Privacy Notice for Customers and Prospective Customers — JACK WOLFSKIN table { border-collapse: collapse; width: 100%; margin: 1em 0; } th, td { border: 1px solid #bfbfbf; padding: 8px 12px; text-align: left; vertical-align: top; } th { background-color: #f2f2f2; }

Privacy Notice for Customers and Prospective Customers (as of April 2026)

1. Part 1: Privacy information about our data processing pursuant to Articles (Art.) 13, 14 and 21 of the General Data Protection Regulation (GDPR) and Art. 19 and 20 of the Swiss Federal Act on Data Protection (FADP)
2. Part 2: Extended privacy notice for our website
3. Part 3: Supplementary privacy information regarding our Facebook fan page

Part 1: Privacy information about our data processing pursuant to Articles (Art.) 13, 14 and 21 of the General Data Protection Regulation (GDPR) and Art. 19 and 20 of the Swiss Federal Act on Data Protection (FADP)

We take data protection seriously and hereby inform you how we process your data and what claims and rights you have under data protection law. Valid from 25 May 2018 (introduction) and adapted from time to time to reflect changed processes and case law.

This privacy notice covers the data-protection-relevant activities of all companies within the Jack Wolfskin Group (see the companies listed under 1), as well as activities carried out as part of services for external companies. Personal data is processed according to the same procedures and principles across the companies listed, which is why a uniform privacy notice is used.

1. Controller responsible for data processing and contact details

For the purposes described in this notice and for compliance with applicable local data protection laws as well as the GDPR, the following responsibilities apply:

For the purposes of

• operating the website, and
• product research and development
• the sale of Jack Wolfskin products – online and offline orders

the following is

Jack Wolfskin Retail GmbH
Jack Wolfskin Kreisel 1
65510 Idstein/Ts., Germany
Phone +49 6126 954 0
Fax +49 6126 954 159
info@jack-wolfskin.com

responsible. (hereinafter: "we / us / Jack Wolfskin")

Who assumes which obligations under the GDPR, and what does that mean for you as a data subject?

a) Data protection incidents, communication with supervisory authorities

Jack Wolfskin Retail GmbH handles all data security incidents relating to any data processing covered by this privacy policy and conducts communication with the data protection authorities, including fulfilling any resulting reporting obligations to the competent supervisory authority (Art. GDPR) and notification obligations towards affected individuals (Art. GDPR).

Our lead authority is:

The Hessian Commissioner for Data Protection and Freedom of Information
represented by
Prof. Dr. Alexander Roßnagel

Gustav-Stresemann-Ring 1
65189 Wiesbaden, Germany

The corporate group is contractually obligated to ensure that, upon becoming aware of a data protection incident, all measures necessary to secure the data and mitigate possible adverse consequences for affected individuals are taken without delay, and that other companies within the corporate group are informed of the data protection incident.

b) Central point of contact

The Jack Wolfskin Data Protection Officer serves as the central point of contact for all concerns and questions relating to the data processing described in this privacy notice, which is available at https://www.jack-wolfskin.com.

You can reach them using the following contact details:

Jack Wolfskin Retail GmbH
Jack Wolfskin Kreisel 1
65510 Idstein/Ts., Germany
Email: datenschutz@jack-wolfskin.com

2. Purposes and legal basis on which we process your data

We process personal data in accordance with the provisions of the General Data Protection Regulation (GDPR), the German Federal Data Protection Act (BDSG), the Swiss Federal Act on Data Protection (FADP), the German Telecommunications-Telemedia Data Protection Act, and other applicable data protection provisions (details below).

Which data is processed in detail and how it is used depends significantly on the purposes of the processing.

Further details or additions regarding the purposes of data processing can be found in the relevant contractual documents, forms, consent declarations and/or other information provided to you (e.g. when using our website or in our terms and conditions). In addition, this privacy notice may be updated from time to time, as you can see on our website www.jack-wolfskin.com/pages/privacy.

2.1 Purposes relating to the performance of a contract or pre-contractual measures (Art. 6(1) sentence 1(b) GDPR and Art. 31(2)(a) FADP)

The processing of personal data takes place in order to perform our contracts with you and to carry out your orders, as well as, at your request, to carry out measures and activities in the context of pre-contractual relationships, e.g. with prospective customers. In particular, the processing serves the delivery of our products and the services related to our products in accordance with your orders and wishes. The scope of the processing accordingly extends to those categories of personal data required for the respective service, measure or activity.

This essentially also includes contract-related communication with you, the verifiability of transactions, orders and other agreements, as well as quality control through appropriate documentation, goodwill procedures, measures to steer and optimize business processes, and fulfilment of general duties of care; management and control by affiliated companies (e.g. the parent company); statistical evaluations for corporate management, cost recording and controlling, reporting, internal and external communication, emergency management, billing and tax assessment of operational services, risk management, the assertion of legal claims and defense in legal disputes; ensuring IT security (including system and plausibility testing) and general safety, including building and facility security, exercising and enforcing our right to determine who may access the premises (e.g. through access controls); ensuring the integrity, authenticity and availability of data, prevention and investigation of criminal offenses; and oversight by supervisory bodies or control authorities (e.g. auditing).

2.2 Purposes in connection with a legitimate interest of ours or of third parties (Art. 6(1) sentence 1(f) GDPR and Art. 31(1) FADP)

Beyond the actual performance of the contract or pre-contract, we may process your data where necessary to safeguard legitimate interests of ourselves or third parties, in particular for the following purposes, which also constitute a legitimate interest of ours or of third parties:

• the further development of services and products, as well as existing systems and processes;
• obtaining information and exchanging data with credit reference agencies, to the extent this goes beyond our economic risk;
• reviewing and optimizing procedures for needs analysis;
• the further development of services and products, as well as existing systems and processes;
• advertising or market and opinion research, unless you have objected to the use of your data;
• disclosure of personal data in connection with due diligence during company sale negotiations;
• screening against European and international anti-terrorism lists, to the extent this goes beyond statutory obligations;
• enriching our data, including through the use or research of publicly available data;
• statistical evaluations or market analysis;
• benchmarking;
• the assertion of legal claims and defense in legal disputes that are not directly attributable to the contractual relationship;
• the restricted storage of data where erasure is not possible, or only possible with disproportionately high effort, due to the specific nature of storage;
• the development of scoring systems or automated decision-making processes;
• the prevention and investigation of criminal offenses, insofar as this is not exclusively for the purpose of fulfilling statutory requirements;
• fraud prevention;
• building and facility security (e.g. through access controls and video surveillance), to the extent this goes beyond general duties of care;
• internal and external investigations, security checks;
• any monitoring or recording of telephone calls for quality control and training purposes;
• obtaining and maintaining certifications of a private-law or regulatory nature;
• exercising and enforcing our right to determine who may access the premises through appropriate measures, including video surveillance to protect our customers and employees, and to secure evidence in connection with criminal offenses and their prevention.

If you would like further information on the balancing of interests, you may contact us or our Data Protection Officer at any time.

2.3 Purposes based on your consent (Art. 6(1) sentence 1(a) GDPR and Art. 31(1) FADP)

Processing of your personal data for certain purposes (e.g. use of your email address for marketing purposes and to carry out an evaluation of your shopping experience, including bonus and loyalty programs) may also take place on the basis of your consent. You may withdraw your consent at any time. This also applies to the withdrawal of declarations of consent given to us before the GDPR took effect, i.e. before 25 May 2018. You will be separately informed about the purposes and the consequences of withdrawal or of not giving consent in the relevant consent text.

