2. Who is responsible for your data

The GANT Group (“GANT”) consists of several different companies. For most processing activities, Gant AB (“GANT AB”), located at Box 27021, 10251 Stockholm, will be the data controller responsible for your data. However, there will be instances, where GANT Switzerland AG Gmbh (“GANT Switzerland”) will be the data controller. For each processing activity, we will inform you who the data controller will be.

If you have any questions about how GANT processes your personal data, our Data Protection Officer can be contacted by sending your request to datenschutz@gant.com or by using our contact form.

3. What personal data do we collect?

The types of personal data Gant collects about you will depend on how you interact with, including with services you use and what information you choose to provide. Please note that where we require your personal data for the performance of a contract and you fail to provide the required data, it will result in the contract being rendered impossible. The table below contains a non-exhaustive list of the types of personal data Gant may collect:

Processing Activity:

• Account Administration

Personal Data: Name, age, gender, email address, phone number, physical address, purchase history

• Customer Service

Personal Data: Name, email address, phone number, physical address, payment details, order details, reviews or feedback

• Direct Marketing & Analytics

Personal Data: Name, email address, phone number, marketing preferences, website interactions, IP address

• Managing Purchases

Personal Data: Name, email address, phone number, physical address, payment details, order details, reviews or feedback.

• Events / Competitions Management

Personal Data: Name, age, email address, phone number, physical address.

• CCTV Surveillance

Personal Data: CCTV imagery

4. Cookies and Similar Tracking Technologies

Gant uses cookies and similar technologies to enhance site navigation, analyse site usage, and deliver a more personalised experience and relevant advertising. For more information on our use of cookies and similar tracking technology, see our cookie notice here.

Categories of Cookies:

We use the following cookie categories:

A. Technically necessary cookies

These cookies are essential for the operation of the website and enable basic functions such as:

• Shopping cart management and checkout process

• Secure login and session management

• Security features and fraud prevention

• Saving your cookie preferences

Legal basis: Article 6(1)(f) GDPR (legitimate interest)

B. Analytics cookies

These cookies help us to understand and improve the use of our website (Microsoft Clarity, Google Analytics 4).

Legal basis: Article 6(1)(a) GDPR

C. Marketing cookies

These cookies enable personalized advertising (Google Ads, Google Remarketing).

Legal basis: Article 6(1)(a) GDPR

Consent and Withdrawal:

On your first visit to our website, a cookie banner will appear, allowing you to grant or refuse your consent. You can withdraw your consent at any time with effect for the future:

• Via our cookie settings (link in the website footer)

• By email to: uk.customerservice@gant.com

• By deleting cookies in your browser settings

Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Use of Microsoft Clarity:

We use Microsoft Clarity to obtain information about your use of our website, e.g. which parts of a website you find particularly interesting or how you navigate between pages. This allows us to analyse and regularly improve our offering and make it more interesting for you as a user. For this analysis, the aforementioned basic data, such as cookies, data on the device/browser, IP addresses and website or app activities, timestamps are stored on your device and used with an ID that contains personal information about usage.

We have entered into a contract with Microsoft for the use of the tool. Microsoft acts as an independent data controller. Gant are the data controller for the internal processing of statistical data, but Microsoft is responsible for other data processing. Microsoft and its partners may also process and evaluate the collected data, including for advertising purposes, for which Microsoft is responsible. The information obtained about your use of our website is transferred to a Microsoft server in the USA and processed there. Microsoft has signed up to the EU-US Privacy Framework to safeguard these transfers.

The legal basis for the processing of the information (which takes place for a maximum of 13 months) is your consent (Article 6(1)(a) GDPR), i.e. the integration only takes place with your consent. You can withdraw your consent at any time without affecting the lawfulness of the processing up to the time of withdrawal. The easiest way to withdraw your consent is to use our Consent Manager.

Further information on the scope of the services provided by Microsoft Clarity can be found at https://clarity.microsoft.com.

Microsoft provides more detailed information on data processing in its privacy policy at the following address: https://privacy.microsoft.com/en-us/privacystatement

Tracking via Google Analytics 4

This website uses Google Analytics 4, a web analytics service provided by Google Inc. ("Google"), which allows us to analyse website usage. GA4 collects data through cookies and other technologies and uses an event-based data model. Information about your use of the website may be transmitted to and stored by Google on servers located in the United States.

