PERSONAL DATA PROTECTION POLICY

NEWSLETTER SUBSCRIPTION FORM

Version Issued July 20th, 2021

1. DATA CONTROLLER

By consenting to fill out this form, you are hereby informed that your personal data will be processed by the SAN PATRICK, S.L.U. company, a firm based in Barcelona, with business domicile at Calle Om, 16, Polígono Industrial Mas Mateu, s/n, holding TIN (CIF) B-63523609 (hereinafter, San Patrick).

2. PURPOSE AND LEGITIMIZING BASIS FOR PROCESSING

The data shall be processed for the purpose of sending you San Patrick newsletters by email (or by any other means if we have the information to do so, such as SMS or instant messaging apps if you provide us with your mobile phone number).

The legitimacy of processing your data for the purpose of sending you our newsletter is based on the consent you provide us when submitting your email address on the subscription form for such promotional messages, in accordance with prevailing norms and legislation.

In addition, your data will be used to create a Customer Account, or update your data if you already have one, establishing the means by which we can offer you personalized attention and services through the storage and management of the information you provide us, such as regarding future events, your purchasing preferences and tastes, or conducting satisfaction surveys regarding the quality of service and care provided, as described in the Profiling section below.

The creation of a Customer Account is based on our legitimate business interest in being able to offer you the best possible service based on your needs and preferences, as well as in maintaining a track record of our relationship with you. You can learn more about how we manage Customer Accounts in section three (3) below, Profiling.

All newsletters or commercial communications shall be sent by SAN PATRICK, S.L.U., even on behalf of other companies within Grupo PRONOVIAS, as the member firm responsible for Group advertising and promotional messaging.

In addition, all messages may be tailored and customized, among other reasons, according to user interests, either based on the products and/or services requested, or on the information that we might infer or obtain from your browsing habits, interest shown in any given content, or reactions to our messages, as explained in section four (4) below, Promotional Messaging.

3. PROFILING

As indicated above, San Patrick creates profiles for the customers who interact with us, setting up a user or customer profile that contains all the information collected through the various data collection channels, both physical and electronic. Depending on the type of interaction, the profile may be more or less complete. The profiles are structured in a manner that serves legitimate business interests, among which we wish to highlight knowledge about our customers and commitment to operating and improving our services based on their preferences and needs.

We describe below the various profiling measures and operations we undertake, which vary depending on how you interact with us and any options you may select, if any:

3.1 Profiling in physical stores or via Customer Service: When visiting our stores, or contacting us through Customer Service, we may ask you to provide us with personal data in order to maintain a business relationship with you, serve you in a personalized way, or manage appointment reservations, among other motives. To accomplish this, we create a Customer record, or profile, in which we store all relevant information, such as your preferences regarding clothing styles, colors, whether or not you are interested in a wedding dress or party, and so on. This information allows us to tailor the services we provide and keep you informed about news or upcoming events in the stores you visit (for example, arrival of a new collection or new colors, Trunk Shows, private showings, and so on). This allows the store a means for directly communicating with you, which may be in addition to any messages we might send from San Patrick (for example, by electronic means, providing you have given us your consent to do so).

In addition, if you visit our stores, we may send you satisfaction surveys both about the quality of the service received and our products. This helps us improve on a daily basis. These satisfaction surveys may be sent to you by electronic means, even if you have not agreed to receive promotional messages electronically, as long as the content does not involve advertising. In any event, this is the best available option for ensuring that the store you choose to visit can provide you with the best service possible in line with the quality standards of Grupo Pronovias, establishing therefore our legitimate interest in processing your contact and communication details for these purposes. Should you consider that the service was not provided properly, we may contact you by phone or by any other channel of communication whose details you have provided us in order to handle any incident that may have transpired during your store visit.

