Privacy Notice for the OUTLETCITY App

Last revised: November 2023

In the following we provide you with information about the processing of personal data when using the OUTLETCITY App (hereinafter the "App"). Personal data are any data that can be related to you personally, such as your name, address, e-mail address, or usage pattern.

1. Controller

1.1 The controller of the App within the meaning of Art. 4 para. 7 of the General Data Protection Regulation (hereinafter "GDPR") is OUTLETCITY AG, Hugo-Boss-Platz 4, 72555 Metzingen, Germany, service@outletcity.com.

1.2 You can reach our data protection officer at datenschutz@outletcity.com.

2. Processing of Personal Data

2.1 When using our App, we will collect the necessary personal data described below in order to enable the use of its functions. If you do not provide us with this information, you will not be able to use the App or certain parts of the App.

2.1.1 We will generate and use unique codes to identify you when you use the App (Art. 6 para. 1 lit. b GDPR), as well as to uniquely assign and analyze errors occurring in the App (Art. 6 para. 1 lit. f GDPR). Our legitimate interest lies in the analysis and handling of errors to ensure the proper functioning of the App.

2.1.2 We will process the language settings of your device so that we can make the App available to you in the correct language (Art. 6 para. 1 lit. b GDPR).

2.1.3 In addition, we will collect the following personal data in order to offer the functions of the App and to guarantee its stability and security (Art. 6 para. 1 lit. f GDPR):

• Session data (such as time and duration of App session)
• Usage data (such as accessed content, data volume transmitted, and error notices/crashes of the App), as well as
• Device and installation data (such as operating system, display size, language settings, and the version of the App).

2.2 When downloading the App, technically necessary information will be transmitted to the Google Play Store or Apple App Store, i.e., in particular the user name, email address, and customer number of your account with the App store provider, time of download, and the unique device code number. We have no influence on this data collection and therefore assume no responsibility for it. We process such data only to the extent necessary for downloading the App to your end device (Art. 6 para. 1 lit. b GDPR).

2.3 In the App we will process your "Likes", i.e., brands, stores and offers selected by you as preferred, in order to display them to you in the App and to be able to give you directions to the brands, stores and offers on the map (Art. 6 para. 1 lit. b GDPR). On the basis of this information, we will provide you with the opportunity to personalize the sorting/viewing of stores and brands on certain pages in the App. This way, you can customize the results of product category searches, the overview of all offers, and stores on the map according to your personal preferences (Art. 6 para. 1 lit. b GDPR). This information will also be used in your OUTLETCITY CLUB account if and as soon as you register for the OUTLETCITY CLUB and connect your account to the App.

2.3.1 Our offer includes certain functionalities (map function and display of available public WiFi hotspots in the vicinity) which are tailored to your location within OUTLETCITY Metzingen. These geodata are only used within the App to show you your location on the integrated map. We use this data according to section 2.3.2 to create user profiles using pseudonyms. There is no further analysis of these geodata by us. You can allow or deny the App access to your geodata at any time in the settings of your operating system. If location sharing is activated, your smartphone will display the data processing via a corresponding icon in the upper bar. Please note that we can offer you some of the functions of the App only if we know your location. You can object to this processing at any time by clicking the opt-out button in the menu "Services > Settings" in the App. To the extent that further personal data are processed in this connection, this will be done based on your consent (Art. 6 para. 1 lit. a GDPR).

2.3.2 For market research purposes and to tailor our entire services to the needs of App users we create user profiles using pseudonyms (Art. 6 para. 1 lit. f GDPR) to improve our services for you. You can object to the creation of a user profile by contacting us at the address or e-mail address shown above or the address shown in the Legal Notice or by clicking the opt-out button in the menu "Services > Settings" in the App (also see section 5.3).

2.4 We may ask you to rate our App using a dialog box included in our App so that this rating is included in the overall rating of our App in the Google Play Store or Apple App Store. For this purpose, we collect and store the following personal data from you that you have deposited in our App:

• The frequency of certain interactions with our App (e.g. Likes, see section 2.3, online purchases and purchases at OUTLETCITY METZINGEN as well as customer benefits, see section 3).

This processing of your personal data serves to obtain a satisfaction rating regarding our App (Art. 6 para. 1 lit. f GDPR).

For further processing of your rating, the respective app store provider independently collects further personal data from you, which you enter into the rating system. The processing of your personal data by the respective app store provider is carried out in accordance with their respective relevant data protection provisions. The data collected by us in accordance with this section will not be transmitted to the respective app store provider at any time.

2.5 If you contact us (e.g., at the mailing address or e-mail address shown above, see section 1.1), we will process the personal data you have provided (e.g., your name and e-mail address) in order to respond to your questions (Art. 6 para. 1 lit. f GDPR).