As a general rule, the withdrawal of consent only takes effect for the future. Processing carried out before the withdrawal is not affected and remains lawful.

2.4 Purposes relating to the fulfilment of statutory requirements (Art. 6(1) sentence 1(c) GDPR and Art. 31(1) FADP) or in the public interest (Art. 6(1) sentence 1(e) GDPR and Art. 31(1) FADP)

Like anyone participating in economic activity, we are subject to a wide range of legal obligations. These are primarily statutory requirements (e.g. commercial and tax laws), but may also include regulatory or other official requirements (e.g. court rulings). The purposes of processing may include identity and age verification, fraud and anti-money-laundering prevention, the prevention, combating and investigation of terrorist financing and asset-endangering crimes, screening against European and international anti-terrorism lists, fulfilling tax-related control and reporting obligations, and archiving data for data protection and data security purposes as well as for review by tax and other authorities. In addition, disclosure of personal data may be required in connection with official or judicial measures for the purposes of gathering evidence, prosecuting offenses, or enforcing civil-law claims.

2.5 Processing in connection with the electronic withdrawal function

When you exercise your right of withdrawal electronically via the provided function, we process personal data necessary to process your declaration. This includes, in particular, your name, your contact details, and information relating to the contract concerned (e.g. order number).

This processing is based on Art. 6(1)(b) GDPR for the purpose of processing the withdrawal and the related communication. The data is stored only for as long as necessary to process the withdrawal and to comply with statutory retention obligations.

3. Categories of data we process where we do not receive the data directly from you, and its origin

To the extent necessary for the provision of our services, we process personal data lawfully obtained from other companies or third parties (e.g. credit reference agencies, address vendors). We also process personal data that we have lawfully obtained, received, or acquired from publicly accessible sources (such as telephone directories, commercial and association registers, residents' registration records, debtor registers) and are permitted to process.

Relevant categories of personal data may include, in particular:

• personal identification data (name, place of birth, gender, nationality, marital status, occupation/industry and comparable data)
• contact data (address, email address, telephone number and comparable data)
• address data (registration data and comparable data)
• payment/coverage confirmation for bank and credit cards
• information about your financial situation (creditworthiness data, including scoring, i.e. data for assessing economic risk)
• customer history, order history, including clothing/size information
• data on your use of the telemedia services we offer (e.g. time of accessing our websites, apps or newsletter, IP address, pages/links clicked by you or entries and comparable data)

4. Recipients or categories of recipients of your data

Within the corporate group referred to in Section 1, only those internal departments or organizational units that require your data to fulfil our contractual and statutory obligations, or in connection with pursuing our legitimate interest, will receive your data (see Section 1 for further details).

Beyond this, your data will only be disclosed to external parties

• in connection with contract processing (e.g. also payment service providers);
• in connection with Jack Wolfskin Store promotional campaigns, to Jack Wolfskin store operators;
• where you hold a customer account or participate in a Jack Wolfskin loyalty program, in connection with registering for your customer account or a Jack Wolfskin loyalty program, and with your purchase at a participating Jack Wolfskin store or the official Jack Wolfskin Online Shop, to Jack Wolfskin store operators;
• for the purpose of fulfilling statutory requirements under which we are obliged to provide information, report, or disclose data, or where disclosure of data is in the public interest (see Section 2.4);
• where external service providers process data on our behalf as processors or as parties assuming a specific function (e.g. external data centers, support/maintenance of IT applications, providers of rating, chat and comment functions, search and merchandising functions, archiving, document processing, call center services, compliance services, controlling, data screening for anti-money-laundering purposes, data validation or plausibility checks, data destruction, purchasing/procurement, customer management, letter shops, marketing, media technology, research, risk controlling, billing, telephony, website management, auditing services, credit institutions, printing companies or companies for data disposal, courier services, logistics);
• on the basis of our legitimate interest or the legitimate interest of the third party, for the purposes listed under Section 2.2 (e.g. to authorities, credit reference agencies, debt collection agencies, lawyers, courts, expert assessors, group-affiliated companies and bodies and control authorities);
• where you have given us consent to disclosure to third parties.

We will otherwise not disclose your data to third parties. To the extent we engage service providers as processors, your data is subject to the same security standards there as with us. In all other cases, recipients may only use the data for the purposes for which it was transmitted to them.

5. Duration of storage of your data

We process and store your data for the duration of our business relationship. This includes the initiation of a contract (pre-contractual relationship) and the performance of a contract.

Beyond this, we are subject to various statutory retention and documentation obligations, arising in particular from the German Commercial Code (HGB) and the Fiscal Code (AO). The retention or documentation periods specified in the applicable legal provisions are up to ten years beyond the end of the business relationship or the pre-contractual relationship.

In addition, specific statutory provisions may require a longer retention period, for example to preserve evidence in connection with statutory limitation periods. Under Sections 195 et seq. of the German Civil Code (BGB), the regular limitation period is three years; however, limitation periods of up to 30 years may also apply.

If the data is no longer required for the fulfilment of contractual or statutory obligations and rights, it will generally be deleted, unless its continued – time-limited – processing is necessary to fulfil the purposes listed under Section 2.2 on the basis of an overriding legitimate interest. Such an overriding legitimate interest exists, for example, where erasure is not possible, or only possible with disproportionately high effort, due to the specific nature of storage, and processing for other purposes is excluded by appropriate technical and organizational measures.

6. Processing of your data in a third country or by an international organization

Beyond the data processing in a third country referred to under Section 1, a transfer of data to bodies in states outside the European Union (EU) or the European Economic Area (EEA) (so-called third countries) or Switzerland may take place where this is necessary in connection with an order/contract with you, is required by law (e.g. tax reporting obligations), is in the legitimate interest of us or a third party, or you have given consent. The processing of your personal data in a third country may also take place in connection with the engagement of service providers as processors. Where no adequacy decision by the EU Commission exists for the country in question regarding an appropriate level of data protection, we ensure, in accordance with EU data protection requirements, through appropriate contracts under Art. 46(2)(c) GDPR and Art. 16(2)(d) FADP, that your rights and freedoms are appropriately protected and guaranteed. We will provide corresponding detailed information upon request.

Information on suitable or appropriate safeguards and on the possibility of obtaining a copy can be requested from our Data Protection Officer.

7. Your data protection rights

Under certain conditions, you may assert the following data protection rights against us

• You have the right to obtain information from us about your data stored with us, in accordance with Art. 15 GDPR (subject, where applicable, to restrictions under Section 34 BDSG) or Art. 25 FADP (subject, where applicable, to restrictions under Art. 26 FADP).
• Upon your request, we will correct data stored about you in accordance with Art. 16 GDPR or Art. 32(1) FADP if it is inaccurate or erroneous.
• If you wish, we will delete your data in accordance with the principles of Art. 17 GDPR or Art. 32(2)(c) FADP, unless other statutory provisions (e.g. statutory retention obligations or the restrictions under Section 35 BDSG) or an overriding interest on our part (e.g. for the defense of our rights and claims) prevent this.
• Subject to the conditions of Art. 18 GDPR or Art. 32(2)(a) FADP, you may request that we restrict the processing of your data.
• Furthermore, you may object to the processing of your personal data under Art. 21 GDPR, in which case we must cease processing your data. However, this right to object – except in the case of direct marketing under Art. 21(2) GDPR – applies only where there are grounds arising from your particular situation, and rights of our company may in certain cases override your right to object. Further details on the right to object are provided in Section 10.
• You also have the right, under the conditions of Art. 20 GDPR, to receive your data in a structured, commonly used, and machine-readable format, or to have it transmitted to a third party, or, under Art. 16 of the Swiss Data Protection Ordinance (DPO), to have this provided in writing or in the form in which the data is held.
• Furthermore, you have the right to withdraw a consent given for the processing of personal data at any time, with effect for the future (see Section 2.3).
• You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). You may also always contact our Data Protection Officer in confidence. There is no right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner.

