will use these data only for the specific
   purpose intended;
   – to service providers in the course of commissioned data processing under Art. 28 GDPR, or
   – to entitled entities in the course of the performance of legal obligations.