This Privacy Notice (“Notice”) provides necessary information required by the EU General Data Protection Regulation (“GDPR”) on how adidas (“adidas”, “we”, “us”) collects and uses information about you that is provided by you directly and indirectly or others. When the information allows us to identify you as an individual independent from others, it’s called “personal data” under the GDPR.

Additionally, you should also read any privacy notices displayed when you provide personal data to us as they provide details of the specific scenario which may not be covered by this Notice.

If you access any of our platforms by using a Virtual Private Network (also known as “VPN”) to interact with us – including making purchases - in a country that is not your current or residential country where GDPR is the governing privacy law, please read the privacy notice displayed at that specific platform or portal to understand how the responsible entities, our affiliated brands and adidas subsidiaries at that country use and protect your Personal Data as local national requirements may be different from the GDPR.

We will routinely review the content of this Notice and make minor adjustments and corrections as necessary. As required by law, when we make any significant changes that would have an impact on your rights and your Personal Data, we will announce these changes in advance, and make sure you are informed of these changes, which may require us to send you an email announcement.

2. Who is responsible for your Personal Data (“adidas Joint Controllers”)?

For the purposes described in this Notice and compliance with local privacy laws and the GDPR, the following adidas entities are responsible:

adidas AG - Adi-Dassler Str. 1, 91074 Herzogenaurach, Germany (”adidas AG”)

adidas (UK) Limited– Pepper Road, Hazel Grove, The adidas Centre, Stockport, Cheshire, SK7 5SA, England (“adidas UK”)

Also, for the purposes of:

§ Sales of adidas products – online and off-line order

§ Product research and development

The adidas entities below are responsible for your Personal Data:

adidas AG

adidas UK

adidas International Trading AG - Am Platz 1b, Root D4, Luzern, 6039, Switzerland

They are known as the adidas “Joint Controllers” under the GDPR and local privacy laws. They are jointly responsible for determining why (“Purpose”), how (“Processing”), and if (“Lawful Basis”) we use your Personal Data. In this Notice, we call them “Responsible Entities” to make it easier for you to understand.

adidas AG handles your requests to exercise your rights with respect to your personal data (as described in this notice). You contact any of the responsible entities with your requests.

adidas AG also handles any data security incident and lead the cooperation and communication with data protection authorities. Our lead authority is the Bavarian State Office for Data Protection Supervision located in Ansbach, Germany.

For some scenarios described in this Notice, there may be other adidas and/or non-adidas entities also responsible for using your Personal Data, please refer to the specific scenario for more information.

3. How do you exercise your rights for your Personal Data?

You have all the rights described below for all your Personal Data provided to Responsible Entities, please read and follow the instructions to exercise your rights in a timely manner. If a non-adidas company is independently responsible for your Personal Data, you will need to contact and read the privacy notice of the non-adidas company to exercise your rights with them. Your request cannot be processed if we cannot verify your identity. We may ask for additional verification questions if we have reasonable doubts about your identity to protect all our consumers’ Personal Data and rights.

If you have any general questions or require immediate assistance and support concerning your rights or how we use your Personal Data, please contact our Customer Service team. You can find their contact information and channels by clicking on this link https://adidas.com/help.

3.1. Access your personal data

3.2. Obtain a machine-readable, portable copy of your personal data which you can share with another Company

3.3. Delete your account and all Personal Data connected to your email address.

To access your Personal Data and information about how adidas collects and uses your Personal Data, obtain a machine-readable, portable copy of your file, or to delete your Personal Data, please use our self-service tool by following the instructions below. Your email address is required as we cannot otherwise identify you and execute your request.

If you need help, please contact our Customer Service team: (https://adidas.com/help).

ADIDAS WEBSITE:

Step 1

Scroll to the bottom of the page, and click on “Data settings”.

Step 2

Select one of the following options: 1) “Send me my data”; or 2) “Send me my machine readable data”; or 3) or “Delete my data & account”.

Step 3

Enter your Last Name and Email address that you have provided to adidas – if the Last Name and email address does not match the information we have on file, your request will be rejected. You can contact our local Customer Service team (https://adidas.com/help) if you need help.

Step 4

Check your email and follow instructions we provided in the email to verify your email address – please note that your request will not be processed if you do not verify your email address, and the request will be deleted after 30 days.

Step 5

Check your email again within 30 days and click on the link to retrieve your file you requested OR get confirmation for your data deletion.

Step 6

Repeat Steps 1- 5 if you wish to execute another request.

ADIDAS APP & CONFIRMED APP

Step 1

Go to “SETTINGS”.

Step 2

Click on “MANAGE ACCOUNT”.

Step 3

Select one of the following options: 1) “Send me my data”; or 2) “Send me my machine-readable data”; or 3) or “Delete my data & account”.

Step 4

Enter your Last Name and Email address that you have provided to adidas – please note these fields are pre-populated.

Step 5

Step 6

Check your email again within 30 days and click on the link to retrieve your file you requested OR get confirmation for your data deletion.

RUNTASTIC.COM

Step 1

Step 2

Click "Home”.

Step 3

Click “Account & Data” on the left-hand side of the screen.

Step 4

Select one of the following options: 1) “EXPORT DATA”; or 2) “REQUEST DELETION” on the right-hand side of the screen.

Step 5

Check your email and follow instructions we provided in the email. Please note that your request will not be processed if you did not verify your email address, and the request will be deleted after 30 days. If you haven’t verified your email yet, you can request a new confirmation link by clicking "Send a new confirmation email" on Runtastic.com.

Step 6

Check your email again within 30 days and click on the link to retrieve your file you requested OR get confirmation for your data deletion.

Step 7

Repeat Steps 1- 6 if you wish to execute another request.

To view and get a copy of your order/transactional information before and/or after your order has been delivered:

WEBSITE

Step 1

Scroll to the top of the page, and click on “order tracker”.

Step 2

Enter the Order Number and the Email address that you have used to make the purchase – if you have purchased from different adidas sites, you will need to repeat this procedure on all sites to access the order that you placed on that particular site. You can contact our local Customer Service team (https://adidas.com/help) if you need help.

Step 3

Click “Go”.

Step 4

View the order matching the Order Number and Email address directly from the website.

ADIDAS APP & CONFIRMED APP

Step 1

Go to “SETTINGS”.

Step 2

Click on “ORDERS”.

Step 3

View all orders made with your current profile based on the specific country/location setting.

Step 4

Repeat Step 1- 3 order made under other country/location settings.

To delete your order/transactional information

You may request to have this information deleted, which will restrict your access to the information. However, the information will be archived and kept on file for 10 years to comply with legal and contractual requirements. Please refer to our “Sales of adidas Products - Online and Off-Line Order” section for more information.

Please note that the standard processing time via our self-service tool is one month. Depending on the complexity of your demand and the number of other requests we are currently processing, our processing time may be extended for two additional months for the following reasons: 1) we cannot successfully identify you using your email and/or other identifier, and may be unable to process your request at all; and/or 2) you do not or cannot use our self-service tool and require further assistance; and/or 3) you request your response to be provided by means other than e-mail.

In addition, please refer to the details provided in this privacy notice to have information about: a) why we have your Personal Data; b) what categories of data we have; c) what we do with your Personal Data; d) who has access to your Personal Data (and where they are); e) where your Personal Data might be transferred to; f) how long we are keeping your Personal Data; g) if you didn’t provide your Personal Data directly to us, how did we get them; h) your rights under applicable laws and the possibility to restrict processing; i) if we use your Personal Data for any automated decision-making; and j) in some cases, you have the right to know how our automated decision-making works, if the decision significantly affects you.

3.4. Make sure your Personal Data are correct

Please contact Customer Service (https://adidas.com/help) to make any changes to your information, and access your account at adidas to make changes directly.

3.5. UNSUBSCRIBE FROM OUR EMAIL AND TARGETED MARKETING MESSAGES

You can unsubscribe from newsletters by adjusting your preferences in your user account. Or you can unsubscribe on marketing emails themselves.

