DATA PROTECTION INFORMATION

This Data Protection Information provides information about the processing of your personal data when you visit the websites of PUMA SE (hereinafter referred to as "PUMA", "we" or "us") under the domain "mediahub.puma.com".

1.1 Scope of this Data Protection Information 

This Data Protection Information applies to the use of the websites of PUMA SE under the domain "mediahub.puma.com". The processing of personal data on websites of other PUMA Group companies is not covered by this data protection information

1.2 The Controller for the processing of your personal data

Unless explicitly stated otherwise in this Data Protection Information, the controller for the processing of your personal data is:

PUMA SE
PUMA Way 1
91074 Herzogenaurach
Germany
Email: dataprotection@puma.com

1.3 Contact details of the Data Protection Officer

We have appointed a data protection officer whose contact details are listed below:

Data Protection Officer
PUMA SE
PUMA Way 1
91074 Herzogenaurach
E-mail: dataprotection@puma.com

1.4 Definitions

This Data Protection Information is based on the following key data protection terms, which we have presented below to make them easier to understand:

• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

• Recipient means a natural person or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by the public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; Examples of possible recipients: IT services providers or adverting partners; for more information please refer to Section 4)
  
  Examples of possible recipients: IT service providers or other advertising partners (more information on the recipients can be found in section 8).

• PUMA Group means all companies affiliated with PUMA SE in accordance with Section 15 of the German Stock Corporation Act (Aktiengesetz).

• Personal data means any information relating to an identified or identifiable natural person ("data subject"). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

  Examples of personal data: Name; contact details; IP addresses

• The controller means the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law.

  PUMA SE is the controller for the data processing described in this Data Protection Information (see section 1.2.), unless explicitly regulated otherwise.

• (Data) processing is any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

2.1 Processing of your data when you visit our websites

If you visit our websites to find out about our brand without actively transfering information to us (purely for information purposes), we process your personal data for the following purposes and by virtue of the following legal bases:

2.2 Provision of websites and IT security

When you visit our websites, we process your personal data that is technically necessary for us to be able to display our websites to you and to ensure stability and security when you visit our websites. This includes the following personal data:

• IP address

• Browser type and version

• Operating system and platform

• The complete Uniform Resource Locator (URL)

These personal data will be stored in server log files for security purposes, which will be automatically deleted after 1 month.

This data processing is necessary to safeguard our legitimate interest in ensuring IT security (legal basis Art. 6 para. 1 sentence 1 lit. f GDPR).

2.3 Provision of localized websites

When you visit our websites, we also process personal data such as your language setting in the browser in order to automatically display a localized version of our websites, i.e. in particular a version adapted to your language.

This data processing is necessary to safeguard our legitimate interest in the automated, needs-based provision of our websites (legal basis: Art. 6 para. 1 sentence 1 lit. f GDPR).

2.4. Analytics and marketing tracking

Use of cookies

We use cookies on our websites. Cookies are small text files that are stored in the browsers of your end devices when you visit our websites. With the help of cookies, your usage behavior and your settings on our websites can be stored and recognized for the duration of a browser session or even beyond.

You can find more information about the cookies used on our websites, different cookie categories and individual settings in our Cookie settings.

 If your personal data is processed by cookies or other technical measures (which store data on your end device or retrieve data from your end device), the legal basis for which in the following passages is consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, you give your consent in accordance with Section 25 para. 1 TDDDG (Act on Data Protection and Privacy in Telecommunications and Digital Services) by activating the services in the cookie banner. You can also withdraw your consent in accordance with Section 25 (1) TDDDG by deactivating the corresponding services in the cookie banner.

In your browser settings, you can restrict or completely prevent the storage of (certain types of) cookies and delete cookies that have already been stored. You can find more information on this in the instructions or help function of your browser.

In principle, our websites can still be visited and used even if cookies have been restricted in the browser settings. Please note, however, that such restrictions may lead to limited functionality of our website.