Requests to exercise your rights should, where possible, be made in writing to the address given above or addressed directly to our Data Protection Officer.

8. Scope of your obligation to provide us with data

You only need to provide the data required to establish and carry out a business relationship or a pre-contractual relationship with us, or which we are legally obliged to collect. Without this data, we will generally be unable to conclude or perform the desired contract, or to fulfil our statutory obligations. This may also relate to data required later in the course of the business relationship. Where we request further data from you beyond this, you will be separately informed that providing it is voluntary.

9. Existence of automated decision-making in individual cases (including profiling)

Jack Wolfskin does not use purely automated decision-making procedures within the meaning of Article 22 GDPR or Art. 5(g) FADP. Where such a procedure is used via third-party providers (e.g. for payment processing), we will inform you separately about this if legally required to do so.

Under certain circumstances, we may process your data with the aim of evaluating certain personal aspects (profiling).

To be able to inform and advise you about products in a targeted manner, we may use evaluation technologies and procedures, which are described in more detail in our extended privacy notice for our website. These enable needs-based product design, communication and advertising, including market and opinion research.

Such procedures may also be used to assess your creditworthiness and ability to pay, as well as to combat money laundering and fraud. So-called "score values" may be used to assess your creditworthiness. In scoring, mathematical methods are used to calculate the probability that a customer will meet their payment obligations in accordance with the contract. Such score values thus support us, for example, in assessing creditworthiness and in decision-making in connection with product agreements, and feed into our risk management. The calculation is based on mathematically and statistically recognized and proven methods and is carried out on the basis of your data, in particular income, expenses, existing liabilities, occupation, employer, length of employment, experience from the previous business relationship, contractual repayment of previous loans, and information from credit reference agencies.

No data on nationality or special categories of personal data under Art. 9 GDPR or Art. 5(c) FADP are processed in this context.

10. Detailed information on your right to object under Art. 21 GDPR

1. You have the right to object at any time to the processing of your data carried out on the basis of Art. 6(1)(f) GDPR (processing based on a balancing of interests) or Art. 6(1)(e) GDPR (processing in the public interest), where grounds exist arising from your particular situation. This also applies to profiling based on this provision within the meaning of Art. 4(4) GDPR.
   
   If you object, we will no longer process your personal data, unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or the processing serves to assert, exercise or defend legal claims.
2. We may also process your personal data to carry out direct marketing. If you do not wish to receive advertising, you have the right to object at any time; this also applies to profiling to the extent it is connected with such direct marketing. We will observe this objection going forward. We will no longer process your data for direct marketing purposes once you have objected to such processing.

The objection may be made informally and should, where possible, be addressed to

Jack Wolfskin Retail GmbH
Jack Wolfskin Kreisel 1
65510 Idstein/Ts., Germany

Or by email to: datenschutz@jack-wolfskin.com

Our privacy policy and the privacy information regarding our data processing pursuant to Articles (Art.) 13, 14 and 21 GDPR and Art. 19 and 20 FADP may change from time to time. We will publish any changes on this page. We will make older versions available for inspection in an archive.

Privacy notice as of July 2026

Part 2: Extended privacy notice for our website

Responsible for this website as well as the internet-based services and applications (hereinafter "website") are the companies named under Part 1, Section 1.

The following privacy notice gives you an overview of how we use and protect your personal data when you visit our website.

1. Collection, processing and use of personal data

In some cases, such as registering for and using (e.g. logging into) your customer account, filling in forms, during the ordering process, or when making service inquiries, you will expressly transmit your data to us.

Your data is processed for the purposes set out in Part 1, Section 2, unless further or different information is provided below.

Depending on the case, we will therefore use and process the following data of yours:

• your contact information (e.g. name, address, email address, telephone number);
• information for fulfilling your order (e.g. information on ordered products, delivery and billing details, as well as payment information such as bank, credit card or other payment details);
• information on orders and services (e.g. order and contact details/order history; details of defective products, correspondence to date);
• optionally, during the order process, your date of birth for disclosure to our payment service providers for verification and/or for the purpose of a compliance check
• optionally, during the order process, your telephone number
• other information that you have expressly provided to us (such as your personal profile, registration data, product references, wish lists, ratings and comments, chat messages, data relating to bonus and loyalty programs (e.g. the Jack Wolfskin Card), etc.).

Please always ensure that only those personal data marked as "mandatory information" need to be transmitted to us.

Information marked as "optional" is transmitted to us on a voluntary basis only.

Any personal data you provide to us through the use of our website is processed by us in the manner described in this privacy notice.

2. Creating a customer account

You can open a customer account at www.jack-wolfskin.com. You can also create a digital account in our stores. Setting up such an account, and thereby concluding a usage agreement for the customer account, is voluntary and is based on Art. 6(1)(b) GDPR.

For as long as your customer account exists, it will store, beyond your orders, the data you provided in connection with your previous orders. The customer account can be cancelled at any time by email to: info@jack-wolfskin.com. To create a) a guest or b) a customer account, personal data is requested that we need to a) carry out the order or b) create your customer account, and which enables you to open and use your account.

Which data is specifically collected depends on whether you register as a guest or create a customer account. The following data may be collected and used for creating a customer account:

• first and last name (voluntary)
• email address (mandatory)
• telephone number (voluntary)
• address (voluntary)

You may change or delete the data stored in your customer account at any time.

If you select "card payment" as your payment method, you add a link to your card information to your customer account so that you do not need to re-enter your card information for future orders. Storing this link serves our legitimate interest and the purpose of offering you this convenience feature, and is based on Art. 6(1)(f) GDPR. We ourselves generally do not store your card data. Storage and processing of card information is handled by Shopify Payments, Shopify International Ltd., Victoria Buildings 2nd Floor, 1-2 Haddington Road, Dublin 4, D04 XN32. To prevent misuse in the event of unauthorized access, your full card number is never visible in your customer account. If you wish to delete a payment card from your customer account, you can do so on the "Payment" page. Please note that if you select this payment option, we may contact you and ask you to provide proof of identity for verification purposes. This serves our legitimate interest under Art. 6(1)(f) GDPR in protecting you and us against card misuse. We will of course only use the proof of identity you submit to verify your identity, and will delete it after the statutory retention period has expired.

Of course, you may also order from us without opening a customer account. If you prefer this, simply select the "Order as guest" option. If you order from us without a customer account, we process your data as described above for the purpose of performing the purchase contract and for warranty purposes.

3. Data processing when registering for and participating in the Jack Wolfskin Member Program

If you participate in the Jack Wolfskin Member Program in Germany, Austria and/or Switzerland, Jack Wolfskin requires the following personal data: first name, surname, email address ("mandatory information").

