PRIVACY POLICY

1. INTRODUCTION

The right to privacy and, in particular, the right to the protection of personal data is one of the fundamental principles of Joyería TOUS, S.A., part of the TOUS Group (hereinafter, ""TOUS""), with registered address at Carretera de Vic - El Guix Km 3 · 08243 Manresa, Barcelona, which is included in its Code of Ethics, available on the corporate website.

The purpose of this General Privacy Policy (hereinafter, the ""Policy"") is to explain the way in which TOUS will process any personal data that may be collected through the different forms on the TOUS websites. Your personal data will be processed in a strictly confidential manner and only for those purposes for which you have provided consent, as explained below and, in greater detail, in each of the specific privacy policies for each form.

2. SCOPE OF APPLICATION OF THE POLICY

This Policy applies only to this website and not to websites owned by third parties. TOUS may provide links from this website to other websites that it considers of interest to its visitors. TOUS strives to ensure that these websites adhere to the highest standards.

However, due to the very nature of the Internet, TOUS is unable to guarantee the privacy levels of these websites, nor can it be held responsible for the content of websites other than those of TOUS itself. This Policy is not intended to be applied to any website with which TOUS has a link and which does not belong to the Grou

3. COMMITMENT TO PRIVACY

TOUS is fully committed to regulatory compliance and, in particular, compliance with the General Data Protection Regulation of the European Union and the regulations related to the protection of personal data in force at any time, this being a priority objective for the Group.

As a result, and with privacy being the basis on which all processing carried out is configured, TOUS has taken the decision to implement the following principles:

• Transparency in data processing is one of the priorities of TOUS, so whenever it is necessary to collect personal data we will duly inform you through the corresponding privacy policy, including the purposes of such processing, among other aspects.
• The processing of those personal data that are strictly necessary to provide any services that you request.
• Accessibility and proactivity, whenever possible, to make available to you simple measures that allow you to control your personal data.
• The non-transfer of your personal data to third parties, except those suppliers providing a service to TOUS, or those about which TOUS has previously informed you and received your consent in this regard.
• The confidentiality of the personal data collected and processed by TOUS, guaranteeing the adoption of adequate security measures for their protection.

4. PURPOSES OF THE PROCESSING

TOUS collects your personal data in order to manage your requests and offer you services and products that may be of interest to you. Specifically, TOUS processes your personal data for the following purposes:

1. Dealing with your queries, questions or requests made through the customer service or communication channels identified on each website and contacting you to respond to them.
2. Improving the TOUS websites, as well as their services and products, in order to offer a better service and content.
3. Offering access to restricted spaces on the TOUS website (registration may require acceptance of a specific privacy policy).
4. Managing your registration on the TOUS website.
5. Allowing you to make purchases through the TOUS website.
6. Sending transactional notifications in relation to your purchase.
7. Conducting studies for statistical purposes.
8. Having your data updated.
9. Processing reservation requests.
10. Managing billing and for accounting purposes.
11. Fulfilling tax obligations.
12. Processing guarantees for the products acquired in TOUS.
13. Complying with the current legal framework.
14. Managing your data to send you commercial information.
15. Collecting, storing and processing your CV, as well as the personal data included in it, with the aim of analysing your professional profile in order to allow you to participate in TOUS selection processes, where appropriate.
16. Sending notifications by email and/or telephone and/or post as part of the TOUS staff selection processes.
17. Evaluating your abilities to perform a job by carrying out specific tests that will be notified in due course.

5. LEGITIMISING THE PROCESSING OF YOUR PERSONAL DATA

TOUS will only collect those personal data that you wish to disclose voluntarily and, in accordance with current regulations on data protection and on information society services and electronic commerce, will inform you that such personal data provided at the time of registration, or any others provided to TOUS for access to some of the services on the website, will be incorporated into files owned by this company.