Account via adidas Website:

1. Log into your account.

2. Go to 'Your Preferences'.

3. Update your preferences and click 'Save'.

Web via https://www.runtastic.com/:

1. Log into your account.

2. Click the drop-down menu next to your avatar and go to "Privacy Settings".

3. Deselect marketing communications.

Within the Marketing Email:

1. Click 'Unsubscribe' at the bottom of the newsletter or marketing email that you want to unsubscribe from.

2. Check the confirmation box to unsubscribe.

3. Click 'Update Preferences'.

You will then be unsubscribed from the newsletter or marketing email. It can take up to 72 hours for your request to be processed, so you may still receive newsletters or marketing emails during this time after you submitted your request.

adidas app, CONFIRMED app:

Push Notifications:

1. Go to your profile via the bottom navigation bar

2. From there go to Settings at the top

3. Simply deselect push notifications

adidas Running:

1. Go to your profile via the bottom navigation bar.

2. From there go to Settings at the top and choose "Privacy".

3. Now you can easily deactivate the "Stay informed" slider.

If you need help, or if your request to unsubscribe failed, please contact our customer service (https://adidas.com/help) to report the failure and request for your email address to be removed and unsubscribed from the adidas email marketing list.

3.6. Restrict how we use your Personal Data

3.7. Withdraw your consent

3.8. Object when we process your Personal Data based on “Legitimate Interest” (including unsubscribing from our direct marketing messages)

3.9. Challenge a decision generated solely by automated decision-making process without human intervention

3.10. General assistance

Please contact our Customer Service team (https://adidas.com/help) for general support. You can find their contact details under the “ASK CUSTOMER SERVICE” section via HELP.

3.11. File a complaint with your local data protection supervisory authority

You have the right to file a complaint with the local authority if you are not happy with how we have handled any of your rights listed above.

We invite you to first share and discuss your concerns and complaints about how we handle your individual rights and use your Personal Data with our Privacy team and our Data Protection Officer by writing to our adidas Privacy Compliance Query and Complaint Inbox (dataprotection@adidas.com) so we can promptly address, and hopefully resolve your concerns and complaints.

3.12. Using Third-Party Tools to Exercise Your Individual Rights

We understand that there are tools, apps, solutions, and websites operated by non-adidas companies which help you exercise your individual rights. Depending on the design of these tools, we may need to contact you directly still to verify your identity before we can process your requests via 3^rd-party solutions. We can’t process your request unless we have verified your identity and have no concern that you are the person who the personal data actually identifies. We can’t and don’t upload any files to 3^rd-party portals as that is a serious data security risk to adidas systems and infrastructure, and it could consequently lead to a significant data breach incident.

Therefore, even when you made a request using a 3^rd-party tool, we may still request that you use our automated solution or contact our customer service by following the instructions above for our website or adidas apps in order to verify your identity, and ensure your request is processed in a timely and secure manner.

If you are not clear about any of the rights listed here, please consult your local authority about your Personal Data rights under the law and to best understand what these rights mean.

4. What Personal Data do we collect and use (“Categories of Personal Data”)?

Most of the time, you give us your Personal Data for specific purposes. However, sometimes, this Personal Data may also be used for other purposes if we have the right or your permission (“Lawful Basis”) to do so. Also, we may use your Personal Data from other companies or sources for some purposes, if it is legally allowed. Please see the Categories of Personal Data below to help you understand how we uses your Personal Data. The Categories include Personal Data you provided directly and indirectly to adidas Joint Controllers.

§ Identity Information

Any information that identifies you as an individual, living person. This includes: name [first, last, initials], Date of Birth, e-mail address, phone number, unique consumer identifier number (including your Membership member ID, or ID from any adidas Platform), nickname, password, social media identifiers and handles, your device fingerprint (including your browser fingerprint), gift card codes that are assigned to you, and the IP address of your browser.

§ Contact Information

Any information we can use to contact you. This may include: your phone number, shipping and billing address, e-mail address, Messenger ID, social media handle, any other communication channel you have used to contact us for more information.

§ Payment, Purchase and Transaction Information

Any information we use to complete or in relation to your purchase record and invoice. This may include: your payment information (credit card details, or bank details, or payment platform details), payment risk profile (provided to us by our payment risk solution), shopping cart details (your ordered items), delivery details, shipping and billing address, customer order number, purchase history with adidas, receipt number, transaction ID, invoice ID, retail store transaction ID, purchase value, order confirmation number, order tracking number.

§ Measurements

Any information we can use to make sure your gear fits. This may include: shoe size, clothes size, height, weight, chest, waist, hip, inseam, body shape, heel-toe measurement.

§ Location Information

Any information we can use to know or guess where you are, real time or otherwise. This may include: your residential location, current log-in location [IP address], real-time device location information via device sensors and signals, GPS location (if you wish to share us, for example through your mobile device settings), or information that helps us guess where you may be such as the specific adidas site you have visited that might give us clues about where you are, or when you “check-in” to an event or website on a social media page indicating location and if it is shared with us.

§ Membership Administration Information

Any information related to your adiClub membership. This includes: acquisition source ID (where you signed up to our membership), your membership country, adiClub Member ID, date you became a member, store ID (if you signed up in a retail store including a franchised store), membership points, engagement history, rewards history, membership vouchers assigned to you.

§ Behavioural and Preference Information

Any information which indicates your preference whether explicitly – if provided by you – or inferred. This may include: activity preference (sports), event participation information, exercise plans, in-store digital interactions, site/brand preference, language preference, product and product attributes preferences, store location preferences, your shopping history (all items in shopping carts), Wishlist items, any “preference” details you provided to us in your profile and Platform setting, any information you provide to us when you interact with our communities such as adidas Runners, participate in events or campaigns as a trainer, team member, a participant or as a promotor of our events.

§ Browsing Information

Any information on. your browsing behaviour. This may include: browser name, IP address (including hashed IP address), clickstream data, data and time of site visits, time remained on site, pages visited, and the links you have clicked in our marketing messages or website , the referral URL that brought you to our site.

§ Mobile Device Information

Any information related to your mobile device. This may include: device EUI, device ID, device fingerprint, IP/Wifi Information, operating system, data stored on device when access is granted, log information when access to device (such as camera) is granted.

§ Social Media Interaction and Activity

Any information about you we obtain through different social media channels such as Facebook, Instagram, Google, etc., when we use these channels for advertising, analytics purposes or to enrich your profile with adidas. This may include: any social media information that is publicly available such as your social media handles, social media interactions and public postings, your “Likes” and other reactions, your social media connections, your photos that are public, or those you send to us by mentioning us or following our social media posts by using “handles” or “hashtags”, comments or messages you shared with us publicly or privately on social media platforms. Also, we may be able to obtain information indirectly from social media companies (Facebook, Google, etc.) when we advertise on these platforms, which may include your participation and membership on particular topics and/or groups, your profile settings and preference, your behaviour on different platforms owned by the same company. .

§ Correspondence

Any correspondence you have with Customer Service teams, and/or our employees and personnel. This may include: written correspondence with us (email or post or messages to our platforms), and voice recording made by Customer Service when we have the right to do so.

§ Image and Recording

Any image, voice or video recordings we have captured or obtained where you may be identified. This may include: CCTV footages, photos taken in our retail stores and/or at events, video recordings made during events or specific interactions, voice recording made during events or interactions (excluding correspondence with Customer Service), any images you share with us through social media.

§ Fitness Activity Information

Any information connected to your fitness activity which you track using our Platforms (including adidas Running). This may include: activity type, distance, exercise duration, exercise routine (start and finish time), fitness score, pace, space utilisation data, speed.

§ Health Information

Any information that relates to your health or vitals such as your body mass index (BMI), heartbeat per minute, or information of any disability. This is used only when you have allowed us to use it – with your consent - for specific reasons and purposes.

§ Personal Opinion

Any opinion you share with us that indicate your point of view and comments. This may include when you provide us feedback and review rating our service or products, or if you participate in any product research and development discussions.

5. WHY AND HOW YOUR PERSONAL DATA IS COLLECTED AND USED BY ADIDAS?

In this section, we provide information and answers to the following:

PURPOSES - Why do we collect and use your Personal Data?

PROCESSING - What do we do with your Personal Data?

LEGAL BASIS - Why the purpose is allowed and necessary?

CATEGORIES OF PERSONAL DATA - What kind of Personal Data do we need to collect and use for the specific purpose?

Specifically, these are the Categories of Personal you may or may not have given to us for this specific purpose, but we either have it on file, or have obtained it from a different source for a different purpose, and we know it is connected to you.

RETENTION PERIOD - How long do we keep your Personal Data for the specific purpose?

CATEGORIES OF RECIPIENTS - With whom (types of service providers or companies) do we share your Personal Data to achieve the purpose?