In GA4, IP anonymization is always enabled by default, meaning your IP address is shortened before being stored and processed. On our behalf, Google uses this information to evaluate your use of the website, compile reports on website activity, and provide other services relating to website and internet usage. The IP address transmitted by your browser as part of Google Analytics will not be combined with other data held by Google.

You can prevent the storage of cookies by adjusting your browser settings; however, please note that in this case you may not be able to use all the functions of this website in their entirety. Additionally, you can prevent Google from collecting and processing data generated by cookies and related to your use of the website (including your IP address) by downloading and installing the browser add-on available at the following link:

http://tools.google.com/dlpage/gaoptout?hl=en

We use GA4 to analyse and regularly improve the use of our website. The statistical data we collect allows us to improve our services and make them more relevant to you as a user. Google also processes your personal data in the USA and has signed up to the EU-US Privacy Framework to safeguard this transfer. The legal basis for the storage and further evaluation of the data collected using GA4 is your consent pursuant to Article 6(1)(a) of the GDPR. You can withdraw your consent at any time with effect for the future:

• Via our cookie settings (link in the footer)

• By email to: uk.customerservice@gant.com

• By installing the browser add-on to deactivate Google Analytics: https://tools.google.com/dlpage/gaoptout?hl=en

• By adjusting your browser settings to block cookies

Google Analytics 4 is implemented on our website via the so-called Google Tag Manager. Google Tag Manager is also a product from Google that allows us to manage website tags via a unified interface. Tag Manager is a cookieless domain and does not collect any personally identifiable information, although the transmission of IP addresses to Google is required. The tool triggers other tags that in turn can collect data; Google Tag Manager does not have access to this data. If deactivation has been made at the domain or cookie level, it remains in effect for all tracking tags implemented via Google Tag Manager. This is where the use and performance of Tag Manager is measured. We have activated the anonymization of IP addresses before forwarding to Google. The collected data is deleted after two years.

More information is also available at: http://tools.google.com/dlpage/gaoptout?hl=sv or https://business.safety.google/privacy/?hl=sv

Google Ads/Google Remarketing

We use Google Ads to promote our attractive offers on external websites using advertisements (so-called Google Ads). These advertisements are delivered by Google via so-called "ad servers". Ad server cookies are used in this process, which makes it possible to evaluate performance parameters such as ad impressions, clicks and conversions. This allows us to determine the success of individual advertising measures in relation to data from the advertising campaigns.

If you visit our website via a Google ad, Google Ads stores a cookie on your device. These cookies are not intended to personally identify you. By integrating these cookies, Google receives information that you have visited the corresponding page on our website or clicked on one of our ads. If you are registered with a Google service, Google can associate your visit with your account. Even if you are not registered with Google or are not logged in, it is possible that the provider will learn about and store your IP address. Using Google's remarketing technology, users who have already visited our website and shown interest in our offers are targeted again with relevant advertising on pages within the Google partner network.

More information about data protection at Google can be found at: https://business.safety.google/privacy/?hl=sv%27 and https://services.google.com/sitestats/sv.html.

If after giving your consent, you no longer wish to see ads tailored to your interests, you can withdraw your consent in our cookie settings or disable cookies in your browser. You can also inform Google directly for the future via the following link: https://www.google.com/settings/ads/onweb/?hl=sv

Additionally, you can opt out of Google retargeting via the Network Advertising Initiative (NAI): http://optout.networkadvertising.org/

Read more about how Google processes personal data here.

5. How do we use your personal data?

How Gant processes your personal data will depend on how you interact with us and which services you use. We may process your personal data for any of the following purposes:

Processing Activity:

• Account Administration

Purpose:

• To offer a personalised experience with our services;

• To manage your account registration;

• To distribute loyalty points and accrued benefits;

• To maintain your account by keeping your order history and loyalty membership status up to date; and

• To ensure your data is kept secure.

Lawful Basis: The processing of this data is necessary for the performance of a contract between Gant and our customers.

Data Controller: Gant AB

• Customer Service

Purpose:

• To provide support to customers by answering questions, handling complaints and warranty issues etc;

• To improve our communications, products and services by collecting statistical data and analysing trends.

Lawful Basis: The processing is necessary for Gant’s legitimate interest in providing customers with a complaint handling services and otherwise responding to customer queries.