3.2 Online profile: New technologies allow us to create much more accurate profiles, analyzing not only the preferences that you transmit to us in our stores, but also, among others, the following sources of data:

Information provided at the time of booking an appointment, such as the date of an event, including that of your wedding; the type of surroundings in which you will conduct the event or your wedding; your preferences regarding wedding dress silhouette and neckline; your budget for the dress;
Information provided at the time of creating a user account, such as personal identity, contact information, and mailing/email addresses;
Purchases that you may make through our online store, from which we can infer your style and product preferences;
Behavior on the website itself (content accessed, types of dresses viewed, favorite colors, frequency with which you visit our website), all of which aid us in understanding your personal tastes;
Behavior with respect to our newsletter (what kind of content leads you to open or click on the newsletter; how often you open our messages); or, among others,
Relevant information based on the dresses you include in the "My Favorites" section (type of dress, colors, and other features that help us understand your preferences in relation to our products).

Both profiles may be combined when their sources relate to San Patrick, either through physical channels (visits to stores or customer support), online visits to our website, use of apps, activity on social networks, and so on.

3.3 Use and exploitation of data stored in user profiles: The information that we may collect from our customers is used for a variety of purposes, although these can easily be summarized in two broad groups, (i) purposes relating to personalized services tailored to our customers, and (ii) purely advertising purposes.

With respect to personalized service, being aware of your preferences facilitates our allowing all our San Patrick stores to anticipate your needs so that they and we may offer added value to our services. For example, knowing your dress preferences allows store staff to not only show you dresses that match those preferences (e.g. long or short party dresses, having a given neckline or color, and so on), but also so that whenever you might book an appointment, you may also pre-select all the dresses or products that might match your tastes, including available sizes and colors.

If you have any upcoming events, especially in the case of your wedding, knowing their date allows us to predict the dresses that should be ideally available for conducting fitting sessions, as well as for providing you with up-to-the-minute availability of sizes and types of dresses.

In similar fashion, the creation of these profiles allows us to improve our advertising effectiveness by allowing us to customize and tailor the content of promotional messages to your interests, as well as the type of message we might send you, or how often we might contact you.

For example, if we know your interest in our new collections, we will inform you any time they are introduced and are available for sale. In addition, if you have shown interest in our events – for example, the presentation of new collections – we can invite you to them, also taking into account their location and where the presentation takes place.

All promotional messages may be made both electronically, as discussed below, and by telephone, both directly from San Patrick through its Customer Service department, as well as directly by the store in order to inform you about new dresses, confirm upcoming appointments and reservations or, in general, maintain a business relationship with you.

The personalization of content allows us to ensure that we send you information that may be of interest to you. For example, if we know you have a preference for long dresses, we will prioritize news or promotions about that type of dress.

In addition, depending on your interactions with us, we may offer you special promotions, contests or the option to participate in certain customer-only events.

In the next section on Promotional Messaging, you can learn more about how we conduct it, the channels used, and with what platforms we collaborate to improve our advertising capacity.

All information contained in your Customer Account, and therefore all information about your profile and preferences, is accessible to our stores, who use it to improve the personalized service provided in the store itself. All data is the exclusive property of San Patrick, S.L.U., without prejudice to a given store, especially when it comes to franchises, being able to request additional data, for their own use, during your visit to that store.

4. PROMOTIONAL MESSAGING

San Patrick shall process the data you provide us in order to send you promotional messages when we have previously obtained your consent to do so. If you provide that to us, we will send you information, advertising, surveys, invitations to events, or promotions concerning products and/or services related to San Patrick business activity. Coinciding with the time of data collection, customers may decide whether or not to receive this type of messaging from us and may at any time withdraw their prior consent.

If you agree for us to send you promotional messages by electronic means (email, SMS, instant messaging or on social networks, among others), you are hereby advised that all messages sent by San Patrick may be tailored and customized according to your tastes, based on the products and services you have previously requested, or on the basis of data that we may infer or obtain from your browsing habits, interest shown in given content, or reaction to our messages, among others, as explained in the Profiling section.

Customization is done in a partially automated way, in the sense that San Patrick determines the parameters of the customization, but the technological platform is the one that actually generates the customer profile. As a general rule, we do not send out mass messages that are not segmented by means of the above procedure, as we consider that it is in the interest of both San Patrick and our customers to send or receive information that is timely and relevant, as well as because mass messaging would not serve to reduce or alter the number of messages received, but only their content. In this regard, if you object to receiving targeted messages for advertising or promotional purposes, please do not subscribe to San Patrick promotional messaging and/or newsletters.