5.1. “COOKIES” NOTICE: Installing Cookies, Pixels, Tags, and other Technologies on Your Browser to Collect Your Device Information and Track Your Activities on Ours and Other Platforms

PROCESSING

When you visit the adidas site, we store data collectors such as cookies, tags, pixels, tag containers, beacons, among others, in your browser to obtain certain information about your current browsing session. These technologies are often referred to as “Cookies” collectively by other websites. Cookies also enable our website to remember your actions and preferences (such as login, language, font size and other display preferences) over a period, so you don’t have to keep re-entering them whenever you come back to the site or browse from one page to another. We use Cookies for different purposes, which also mean they have different legal bases. Please review the information below to understand how we use different types of Cookies to fulfil different purposes.

Managing Cookies In Your Browser

You can change your browser settings to delete or prevent certain cookies from being stored on your computer or mobile device without your explicit consent. The ‘help’ section in your browser should provide information on how to manage your cookie settings.

Alternatively, you can select the “Logging out from all my devices” option in your account section.

Most browsers allow you to manage how cookies are set and used as you’re browsing, and to clear cookies and browsing data.

Find out how this works for your browser here:

Internet Explorer: https://support.microsoft.com/help/17442/windows-internet-explorer-delete-manage-cookies

Mozilla Firefox: http://support.mozilla.com/en-US/kb/Cookies

Google Chrome: http://www.google.com/support/chrome/bin/answer.py?hl=en&answer=95647

Safari: http://support.apple.com/kb/PH5042

Opera: http://www.opera.com/browser/tutorials/security/privacy/

Adobe (flash cookies): http://www.adobe.com/privacy/policies/flash-player.html

Google Chrome App: https://support.google.com/accounts/answer/61416?co=GENIE.Platform%3DAndroid&hl=en

These websites will also help you understand more about how Cookie-based advertising works and how you can manage your Cookie Settings:

http://www.aboutads.info/choices

http://www.youronlinechoices.eu/

Network Advertising Initiative opt-out page: http://optout.networkadvertising.org/?c=1

You can learn more about the laws governing the use of “Cookies” here: http://ec.europa.eu/ipg/basics/legal/cookies/index_en.htm

5.1.a. “REQUIRED” – site functionality and business operation

We use “Required Cookies” to operate our site. This includes storing a unique identifier to manage and identify you as a unique visitor to our site, to provide a consistent and accurate service to you. This includes making sure that we remember the products you have placed in your cart, or your language preferences. Without these Cookies, you will not be able to view our site properly.

Specifically, they allow us to do the following:

§ Site Diagnostics and Analytics

The technology is used to collect information about how visitors use the site/app. For example, which pages visitors go to most often, and if they get error messages from web pages.

§ Site Security Maintenance

The technology is used to ensure site and user security. For example, session timed-out for security reasons.

§ Routing

The technology is used to route customers to specific versions/applications of a service, such as might be used during a technical migration.

§ Site Loading

The technology is used to allow the site to load. Without this technology, the site will simply not load, and individuals may get an error message when attempting to load the site.

§ User-Requested Multi-Session Log-In

The technology is explicitly requested by the user to remember their user ID’s or stay logged in more than one session.

§ User Identification and Authentication

The technology is used for user identification and authentication purposes: for example, to manage and pass security tokens to different services within a website to identify the visitor’s status (e.g. logged in or not).

§ Essential Functions Enabler

The technology is essential to enable a user to move around the site/app and use its features. For example, shopping baskets and e-billing: for example, it is used to remember user entered text, or make size selection, or add purchases to "carts" or navigate the user back to the previous page or a different location on the site/app.

§ A/B Testing – Design

The technology is used for design testing purposes. Testing variations of design, typically using A/B or multivariate testing, to ensure a consistent look and feel is maintained for the user of the site in the current and subsequent sessions.

§ Non-Marketing Site/App Business Analytics

The technology is used for business analytics relating to non-marketing activities on the website (such as performance of products). For example, Web analytics — where the data collected is limited to the website operator’s use only, for managing the performance and design of the site/app.

LEGAL BASIS

Necessary for Website Operations

CATEGORIES OF PERSONAL DATA

Browsing Information

Mobile Device Information

Location information: this is collected through observing your browsing behaviour

RETENTION PERIOD

Browsing Session

Duration of the browsing session whilst you access the website or continue your session which lasts for as long as your browsing session does not expire.

Anytime

You can manually delete these cookies by deleting them by following instructions provided by the browser you use in browser setting.

Tealium [utag_main]: We use Tealium [utag_main] to comply with the retention period set for each Cookie. If you manually delete or block or in any way restrict our use of [utag_main], the Cookies may be stored in your browser longer than the intended retention period specified in this Notice.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Site Administration Support Providers

5.1.b. “FUNCTIONAL” – website improvement and performance

We use “Functional Cookies” to continuously improve our website performance.

Specifically, they allow us to do the following:

§ Non-Marketing Site/App Business Analytics

LEGAL BASIS

Consent

CATEGORIES OF PERSONAL DATA

Identity Information (when available to adidas)

Browsing Information

Mobile Device Information

Location information: this is collected through observing your browsing behaviour

RETENTION PERIOD

Browsing Session up to 24 months.

Anytime

You can manually delete these cookies by deleting them by following instructions provided by the browser you use in browser setting.

Tealium [COOKIE ID]: We use Tealium [COOKIE ID] to comply with the retention period set for each Cookie. If you manually delete or block or in any way restrict our use of [INSERT TEALIUM COOKIE ID], the Cookies may be stored in your browser than the intended retention period specified in this Notice.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Site Administration Support Providers

Business Consulting Service Providers

Data Analytics Solution Providers

5.1.c. “MARKETING” – website improvement and performance

We use “Marketing Cookies” provided by our advertising partners to make sure our advertising messages are shown to you at the right time and the right place. These Cookies are persistent but time-limited cookies. These Cookies contain a unique key to distinguish individual users’ browsing habits. We also use these Cookies to limit the number of times a user sees a particular ad on a website and to measure the effectiveness of a particular campaign. The identifier stored by these Cookies are provided by our partners. We cannot use the same identifier in our own systems.

Specifically, they allow us to do the following:

§ 3rd-Party Advertising

the technology is used to share your data collected with third-party (non-adidas) advertising platforms and publishers. For example: sharing information with our partners like facebook so that we can use the data for our ads on facebook – not so facebook can use it for other advertisers or data sellers, etc.

§ Behaviour Tracking

The technology is used to collect your device data, and related web browsing behaviour (e.g. clickstream).

§ Marketing Performance Analytics

The technology is used for tracking a consumer’s behaviour on the site or app for the purposes of improving the performance of our marketing activities.

§ Marketing Precision Analytics

The technology is used to analyse consumer behaviour and preference for more accurate targeted, personalised ads and digital messages, and other marketing ROIs. For example, Ad response rates — where the data is used exclusively for calculating response rates (click-through rates) to improve the effectiveness of advertising purchased on a site external to the destination website.

§ RTB - Real Time Bidding

The technology enables real time bidding (“RTB”).

§ Cross Device Tracking

We use Google Analytics to collect consumer device data, and related web browsing behaviour across devices (e.g. mobile phone / tablet / computer) wherever you can be identified with the same identifier (device ID or Consumer Identifier), for instance by tracking consumers who browse products on our site from a phone, and later return to complete purchases from a tablet or laptop. We do so to improve the effectiveness of our different marketing channels.

LEGAL BASIS

Consent

CATEGORIES OF PERSONAL DATA

Identity Information (when available to adidas)

Browsing Information

Mobile Device Information

Location information: this is collected through observing your browsing behaviour

Membership Information (when available to adidas)

Behavioural and Preference Information (if available to adidas)

RETENTION PERIOD

Browsing Session up to 24 months.

Anytime: you can manually delete these cookies by deleting them by following instructions provided by the browser you use in browser setting.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Site Administration Support Providers

Business Consulting Service Providers

Data Analytics Solution Providers

Advertising Agency Partners

Social Media Platforms

Targeted Marketing Service Providers

5.2. Operate adidas Online Shop and adidas Platforms

5.2.a. Site Operation and App Operation

PROCESSING

We screen all traffic to our sites and apps, and analyse data that is received by our servers to: a) run the sites that are connected to our domain and apps, b) fix bugs to make sure the layout and design are displayed properly, and c) fix bugs to make sure the sites and the apps function properly, and d) to monitor compliance with our Terms and Conditions.

