PERSONAL DATA PRIVACY POLICY

This Policy (the "Policy") details the policy of Etam Lingerie SA and Etam SCE SAS, subsidiaries of the Etam Group, and/or its affiliates (hereinafter "we", "our", "Etam") in relation to personal data and cookies. The purpose of this Policy is to inform you of the conditions under which Etam collects your personal data, the reasons why it collects your data, the use made of it and your respective rights. It applies to all information provided by you or collected by Etam during your interaction with us.

As controller, Etam attaches great importance to the protection of and respect for your privacy. As this is an important subject, we invite you to read the entire Policy carefully to learn and understand how we process your personal data. This Policy lays down the rules for the personal data of all our actual and potential customers, regardless of the channel in which it is collected.

When we refer to our Platform, we refer in particular to one of the digital and/or physical channels and/or media you can use to interact with us via the website www.etam.com (the "Site"), mobile application, physical Etam stores or by mail or telephone.

When using our Platform, Etam may be required to process personal data about you, which we have collected from you or which you have provided to us.

When you use our Platform, you are subject to the Policy in force and the said use confirms your acceptance of the Policy. Since we may amend our Policy at any time in accordance with the conditions given in Article 6, we invite you to check it before each time you use our Platform.

1. GENERAL INFORMATION

The parties responsible for processing your personal data are:

• ETAM LINGERIE,
Société Anonyme (public limited company), with registered office at 57/59 rue Henri Barbusse, 92110 Clichy, France.
Filed with the Nanterre Business Register under number 478 355 753
• ETAM SCE,
Société par Actions Simplifiée (simplified public limited company), with registered office at 57/59 rue Henri Barbusse, 92110 Clichy, France.
Filed with the Nanterre Business Register under number 450 966 445

Accordingly, we have put in place guidelines and guarantee the supervision of the processing and protection of your personal data.

Through our Platform, you may be invited to share personal data with Etam, for example, when creating a customer account, ordering products or subscribing to our newsletter.

Etam may also collect certain information relating to how you browse the Site under the conditions described in more detail in the "Cookies" section below.

In accordance with applicable rules, the law firm POGGI, Anne-Sophie Poggi, court lawyer, 50 rue Etienne Marcel, 75002 Paris, has been appointed Data Protection Officer (DPO).

2. DATA CONCERNED

The data we collect and use varies depending on the products, services and features you are looking for. The personal data we collect or that you decide to provide to us includes in particular:

• identification data, such as your first name, last name, telephone numbers, your home address to deliver your order, e-mail address to send you our newsletter, photographs you send or images from video surveillance systems when you visit our stores;
• financial and payment data, such as payment card data, data about your purchases, orders and returns;
• electronic identification data available on or from your computer (such as "cookies" and "IP addresses"). Your electronic identification data enables your identification or geolocation (accurate only in terms of town or city), your connection terminal or the pages visited on the Site during your browsing and is generally insufficient in itself to identify you in a nominative way. For further information on the information collected, please refer to Article 5 on cookies;
• data about your online or in-store purchases (e.g. type, quantity and price of products purchased);
• data about your tastes and preferences, such as your preferences regarding our collections, colours, habits and size.

When you submit your application for a job vacancy in the Etam group posted on our Platform, you may be required to provide us with data such as your full name, sex, address, e-mail address, training and professional qualifications and experience.

3. YOUR RIGHTS

In accordance with applicable regulations, you have different rights concerning your personal data. These rights may be exercised directly at any time by contacting us at privacy@etam.com or Etam Lingerie, Customer Service, 57/59 rue Henri Barbusse, 92110 Clichy, simply indicating the reason for your request and the right you wish to exercise. In case of doubt about your identity, we may ask you for a copy of your identity document or other documentation. Your rights include:

• The right of access: The right to request a copy of the personal data we have about you. If your request is unjustified or abusive, we may charge you a fee for the request.
• The right of rectification: The right to request the correction of any incorrect personal data we have about you. We would like to remind you that if you have a customer account, you can access the section corresponding to your personal data to modify or update it. You must make sure the data is true and accurate. You also agree to inform us of any changes or modification to the data. We also remind you that, in principle, you must provide only your own personal data and not that of a third party. Any damage or loss caused as a result of inaccurate or incomplete information in our data collection forms is the exclusive responsibility of the Platform user.
• The right to erasure: The right to request the erasure of your data if one of the following conditions is met:
- o your personal data is no longer necessary for the corresponding purposes;
- o you withdrew your consent and there is no other legal basis for continuing to process your personal data;
- o you have exercised your right of opposition in a valid manner;
- o processing your data is not legal; or
- o your personal data must be erased to comply with a legal obligation.
However, there are cases where you cannot exercise your right to erasure, even if one of the said conditions is fulfilled (in particular, where the processing of your data is necessary for freedom of expression and information, compliance with a legal obligation, challenge/exercise/defence of a right in court or for statistical, archival purposes of public interest or scientific or historical research).