2.6 We will use push notifications to send you messages. In doing so, we will process a unique code (see sec. 2.1.1) based on Art. 6 para. 1 lit. f GDPR as far as we are legally permitted to do so without your consent, or otherwise based on your consent (Art. 6 para. 1 lit. a GDPR). We have a legitimate interest in informing you of special offers, terms and conditions, and innovations of OUTLETCITY METZINGEN and the App. You can object to this processing at any time by clicking the opt-out button in the menu "Services > Settings" in the App (see also section 6.3).

2.7 To the extent that your personal data are processed by the App in connection with the OUTLETCITY CLUB, the Privacy Notice of OUTLETCITY CLUB shall supplement the provisions of this Privacy Policy. When you use the App for the first time, we will provide you with an OUTLETCITY CLUB code to make it easier for you to use the App for the OUTLETCITY CLUB (Art. 6 para. 1 lit. f GDPR). The OUTLETCITY CLUB code is an OUTLETCITY customer card for the OUTLETCITY CLUB that will be issued by us in digital form. This OUTLETCITY CLUB code will however not be linked to your customer account until you register.

2.8 If you redeem the code of a shopping pass in the App, we will process your OUTLETCITY CLUB code as well as the date of redemption and the date and time of activation of the respective shopping pass on the basis of Art. 6 para. 1 lit. b GDPR.

3. Personalisation of advertising in connection with your customer account

We classify your master, location and registration data, your interactions with our online services (Website and app, e.g. clicks, search entries, shopping baskets, watch lists, likes), with customer benefits (e.g. coupons, vouchers, discount codes, club), with our e-mail services (e.g. newsletter and e-mail reminder), and also all aspects of your purchases at OUTLETCITY METZINGEN and your online purchases as well as the preferences you have given and your cookie and data protection consent management settings to your customer account, insofar as we are able to do so. This usually takes place with the addition of time information.

We do this in order to be able to present and offer you advertising that is as relevant to you as possible, such as category and product lists, brands, offers, specific products, coupons, vouchers or discount codes as well as restaurants of OUTLETCITY METZINGEN, or to limit our advertising measures towards you or to exclude you from these. Time information is also used to calculate deadlines for the deletion of data.

For these purposes, we use various methods to calculate categorised information, affinity lists and probability values from individual pieces of information, which we store with us in addition to your data record (profile information). The profiles are updated regularly with each new piece of information or in other cases.

We use the calculated profile information to decide which advertising we present to you, how often and via which channels (e.g. our and third-party websites of our advertising partners as data recipients, our e-mail newsletters, our and third-party apps of our advertising partners as data recipients, on-site promotions). The advertising may also be based on product categories, trend affinities, brands, articles, taking into account available sizes, coupons, vouchers, discount codes and the like calculated individually for you, as we calculate corresponding personalised profiles in advance. The advertising measures can be disseminated by us ourselves or by our advertising partners, to whom we send profile information as data recipients for this purpose.

The evaluation can also decide which coupons, vouchers, discount codes we send out. We also use redeemed coupons, vouchers, discount codes to measure the success of any associated advertising campaign we may run with third parties, to determine your preferences and, where relevant, to calculate the amount of any revenue-based compensation claims by our promoters or revenue-based commissions for other intermediaries, as you may also receive such coupons, vouchers, discount codes from time to time from third parties with whom we work.

We also aim to target individual customers, particularly identified TOP customers, and to continue to estimate the overall value of our customer base.

Depending on your place of residence and its proximity to OUTLETCITY METZINGEN, you will receive preferential advertising with offers from OUTLETCITY METZINGEN, omnichannel offers or purely online offers. For this purpose, your place of residence is evaluated at the level of the first digit of the postcode.

3.1 Individual information

In this context, we process your history with us (individual information):

• your shopping baskets, purchases and returns to calculate purchase and return rates
• information about whether you bought more online or more at OUTLETCITY METZINGEN
• information on which brands and categories of goods you view, search, add to the shopping basket, place on the watch list and purchase
• information on whether and which offers in the sale you view, search, add to the shopping basket, place on the watch list and purchase
• information on whether and which items you view, search, add to the shopping basket, place on the watch list and purchase, as well as how we have described these products
• information on whether and which coupons, vouchers or discount codes you use and in what amount, in particular whether you have already activated and/or used a coupon, voucher or discount code (for example a shopping pass) and via which advertising channel you received these
• information on which sizes and/or colours you view, search, add to the shopping basket, place on the watch list, purchase and/or return
• information on which payment methods you use
• information on which rewards you choose
• preference information that you deposit with us yourself
• your registrations for e-mail reminders (e.g. for sold-out goods) and what the desired e-mail reminder refers to
• time details of your initial registration, your actions on our Website and in the app and your purchases, as well as your age