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Identity Information

Contact Information

Browsing Information

Mobile Device Information

RETENTION PERIOD

Browsing Session

We need your data for as long as you are on the site. We keep it for the duration of your browsing session.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Site Administration Support Providers

5.2.b. Domain and Network Security and User Authentication

PROCESSING

To protect our domains, detect unusual activities, and prevent security threats and protect our site-visitors from unauthorised accesses (such as hackers), we screen all traffic to our sites, and authenticate user log-in information using tokens to verify the details you provide to us and compare it with other available information, such us the credentials you have provided directly to us or other platforms (such as Runtastic or Facebook) or information that is available in the public domain to ensure only “authorised” users have access to our sites.

reCAPTCHA

We use reCaptcha operated by Google on our websites and apps to authenticate user identity and secure our platforms from malicious software (or known as a “bot”) that might engage in abusive activities on our platforms. reCAPTCHA works by collecting information about your hardware, and software (for example, device and application data) This data is shared with Google for analysis. Data captured by reCAPTCHA is also subject to the Google Privacy Policy and Terms of Use.

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Identity Information

Contact Information

Browsing Information

Mobile Device Information

RETENTION PERIOD

Browsing Session

We need your data for as long as you are on the site. We keep it for the duration of your browsing session.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Site Administration Support Providers

5.2.c. Persistent Log-In

PROCESSING

If you select to be logged in persistently, you do not have to log in every time you visit the adidas website for up to 30 days. Your personal data will be used by the adidas website to show your personal information: Your email will be used during checkout journey to let you know the email that will be used for the order confirmation, your first name will be used for personalization and your unique identifier may be used for Frontend Analytics. Please note that no consent status will be stored.

This basic profile information will be stored for up to 30 days in the browser that was used for the login within an access token. The access token is a HTTP only cookie. The token is valid for 20 minutes if the ‘keep me logged in’ functionality was selected. After the expiration of the token it is no longer possible to access personal information so the logged in session is over. For persistent login we additionally store a refresh token in the browser which can be used to refresh the access token within a 30 days period and extend the logged in session that way. If this refresh token is missing (if you have not selected persistent login or cookies were cleared) the access token cannot be refreshed. Hence, your session cannot be extended, and you will not be logged in anymore.

Please note: If you chose persistent log-in, your personal address details may be exposed to an unauthorised third party if you forget to log-out from persistent log-in from a publicly accessible device.

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

RETENTION PERIOD

The information will retain in your browser for up to 30 days. You can delete the data yourself by clearing your cookies from your browser or by selecting the “Logging out from all my devices” option in your account section.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Site Administration Support Providers

5.2.d. Sales of adidas Products - Online and Off-Line Order

PROCESSING

To process your online and/or in-app orders, provide you with different payment options, create a smooth check-out process for you, make sure your payment is received, comply with the requirements under our Terms and Conditions (3. Purchase Terms) (for selling you the products) including invoice processing, delivery, personalisation services, exchanges and refunds, click and collect. Your order cannot be completed if our payment fraud detection solutions flag your transaction as suspicious and potentially fraudulent. Please note the payment fraud detection system is an automated decision-making process. It is required to allow us to conclude the contract with you. You have the right to request a human review of this decision, and challenge the decision.

LEGAL BASIS

Performance of Contract

Legitimate Interest

Legal Obligation

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Location information

Measurements

Payment, Purchase and Transaction Information

Correspondence

Browsing Information

Mobile Device Information

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

Duration of contract and statutory limitation period (10 years). We need to keep the information in case of any legal disputes concerning the contract.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Selling Partners (where applicable)

Manufacturing Providers

Delivery Service Providers

Payment Risk Solution Providers

Payment Processing Providers

IT Cloud Solution Providers

5.2.e. Enrichment and Improvement of your Digital Shopping Experience

PROCESSING

When you shop at various adidas digital shopping platforms (adidas website, and adidas app), we collect your Personal Data to enrich and improve your shopping, browsing and check-out experience. This may include helping you find the right size, helping you visualise how a product will look on you via our digital platforms, or when you engage with platforms for any specific experience we make available through our digital platforms directly or via our digital devices in retail stores.

§ PROFILING (PERSONALISATION)

§ Data Enrichment

We create a single, unified consumer profile of you by matching all personal data which you can be identified. This includes personal data we collected directly or indirectly from you across digital media or offline, the feedback you provide to us, your interaction and communication with us through our various platforms and communication channels.

§ Improve data models

We use data science and your profile and personal data to create data models that can help us improve the logic in our analytics activities that give us more insight about your comments and feedback, your interactions, preference and needs in our products and services. We will compare the data model we created using your profile with other similar consumer profiles and categories to further predict and analyse your preference.

§ SIZE RECOMMENDATION

To help you find the best size that fits your measurements best, we use size recommendation widgets on our app and website. The widget will recommend you the appropriate size for a certain adidas product by using machine-learning algorithms. The widget will combine the measurements you provided to us with adidas product information, your shopping cart details and shopping history (if they are available to us) to recommend you the most appropriate size for a certain adidas product. The size recommendations are provided by a third-party provider.

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Measurements

Behavioural and Preference Information

Payment, Purchase and Transaction Information

RETENTION PERIOD

As long as you do not delete your data.

CATEGORIES OF RECIPIENTS

Size Recommendation Providers

§ AUGMENTED REALITY TRY-ON EXPERIENCE AND VISUAL SEARCH

On our apps we give you the possibility to use your device camera for different purposes: to see how certain adidas products would fit you through augmented reality (AR) functionality, and to search by image for adidas products. To this purpose, we implement on our apps third-parties software development kits (SDKs). We will ask for your permission before you use your camera to try this feature. We will not store any photos and videos from your device camera. We will then analyse how you use the AR feature to improve our user experience design to make sure you will continue interact with us on our applications.

§ AI Shopping Assistant

When you choose to use the AI Shopping Assistant widget, any information you provide in the widget will be processed by artificial intelligence technology to help you find the shoe you are looking for. We do not require any personal data to help you find the product; however, your BROWSING INFORMATION will be processed for internal performance (of the widget and customer care) optimisation purposes. Information provided in the widget is not stored with your membership profile (if applicable).

LEGAL BASIS

Legitimate Interest

Consent (AI Shopping Assistant)

CATEGORIES OF PERSONAL DATA

Measurements

Behavioural and Preference Information

AI Shopping Assistant: Browsing Information Only

RETENTION PERIOD

As long as you do not delete your data.

AI Shopping Assistant: 14 Days

CATEGORIES OF RECIPIENTS

Augmented Reality Services Providers

Visual Search Providers

§ AI Shopping Assistant

When you choose to use the AI Shopping Assistant, any information you provide in the widget will be processed by artificial intelligence technology to help you find the shoe you are looking for. We do not require any personal data to help you find the product; however, your BROWSING INFORMATION will be processed for internal performance (of the widget and customer care) optimisation purposes. Information provided in the widget is not stored with your membership profile (if applicable).

5.2.f. Payment Fraud Detection

PROCESSING

We collect your IP address, device, browser, connection and behavioural data as soon as you visit adidas sites by using our Payment Risk Solution (“PRS”) Provider’s Javascript SDK (note: SDK stands for “Software Development Kit”). This data will be tagged with user ID generated by the PRS Provider (“PRS ID”) and stored on the PRS Provider’s server. If you do not purchase anything during your browsing session, the data will be stored in the Provider’s server for up to one year. However, it will not be used for any decisioning algorithm or model.

If you decide to purchase something during your browsing session, information you provide to us during the checkout process, including your: Identity Information, Contact Information, Payment, Purchase and Transaction Information (including partial credit card details) will also be disclosed to the PRS Provider through an API (API stands for “Application Programming Interface”). This data will be tagged with the same PRS ID as the other information collected during your browsing session. All data with the same PRS ID will be processed by our PRS Provider’s machine learning models and return with a transaction recommendation. The recommendation is rendered in real-time; however, adidas can manually review and override any automated recommendation provided by the PRS solution.

The information collected by our PRS Provider will also be used to train the PRS Provider’s machine learning model and algorithm and used to provide recommendations to PRS Provider’s other clients.