To delete your customer account, simply send your request to us at privacy@etam.com or Etam Lingerie, Customer Service, 57/59 rue Henri Barbusse, 92110 Clichy. However, we would like to inform you that such erasure will automatically lead to the loss of any points you may have accumulated if you have joined our loyalty programme.
• The right of opposition: The right to oppose the processing of your personal data based on our legitimate interest for reasons relating to your particular situation. If necessary, we will cease processing your data unless we have a legitimate reason to continue to do so. If your data is used for market research, you have the right to oppose without having to justify your opposition.
• The right to limitation of processing: The right to request, in certain cases, the temporary suspension of the processing of some of your data or the storage thereof, if necessary, for longer than required.
• The right to portability: If the processing of your personal data is based on your consent or the performance of the contract and the data is processed automatically, you will have the right to ask to receive your data in a structured, commonly used and machine-readable format, so that it can be transferred to another entity, provided it is technically possible.
• The right to set guidelines for what is to happen to your personal data after your death.

You also have the right to lodge a complaint with a supervisory authority, in particular the authority in the Member State in which your habitual residence or place of work is located or where the infringement was committed if you consider that the processing of your personal data constitutes a breach of applicable rules. In France, the supervisory authority is: Commission Nationale de l’Informatique et des Libertés (CNIL - French National Commission for Information Technology and Civil Liberties), 3 Place de Fontenoy - TSA 80715 - 75334 PARIS CEDEX 07, Tel. 01 53 73 22 22

You also have the right to withdraw your consent at any time for any processing based on consent. To simply unsubscribe from our newsletter, simply click on the unsubscribe link on any of our e-mails.

4. PERSONAL DATA PROCESSING BY ETAM

4.1 Purposes and legal bases of our data collection

The following table shows how Etam uses your personal data (the "purpose") and the corresponding legal basis (the "legal basis"):

PURPOSE: WHY WE PROCESS YOUR DATA	LEGAL BASIS: THE BASIS FOR THE PROCESSING	MORE DETAILS
Process and track your orders for products on the Site	Performance of the contract	To perform the contract of purchase or service level agreement you have entered into with us, issue invoices, process payment of the products you purchase, deliver them to you and organize any returns after the purchase.
		When you use our Try at Home service to purchase products. Please read the "Try at Home Service Terms and Conditions" section of our General Terms and Conditions for more information.
		As part of the purchase, processing and use of a gift card. Please read the "Gift Card" clause in our General Terms and Conditions for more information.
	Consent	Certain processing of your personal data associated with the purchase process, such as the storage of your payment card data for future purchases, is only activated when you give your consent to such processing.
	Legitimate interest	When you make a purchase, we may perform the necessary checks to detect and prevent fraud.
Allow and process your registration as a user of our Platform and/or your loyalty programme membership	Consent Performance of the contract	By creating a user account and/or joining the loyalty programme, you provide certain personal data necessary to identify yourself and gain access to the various features, services and products available to you as a registered user. The processing of your data is therefore required for the general conditions of our Platform.
	Consent Performance of the contract	If you subscribe to our loyalty programme and apply for the installation of your Etam loyalty card in your mobile wallet, i.e. Apple Wallet or Google Pay, you authorize us to provide your identification data (full name and loyalty card number) and information about your purchases of Etam products.
Marketing and marketing research	Consent	If you subscribe to the newsletter, you consent to our processing your data to manage your subscription and/or send you information about our products and/or services, as well as marketing messages through various media, such as e-mail or SMS. If you participate in a contest via the Platform or our social media, you consent to the use of your data in the contest and the delivery of any prizes you have won. Unless you give your express consent, we do not use the data we collect for our own or our trading partners’ advertising. If you agree in advance to the applicable legal terms and conditions (including the social media you use), we will be able to repost any photographs you share publicly or with us on our Platform or social media. With your prior consent, we may record your preferences (such as size or colour) to personalize your Etam experience.
Marketing and marketing research	Legitimate interest	We have a legitimate interest in contacting you by telephone or by post to inform you of our commercial offers, provided you have not objected thereto when collecting your data (please note that you may oppose them at any time by sending an e-mail to privacy@etam.com). Furthermore, unless you disagree, we have a legitimate interest in sending you electronic commercial communications (e.g. SMS or e-mail) if you are already a customer and if such communications concern only products or services similar to those we have already provided to you. We also have a legitimate interest in carrying out actions to measure the impact that our advertising or marketing campaigns may have on you (statistics, return on investment studies...) In order to adapt our marketing actions to your preferences and needs, provide you with a better service and meet your expectations (personalization of our services through our Platform and messages), we believe that in some cases we have a legitimate interest in profiling the data you provide and the information we have about you from the cookies you have agreed to install on your terminal, including your browsing on the Site, your preferences (language, colour, type of product, etc.) and your shopping history. Functional cookies are essential to your browsing on our Site and allow us to send you an email to offer you the opportunity to recover your unfinished cart if you are a potential or registered customer. Please read Article 5 "Cookies" for more information.
Reply to any questions, requests or claims sent through Customer Service channels.	Performance of the contract	If your request relates to your order or product(s) purchased through our Platform, the processing is necessary for the performance of the contract and the correct provision of the after-sales service.
	Legitimate interest	We believe we have a legitimate interest in processing your personal data as strictly necessary to duly process your requests and complaints and reply to your questions. The data we process may include photographs if you have sent any to us with your request or complaint. For the completion of after-sales service procedures (e.g. gestures of goodwill), we may contact you by SMS or e-mail. When you call our Customer Service, telephone conversations may be recorded for quality assurance and training purposes.
	Legal obligation	If your question relates to the exercise of the rights set out in Article 3 "Your rights" or to a claim concerning our products or services, we must process your data to comply with our legal obligations.
Compile anonymous statistics on site visits	Legitimate interest	We believe we have a legitimate interest in analysing the ergonomics and quality of our Platform in order to improve our users’ experience and offer our customers a better quality Platform. Please read Article 5 "Cookies" for more information.
Conduct customer satisfaction surveys and customer studies.	Legitimate interest	We believe we have a legitimate interest in conducting surveys and studies to analyse our customers’ satisfaction in order to improve the quality of our products and services.
Recruitment management	Performance of the contract (pre-contractual measures) Legitimate interest	We may process and respond to any job application you send us.