3.2 Legal basis and legitimate interests

This processing of your personal data is carried out in our legitimate interest (Art. 6 para. 1 p. 1 lit. f GDPR) in presenting our customers with the most relevant advertising possible and in running successful advertising campaigns so that we can improve your shopping experience with us and so that you are happy to shop again in the Online Shop or at OUTLETCITY METZINGEN. We also have a legitimate interest in making it easier for you to find the offers you need at the right time, and to remind you of what has interested you on our site by e-mail or on third party platforms. We ourselves have a legitimate interest in ensuring that you reduce expensive occasional purchases that you later become annoyed about and return the goods. We want to avoid unnecessary advertising by providing you with offers that are as relevant to you as possible. In doing so, we want to provide you with targeted advice, but also inspire you with relevant trends so that you stay up to date. Overall, we are pursuing our legitimate interest in optimising the shopping experience so that you can quickly find an overview of the offers that are relevant to you and thus waste less time with searches or irrelevant advertising and offer presentations. It may also happen that our systems conclude that you are not being targeted by advertising from us, so that we then reduce or suspend our advertising measures. For this purpose, we have a legitimate interest in forming corresponding profiles and carrying out personalisation.

3.3 Algorithms

We use both rule-based models and machine learning models for the aforementioned calculations of profile information.

In rule-based models, for example, we count and weight how often you have clicked on a category or added it to your shopping basket, for example, and this is combined with products you have bought, which we also categorise. Purchases are usually weighted much higher than individual clicks. The categories with the highest ratios are categorised as most likely to be relevant to you in the future. Within the framework of rule-based models, we also compare your history with the history of all other customers, for example, and thereby form customer groups.

In machine learning, a software analyses a large amount of historical behavioural and outcome data from all customers and compares this with data about you to infer your likely future preferences according to weightings the software has created itself.

3.4 Storage period

We only store profile information that we have algorithmically calculated for you until the next recalculation of the profile information with us or until your objection, whichever comes first. If no more individual information is available for the calculation, the profile information will be deleted with the subsequent recalculation.

Beyond, we only store the individual information that we only store for the aforementioned purposes and not also for other reasons for as long as this individual information can still have a significance for future behaviour. For example, in the area of OUTLETCITY METZINGEN, data that we categorise according to predefined rules is relevant for up to 900 days after the individual information was created, whereas in the area of online sales, which are usually more frequent, we only use individual information for up to 730 days (2 years) after it was created.

For the storage period for other reasons, please refer to the other parts of this privacy notice.

4. Storage period

We process personal data only as long as this is necessary for the aforementioned purposes and erase personal data thereafter or – if we are subject to legal retention obligations - restrict the processing of personal data.

5. Recipients of Data

5.1 In order to be able to offer the App, we will transfer your personal data to our hosting provider. We will also use other service providers as data processors to provide certain services through the App and to improve the App:

We have entered into data processing agreements with all of them to ensure your personal data will be processed strictly according to our instructions.

5.2 We only transfer personal data to third countries to the extent that service providers operate in third countries as processors or under joint control. In the absence of an adequacy decision by the European Commission for the respective third country, this is done with your consent and/or subject to appropriate or adequate safeguards (Art. 46, 49 GDPR).

You have the possibility to obtain a copy of the respective safeguards used via the address of the responsible person indicated above.

For U.S.-based companies, the adequacy decision (EU-US Privacy Framework) adopted by the European Commission on July 10, 2023 applies, provided that the respective company is certified under the EU-US Privacy Framework.

6. Your Rights

6.1 You have the following rights with respect to your personal data in accordance with applicable law:

• Right of access;
• Right to rectification and erasure;
• Right to restricted of processing;
• Right to data portability.

6.2 If data processing is based on Art. 6 para. 1 lit. a GDPR, you have the right to revoke your consent at any time, in which case the lawfulness of data processing carried out on the basis of your consent prior to revocation will remain unaffected.

6.3 You have the right, for reasons arising from your particular situation, to object at any time to the processing of your personal data on the basis of Art. 6 para. 1 lit. f GDPR; this also applies to any profiling based on these provisions. We will no longer process personal data unless we can show compelling legitimate reasons for continued data processing that override your interests, rights and freedoms, and unless we process data to assert, exercise, or defend legal rights or claims. If the purpose of data processing is direct advertising, you have the right to object at any time to the processing of your personal data for the purpose of such advertising; this also applies to profiling insofar as it is connected with such direct advertising. If you object to the processing, the personal data concerning you will no longer be processed for these purposes.

6.4 You also have the right to lodge a complaint with a supervisory authority.

6.5 You may contact our data protection officer (Section 1.2) to exercise your rights.