Without providing this data, you cannot participate in the Member Program.

Beyond the mandatory information, you may voluntarily provide further personal data, such as date of birth, postal address, gender, telephone/mobile number, interests, and preferred store ("voluntary information").

We process the personal data you provide for the purpose of participating in the Jack Wolfskin Member Program and to improve our customer offering. We collect and process your data for the purposes of contract performance, namely participation in and operation of the Jack Wolfskin Member Program. This also enables you to enjoy the benefits of the Jack Wolfskin Member Program at our franchise partners. Our franchise partners are therefore able to view the Member ID, first name, last name, and email address of the member in order to grant you the benefits of the Member Program. We have therefore entered into a data processing agreement with our franchise partners in accordance with Art. 28 GDPR. In addition, we use your personal data to inform you about our promotions and offers (marketing purposes) via newsletter. You can object to receiving the newsletter at any time by clicking the unsubscribe link in the email.

Internal analysis and market research

In addition, we store your submitted mandatory and voluntary information for internal analysis and market research purposes. We wish to use the resulting insights, on the one hand, to continuously improve our offering, and on the other hand, to optimally tailor our offering to your demand and needs.

Customer Match

To increase customer satisfaction, we collect customer data, including but not limited to email addresses, from various sources such as our Customer Relationship Management (CRM) system and our Customer Data Platform (hereinafter "CDP"). We use this data to improve our marketing measures and your customer experience by providing personalized advertising, services and offers.

For this purpose, we pass on personal customer data (such as email address, first name and surname) to the provider of our CDP

Bloomreach B.V.
Fred. Roeskestraat 109
1076 EE, Amsterdam
The Netherlands

We have entered into a data processing agreement with Bloomreach in accordance with Art. 28 GDPR. Further information on data protection at Bloomreach can be found at https://www.bloomreach.com/en/legal/services-privacy-notice.

For the purpose of customer matching and displaying personalized advertising, we create so-called Customer Match lists, in connection with which your data may be passed on from Bloomreach to our partners. For this, encrypted ("hashed") user data (email address, telephone number, postal address, customer-specific identifiers) is transmitted to our partners for use in Customer Match lists and uploaded there. Our partners then compare whether the transmitted user data matches the customer data they already hold. From this, target groups can in turn be created, which can be used to serve advertisements/campaigns. The matching process can take up to 48 hours. Once the matching process has been completed and reviewed for policy compliance, your data is deleted.

Our partners are:

Meta Platforms Ireland Limited
Block J, Serpentine Avenue, Dublin 4, Ireland
https://www.facebook.com/privacy/policy

Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland
https://business.safety.google/privacy/?hl=en

Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
https://privacy.microsoft.com/en-us/privacystatement

Emarsys eMarketing Systems GmbH
Zeppelinstr. 2, 85399 Hallbergmoos, Germany
https://emarsys.com/en/privacy-policy/

This only takes place where we have obtained your consent. You may withdraw your consent at any time with effect for the future. You can most easily declare your withdrawal by clicking the unsubscribe link in any newsletter. You may also send us an email at datenschutz@jack-wolfskin.com or a letter to the contact address given in the legal notice (Impressum).

Legal basis for the data processing

The above processing of your personal data in connection with the Jack Wolfskin Member Program takes place to perform our contract with you and to carry out your orders, as well as, at your request, to carry out measures and activities in connection with pre-contractual relationships pursuant to Art. 6(1) sentence 1(b) GDPR and Art. 31(2)(a) FADP.

This essentially also includes contract-related communication with you, the verifiability of transactions, the booking of bonus points and vouchers, other agreements, as well as quality control through appropriate documentation, goodwill procedures, measures to steer and optimize business processes, and fulfilment of general duties of care; management and control by affiliated companies (e.g. the parent company); statistical evaluations for corporate management, cost recording and controlling, reporting, internal and external communication, emergency management, billing and tax assessment of operational services, risk management, the assertion of legal claims and defense in legal disputes; ensuring IT security (including system and plausibility testing) and general safety, including building and facility security, and exercising and enforcing our right to determine who may access the premises (e.g. through access controls); ensuring the integrity, authenticity and availability of data.

Duration of storage of your data

We process and store your data for the duration of our business relationship. This includes the initiation of a contract (pre-contractual relationship) and the performance of a contract. If you have not earned any new bonus points for a period of 10 years and your customer account has not been used by you (i.e. was inactive), JACK WOLFSKIN will delete your loyalty account without further notice. You may, however, register again free of charge at any time.

Beyond this, we are subject to various statutory retention and documentation obligations, arising in particular from the German Commercial Code (HGB) and the Fiscal Code (AO). The retention or documentation periods specified in the applicable legal provisions are up to ten years beyond the end of the business relationship or the pre-contractual relationship.

In addition, specific statutory provisions may require a longer retention period, for example to preserve evidence in connection with statutory limitation periods. Under Sections 195 et seq. of the German Civil Code (BGB), the regular limitation period is three years; however, limitation periods of up to 30 years may also apply. If the data is no longer required for the fulfilment of contractual or statutory obligations and rights, it will generally be deleted, unless its continued – time-limited – processing is necessary to fulfil the purposes listed under Section 3.2 on the basis of an overriding legitimate interest. Such an overriding legitimate interest exists, for example, where erasure is not possible, or only possible with disproportionately high effort, due to the specific nature of storage, and processing for other purposes is excluded by appropriate technical and organizational measures. If you wish to unsubscribe from our Member Program, we will delete your personal data in connection with the unsubscription, unless you are subject to longer statutory retention periods. This also includes the deletion of your data at our partners.

Provision of data

You only need to provide the data required to establish and carry out a business relationship (participation in the Jack Wolfskin Member Program) or a pre-contractual relationship with us, or which we are legally obliged to collect. Without this data, we will generally be unable to conclude or perform the desired contract with you, or to fulfil statutory obligations. This may also relate to data required later in the course of the business relationship.

Jack Wolfskin offers, via the service provider Fobi AI Deutschland GmbH, Walter-Gropius-Str. 15, 80807 Munich, Germany, the option to download your digital customer card to your smartphone wallet. Further information can be found at Passcreator.

4. Payment processing

We offer you the common payment methods used in online retail.

Below you will find an overview of the payment methods available in the various countries:

• Belgium
• Germany
• Finland
• France
• Ireland
• Italy
• Netherlands
• Austria
• Poland
• Portugal
• Switzerland
• Spain
• UK

To process payments, we collect the payment data you provide. Payment data includes, for example:

• preferred payment method
• billing addresses
• IBAN and BIC or account number and sort code
• credit card data
• creditworthiness data

Payment data also includes other information directly related to payment processing and credit checks. This includes, for example, details used by external payment service providers for identification purposes, such as your PayPal ID (if you pay with PayPal).

We also receive further payment data from external payment service providers and credit reference agencies with whom we cooperate for payment processing and credit checks. We only pass on to our payment service providers the data necessary for payment processing.

Payment Service Providers

To process payments in our online shop, we offer various payment methods. Depending on the payment method selected, the personal data required for payment processing is transmitted to the respective payment service provider. This includes, in particular, name, billing and delivery address, email address, order and transaction data, payment amount, and, where applicable, further information required for processing the payment or preventing fraud.