LEGAL BASIS

Performance of Contract

Legitimate Interest: of adidas as well as other PSR Providers’ clients to detect and prevent payment fraud

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Payment, Purchase and Transaction Information

Browsing Information

Mobile Device Information

RETENTION PERIOD

All Categories of Personal Data of Consumers purchased from adidas during the browsing session: stored by the PRS Provider for the duration of contractual period with adidas

Browsing Information of Consumers who did not purchase during the browsing session: stored by the PRS Provider for 2 weeks (up to 1 year in exceptional cases)

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Payment Risk Solution Providers

Payment Processing Providers

IT Cloud Solution Providers

5.2.g. Product Delivery

PROCESSING

Once you have successfully placed an order, we use your contact details (home and/or shipping address) and other Payment, Purchase and Transaction Information to deliver the products you purchased to you.

LEGAL BASIS

Performance of Contract

CATEGORIES OF PERSONAL DATA

Identity information: Name

Contact information: Shipping Address

RETENTION PERIOD

Duration of contract and statutory limitation period. We need to keep the information in case of any legal disputes concerning the contract.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Service Providers

IT Cloud Solution Providers

5.2.h. Electronic Delivery Tracking

PROCESSING

This service is provided by our Delivery Service Providers, and is subject to availability by the Delivery Service Provider servicing your delivery address. Depending on the delivery service provider, you may have the option to track your delivery using services provided directly by our delivery partners. This service is provided on the basis of our consumers’ legitimate interest so they can organise receipt of their parcels. However, with some service providers, this may only be possible with your consent. The service is hosted on the Delivery Partner’s platform. You should read their Privacy Notice for the processing of your Personal Data for this purpose.

LEGAL BASIS

Legitimate Interest / and where applicable, Consent

CATEGORIES OF PERSONAL DATA

Identity information: email address

Contact information: phone number

Any other information you may directly and voluntarily provide to the Delivery Partner

RETENTION PERIOD

As determined by our Delivery Partner.

CATEGORIES OF RECIPIENTS

Delivery Service Providers

5.2.i. Business Operational Analytics

PROCESSING

We need to know how we do as a business. This is in the interest of our shareholders, our board members, our employees, and our partners, as well as our consumers. We create data models for different analytical purposes, and analyse using these data models to understand how our products are selling in different markets, what are the popular features of our products, what worked and what didn’t in terms of our marketing and advertising campaigns, our product designs and distribution strategy, our website design and overall user experience, so we can establish, implement, and evaluate our business strategy.

This includes, for example, analysing data to understand how users browse our site and use the app to improve our user experience design to make sure you will continue to purchase our products and interact with us on our sites and applications.

We remove any identity information that would directly identify you (for example, your name and email address), and use only our internal unique identifier IP address to minimise any possible privacy risks to you.

§ PROFILING (PERSONALISATION)

§ DATA ENRICHMENT

§ IMPROVE DATA MODELS

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Identity information: Unique Consumer Identifier (only)

Measurements

Behavioural and Preference Information

Location Information

Payment, Purchase and Transaction Information

Fitness Activity Information

Browsing Information

Mobile Device Information

Correspondence

Social Media Interaction and Activity

Personal Opinion

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

When using analytics services provided by the vendors identified above, we are required to retain data for the period specified by these vendors. You can find the retention period indicated by the vendors here:

Adobe Analytics: 36 months (https://marketing.adobe.com/resources/help/en_US/reference/data-retention.html )

Google Analytics: 38 months

(https://support.google.com/analytics/answer/7667196?hl=en)

We need the information for this duration to produce accurate analysis of our business operations.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Prospective Buyers and Investors

Business Consulting Service Providers

Data Analytics Solution Providers

IT Cloud Solution Providers

You can learn more about how our Data Analytics Solution Providers provide analytics services by using your data here:

Adobe Analytics Data Collection: https://marketing.adobe.com/resources/help/en_US/reference/c_Privacy_Overview.html

Google Analytics Data Collection:

https://support.google.com/analytics/answer/6318039?hl=en

5.2.j. Customer Service

PROCESSING

We collect your Personal Data to answer your queries about your order, inform you when the product you like is available upon your request, and respond to your questions and concerns through various communications channels we make available to you, including if you contact us for questions about your Personal Data rights. Your requests to our customer service will be analysed so that we can provide you with valuable service in the future. We may record our phone conversations with you for quality assurance purposes only when you agree to the recording.

§ DATA ENRICHMENT

§ IMPROVE DATA MODELS

LEGAL BASIS

Legitimate Interest

Consent (for recording our phone conversations)

CATEGORIES OF PERSONAL DATA

§ Identity information

§ Contact information

Location information

Measurements

Payment, Purchase and Transaction Information

Correspondence

Membership Administration Information (where adidas brand membership applies / if available to adidas)

Image and Recordings (with your consent only)

RETENTION PERIOD

Statutory limitation period: 2 years

We need to keep the information in case of any legal disputes.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Selling Partners (where applicable)

Delivery Service Providers

Payment Risk Solution Providers

Payment Processing Providers

IT Cloud Solution Providers

5.2.k. Infinite Play Programme Resell Participation

PROCESSING

adidas has partnered with our Selling Partner - Stuffstr Limited (“Stuffstr”) - to provide consumers the opportunity to sell back eligible adidas products in return for adidas gift cards through the adidas Infinite Play resell Programme (“the Programme”).

For the Programme, we will need to use the following information:

Contact Information – so Stuffstr knows where to pick up your items, send you bags to pack your items, and to issue gift cards to the right person, and you will receive adidas Gift Cards via email or in-app messages;

Payment, Purchase and Transaction Information – as gift cards are issued based on the length of the item purchased, we need to verify when you actually bought the items; and

Membership Administration Information – you get points when you resell your items according to adiClub Terms and Conditions.

Stuffstr will conclude the contract with you directly, so they can collect the items from you, sell the products for recycling, and provide you with gift cards in return. If you need more bags for the items you wish to resell, you will be redirected to the Stuffstr website to provide additional information.

Profiling: Stuffstr staff will be manually assessing the status of the items you resell and create a profile for the items you have resold through the Programme. Stuffstr uses this information to determine their future assessment for your items. If you have consistently returned items that are more worn out than expected (the original return price), Stuffstr may provide a different value based on your profile.

Labels Scanning: you have the option to use your device camera to scan the labels of the adidas products you want to sell back to us. We will use the labels pictures to recognize information about the product (size, materials, model, production date) and to identify whether the product is genuine or not.

To analyse the labels we use the Google Machine Learning Kit (https://developers.google.com/ml-kit/vision/barcode-scanning). Your label pictures will not be shared with Google.

We will ask for your permission before you use your camera to try this feature.

LEGAL BASIS

Performance of Contract

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Measurements

Payment, Purchase and Transaction Information

Correspondence

Browsing Information AND Mobile Device Information

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

Duration of contract and statutory limitation period. We need to keep the information in case of any legal disputes concerning the contract.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Selling Partner (Stuffstr Limited)

Manufacturing Providers

Delivery Service Providers

Payment Risk Solution Providers

Payment Processing Providers

IT Cloud Solution Providers

5.3. Display Targeted Advertisements and Send Individualised Marketing Messages

5.3.a. Personalised Marketing Messages Via Email (Newsletter Sign-Up)

PROCESSING

We send you marketing messages that we think you would be interested (“personalised”) to the email address you provide to us or via push-notifications when you have installed our app. To send you “personalised” messages, we observe your online (and sometimes, where applicable, offline) behaviour, and analyse your behaviour using analytics to best estimate what product lines you might be interested in, and you can benefit from. This requires us to collect various categories of Personal Data from you. We use different analytics tools to understand what your behaviour means in terms of your like and dislike of our various product lines, and to understand the impact (success rates) of the messages delivered to you.

§ PROFILING (AUDIENCE MANAGEMENT)

We create a profile about you by consolidating all the information you provided to us directly or indirectly. This allows us to establish a personalised interaction with you that is based on our past interaction, and other information we can use to infer your likes and dislikes. We use audience management technologies to ensure the right messages and information reach you at the right moment through the right channel. This includes sending you marketing messages of deals and products or addressing you across digital media through ads on adidas brand platforms. The level of personalisation depends on the permission you have provided to us.

§ MARKETING ANALYTICS

We use your data for different analytical purposes to better understand: a) how you browse and use our platforms; b) which products you are interested in; c) which features of our products and platforms you like; d) the quality of our services including customer service, marketing and advertising campaigns addressed to you, and your reaction to these services; e) our product and website design; f) and whether overall user experience worked for you or not. We use this analysis to improve the relevance of our marketing communication to you and the quality of our personalisation experience across our channels and platforms.