Data Controller: Gant AB

• Direct Marketing & Analytics

Purpose:

• To send you newsletters and other marketing materials about our services, offers, and benefits via email, text message, post, push notifications, our website or other platforms

• To customise your experience on our website or other platforms based on your behaviour and preferences

• To analyse customer habits on our website, as well as their reactions to marketing campaigns, in order to improve our products and services

Lawful Basis:

• Existing Customers (“Soft Opt-In”): Processing is carried out in accordance with Regulation 22(3) of the Privacy and Electronic Communications (EC Directive) Regulations 2003, which allows sending of commercial communications provided that you have not previously object. You may exercise your right to object at any time.

• Non-Customers: Processing is carried out solely with your explicit consent, in accordance with Regulation 22(2) of the Privacy and Electronic Communications (EC Directive) Regulations 2003.

Data Controller: Gant AB or Gant UK depending on the entity carrying out the marketing campaign

• Managing Purchases

Purpose:

• To process your order and handle payment transactions;

• To manage delivery of your orders, warranty issues, returns or refunds;

• To contact you with information about your order such as order confirmation, delivery information etc;

Lawful Basis: The processing of this data is necessary for the performance of a contract between Gant and our customers.

Data Controller: Gant AB (for online purchases) or Gant UK (for instore purchases)

• Events / Competitions Management

Purpose:

• To organise and manage participation in competitions or events;

• To communicate before and after competitions and / or events.

Lawful Basis: The processing of this data is done with the consent of the data subject

Data Controller: Gant AB or Gant UK depending on the entity organising the competition or event

• CCTV Surveillance

Purpose: To protect the company, our customers, premises, property and personnel from crime and illegal activities.

Lawful Basis: The processing is necessary for Gant’s legitimate interest to prevent, detect and identify crime on their premises.

Data Controller: Gant UK

6. Who do we share your personal data with?

We may disclose your personal information to outside organisation. Below is a list of the categories of recipients we share your personal data with:

Gant Group

We share your personal data with other members of the Gant Group, including Gant franchisees to ensure you can enjoy your membership benefits while shopping online and in-store and to keep you informed of any special offers about new or existing Gant products.

Our Representatives / Service Providers

Our employees, agents and contractors including companies that provide services in relation to telecommunications and postage, data storage, document production and destruction, IT and IT security, customer loyalty programmes, fraud detection, making and receiving payments, data analysis and management information, risk analysis, complaints handling, marketing communications, targeted marketing and market research.

Your Representatives

Any party you have given us permission to speak to (such as a relative, friend or legal advisor) and other people or companies associated with you that are authorised by you to act on your behalf.

Government, Statutory and Regulatory Bodies

Where required by law, we may need to share your data with law enforcement or with state regulators or authorities.

We may also disclose your personal to the following recipients or categories of recipients:

• In the event that we sell or buy any business or assets, in which case we may disclose your personal data to the prospective seller or buyer of such business or assets.

• If Gant or substantially all of its business or assets are acquired or transferred to a third party whether in the event of a merger, reorganisation, transfer of undertakings, receivership, liquidation or other winding up or any other similar circumstances, in which case personal data held by it about its customers will be one of the transferred assets.

• If we are under a duty to disclose or share your personal data in order to comply with any law, legal obligation or court order, or in order to enforce rights under the GDPR or other agreements.

• To protect our rights, property or safety, our customers, or others. This includes exchanging information with other companies and organisations for the maintenance and security of the site and services.

7. International Transfers

Some of our suppliers who provide us with services such as IT security or data hosting services may process some or all of your personal data outside the European Economic Area (“EEA”). Gant will take all reasonable steps necessary to ensure that your information is treated securely and in accordance with our privacy notice. If we transfer personal data to a third party outside the EEA, we will ensure that the transfer agreement is based on an approved transfer mechanism, such as the European Commission’s standard contractual clauses or an Adequacy Decision.