4.2 Data storage period

The period during which your data is stored is determined by the purpose for which it was collected. If the purpose is achieved, your data will be archived, erased or anonymized (especially for statistical purposes).

Initially, the data will be stored for a period not exceeding the period necessary for the purpose for which it was collected:

TYPE OF PROCESSING	STORAGE PERIOD
Contract management (processing of order, delivery, provision of service or supply of goods, invoices and payments), including the loyalty programme.	Storage for the performance requirements of your contract, and then for the period necessary to establish proof of a right or contract; such data may be archived in accordance with the provisions of the Commercial Code on the storage period for books and documents created in connection with commercial activities and the Consumer Code on the storage of contracts entered into electronically.
Payment bank card data	Erasure once the transaction has been completed, i.e. as soon as payment is actually made, which may be deferred until receipt of the product, plus, where applicable, the 14-day withdrawal period (during which you may change your mind) for purchases on our Site. If you pay by bank card, the card number and date of validity may nevertheless be kept in interim archives as evidence in the event of a possible claim regarding the transaction for a period of 13 months from the date of debit or 15 months in the case of a deferred debit card. Subject to your express and informed consent, your credit card data (except for the visual cryptogram) may be kept longer for payment for future purchases, without exceeding the period required for such purpose. In other words, your data may be stored until your consent is withdrawn and/or your bank card data expires.
Processing our file on actual and potential customers	Storage for 3 years from your last contact with us (for example, for actual customers, a purchase or, for potential customers, a click on a hyperlink sent in an e-mail) or until you withdraw your consent.
Your questions to Customer Service	Storage for the time required to process your question. Recordings of telephone conversations with our Customer Service are kept for a limited period (maximum of 6 months) unless there is an exception (e.g. investigation, fraud or legal reasons).
Your electronic identification data (your connection logs, subject to your agreement and your terminal set-up parameters, through the use of cookies and other trackers on our Site).	Storage in accordance with applicable regulations for a period not exceeding 13 months. For more information on cookies, how they work and how you can disable them, see section "5. Cookies".
For staff recruitment and management	Storage for two years from the last contact with the unsuccessful candidate. If the candidate is selected, the data necessary for staff management shall, as a matter of principle, be stored throughout the employment relationship unless otherwise provided by law or regulations.

