ADIDAS INTO THE METAVERSE
Privacy Notice

2022-10-11

1. WHAT DOES THIS PRIVACY NOTICE TELL YOU? This Privacy Notice tells you how adidas collects and uses the information you provide us which can be used to identify you directly or indirectly (“Personal Data”) when you participate in the adidas Into the Metaverse (“ITM”) activities.

2. WHO IS RESPONSIBLE FOR YOUR PERSONAL DATA? adidas AG. (“adidas”) (Adi-Dassler-Strasse 1, 91074 Herzogenaurach, Germany) is responsible for compliance with applicable privacy laws concerning personal information collected via the ITM site (including the EU General Data Protection Regulation) for the purposes described in this Notice.

3. WHAT DOES ADIDAS DO WITH YOUR PERSONAL DATA AND WHY (CATEGORIES OF PERSONAL DATA, PURPOSE, PROCESSING, LEGAL BASIS)? To reveal your NFT, we need to connect to your crypto wallet to access your NFTs upon your request to reveal your ITM capsule contents; to dress your PFP and generate a new jpg-format image on your behalf, we need to connect to your crypto wallet to access your NFTs upon your request to overlay your PFP NFT image with your digital wearable NFT to generate a new jpg-format image.

4. WHAT HAPPENS WHEN ADIDAS TRANSFERS YOUR PERSONAL DATA OUTSIDE YOUR COUNTRY OF RESIDENCE? adidas will share your Personal Data with other companies to complete the purpose and the processing of your Personal Data described in this Privacy Notice. Where the other companies are located outside or your country of residence, or outside the EU/EEA, adidas will make sure your Personal Data is protected in accordance with the laws of your country of residence even when it has been transferred abroad. To be more specific, we implement the following measures: a) contracts; b) information security controls; and c) organisational privacy standards and processes. More details provided in “5. HOW DO WE SECURE YOUR PERSONAL DATA?”.

5. HOW DO WE SECURE YOUR PERSONAL DATA? a) Contracts adidas concludes appropriate contracts and/or contractual clauses to ensure the privacy standard we established is maintained when we share your Personal Data with other adidas and third-party companies located within or outside your country of residence. This includes: inter-company agreements, data processing agreements, data transfer agreements or data privacy clauses approved by regulatory authorities such as the EU Standard Contractual Clauses approved by the EU Commission. b) Information Security Controls adidas has sufficient information security controls to address the risks and the impacts corresponding to our use of your Personal Data, including loss, alteration, or unauthorised access to your Personal Data as a result of malicious intent (hacking) or negligence (human error). Please be aware that any transmission of your Personal Data through the internet is at your own risk. We can only protect your Personal Data once we have access to it. c) Organisational Standard and Processes adidas has privacy standard and processes in place to ensure necessary privacy impact assessments are completed before we collect and process any Personal Data, as well as processes to ensure compliance with privacy legal requirements and to enable you to exercise your rights under the law.

6. WHAT ARE YOUR RIGHTS AND HOW CAN YOU EXERCISE THEM? Depending on your country of residence, you may have the following rights to your Personal Data: a) right to delete your personal data; b) right to access your personal data; c) right to correct your personal data; d) right to object to direct marketing and commercial messages; and e) right to withdraw your consent. If you wish to exercise your rights listed above, please contact adidas Customer Service. For consumers located EU/EEA country, Switzerland, and the UK You have the following rights specifically under the EU GDPR:

• Access your Personal Data
• Make sure your Personal Data are correct
• Delete your Personal Data
• Restrict how we use your Personal Data
• Obtain a portable file so you can share it with another company
• Withdraw your consent
• Object when we process your Personal Data based on “Legitimate Interest”
• Challenge the decision generated by our automated decision-making process
• File a complaint with your local data protection supervisory authority

Please also contact the Designated Local Courier Service Vendor for your delivery directly to exercise your rights as they are responsible for your Personal Data for the purpose of shipping the requested product. If you are located outside the US, EU/EEA, Switzerland and the UK, you may also have similar rights under local applicable laws. However, the requirements may differ. Please check out the websites or contact your local privacy authorities to understand how your rights mean under the local law.

7. DATA PROTECTION OFFICER If you have any queries or concerns about how adidas uses your information for the purposes stated in this Privacy Notice, please contact us by sending an email to web3inquiries@adidas.com.