8. Retention

We only keep your personal data for as long as is necessary for the purpose for which it was originally obtained, and / or in accordance with any requirements imposed by the law. This means that the period of time for which we store your personal data may depend on the type of data we hold. To determine the appropriate retention period of personal data, we consider the amount, nature and sensitivity of the personal data, the purposes for which we process your personal data and any legal requirements to retain your data. The table below outlines a general summary of our retention periods:

Processing Activity:

• Account Administration

Retention Period:Until you delete your account or there has been no activity in the last 24 months

• Customer Service

Retention Period: 24 months

• Direct Marketing

Retention Period:Until you withdraw your consent

• Website Analytics

Retention Period: 24 months

• Managing Purchases

Retention Period: 24 months after your purchase to handle any complaints or warranty issues

• Events / Competitions Management

Retention Period: Until the event or competition has concluded

CCTV Surveillance

Retention Period: One month

9. Security

Gant will take all steps reasonably necessary to ensure that your personal data is treated securely and in accordance with this privacy notice. We will use all reasonable efforts to put in place security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors, other recipients and other third parties who have a business need to know. They will only process your personal data on our instructions, and they are subject to a duty of confidentiality.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our website; any transmission is at your own risk. Once we have received your information, we will use reasonable procedures and security features to try to prevent unauthorised access. We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

10. Data Subject Rights

As a data subject, you will have the following rights in relation to the processing of your personal data. Please note that these rights are not absolute, and restrictions may apply in certain situations.

Upon receipt of a valid request, we will have one calendar month to respond to your request, with the possibility of extending by two further months if the request is complex. Where we extend our response, we will notify you of our reason for doing so.

Right to Access

You have the right to know what personal data we hold about you, why we hold the data and how we process your personal data.

When submitting your request, please provide us with as much detail as possible to help us identify the information you wish to access (i.e. date range, subject of the request).

Right to Rectification

You have a right to request that the personal data held in relation to you is up to date and accurate. Where information is inaccurate or incomplete, we encourage you to contact us to have this information rectified.

Right to Erasure

You have the right to have Gant erase the personal data we have collected about you. Your right of erasure will apply in the following circumstances:

• The data is no longer need the data for the purpose that it was originally collected;

• You withdraw your consent (and where no other lawful basis applies);

• You object to the processing and Gant has no overriding legitimate interest in the data;

• We have collected the data unlawfully; or

• The data must be erased to comply with a legal obligation.

This right will not apply where we are required to process personal data in certain circumstances including the following:

• Compliance with a legal obligation, such as the performance of a contract or compliance with certain legislation.

• For the performance of a task carried out in the public interest.

• Archiving, research or statistical purposes in the public interest.

• The establishment, exercise or defence of legal claims.

Right to Object

You have the right to object to the further use of your personal data where:

• The lawfulness of the use of your personal data by us is reliant on the basis of our legitimate interests.

• Where the data is non-sensitive and being used for reasons in the public interest.

• Where the data is being used for direct marketing purposes.

Right to Restriction

You have the right to restrict the extent for which your personal data is being used by us in circumstances where:

• You contest the accuracy of the personal data (we will restrict the processing of the personal data until we verify the accuracy of the personal data).

• The processing of personal data is unlawful, but you wish to restrict the use of the data rather than erase it.

• Where personal data is no longer required by us, but you require the retention of the data for the establishment, exercise, or defence of a legal claim.

• You object to the processing of the personal data (we will restrict the processing of the personal data while we verify our legitimate grounds for the processing which may override your interests, rights and freedoms)

Right to Data Portability

You have the right to the provision of all personal data, which you provided to us, provided to you in a structured, commonly used and machine-readable format where:

• The lawfulness of the use of your personal data by us is reliant on the basis of a contract.

• The lawfulness of the use of your personal data by us is reliant on the provision of your consent.

• The data is being utilised by fully automated means.

You may also request that we send this personal data to another legal entity where technically feasible.

Right to Object to Automated Decision-Making

You have a right not to be subject to a decision based solely on automated processing or profiling, where such decisions would have a legal effect or significant impact on you.

Currently, we do not employ any systems which use automated decision making or profiling on data.

Right to Withdraw Consent

Where we are processing your personal data on the legal basis of consent, you are entitled to withdraw your consent at any time. Where you have withdrawn your consent, this does not affect the legality of the processing which took place when we had your consent.

Right to Complain

If you are not satisfied with our use of your personal data, or our response to any request by you to exercise any of your data subject rights, then you have the right to complain to the Information Commissioner’s Office or the competent supervisory authority for your country of residence. Please see below the contact details for the Information Commissioner’s Office.

Information Commissioner’s Office

Website: https://ico.org.uk/make-a-complaint/

Telephone: 0303 123 1113

11. How to exercise your rights

If you would like to exercise your rights or contact us regarding our processing of your personal data, you can do so by contacting uk.customerservice@gant.com or by using our contact form.