The data that TOUS may request from you are the following:

• Identification data. Information concerning an individual that allows them to be differentiated from others in a group, such as: name; handwritten and electronic signature; tax identification number; place and date of birth; nationality; photograph; age.
• Contact data. Information that allows contact with their owner to be maintained or initiated, such as: address; email address; landline; mobile phone.
• Data on physical characteristics. Information about an individual relating to their physiognomy, anatomy, features or specific characteristics, such as: measures necessary for the manufacture of the products.
• Asset or financial data. Information concerning an individual relating to their assets, rights, liens or obligations that can be valued economically, such as: bank accounts, credit card number, security number.

6. SENDING COMMERCIAL NOTIFICATIONS.

Within the framework of its promotional activity, TOUS may provide you with resources for registration or subscription to news or commercial information related to the TOUS Group. These resources will always be subject to your express consent to send them.

In the event that you have authorised this, TOUS will send you information about its products, activities and personalised services in keeping with your tastes and preferences. Moreover, and in the event that you have also expressly consented to this, you may receive information related to TOUS competitions and/or prize draws, as well as its events and corporate activities close to your location.

You can revoke your consent to receiving commercial notifications at any time, through the link or button enabled for this purpose in each of the notifications or by directly communicating your wish to revoke the consent through the following channels:

• By email, sent to the following address: dataprotection@tous.com
• By post, addressed to Joyería Tous, S.A., Carretera de Vic, El Guix 3, 08243 Manresa (Spain)
• By the web form at https://www.tous.com/gb-en/help/contact-us

7. AUTOMATED DECISIONS AND THE CREATION OF PROFILES

TOUS will obtain your express consent for the processing of your personal data in relation to the possible adoption of automated decisions and/or the creation of profiles.

For the provision of some services, TOUS may process your personal data using automated means. This means that certain decisions are taken automatically, without human intervention. For example, in the event that you have purchased products in your ""Shopping Bag"", you will receive specific notifications informing you that your order has left the TOUS facilities.

TOUS can also process your data to create profiles, with the purpose of predicting your behaviour on the website. As a result of that, products that may be of interest to you will be displayed on the homepage, based on the preferences you have shown through your browsing or information obtained through cookies, as well as if you are part of the MY TOUS loyalty programme.

You can review the applicable Cookies Policy at the following link https://www.tous.com/gb-en/policies/cookies-policy. Likewise, you can contact TOUS for any questions or queries related to the processing of your personal data through the following address: dataprotection@tous.com

8. DURATION OF THE PROCESSING AND DATA RETENTION PERIOD

TOUS is committed to processing your personal data while they are useful and necessary to offer you a quality service through their processing. Therefore, TOUS will make all reasonable and timely efforts to minimise the processing and retention time for your personal data.

In this sense, in each data collection form TOUS will inform you of the expected period for the processing and/or retention of your personal data.

In any case, and even if you request the erasure of your personal data, TOUS will have the right to store and retain them, under the appropriate blocking, for the time necessary to comply with the legal obligations that apply, as well as to make them available to the competent authorities in the different matters that are applicable.

9. EXERCISING OF RIGHTS AND CLAIMS WITH THE AEPD (SPANISH DATA PROTECTION AGENCY)

As a result of the processing of your personal data by TOUS, the current legislation grants you a series of rights. TOUS offers a brief explanation of each right in order to facilitate your exercising of them:

1. Right to access: You will have the right to know what personal data are being processed by TOUS, as well as the purposes of this processing.
2. Right to rectification: Your data will always be yours, and as such you can request their rectification at any time if those that appear in the TOUS records are erroneous.
Right to be forgotten:> You may at any time request that your personal data be erased from the TOUS files. However, and as previously indicated, you must take into account that in certain circumstances compliance with the current legislation may prevent the effective exercising of this right.
3. Right to object: You can object to the processing of your personal data in relation to any of the purposes for which we process your data, in accordance with the privacy policies applicable in each case.
4. Right of restriction of the processing: You can request the restriction of the processing in the following cases:
   1. When you consider that the data that TOUS retains about you is not correct or accurate;
   2. When, even though you consider that TOUS is not processing your data legitimately, you prefer the restriction of their processing to their elimination;
   3. When the data that TOUS retains are no longer necessary in accordance with the purpose for which they were collected, but you need TOUS to retain them to lodge legal claims;
   4. When, having exercised the right to object to any processing, a response from TOUS is being awaited.
5. Right to the portability of your data: Whenever technically possible and reasonable, you will be entitled to request that the personal data you have provided directly be communicated to another data controller. If this is not possible, TOUS will directly provide your data to that other data controller, but if it is not they will be provided to you in a standard format.