The legal basis for this processing is Art. 6(1)(b) GDPR (contract performance). Where payment service providers carry out their own fraud prevention or creditworthiness checks, this is based on their respective privacy notices and, where applicable, on Art. 6(1)(f) GDPR.

Payment Service Provider	Payment Methods Offered	Responsible Entity / Address	Privacy Notice
Shopify Payments	Visa, Mastercard, American Express, Diners Club, Discover, Apple Pay, Google Pay, Carte Bancaire (FR), iDEAL (NL), TWINT (CH), Bancontact (BE), BLIK (PL), Przelewy24 (PL), Klarna (PL and UK orders only)	Shopify International Limited, 2nd Floor, 1-2 Victoria Buildings, Haddington Road, Dublin 4, D04 XN32, Ireland	https://www.shopify.com/legal/terms-shopify-payments
PayPal	PayPal, PayPal Express	PayPal (Europe) S.à r.l. et Cie, S.C.A., 22-24 Boulevard Royal, L-2449 Luxembourg	https://www.paypal.com/us/webapps/mpp/ua/privacy-full
Klarna (direct integration)	Klarna Pay Now, Klarna Pay Later, Klarna Pay Over Time (all supported countries except PL and UK)	Klarna Bank AB (publ), Sveavägen 46, 111 34 Stockholm, Sweden	https://www.klarna.com/international/privacy-policy/
Payloop	Gift cards (DE, AT)	Payloop GmbH, Eichacherstrasse 3, 8904 Aesch ZH, Switzerland	—
Apple Pay	via Shopify Payments	Apple Distribution International Ltd.	https://support.apple.com/en-us/HT203027
Google Pay	via Shopify Payments	Google Ireland Limited	https://payments.google.com/payments/apis-secure/get_legal_document?ldo=0&ldt=privacynotice&ldl=en
Bancontact (mobile + app)	via Shopify Payments (BE)	Bancontact Payconiq Company	https://www.bancontact.com/files/privacy.pdf
iDEAL	via Shopify Payments (NL)	Currence iDEAL B.V.	https://www.ideal.nl/en/ideal-privacy-cookiestatement
Online Banking PL (P24)	via Shopify Payments (PL)	PayPro S.A. (Przelewy24)	https://www.przelewy24.pl/en/information-obligation-gdpr-payer
BLIK	via Shopify Payments (PL)	Polski Standard Płatności sp. z o.o.	https://blik.com/media/PRIVACY_POLICY_AND_COOKIES_POLICY.pdf
TWINT	via Shopify Payments (CH)	TWINT AG	https://www.twint.ch/en/data-protection/

The personal data required for payment processing is transmitted to Shopify Payments. Further information can be found in Shopify's privacy notices.

For payments via PayPal, including PayPal Express, we use a direct integration with PayPal (Europe) S.à r.l. et Cie, S.C.A. PayPal processes the personal data required for payment processing on its own responsibility. Further information can be found in PayPal's privacy notices.

For certain payment methods, we offer a direct integration with Klarna Bank AB (publ). For orders from Poland and the United Kingdom, Klarna payment methods are provided via Shopify Payments. Klarna processes personal data on its own responsibility. This may include, in particular, identification data, contact information, order information, and information on your ability to pay. Klarna may carry out creditworthiness checks where required for the payment method offered.

For redeeming and managing gift cards in Germany and Austria, we use a direct integration with Payloop GmbH. This involves processing the data required to redeem the gift card (e.g. card number, balance, order information and transaction data).

5. Credit reference agencies

Creditworthiness data consists of our own records of your previous payment behavior towards Jack Wolfskin, as well as score values that we obtain about you from external credit reference agencies. These indicate the estimated economic capacity and willingness to pay of a person. This is done for the purpose of preventing payment defaults for Jack Wolfskin.

Creditworthiness data is typically determined by so-called credit reference agencies. From various pieces of information, the agencies calculate a so-called score value, which takes into account, among other things, existing payment obligations and, where applicable, previous payment defaults. Score values are statistically based estimates of a person's future risk of payment default and are expressed as a numerical value, such as a percentage. We have only limited influence on the data processing of external credit reference agencies (e.g. when we report information to credit reference agencies about unfulfilled payment obligations).

Cooperation with external credit reference agencies takes place on a country-specific basis in order to take account of country-specific particularities and requirements. Under country-specific information, you can find out in which countries we work with which external payment service providers and credit reference agencies.

There you may also find specific privacy notices which we provide to you on behalf of the respective payment service providers and credit reference agencies.

6. Debt collection service providers

Cooperation with external debt collection service providers takes place in Germany, Austria and Switzerland exclusively for the purpose of debt collection. For this purpose, we transfer your personal data to Riverty Services GmbH, Gütersloher Str. 123, 33415 Verl, Germany.

7. Cookies and related data processing

We use cookies and similar technologies (e.g. local storage, session storage), referred to in this privacy notice as "cookies", which store information on end devices (e.g. laptops, smartphones, tablets) or access information already stored on the end device. Our overall aim is to make our website more user-friendly, effective and secure. Cookies are used, for example, for navigation and functionality of our website, where this is necessary, for instance, to save the current shopping cart status.

We primarily rely on so-called session cookies, which are automatically deleted when you close our website.

We also use cookies, in particular, to optimize and improve the online experience on our website. As a result of this use, your data may be collected by us, or by a third party engaged by us, simply through the interaction between your end device and our website. Such data may include, for example (without being limited to such data):

• the IP address of your internet device (e.g. the IP address of your computer, tablet, etc.);
• information about the use of the website (e.g. time and date of your visit, referral URLs, or page views);
• information about your internet device (e.g. type and version of your internet browser and version of your operating system).

In connection with the use of such data, user profiles may be created. Cookies may also be used for this purpose.

The storage of information, such as through cookies and other technologies, on your end device, or access to information already stored on your end device, only takes place on the basis of your consent (e.g. Section 25(1) TTDSG). Consent is not required where the sole purpose of storing information on your end device, or the sole purpose of accessing information on your end device, is to carry out the transmission of a message via a public telecommunications network, or where this is strictly necessary in order to provide you with a telemedia service you have expressly requested.

We have grouped the cookies used on our website into the following categories. You may specify at any time, via the cookie settings, which cookie categories you wish to enable and which you wish to disable.

7.1 NECESSARY / ESSENTIAL

Cookies are used to ensure the basic functions of our website, such as the shopping cart. Without these cookies, our website cannot function. For this reason, these settings cannot be disabled if you wish to use our website.

You can find out more about the technologies, service providers and cookies used under Cookie Settings.

7.2 FUNCTIONAL AND MARKETING

Cookies help us personalize our website for users. Based on your last website visit and the insights gathered there about your behavior in our webshop, our webshop system can make appropriate product suggestions on our website. For example, the homepage may feature products tailored to your interests during your last website visit.

In the area of personalization, this generally involves the use of cookies to improve your user experience in our webshop. This generally does not include any advertisements or marketing measures outside the context of our webshops.

You can find out more about the technologies, service providers and cookies used under Cookie Settings.

7.3 STATISTICS

When visiting the website www.jack-wolfskin.com, data from your browser may be collected for statistical analysis. This data may be shared with various service providers.

You can find out more about the technologies, service providers and cookies used under Cookie Settings.