Google Analytics

We use Google Analytics on our websites, a web analytics service provided by Google Inc ("Google"). Google Analytics uses cookies (further information on cookies can be found in the previous section and in our cookie information), which enables us to analyze the use of our websites. The information generated by the cookie about the use of our websites is usually transmitted to a Google server in the USA and stored there. However, since we use Google Analytics with the extension "anonymizeIP()" for IP anonymization, your IP address will be shortened by Google within member states of the European Union or in other contracting states of the Agreement on the European Economic Area beforehand. Only in exceptional cases will the full IP address be transmitted to a Google server in the USA and shortened there. On behalf of PUMA, Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity, analyzing the effectiveness of our digital advertising and improving its customization, and providing other services relating to website activity and internet usage to PUMA. The IP address transmitted by Google Analytics will not be merged with other Google data. You can find more information on terms of use and data protection under:

https://policies.google.com/terms

https://policies.google.com/privacy

This data processing is necessary to safeguard our legitimate interest in carrying out analyses to improve our website and our products (legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Google Analytics Opt-out:

You can generally prevent Google from processing your usage data (including your IP address) on websites by downloading and installing the browser plug-in available at the following link:

https://tools.google.com/dlpage/gaoptout

In addition, you can also prevent Google Analytics from collecting your usage data (only) on our websites by clicking on the following link:

Click here to opt-out of Google Analytics

In this case, a permanent opt-out cookie is set in your browser, which prevents your data from being stored in the future when you visit our websites with this browser. Please note that Google Analytics will be reactivated if you delete the above opt-out cookie in your browser.

2.5 Media Alerts

We use Brevo for personalization, analytics, automation, and email campaigns (such as sending news alerts). Brevo uses cookies and tracking pixels to help us create and optimize our newsletters. If you consent to receiving our news alerts and complete the double opt-in procedure to verify your email address, your personal data will be collected by Brevo and used to create a [pseudonymized] user profile linked to your email address. Your email address will be pseudonymized by us. With your consent, we may also track how you interact with our emails and website — including whether you opened our newsletter, which links you clicked and how long you stayed on our website.

You can find Brevo's privacy policy here:

-Privacy Policy

This data processing (evaluation of the newsletter and performance measurement) is carried out on the basis of our legitimate interest - subject to your consent - via a secure and user-friendly procedure of our newsletter system and thus serves both our business interests and your expectations for the improvement of our website (legal basis: Art. 6 para. 1. p. 1 lit. f) GDPR)).

2.6 Use of Friendly Captcha

To protect our online forms from abuse and automated submissions, we use the service Friendly Captcha, provided by Friendly Captcha GmbH, Am Anger 3–5, 82237 Wörthsee, Germany. Friendly Captcha helps ensure that form entries are made by human users and not by automated programs (bots). To do this, your IP address is anonymized and your device is asked to solve a small cryptographic puzzle (proof-of-work). No cookies are stored, and no personally identifiable data is shared with Friendly Captcha that could be used to identify you.

This processing is based on our legitimate interest in protecting our website from spam and misuse in accordance with Art. 6 (1) lit. f GDPR.

For more information, please refer to Friendly Captcha’s privacy policy: https://friendlycaptcha.com/legal/privacy-end-users/

We keep your personal data for as long and to the extent necessary for the purposes stated in the respective section of this Data Protection Information.

As soon as the data is no longer required for the purposes stated in the respective section, we may retain your personal data for the period in which you can assert claims against us or we against you (statutory limitation period generally three years, starting at the end of the year in which the claim arises, e.g. at the end of the year of purchase).

In addition, we store your personal data for as long as and to the extent that we are legally obliged to do so. Corresponding proof and retention obligations arise from the German Commercial Code, the German Tax Code and the German Money Laundering Act, among others. The retention periods may accordingly last up to ten years.

Your personal data may be transferred to the following categories of recipients.

• Other companies within the PUMA Group as part of an intra-group, cooperative process. This data processing may be necessary to safeguard our legitimate interest in order to carry out our administrative activities efficiently and cooperatively and to improve our products and services (legal basis: Art. 6 para. 1. sentence 1 lit. f GDPR).