Provided that TOUS is processing your personal data based on your express consent, you can revoke this at any time without further consequences for you beyond, depending on the right exercised, not being able to provide you certain services.

The exercising of the rights held may be carried out by contacting TOUS through any of the following means, along with a copy of your DNI or equivalent identification document:

1. By email, sent to the following address: dataprotection@tous.com
2. By post, addressed to Carretera de Vic, El Guix 3, 08243 Manresa (Spain)

In addition, if you consider it necessary you can contact our TOUS data protection officer (DPO) through the following email address dpo@tous.com

If you do not want to exercise a specific right but want to ask a question or make a suggestion in relation to the processing of your personal data, you can also use the addresses provided for the exercising of rights.

Please note that in any case, you may lodge a claim with the competent data protection authority if you consider that TOUS has not processed your data in a lawful manner or it has not correctly responded to your requests or rights. In Spain, this competent authority is the Spanish Data Protection Agency (Agencia Española de Protección de Datos).

10. CONFIDENTIALITY AND SECURITY IN THE PROCESSING OF DATA

Your personal data are very important for TOUS so it is committed to processing them with the utmost confidentiality and discretion and to implementing all those security measures that it deems appropriate and reasonable.

In this sense, TOUS declares and guarantees that it has established all the technical means at its disposal to avoid the loss, misuse, alteration, unauthorised access and theft of the data provided by the users. Likewise, TOUS constantly reviews its security measures to ensure that they are always up-to-date.

11. SOCIAL NETWORKS

Social networks are part of the daily life of many internet users and for this purpose different TOUS profiles have been created in them. All users have the opportunity to join the pages or groups that TOUS has in different social networks.

However, it must be taken into account that, unless we request your information directly (for example, through marketing actions, competitions, promotions, or any other valid form), your data will belong to the corresponding social network. Therefore, it is recommended that you carefully read its conditions of use and privacy policies and ensure that you configure your preferences regarding the processing of data.

12. INTERNATIONAL TRANSFERS

As a general rule, TOUS tries to keep your personal data within the European Union (EU) or the European Economic Area (EEA). However, sometimes TOUS may need to provide them to other companies in the Group or to service providers located in other countries, either by necessity to provide the requested service or to be able to offer you the service with the highest quality standards.

In these situations, TOUS ensures the application of all necessary measures and controls to guarantee and protect the processing of your personal data, such as:

1. Communication to countries that, despite not being part of the EU or the EEA, have been considered by the European Commission as countries that have data protection regulations that guarantee a level of security similar to that applicable in Europe.
2. Existence of standard European Commission contractual clauses: to ensure that companies in third countries that are not part of the EU or the EEA comply with a similar level of protection. TOUS will sign these agreements as long as there is no equivalent alternative that guarantees the protection of your personal data.
3. Definition of binding corporate rules (BCRs) approved by the companies, which are reviewed and approved by control authorities, with the aim of ensuring that the company, in any country, to whom we provide your data complies with an adequate level of protection.
4. In certain cases, the company to which TOUS provides the data may have Data Protection Certificates that guarantee the correct use of your data in accordance with current regulations.

You can request information about these guarantees from the addresses indicated below.

13. CONTACT WITH TOUS

If you have any questions or concerns about the processing of your personal data, please contact us through:

• Email that must be sent to the address dataprotection@tous.com
• Web contact forms
• Post, addressed to Carretera de Vic, El Guix 3, 08243 Manresa (Spain)
• DDPO contact details: dpo@tous.com

14. ROLEX SECTION

While navigating on the Rolex section of our website, you may interact with an embedded website from www.rolex.com. In such case, Terms of Use, Privacy Notice and Cookies Policy of www.rolex.com are solely applicable.