8. Data storage

We ourselves will only store the data received and collected in member states of the European Union. If we disclose your data to the recipients described in this privacy notice, they may, as described, also process your data outside Europe. In such cases, we have concluded so-called "standard contractual clauses" under Art. 46(2)(c) GDPR or Art. 16(2)(d) FADP (see also Part 1, Sections 1 and 6: Processing of your data in a third country or by an international organization). We will take all reasonably required technical and organizational precautions to protect your data against unauthorized use or unlawful disclosure, destruction, loss, or unlawful alteration.

9. Social plug-ins / social media

Our website links to social media and uses so-called social plug-ins ("plug-ins") from the following social network providers ("providers"), where you have activated them.

You can find out which social plug-ins and which links to social media we use here: Cookie Settings.

With the aforementioned plug-ins, you have the option to interact with these social networks (e.g. through likes or posts) and with users there (e.g. your network or your friends), or to retrieve content (e.g. videos, interactive maps).

If a website contains a corresponding plug-in from one of the aforementioned providers and you have activated it with your consent, your internet browser will automatically connect to the server of the relevant provider. The content of the plug-in is transmitted directly by the provider to your internet browser, which integrates the data into the website accordingly.

This integration of plug-ins shows the provider which websites you have visited. If you are logged into the provider's website, the provider can track your visit to our website and match it to your account. If you interact with the plug-ins, e.g. by clicking the "Like" button or adding comments, your internet browser sends the relevant information directly to the provider, who then stores it.

If you do not want the provider to collect this data through your visit to our website, you should log out of the providers' websites before visiting ours.

You may withdraw your consent here at any time, without affecting the lawfulness of the processing carried out before the withdrawal.

For all further information on the collection and use of data, as well as your rights and options for data and privacy protection, please refer to the privacy policies of the respective provider linked above.

10. Newsletter

If you would like to be informed about our current offers, you can subscribe to our newsletter. For electronic subscription to our newsletter, we use the so-called double opt-in procedure, so that the newsletter is sent to your email address and not used by third parties for your email address. This means that after you subscribe, you will receive an email asking you to confirm your subscription. If we do not receive confirmation from you within 72 hours, your data will be automatically deleted. In addition to your email address and any other information you provide upon subscribing, we also store your IP address and the times of your subscription and, for electronic subscription, your confirmation. We store this data to document your subscription and to be able to clarify any possible misuse of your personal data. We process your data to send the newsletter (legal basis Art. 6(1) sentence 1(a) GDPR and Art. 31(1) FADP). Newsletter dispatch is carried out under a data processing agreement by our service provider

Emarsys eMarketing Systems GmbH
Märzstrasse 1
A-1150 Vienna
Austria
Tel.: +43(0)1 4782080-0 Fax: +43(0)1 4782080-80
Email: vienna@emarsys.com
Web: emarsys.com

Emarsys eMarketing Systems GmbH stores your personal data within the EU. Further information on data protection at Emarsys eMarketing Systems GmbH can be found at: https://emarsys.com/en/privacy-policy/

Tracking pixel: Our newsletters contain so-called web beacons or tracking pixels. These are small image files stored on our website. When you open the newsletter and download the images, we link your registration data to the newsletter's individual identification number. This link enables us to evaluate your usage behavior in connection with our newsletter and also on our website. Such tracking is not possible if you disable the display of images by default in your email program (and do not manually download images), which may result in the newsletter not being displayed fully or not all functions being usable. We store the data obtained through tracking for a period of one year after your unsubscription, after which it is deleted.

You may of course withdraw your consent to receive our newsletter and your consent to the tracking described above at any time. You can most easily declare your withdrawal by clicking the unsubscribe link in any newsletter. You may also send us an email at datenschutz@jack-wolfskin.com or a letter to the contact address given in the legal notice (Impressum).

Customer Match

We collect customer data, including but not limited to email addresses, from various sources such as our Customer Relationship Management (CRM) system and our Customer Data Platform (hereinafter "CDP"). We use this data to improve our marketing measures and your customer experience by providing personalized advertising, services and offers. Provided you have given us your express consent for this purpose, we pass on your personal customer data (such as email address, first name and surname) to the provider of our CDP

Bloomreach B.V.
Fred. Roeskestraat 109
1076 EE, Amsterdam
The Netherlands

We have entered into a data processing agreement with Bloomreach in accordance with Art. 28 GDPR. Further information on data protection at Bloomreach can be found at https://www.bloomreach.com/en/legal/services-privacy-notice. For the purpose of customer matching and displaying personalized advertising, we create so-called Customer Match lists, in connection with which your data may be passed on from Bloomreach to our partners. For this, encrypted ("hashed") user data (email address, telephone number, postal address, customer-specific identifiers) is transmitted to our partners for use in Customer Match lists and uploaded there. Our partners then compare whether the transmitted user data matches the customer data they already hold. From this, target groups can in turn be created, which can be used to serve advertisements/campaigns. The matching process can take up to 48 hours. Once the matching process has been completed and reviewed for policy compliance, your data is deleted.

Our partners are:

Meta Platforms Ireland Limited
Block J, Serpentine Avenue, Dublin 4, Ireland
https://www.facebook.com/privacy/policy

Google Ireland Limited
Gordon House, Barrow Street, Dublin 4, Ireland
https://business.safety.google/privacy/?hl=en

Microsoft Ireland Operations Limited
One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, D18 P521, Ireland
https://privacy.microsoft.com/en-us/privacystatement

Emarsys eMarketing Systems GmbH
Zeppelinstr. 2, 85399 Hallbergmoos, Germany
https://emarsys.com/en/privacy-policy/

This only takes place where we have obtained your consent. You may withdraw your consent at any time with effect for the future. You can most easily declare your withdrawal by clicking the unsubscribe link in any newsletter. You may also send us an email at datenschutz@jack-wolfskin.com or a letter to the contact address given in the legal notice (Impressum).

10.1 WhatsApp newsletter

You can also subscribe to our WhatsApp newsletter, which we use to inform you about our current offers.

For electronic subscription to our WhatsApp newsletter, we use the so-called double opt-in procedure, so that the newsletter is sent to your mobile number and not used by third parties for your mobile number. This means that after subscribing, you will receive a WhatsApp message asking you to confirm your subscription.

In addition to your mobile number and any other information you provide upon subscribing, we also store the times of your subscription and confirmation. We store this data to document your subscription and to be able to clarify any possible misuse of your personal data. We also use this data to recognize you and your preferences and to respond to your WhatsApp messages. The legal basis here is your consent to being contacted under Art. 6(1)(a) GDPR. In addition, we send you newsletters via WhatsApp where you have given us consent to do so. We process your data to send the newsletter (legal basis Art. 6(1) sentence 1(a) GDPR and Art. 31(1) FADP).

You may withdraw a consent already given at any time with effect for the future. You can most easily and at any time declare your withdrawal by replying with the word "Stop" in the WhatsApp chat. You may also send us an email at info@jack-wolfskin.com or a letter to the contact address given in the legal notice (Impressum). Under the GDPR, you further have the right to access, rectification, data portability, and erasure of your personal data, as well as the right to restrict certain processing or to object to it. You also have the option to lodge a complaint with the competent supervisory authority.

For the WhatsApp chat, we use Hello Charles, a software solution provided by Charles GmbH, Gartenstr. 86-87, 10115 Berlin, Germany, under a data processing agreement. Charles stores all personal data within the EU. As an official WhatsApp partner, Charles uses the WhatsApp Business API, meaning that within the scope of our responsibility, no other third parties or WhatsApp gain access to the content of your communications.