Secondly, regardless of the time it takes to achieve the purpose for the data processing, we may be justified in archiving your data securely and under restriction for a limited period of time and for a number of reasons:

• To comply with a legal obligation to store data (for example, the storage of personal data for accounting purposes is 10 years).
• To ensure protection against possible liability for processing your personal data. In order to manage pre-litigation and litigation, we may archive your data as evidence throughout the period during which such liability may arise (corresponding limitation period: civil, commercial, etc.).

Once the storage period has elapsed and any actions statute-barred, your personal data will be erased or anonymized.

4.3 Data recipients

Your personal data is intended for those of Etam’s services related to your requests. However:

• When you order a product on the Site, the personal data you provide with the order is for Etam and other companies belonging to the Etam Group (such as our warehouses) or those of its subcontractors responsible for processing the order.
• The processing of your personal data is authorized for third parties we use to provide certain services. These include:
- o providers of technical, logistical, transport and delivery services;
- o customer service and marketing providers;
- o payment service providers and fraud detection and prevention entities.
• We may share your data with certain trading partners only when you give your consent.

In any case, there are no transfers outside Europe and Etam does not transmit your personal data unless:

• Etam has to share the information with third parties to provide you with the service you are requesting; or
• Etam is required to provide your information by a court or other administrative authority; or
• you have given your prior consent to your information being shared.

In this case, your personal data will be transferred out of Europe with the appropriate safeguards and protection for the security of your data.

Etam may be required to transmit personal data about you to court and police authorities, regulatory authorities, public bodies or third-party companies in compliance with a court order, summons, formal notice, search or other legal or regulatory obligation or request. Such transfers may also be made for the purpose of protection against fraud and the investigation of offences.

4.4 Data security

Etam has endeavoured to take reasonable precautions to protect the confidentiality, integrity and availability of the personal data it processes and to prevent it from being distorted, damaged, destroyed or accessed by unauthorized third parties. Technical and organizational security measures have been put in place for this purpose.

However, Etam cannot fully control the risks associated with how the Internet works and informs Internet users of the risks involved in its use and operation.

The technical storage of your personal data will be centralized with the following providers:

• oXya - Ile-de-France and Hauts de France;
• Salesforce Commerce Cloud - Ireland;
• Amazon Web Service - Germany and Ireland;
• Jaguar Networks - Provence-Alps-Côte-d’Azur;
• OVH - Hauts-de-France;
• Actito - Belgium.

Etam attaches the utmost importance to the protection and security of its IT systems. Tools have been put in place so that Etam can detect possible security breaches. Such tools may result in accidental access to personal data by security teams. The data will be collected and processed exclusively to manage the said breaches and in accordance with applicable regulations on personal data protection.

5. COOKIES

5.1 What is a cookie?

A cookie is a text file that can be saved in a specific space on the hard drive of your electronic device when you view an online service using your browser software. A cookie file allows the sender to identify the terminal on which it is stored during the period of validity or registration of the cookie in question.

5.2 Cookies sent on the Site

According to your preferences, when you log on to the Site, Etam may install various cookies to recognize the browser you use during the period of validity of the cookie in question.

The cookies sent are for the following purposes:

• compile statistics and number of visits to and use of the various pages on the Site (topics and content visited, browsing) so that Etam can improve the interest and ergonomics of the services and the visibility of the published content;
• enable or facilitate your browsing around the Site or provide you with the online communication services you request when you browse and, accordingly:
- o adapt the layout of the Site to the display preferences of your terminal (language used, display resolution, operating system used, etc.) when you visit the Site, depending on the display or reading hardware and software of your terminal;
- o store information about a form you have completed on the Site (registration or access to your account) or access to products, services or information on the Site (subscribed service, contents of a shopping basket, wishlist, etc.);
- o allow you to access reserved and personal spaces on the Site, such as your account, through identifiers or data you have previously provided;
- o implement security measures, such as when you are asked to re-connect to a content or service after a certain amount of time;
- o implement security measures, such as when you are asked to re-connect to a content or service after a certain amount of time;

5.3 Cookies on the Site sent by third parties

Etam may include computer applications on the Site from third parties that allow you to share Site content with others or to make your query or give our opinion regarding any content of the Site known to such other persons.

The sending and use of cookies by third parties are subject to the privacy policies of such third parties.

Etam does not control the processes used by social media to collect information about how you browse the Site. Etam invites you to consult the privacy policies of these social media to learn about the purpose of their use, including advertising, and the browsing information the application buttons may collect. These protection policies should enable you to make your choices with these social media, in particular by setting up your user accounts for each one.