§ DATA ENRICHMENT

§ IMPROVE DATA MODELS

LEGAL BASIS

Consent

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Location information

Measurements (if available to adidas)

Payment, Purchase and Transaction Information (if available to adidas)

Social Media Interaction and Activity (if available to adidas)

Fitness Activity Information (if available to adidas)

Browsing Information

Mobile Device Information

Behavioural and Preference Information (if available to adidas)

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

We retain it for as long as you do not withdraw your consent sending you emails or object to us processing your Personal Data for marketing purposes.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Email Marketing Support Providers

IT Cloud Solution Providers

5.3.b. Personalised Marketing Messages Via Email (Via Existing Contract)

PROCESSING

When you purchase our products or conclude any contracts with us, we consider that to be an indication of interests to our products, services, promotions, and various offerings. We send you marketing messages that we think you would be interested in (“personalised”) to the email address you provide to us or via push-notifications when you have installed our app. To send you “personalised” messages, we observe your online (and sometimes, where applicable, offline) behaviour, and analyse your behaviour using analytics to best estimate what product lines you might be interested in, and you can benefit from. This requires us to collect various categories of Personal Data from you. We use different analytics tools to understand what your behaviour means in terms of your like and dislike of our various product lines, and to understand the impact (success rates) of the messages delivered to you.

§ PROFILING (AUDIENCE MANAGEMENT)

§ MARKETING ANALYTICS

§ DATA ENRICHMENT

§ IMPROVE DATA MODELS

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Location information

Measurements (if available to adidas)

Payment, Purchase and Transaction Information (if available to adidas)

Social Media Interaction and Activity (if available to adidas)

Fitness Activity Information (if available to adidas)

Browsing Information

Mobile Device Information

Behavioural and Preference Information (if available to adidas)

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

We retain it for as long as you do not withdraw your consent sending you emails or object to us processing your Personal Data for marketing purposes.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Email Marketing Support Providers

IT Cloud Solution Providers

5.3.c. Targeted Messages On 3rd-Party Advertising Platforms

PROCESSING

We use third-party advertising platforms, such as Facebook, Google, YouTube, Instagram, etc. to send you messages that are targeted at you, based on your behaviour and browsing pattern, at specific times and locations of these platforms to increase the efficiency of our advertising campaigns. In order to do this, we share your Personal Data with our Advertising Agency Partners as well as Social Media Platforms. We use third-party solutions such as Google Analytics and Facebook Business Manager tools to help us do a better job at targeting our campaigns and messages for our consumers. Social Media Platforms will attempt to match your profile in their database to determine the optimal time and place (the page you are browsing) to show you an advertisement from adidas. We also need to analyse necessary information to understand the impact of our campaigns. If you don’t accept that we track you for this purpose, you will still see adidas advertisements on Social Media Platforms and other third-party platforms at random. Please also read the privacy notice on the Social Media Platforms to understand how your Personal Data is used by them for this purpose.

§ PROFILING (AUDIENCE MANAGEMENT)

§ MARKETING ANALYTICS

§ DATA ENRICHMENT

§ IMPROVE DATA MODELS

You can learn more about how our Advertising Partners and Social Media Platforms help us achieve this purpose by visiting their sites:

Google Personalised Advertising: https://support.google.com/adspolicy/answer/143465?hl=en

Google Advertising Policies: https://support.google.com/adspolicy/answer/6020956

Facebook Lookalike Audiences: https://www.facebook.com/business/help/164749007013531

Facebook Custom Audience Terms: https://www.facebook.com/legal/terms/customaudience

LEGAL BASIS

Consent

CATEGORIES OF PERSONAL DATA

Identity information

Contact information (if available to adidas)

Location information

Measurements (if available to adidas)

Payment, Purchase and Transaction Information (if available to adidas)

Social Media Interaction and Activity (if available to adidas)

Fitness Activity Information (if available to adidas)

Browsing Information

Mobile Device Information

Behavioural and Preference Information (if available to adidas)

Personal Opinion

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

We retain it for as long as you do not withdraw your consent.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Advertising Agency Partners

Social Media Platforms

Targeted Marketing Service Providers

IT Cloud Solution Providers

5.3.d. User-Generated Content (UGC) Acquisition From Social Media

PROCESSING

We invite you to provide your images to us via social media platforms by following specific instructions such as “#yesadidas”. We will be using the images you provide for our campaign communications. We will obtain rights to your image through a licence agreement in the form of our terms and conditions. By submitting your images via social media platforms to us, you will agree for us to use your images as described in the licence agreement.

LEGAL BASIS

Performance of Contract

CATEGORIES OF PERSONAL DATA

Identity information: your social media handler

Community information: images, videos, comments, sound recordings and other files provided through the social media platform promoting adidas

Social Media Interaction and Activity

RETENTION PERIOD

Duration of licence agreement and statutory limitation period in case of any disputes.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Event Partners (where applicable)

UGC Support Partners

Advertising Agency Partners

Social Media Platforms

IT Cloud Solution Providers (where applicable)

5.3.e. Push Notifications (In-App Communication)

PROCESSING

When you use the adidas app, we use push notifications in this app to communicate with you concerning the purposes stated in this Notice. This includes information that relates to purposes based on the Performance of Contract (such as your purchase). You can switch off push notifications at any time using “Settings” in your mobile devices. However, if you switch off push notifications, we may need to contact you via emails for important messages relating to your purchase.

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Browsing Information AND Mobile Device Information

RETENTION PERIOD

For as long as you use the app and not switched Push Notification off.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

5.3.f. Push Notification on Mobile Devices Based on Your Current Location

PROCESSING

We need to access your real time location information via your mobile devices in order to send you push notifications about an event or an adidas store closest to you.

When you enable location sharing for the adidas app, including when you’re not using the app, or when the app is closed, you allow the adidas app to continue to access your mobile device’s location data in the background.

adidas sets up a “geofence” around a specific location of interest, such as a store or an event. This geofence is registered with the location service available on your mobile device, such as Google or Apple. We do not receive information about your actual location in real time. We only receive information from the location services about your mobile device entering and leaving our geofences.

Android Device and Google location service: We checks every 15 minutes to see whether a device is close to one of our geofences. We store a cache on your device to capture the location from which the request was made so that we can invalidate the cache stored on your device when you move away.

Apple Device and location service: adidas is notified every time a user moves more than about 500m so we can re-register the regions in order of proximity to users (to get around the limit of 20 regions). We store your last known location temporarily. The information is discarded when the app is closed.

LEGAL BASIS

Consent

CATEGORIES OF PERSONAL DATA

§ Mobile Device Information

WIFI/IP Information

Operating System

Activity Log on Device

Apps installed on device

Device EUI

Device ID

§ Location Information

Real-Time Device Location Information – Device Sensors / Signals

RETENTION PERIOD

For as long as you do not switch push notification or location tracking off.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

5.4. Administer adidas Membership Programmes and Organise Events and Activities

5.4.a. adiClub Membership Administration

This section applies when you create and register a membership account and become an adiClub member.

adidas collects and uses your adiClub membership Personal Data for the purposes of:

1. Compliance with Membership Terms and Conditions; and

2. Profiling for Personalised Content, Experience, Business & Marketing Analytics and Targeted Marketing Messages

1. Compliance with Membership Terms and Conditions

PROCESSING

When you apply and create a membership account, we collect and use your Personal Data to administer your account and comply with the adiClub Terms and Conditions.