Use of WhatsApp by the respective user is governed exclusively by the agreements they have entered into with the WhatsApp provider.

Further information can be found from our processors:

Charles GmbH: https://www.hello-charles.com/de-de/wiki/whatsapp-newsletter/

WhatsApp Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland: https://www.whatsapp.com/legal/privacy-policy-eea

11. Customer service platform GUURU

We use a crowd-based customer service platform called "GUURU" provided by Guuru AG, Bösch 67, 6331 Hünenberg, Switzerland, email: dataprotection@guuru.com (hereinafter "the provider"). For this purpose, the provider makes available an online chat and carries out evaluations on our behalf.

When you use the provider's services, you generally transmit the following personal data to GUURU:

• name entered
• email address
• IP address
• documentation data.

In addition, data that you actively and voluntarily send to GUURU is transmitted to GUURU.

The legal basis is your express consent under Art. 6(1)(a) GDPR. You may withdraw this at any time with effect for the future; to do so, please send us an email at datenschutz@jack-wolfskin.com. The provider also uses cookies. Personal data is processed by the provider in the European Union and Switzerland and is deleted once it is no longer required for the processing purposes.

The provider's privacy policy can be found at: https://www.guuru.com/en/privacy-policy/

12. Google Seller Ratings (customer reviews)

As part of our online shop, we offer our customers the option to rate their overall shopping experience. For this purpose, we work with the service provider Bazaarvoice, which collects so-called Google Seller Ratings on behalf of Google. If you select the corresponding optional checkbox at checkout, you will receive an email after your purchase asking you to rate your experience with our online shop. The rating covers, in particular, aspects such as product search, ordering process, and purchase fulfilment.

The submitted rating is processed by Google and may subsequently appear in aggregated form as a star rating and average rating of our online shop in Google services, e.g. in Google search results or Google advertisements.

As part of your participation in Google Seller Ratings, the following data is processed, in particular:

• your email address
• information on your order (e.g. order number, purchase date)
• your submitted rating

Your data is processed exclusively on the basis of your consent under Art. 6(1)(a) GDPR. You give your consent by actively selecting the optional checkbox at checkout.

Recipients of the data are:

• Bazaarvoice, as technical service provider: Bazaarvoice Inc., 10901 Stonelake Blvd., Austin, Texas 78759, United States of America
• Google, in connection with Google Seller Ratings: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, https://business.safety.google/privacy/?hl=en

We have entered into data processing agreements with the respective service providers.

This may result in the transfer of personal data to third countries (in particular the USA). The transfer takes place on the basis of appropriate safeguards under Art. 46 GDPR (e.g. standard contractual clauses).

You may withdraw your consent at any time with effect for the future, e.g. via the unsubscribe link contained in the rating email or by contacting our customer service. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Further information on Google Seller Ratings can be found here: Store ratings overview (Google Merchant Center Help), Add or delete shopping reviews (Google Shopping Help), How Google Shopping works (Google Shopping Help).

13. TikTok Matching / Marketing Pixel (Advanced Matching)

We use the TikTok Pixel on our website, a marketing and analytics service provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin 2, D02 T380, Ireland ("TikTok").

The TikTok Pixel enables us to track the behavior of visitors to our website after they have been directed to our website by clicking on a TikTok advertisement. This allows us to evaluate the effectiveness of TikTok advertisements for statistical and market research purposes and to optimize our marketing measures.

Where you have expressly given consent via our cookie banner, we use the "Advanced Matching" function. In doing so, the following data may be automatically transmitted to TikTok: email address. This data is pseudonymized (hashed) using a cryptographic hash procedure prior to transmission.

TikTok may compare the transmitted hashed data with existing TikTok user profiles in order to serve personalized advertising and carry out conversion measurement.

This processing takes place exclusively on the basis of your consent under Art. 6(1)(a) GDPR and Section 25(1) TTDSG (setting and reading cookies). Without your consent, the TikTok Pixel is not activated and no data is transmitted.

In connection with the use of the TikTok Pixel, it cannot be ruled out that data will also be transmitted to servers outside the European Union. In this case, the transfer takes place on the basis of appropriate safeguards under Art. 44 et seq. GDPR, in particular through the conclusion of standard contractual clauses issued by the European Commission.

You may withdraw your consent at any time with effect for the future by changing the cookie settings via our consent management tool.

Further information on data processing by TikTok can be found at: https://www.tiktok.com/safety/en-us/privacy-and-security-on-tiktok/

14. Surveys, event registrations, sweepstakes, and contact requests via SurveyMonkey

If you take part in a survey, registration, or contact request provided by us via SurveyMonkey, we process the personal data you provide in order to:

• enable your participation in the survey or event;
• be able to follow up on your responses;
• contact you in connection with the event or request;
• send you organizational information (e.g. date, location, schedule, confirmation of participation);
• internally evaluate the results of the survey and improve our offers, events and services.

To the extent we request personal contact data (e.g. email address or address), this is done exclusively for the purposes stated above.

What data we process

Depending on the survey or event, the following data may be processed, in particular:

• first and last name
• email address
• telephone number
• address
• details of participation in an event
• answers to the survey
• voluntary free-text entries
• technical usage data (e.g. time of participation, IP address, browser information, to the extent technically collected by SurveyMonkey)

Providing your contact data is voluntary. However, without this information, we may not be able to contact you or process an event registration.

Your personal data is processed, depending on the case, on the basis of:

• Art. 6(1)(a) GDPR: your consent;
• Art. 6(1)(b) GDPR: carrying out pre-contractual measures or organizing your participation in an event;

Where we use your contact data exclusively to carry out an event or to respond to your inquiry, the processing is necessary for this purpose.

Use of SurveyMonkey

We use the SurveyMonkey service to conduct surveys, sweepstakes, and event registrations.

The service provider for customers in the European Economic Area and the United Kingdom is:

SurveyMonkey Europe UC, 2 Shelbourne Buildings, Shelbourne Road, Dublin 4, Ireland

SurveyMonkey processes the data on our behalf as a processor. We have entered into a data processing agreement with SurveyMonkey.

Please note that personal data may also be processed by SurveyMonkey on servers outside the European Economic Area and the United Kingdom, in particular in the USA.

Appropriate safeguards exist for these data transfers under Art. 44 et seq. GDPR and UK GDPR, in particular standard contractual clauses and, where applicable, participation in the EU-US Data Privacy Framework or the UK Extension.

Recipients of the data

Within our company, only those departments that require access to your data to conduct the survey or event or to process your inquiry will have access. Your data will not be disclosed to other third parties unless:

• this is necessary to conduct the event;
• you have expressly given consent;
• we are legally required to do so.

Storage period

We store your personal data only for as long as necessary for the respective purposes.

• Contact data from general surveys is generally deleted no later than 3 months after the survey has ended.
• Data relating to event registrations is deleted no later than 3 months after the event has taken place, unless statutory retention obligations apply.
• Anonymized or aggregated survey results may otherwise be stored permanently.

Where statutory retention obligations apply, the relevant data is stored for the duration of the statutory period.