The Site may contain cookies sent by third parties (communication agency, audience measurement company, etc.) and allow third parties to collect browsing information about the Terminals logging on to the Site during the period of validity of such cookies, in particular in order to measure the effectiveness of the search engine paid referencing campaigns.

5.4 Your cookie settings

You have several options for managing cookies. Any settings you apply may change your Internet browsing and access conditions for certain services that require the use of Cookies.

At any time, you may choose to express and modify your wishes regarding cookies as follows.

You can configure your browser software so that cookies are saved on your terminal or, on the contrary, rejected either systematically or depending on the sender.

You can also set up your browser software so that you are asked to accept or reject cookies as they are sent before they can be stored on your terminal. For more information, see "Cookie settings for the browser you are using"

For more information about cookies, follow this link

To change your cookie settings, see the "Cookie Settings" section in the Site footer.

(a) The Cookies Agreement

The registration of a cookie on a terminal is essentially subject to the will of the terminal user, who may express and modify it at any time and free of charge using the options offered by his browser software.

If you have accepted the registration of cookies on your terminal in your browser software, cookies embedded in the pages and contents you have visited may be temporarily stored in a specific space on your terminal. They will be readable only by the sender.

(b) Rejection of cookies

If you reject cookies being stored on your terminal or if you remove cookies from your terminal, you will no longer be able to enjoy a number of features that are necessary to browse certain areas of the Site.

This would be the case if you tried to access content or services that require you to identify yourself. This would also be the case when, for technical compatibility purposes, Etam or its providers cannot recognize the type of browser your terminal uses, its language and display settings or the country from which your terminal appears to be connected to the Internet.

Where applicable, Etam shall not be liable for any consequences of a downgraded provision of its services resulting from our inability to record or consult the cookies necessary for the said services when you have rejected or deleted them.

(c) Cookie settings for the browser you are using

To process cookies and your options, each browser settings are different. They are described in your browser's help menu, which will show you how to change your cookie preferences.

5.5 If you share your terminal with others

If your terminal is used by more than one person and the same terminal has more than one browser installed, Etam cannot ensure that the services and advertisements for your terminal correspond to your own use of the terminal and not to that of another user.

Where applicable, sharing the use of your terminal with others and configuring your browser's settings for cookies is your choice and responsibility.

For more information on cookies and their use, you can consult the file provided by the Commission Nationale de l’Informatique et des Libertés (French National Commission for Information Technology and Civil Liberties) at https://www.cnil.fr/fr/site-web-cookies-et-autres-traceurs.

6. AMENDMENT OF THE POLICY

Etam may be required to amend the Policy and will ensure that you are informed thereof either by special reference on the Site or by personal notice, especially in our newsletters.

7. PERSONAL DATA POLICY FOR MINORS

The Site does not target minors as its public. However, access to the Site is not prohibited as it does not contain content prohibited for persons under the age of 18.

Any processing of personal data of a minor under 15 years of age based on consent shall only be considered lawful if such consent is given or authorized by the legal representative of such minor.

If information is collected on a minor by the Site, the minor's legal representative may contact privacy@etam.com to correct, modify or erase such information.

Lightly Lined

SUCCESS Bra no. 5 - underwire plunge bra

CHERIE CHERIE Lightly lined wireless bra

SUBLIME Bra no. 4 - lightly lined plunge bra

PERFECT COTON Lightly lined wireless bra

HAPPILY Lightly lined wireless bra

SUCCESS Bra no. 5 - Underwire plunge bra

PASSION Wireless bralette

DESTINEE Lightly lined wireless bra

VOYAGE Lightly lined wireless bra

SKY Lightly lined wireless bra

DESTINEE Lightly lined wireless bra

GROOVY Lightly lined wireless bra

LOUANGE MESH Bra no. 5 - underwire plunge bra

MIDNIGHT Lightly lined tulle and silk bra

SKY Lightly lined wireless bra

PURE MESH Lightly lined balconette bra

MIDNIGHT Lightly lined tulle and silk bra

OMBRELLE Bra no. 5 - underwire plunge bra

AIME Lightly lined wireless bra

SOMETIMES Lightly lined mastectomy bra

PURE 360 Lightly lined mastectomy bra

PANAMA Lightly lined wireless bra

PURE 360 Lightly lined mastectomy bra

SOMETIMES Lightly lined mastectomy bra

DESTINEE Lace bralette

SKY Bra no. 5 - underwire plunge bra

PANAMA Lightly lined wireless bra

SKY Lightly lined wireless bra

SKY Lightly lined wireless bra

PURE FIT® Bra no. 5 - underwire plunge bra, a-c cup