This includes the following:

a. collecting, storing, and processing the Personal Data you provided in the registration form to create a membership profile and account for you;

b. assigning a membership ID to your profile and account and using the membership ID along with other Identity Information you provided to identify you;

c. storing your membership account log-in details in our global authentication platform to allow you to log in to all eligible adidas platforms (adidas website, adidas app, CONFIRMED app, and adidas Running app) with one set of log-in details;

d. displaying your current membership status, including your profile information, level, points, and other relevant information in all adidas domains and apps;

e. sending you membership administration messages via email including messages about your account status (level up and/or down), management (rewards unlocked for you and how to retrieve them) and maintenance requests (for example, password reset);

f. sending you membership administration messages via push notification in adidas apps about your account status (level up and/or down), and management (rewards unlocked for you) and maintenance requests (for example, password reset) - you can switch off push notifications at any time using “Settings” in your mobile devices. However, if you switch off push notifications, we may need to contact you via emails for important messages relating to your membership;

g. verifying and using your profile and account information for the purpose of participating in member-exclusive challenges and/or raffles - this will also include sharing your contact details with partners who support us with administering the raffles especially in the case where you have won a prize;

h. calculating your club points to provide you rewards - this will include sharing your data with partners who support us with administering the reward, where the reward may be provided via a partner or exclusively by the partner;

i. updating your point status once you have used points to redeem awards;

j. keeping track of your redemption activity and history;

k. providing you access to special offers and promotions;

l. sending you invitations to exclusive events;

m. allowing you access to limited edition products;

n. providing you adidas running Basic Features (subject to change) as part of membership offering;

o. providing you access to adidas running Premium Features offered as a reward of membership in accordance with membership Terms and Conditions;

p. providing you access to adidas running Premium Features via a subscription purchased from runtastic GmbH;

q. storing your shipping address and payment details to shorten check-out time online and in the app;

r. storing your complete order history so you can access it at any time;

s. allowing you to track your order delivery from your account;

t. accessing your membership profile and providing you services and support – including updating your account information following your instructions, providing you with support and answer your queries about your account, your purchases, technical support for using our apps, supporting you with your privacy queries - when you contact adidas through various communication channels using your membership ID and profile;

u. storing all Personal Data we collect from you directly or indirectly that has been identified via your membership ID or email with your membership profile, including details you may have shared at a adidas brand retail store and outlet and participating adidas franchised stores to enable for the purposes of calculating points and levels to enable all the points listed above; and

v. sharing Membership Administration Information with adiClub Partners and receiving data from adiClub partners for the purpose of Earning Points and Rewards as specified in the Terms and Conditions – this is strictly based on your explicit consent at the time where the data is collected by adiClub Partners; if you wish to stop sharing data with the adiClub Partner or with adidas, you can withdraw your consent at any time.

w. reviewing your account activity status to delete inactive (terminated) accounts: your account is considered inactive after four (4) years where: you have not made any purchases, OR visited and/or used any of the features of our site and apps, OR opened any of the email communication we have sent you, OR made any changes to your profile, OR interacted with adidas in any way for 4 years. Once your account is deemed inactive, all of your data hosted by adidas (adidas.COM/adidas app/adidas running app/confirmed app) associated with your membership account will be deleted.

Also, for the purposes of:

§ PROVIDING YOU ACCESS TO ADIDAS RUNNING PREMIUM FEATURES VIA A SUBSCRIPTION PURCHASED FROM RUNTASTIC GMBH

The adidas entities below are responsible for your Personal Data:

adidas AG

Runtastic GmbH – Pluskaufstraße 7, 4061 Pasching, Austria (“adidas Runtastic”)

LEGAL BASIS

Performance of Contract (PROCESSING: a – u, w)

Consent (PROCESSING: v)

CATEGORIES OF PERSONAL DATA

Membership Administration Information

Identity Information

Contact Information

Browsing Information

Mobile Device Information

Correspondence

Image and Recordings (when available to adidas)

Personal Opinion (when available to adidas)

Measurements (when available to adidas)

Payment, Purchase and Transaction Information (when available to adidas)

Social Media Interaction and Activity (when available to adidas)

Fitness Activity Information (when available to adidas)

Behavioural and Preference Information (when available to adidas)

RETENTION PERIOD

Active Members: Duration of contract. Limited information will be kept separately for 3 years after contract termination in case of any legal disputes concerning the contract.

Inactive Members (PROCESSING: m): 4 years.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Prospective Buyers and Investors

Business Consulting Service Providers

Data Analytics Solution Providers

adiClub Partners

2. Profiling for Personalised Content, Experience, Business & Marketing Analytics and Targeted Marketing Messages

PROCESSING

We use your Personal Data to create personalised content for you and make sure we interact with you in a manner that you are more likely to keep and maintain your membership, respond to our targeted marketing messages, and to continue purchase adidas products and use adidas platforms.

This includes the following:

a. sending you personalised email messages about how to gain club points or retain your level including promotional messages about adidas products, services and lifestyle recommendations - you can unsubscribe from this message at any time by using the “Unsubscribe” function in the message;

b. sending you push notification via adidas apps about how to gain club points or retain your level including promotional messages about adidas products, services, and fitness and lifestyle recommendations - you can switch off push notifications at any time using “Settings” in your mobile devices. However, you may still receive email messages which you can unsubscribe directly in the email messages;

c. tracking and monitoring your online browsing behaviour (if you have logged in and accepted our use of certain tracking technologies on the website and in our apps including using Cookies, Pixels, Tags);

d. storing all Personal Data we collect from you directly or indirectly that has been identified via your membership ID or email with your membership profile, including details you may have shared at a adidas brand retail store and outlet and participating adidas franchised stores to enable for the purposes of calculating points and levels, and using them to enrich your membership profile as detailed below; and

e. analysing and assessing all Personal Data we collect from you directly or indirectly that has been identified via your membership ID or email with your membership profile, including details you may have shared at a adidas brand retail store and outlet and participating adidas franchised stores. More specifically, this includes using your Personal Data in the following ways:

§ PROFILING (AUDIENCE MANAGEMENT)

§ MARKETING ANALYTICS

§ DATA ENRICHMENT

§ IMPROVE DATA MODELS

LEGAL BASIS

Legitimate Interest

You have the right to object to our legitimate interest at any time.

CATEGORIES OF PERSONAL DATA

Membership Administration Information

Identity Information

Contact Information

Browsing Information

Mobile Device Information

Correspondence

Image and Recordings (when available to adidas)

Personal Opinion (when available to adidas)

Measurements (when available to adidas)

Payment, Purchase and Transaction Information (when available to adidas)

Social Media Interaction and Activity (when available to adidas)

Fitness Activity Information (when available to adidas)

Behavioural and Preference Information (when available to adidas)

RETENTION PERIOD

Duration of membership and for as long as you do not object to our legitimate interest by deleting your Personal Data

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Prospective Buyers and Investors

Business Consulting Service Providers

Data Analytics Solution Providers

Email Marketing Support Providers

adiClub Partners

5.4.b. Operation of adidas Running Features

PROCESSING

We process your personal data to be able to provide you with a seamless user experience when using adidas Running. This includes any data processing that is necessary for the use of the specific features you want to use, e.g. the comparison of activity data with those of other users, if you participate in a leaderboard ranking or a challenge.

LEGAL BASIS

Performance of Contract

CATEGORIES OF PERSONAL DATA

Membership Administration Information

Identity Information

Contact Information

Browsing Information

Mobile Device Information

Correspondence

Image and Recording (if available to adidas)

Personal Opinion (if available to adidas)

Measurements (if available to adidas)

Payment, Purchase and Transaction Information (if available to adidas)

Social Media Interaction and Activity (if available to adidas)

Fitness Activity Information (if available to adidas)

Behavioural and Preference Information (if available to adidas)

RETENTION PERIOD

Duration of contract and statutory limitation period. We need to keep the information in case of any legal disputes concerning the contract.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Data Analytics Solution Providers

IT Cloud Solution Providers

CRM Solution Providers

5.4.c. Sweepstakes and Competitions Participation

PROCESSING

We use your information to verify your eligibility to enter the sweepstake and competition, and to contact you using the contact details you share with us. In case you are the winner of the competition or the sweepstake, we will use your information to send you the prize, and to take care of other administrative and legal requirements as necessary.

LEGAL BASIS

Performance of Contract

CATEGORIES OF PERSONAL DATA

Identity Information

Contact Information

Behaviour and Preference Information

Payment, Purchase and Transaction Information

Fitness Activity Information

Measurements

RETENTION PERIOD

Duration of the Competition + two months

CATEGORIES OF RECIPIENTS

adidas Data Controllers

adidas affiliates administering the Competition

Agencies providing support to the Competition

Delivery Service Providers

5.4.d. Private Event Registration

PROCESSING

When you sign up for an event which we organise that have limited spots, we use the Personal Data you provide to reserve a spot for you. Your Personal Data will be used according to the Terms and Conditions associated with the event. Please read the specific privacy notice we may publish at the time of the registration if available.

LEGAL BASIS

Performance of Contract

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Location information

Fitness Activity Information: any information we may collect from you on the day of the event.