• IT service providers who provide platforms, databases and tools for our products and services on our behalf (e.g. for our website, the sending of news alerts and informative e-mails), create analyses of user behavior on our websites or carry out marketing campaigns.

• As part of the use of Google Analytics and Google Ads, including through tags and cookies, your personal data may be transferred to the USA.

• To analyze your behavior on our website, we transfer your personal data to specialized service providers. Data may be transferred to third countries.

• In order to be able to offer you localized versions of our websites, we transfer your personal data to an external service provider in the USA.

• In case of legal disputes, we transfer your data to the competent court and, if you have engaged a lawyer, to the latter, in order to conduct the legal dispute. This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR) and/or for the purpose of our legitimate interest in the establishment and exercise of legal claims (Legal basis: Art. 6 para. 1 s. 1, lit. f GDPR).

• In addition, we only transfer your personal data if we are legally obliged to do so (e.g. to police authorities in the context of criminal investigations or to data protection supervisory authorities). This transfer of personal data is necessary to fulfill a legal obligation (legal basis: Art. 6 para. 1. p. 1 lit. c GDPR).

We ensure that appropriate safeguards (e.g. certification under the EU-U.S. Data Privacy Framework adopted by the EU Commission, conclusion of applicable EU standard contractual clauses and, where appropriate, additional measures) are in place to ensure adequate data protection when your personal data is transferred to the above-mentioned recipients based outside the EU/EEA.

We may process your personal data in accordance with the above sections on the basis of our legitimate interests, in particular to ensure IT security on our websites, to carry out analyses, to safeguard, enforce and defend our legal interests (including in court if necessary) and to carry out internal administration efficiently and in a division of labor. Information on the balancing of interests carried out by PUMA can be found at datenschutz[at]puma.com.

Without prejudice to the objection options described in the sections above (e.g. opt-out/objection links provided), you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data which is based on our legitimate interests in accordance with Art. 6 para. 1 sentence 1 lit. f GDPR. To do so, please send your objection to dataprotection@puma.com. We will then no longer process your data for these purpose(s), unless our legitimate interests prevail or the processing serves the assertion, exercise or defense of legal claims.

If you object to data processing, we will process your personal data collected in this context to respond to your request. This data processing is necessary to fulfill a legal obligation (legal basis: Art. 6 para. 1 sentence 1 lit. c GDPR).

If you have given us your consent to process your personal data, you can withdraw this consent at any time. The whitdrawel of your consent is effective for the future and shall not affect the lawfulness of processing based on consent before its withdrawal.

Unless otherwise described in the above sections on data processing based on your consent, please send your withdrawel to dataprotection@puma.com.

If you withdraw your consent, we will process your personal data collected in this context to respond to your request. This data processing is necessary to fulfill a legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR).

In accordance with the GDPR, you can request from us at any time that we

• provide you with information about the personal data concerning you that we process (Art. 15 GDPR),

• rectify personal data concerning you that is incorrect (Art. 16 GDPR),

• erase (Art. 17 GDPR), restrict (Art. 18 GDPR) and/or export (Art. 20 GDPR) your personal data stored by us.

Please send your request, at least stating your first and last name, by e-mail to dataprotection@puma.com or in writing to PUMA SE, PUMA Way 1, 91074 Herzogenaurach, Germany.

If you exercise these rights against us, we will process your personal data collected in this context to respond to your request. This data processing is necessary to fulfill a legal obligation (Art. 6 para. 1 sentence 1 lit. c GDPR).

Irrespective of your abovementioned rights, you may lodge a complaint with a data protection supervisory authority if you consider that the processing of personal data concerning you by PUMA infringes the GDPR (Art. 77 GDPR).

The provisions of this Data Protection Information, including the PUMA SE Cookie Information, apply in the version valid at the time of use of the Media Hub.

We reserve the right to supplement and modify the content of the Data Protection Information. The updated Data Protection Information applies from the time it is published on our website. We will inform you separately (e.g. by e-mail) of any significant (material) changes to the Data Protection Information, in particular changes that affect the processing of your personal data already collected by us.