15. Voyado AB

Voyado Elevate

To provide intelligent product search, product sorting (merchandising), and personalized product recommendations, we use the Voyado Elevate service provided by Voyado AB, Linnégatan 8, 114 47 Stockholm, Sweden. This involves processing, in particular, search queries, product views, clicks, shopping cart actions, purchases, and technical information (e.g. device and browser information, IP address, session and visitor identifiers) in order to optimize search results, display products according to their relevance, and provide personalized product recommendations. Where cookies or comparable technologies are used for this purpose and consent is required, the processing is based on your consent under Art. 6(1)(a) GDPR. Otherwise, the processing is based on our legitimate interest under Art. 6(1)(f) GDPR in a user-friendly and economically efficient design of our online shop. Voyado processes the data as a processor under Art. 28 GDPR. Processing generally takes place within the European Union. Where personal data is, in individual cases, transferred to a third country, this is done exclusively in compliance with the requirements of Art. 44 et seq. GDPR.

Further information can be found from our processor:

Voyado AB: https://voyado.com/products/product-discovery-engine/
Linnégatan 8, 114 47 Stockholm, Sweden
https://voyado.com/legal/privacy-policy/

16. Revoq — EU Withdrawal Button (Shopify App)

To provide the legally required electronic withdrawal function, we use the Revoq service. Through this service, you can declare your withdrawal electronically. This involves processing the personal data you enter in the withdrawal form (in particular name, email address, order number, and details of the withdrawal) in order to receive and document your declaration of withdrawal and send you an automatic confirmation of receipt. The legal basis for this is Art. 6(1)(c) GDPR in conjunction with the statutory obligations to provide an electronic withdrawal function, as well as Art. 6(1)(b) GDPR. The service provider processes the data as a processor under Art. 28 GDPR. Processing takes place within Europe. The data is stored only for as long as necessary to process the withdrawal or in accordance with statutory retention obligations.

Further information can be found from our processor:

Jonas Busch (sole trader): https://www.consumer-withdrawal.eu/en
Hofstraße Nr. 2-4, 51061 Cologne, Germany
https://www.consumer-withdrawal.eu/privacy

17. STOQ - Back In Stock, PreOrder (Shopify App)

To provide notifications about products that are back in stock, as well as to manage pre-orders, we use the STOQ – Back In Stock & PreOrder service provided by Artos Software Inc. When a user signs up for a notification or places a pre-order, the service processes, in particular, the email address, any further contact details, information on the desired product or product variant, and the time of registration. In addition, technical information such as IP address, browser type, operating system, and further usage data is processed where necessary for the provision and security of the service. The legal basis for the processing is Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR. Where personal data is processed outside the European Economic Area, this is done on the basis of appropriate safeguards under Art. 44 et seq. GDPR. The data is stored only for as long as necessary to provide the notification and pre-order function or in accordance with statutory retention obligations.

Further information can be found from our processor:

Artos Software Inc.: https://www.stoqapp.com/
1111B S Governors Ave, STE 3617, Dover, DE 19904, USA
https://www.stoqapp.com/policy

Privacy notice as of July 2026

Part 3: Supplementary privacy information regarding our social media pages

Personal data collected when you visit one of our social media pages (e.g. Facebook fan page, Instagram/Pinterest) is processed by us confidentially in accordance with statutory provisions.

Jack Wolfskin is, in each case, jointly responsible with the operator of the social media page for the processing of your data on the respective social media page. To the extent the processing of this data falls within our area of responsibility, we are available to you for any questions regarding data protection and the exercise of your rights, in accordance with the information provided in this privacy notice.

Data processing by the social media service

The social media service processes your personal data as soon as you use our respective social media page. Processing takes place, in particular, in the following cases:

• viewing a page or a post or a video from a page
• subscribing to or unsubscribing from a page
• marking a page or a post with "Like" or "Unlike" or similar functions
• recommending a page in a post or comment
• commenting on, sharing, or reacting to a page post (including the type of reaction)
• hiding a page post or reporting it as spam
• clicking a link from another page to the social media provider, or from a website outside the social media provider that leads to the page
• hovering the mouse over the name or profile picture of a page to see a preview of the page content
• using functions of the social media provider, such as the website, telephone number, "get directions" button, or another button on a page
• information on whether the login occurred via a computer or a mobile device.

As we have no influence over the data processing carried out by the respective social media provider, you can find out on the websites of the respective social media provider how your personal data is processed and how you can exercise your rights as a data subject under the GDPR.

• a) Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland; http://www.facebook.com/policy.php; Facebook has self-certified under the EU-US Privacy Shield.
• b) X Corp. (formerly known as Twitter), Inc., 1355 Market St, Suite 900, San Francisco, California 94103, USA; https://twitter.com/privacy. Twitter has self-certified under the EU-US Privacy Shield.
• c) Instagram, provided by Facebook Ireland Limited, 4 Grand Canal Square, Dublin 2, Ireland, https://help.instagram.com/519522125107875
• d) Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland, https://policy.pinterest.com/en/privacy-policy
• e) LinkedIn for countries in the European Union (EU), the European Economic Area (EEA) and Switzerland: LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland, and for all other countries: LinkedIn Corporation, 1000 W. Maude Avenue, Sunnyvale, CA 94085, USA. LinkedIn Corporation has self-certified under the EU-US Privacy Shield.
• f) Xing SE, Dammtorstraße 30, 20354 Hamburg, Germany, https://privacy.xing.com/en/privacy-policy
• g) YouTube, Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. We have embedded YouTube videos on our website, which you can access directly from our website via youtube.com. To be able to play videos on our website, you must activate the respective video via your consent. No data is transmitted to YouTube without your consent. For this, we use plug-ins from YouTube, operated by Google Ireland Limited, Gordon House, 4 Barrow St, Dublin, D04 E5W5, Ireland. These plug-ins are identified by the YouTube logo. You can find YouTube's privacy policy here: https://www.youtube.com/intl/en/howyoutubeworks/user-settings/privacy/.
• h) TikTok Technology Ltd., 10 Earlsfort Terrace, Dublin D02 T380, Ireland. You can find TikTok's privacy policy here: https://www.tiktok.com/safety/en-us/privacy-and-security-on-tiktok/

Data processing by Jack Wolfskin

As part of our corporate social media page ("fan page"), the social media provider grants us access to the following categories of data:

• We process this data exclusively for the purpose of promoting content on our social media page in a manner tailored to our target audience, and to better understand and optimize the use of our social media page.
• For our fan page, or for individual published posts, we can set which target audience should be reached. This is done based on general parameters (e.g. age group, language, region, interests), which allow our content to be targeted at specific groups. Based on the data provided to us by the social media provider, it is not possible for us to address or identify individual persons.
• Statistical analyses that provide insight into the use of our social media page. The analyses visible to us do not allow us to individually analyze the usage behavior of individual persons. We can only view aggregated data (including number of visits, likes, followers, region of origin, age group, gender) that provides insight into our audience and the use of our fan page. The underlying data of individual users on which these analyses are based is not transmitted to us.
• Where you contact us directly via the social media provider or otherwise interact with us and knowingly provide personal data (e.g. by directly connecting with our social media page), we store and process this personal data for the purposes for which you provided it to us.

Joint controllership

We are jointly responsible, under data protection law, with the social media operators named above, and have entered into an agreement with them regarding processing under joint controllership pursuant to Art. 26 GDPR. This agreement serves, in particular, to fulfil our responsibility to protect your personal data and to clearly define the associated tasks.

If you have any questions about our information offering, you can reach us at socialmedia@jack-wolfskin.com.

Privacy notice as of July 2026