Behavioural and Preference Information (if collected for the specific event)

Image and Recordings (if collected for the specific event)

Personal Opinion (if collected for the specific event)

Social Media Interaction and Activity (if collected for the specific event)

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

Duration of the event and statutory limitation period in case of any disputes.

CATEGORIES OF RECIPIENTS

adidas Controller organizing the event.

adidas AG Subsidiaries and Affiliates

Event Partners (where applicable)

IT Cloud Solution Providers (where applicable)

5.4.e. Open Event Registration

PROCESSING

We often also organize events that are open to everyone. We use the Personal Data you provide to keep you inform of the events you are interested in. Please read the specific privacy notice we may publish at the time of the registration if available.

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Identity information

Contact information

Location information

Fitness Activity Information: any information we may collect from you on the day of the event.

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

For the duration of the event + 36 months if the data from a particular event is used for BUSINESS OPERATIONAL ANALYTICS purpose.

CATEGORIES OF RECIPIENTS

adidas Controller organizing the event.

adidas AG Subsidiaries and Affiliates

Event Partners (where applicable)

IT Cloud Solution Providers (where applicable)

5.5. Improve and Develop adidas Brand Products and Services

5.5.a. Product Research and Development

PROCESSING

We conduct analysis to research improve our products and services. This includes asking you questions in surveys, asking you for feedback, asking you to test our products and provide us with a review, asking other service providers to conduct market and product research for us, try new technologies in our product that might collect Personal Data to stay ahead of the competition. We retain this information based on our “legitimate interest”, so by participating in any product review or survey, you agree that this is our legitimate interest. Where it is possible for the specific project or if you object to this legitimate interest, we will remove any identity, contact, or mobile device information, so the information cannot be used to identify you, and will no longer be your Personal Data, and is considered “anonymised”.

§ DATA ENRICHMENT

LEGAL BASIS

Legitimate Interest

CATEGORIES OF PERSONAL DATA

Measurements (only if required by the project)

Identity information (only if required by the project)

Contact information (only if required by the project)

Location information (only if required by the project)

Payment, Purchase and Transaction Information (only if required by the project)

Social Media Interaction and Activity (only if required by the project)

Fitness Activity Information (only if required by the project)

Browsing Information (only if required by the project)

Mobile Device Information (only if required by the project)

Correspondence (only if required by the project)

Behavioural and Preference Information (only if required by the project)

Membership Administration Information (where adidas brand membership applies / if available to adidas)

RETENTION PERIOD

The duration of the project and statutory retention period stated to protect our IP rights.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Prospective Buyers and Investors

Business Consulting Service Providers

Data Analytics Solution Providers

Manufacturing Providers

IT Cloud Solution Providers

5.6. Comply with Legal Obligations

5.6.a. Legal Obligation - Cooperation with Law Enforcement And Regulatory Authorities (Including Courts)

PROCESSING

When we are legally required to provide your Personal Data for national and public security reasons, crime prevention, investigation and prosecution, anti-money laundering, judicial proceedings, protection of other individuals’ rights and freedoms, and enforcement of civil claims, we will provide information as requested by the authorities or parties once we are satisfied that the request is mandated by law. We may not be able to notify you if it is against the law to do so.

LEGAL BASIS

Legal Obligation

CATEGORIES OF PERSONAL DATA

All Categories of Personal Data as requested by the enforcement authority.

RETENTION PERIOD

For as long as required by law.

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

Local and national government authorities, including tax authorities

Local and national law enforcement agencies

Local and national judiciary

5.6.b. Evidence – Contract Dispute and/or Legal Compliance

PROCESSING

We need to keep evidence in case of any contractual dispute, or to defend ourselves in case of any investigatory audits or privacy compliance disputes and complaints, including how we have handled your individual rights.

LEGAL BASIS

Legal Obligation

CATEGORIES OF PERSONAL DATA

All Categories of Personal Data as required to be used as evidence

RETENTION PERIOD

Statutory Limitation period depending on the contractual period and/or the legal requirement

CATEGORIES OF RECIPIENTS

adidas AG Subsidiaries and Affiliates

6. Recipients of your Personal Data

You can find a list of Data Recipients who processes your Personal Data under Responsible Entities’ instructions below. The list is subject to change as necessary.

COMPANY - SERVICE

adidas International Marketing B.V. | the Netherlands - Webshop operations & Marketing Services

Demandware Inc.| USA - Website Hosting

Adyen | the Netherlands - Payment Processes

Klarna | Sweden - Payment Processes

InfoSys Technologies Ltd. | India, EPAM | Belarus - Website Development

Adobe Analytics | Ireland, Google Analytics | USA - Web Analytics

Sprinklr | USA, Olapic Inc. | USA - Social Media Analytics

Flurry | USA, Apps Flyer | Israel - Mobile App Analytics

Qualtrics LLC | USA – Survey, Net Promoter Score

act.3 | Germany, cip Trademarketing GmbH | Germany - Event Management

Neolane Ltd. | France - Marketing

Batterii LLC | USA - Consumer Insights

Olapic, Inc. | USA - UGC Support Partners

adidas affiliates | globally - Consumer Relationship Management

DHL | Germany - Product Delivery

Forter Inc. | UK, USA, Israel, Singapore – Payment Risk Solution Provider – Fraud Prevention

Feedzai | Germany - Fraud Prevention

PayPal | USA - Payment Service

Apple Pay, Google Pay | USA - Mobile Payment

Facebook (WhatsApp, Instagram) | USA - Social Media Interaction

Facebook Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2 | Ireland - Social Media Interaction

Twitter | USA - Social Media Interaction

Google | USA - Social Media Interaction

Runtastic GmbH | Austria - Health and Fitness Community

Google Analytics | USA - Analytics

Adobe Analytics | USA - Analytics

Anatwine Limited | UK - Consumer Experience

AWIN AG | Germany – Advertising Partner

MediaCom | UK - Advertising Partner

Salesforce - CRM Software | Data Analytics

Wunderman - Email Marketing Services

Stuffstr Limited | UK - Selling Partner

Webhelp | France - – Customer Service Provider

Fit Analytics GmbH | Germany – Size Reccomnedation Provider

Bazaarvoice, Inc | USA – Ratings analytics Provider

mParticle Inc | USA – Mobile App analytics

Amplitude Inc | USA – Mobile App analytics

Appsflyer Ltd | Israel – Mobile App analytics

Visenze Pte. Ltd | Singapore - Visual Search Provider

Vyking Limited | UK - Augmented Reality Services Provider

Akamai Technologies GmbH | US – website traffic management

Tealium | US - Tag manager

Decibel Insight Ltd | UK – Non-Marketing Site/App Business AnalyticsCertona Corporation | US - Ab testing & personalization

Bing (Microsoft Corporation) | US – Social Media Interaction

Pinterest Inc. | US – Social Media Interaction

Snap Inc. | US – Social Media Interaction

Instana Inc. | US – Site Diagnostics and Analytics

nShift | UK - Multicarrier Delivery Management Platform

In case you are using adidas Running app please also consult https://www.runtastic.com/pdfs/terms/recipients%5Fof%5Fpersonal%5Fdata.pdf for more information on the potential recipients of app related data , the data categories affected and the purpose of the respective data sharing.

Where your personal data may be used by non-adidas Data Controllers via adidas platforms, applications or elsewhere for their own purposes, please consult the privacy notice of the non-adidas Data Controller for more information about how they handle your personal data.

7. What does adidas do when we transfer your Personal Data outside of the EU/EEA?

Depending on the Personal Data processing activity, your Personal Data is shared with different “Categories of Recipients”. Where the recipient is located outside the EU/EEA, we have implemented necessary measures such as singing the EU Standard Contractual Clauses approved by the EU Commission and appropriate security safeguards.

8. How do we secure your Personal Data?

We implement appropriate technical and organisational measures to address the risks corresponding to our use of your Personal Data, including loss, alteration, or unauthorised access to your Personal Data, and empowering you to exercise your rights. We require our service providers to do the same through contractual agreements. However, you should be aware that any transmission of your Personal Data through the internet is at your own risk. We can only protect your Personal Data when we have it.

9. General Questions, Support

adidas CUSTOMER SERVICE - (https://adidas.com/help)

LOCAL AUTHORITIES

If you have any questions about your rights, please consult your local authorities’ websites and offices.

10. Data Protection Officer

DataProtection@adidas.com

Global Legal (Privacy) | Data Protection Officer

adidas AG

Adi-Dassler-Straße 1

91074 Herzogenaurach

Germany