All newsletters or promotional messages shall be sent by SAN PATRICK, S.L.U., even on behalf of other member companies within Grupo PRONOVIAS, as the firm responsible for the advertising and promotional messaging of the Group.

The promotional electronic messaging discussed above may be sent via the following channels:

Messages sent by email, SMS, MMS or direct messaging (WhatsApp, telegram, Facebook Messenger, direct messages in Forums or on Social Media platforms, and so on):

If we possess the appropriate information (email, mobile phone number, etc.) we may send you promotional messages by such means. As a general rule, the communication channel will be limited to email, wherever possible, although certain messages may relate to another one of the purposes indicated (e.g. sending reminders, events or surveys).

Promotional messaging on third-party platforms (e.g. social networks):

Some third-party platforms (i.e., websites, online communities, or apps, for example) allow outside advertisers, such as San Patrick, to use such platforms to place advertising directly targeting San Patrick customers who also have a user account on the platform.

To do so, the platform may require the advertiser (San Patrick) to establish the identity of its customers by providing an encrypted and protected means to do so using the technical tools provided by the platforms themselves, with matching based on basic identifying data, such as an email address or phone number.

Once the identity of a customer and the existence of their user account on the platform has been established, San Patrick can create what is commonly referred to as a "custom audience" comprised of those customers who have agreed to receive advertising on that platform, and may thus display San Patrick advertising directly on the user's profile.

For example, among social networks, this type of activity can be found on Facebook (Custom Audience), Twitter (Custom Audiences), or Google (Customer Match).

Such activity is solely intended for advertising purposes, so your data shall only be used if you have previously agreed to receive promotional messages from us.

In addition, such third-party platforms may also allow their advertisers, such as San Patrick, to use their tools to identify users who, within their platform user base, have a "similar profile" to that of San Patrick customers.

The procedure for identifying and accrediting the identity of customers is the same as that indicated earlier.

For example, on social media sites, this type of activity can be found on Facebook (Lookalike Audience), Twitter (Custom Audiences), or Google (Similar Audiences).

In this case, since the data is not used for a purpose directly relating to sending advertising to our Customers, but rather for sending it to those who, without being customers, possess a profile similar to that of our Customers, we will use the basic data of all our Customers (and not only those who may have agreed to receive promotional messaging) to identify potential customers on that platform. Thus, the advertising will be aimed only at those potential customers who have consented on that particular platform to receive promotional messaging. We conduct such processing based on our legitimate business interest in expanding our client base, but you may object to your data being processed for such purposes at any time.

As indicated in the preceding paragraphs, the services in question only request basic identifying data; namely, we do not provide all your personal data, not even the preferences that we may already be aware of. Rather, they are limited to an email account or phone number that is shared in an encrypted and protected format using the technical tools provided by the platforms themselves and which is sufficient for the social network to identify you in its database.

In addition, secure data communication methods, including data encryption prior to upload, are used to ensure data confidentiality and security.

Finally, we do not obtain data about you directly from such third-party platforms; namely, we may obtain anonymous and statistical data, but never accurate information identifying your interests or indicating whether or not you have seen a particular advertisement, unless you choose to interact with us or with the specific ad.

If you do not wish us to use your data for advertising purposes on third-party platforms, you may contact us at the e-mail and postal addresses below. If we are already using them on those platforms, we shall delete them during the next update of the data provided.

You may revoke your consent to the receipt of promotional electronic messaging and/or advertising at any time by simply following the instructions given at the foot of any of the electronic messages sent by San Patrick, by sending an email to the privacy@pronovias.com email address, or by postal mail addressed to San Patrick, Calle Om, 16, Polígono Industrial Mas Mateu, s/n, 08820 El Prat de Llobregat (Barcelona), attaching in either case a copy of your personal identity documentation or passport and indicating "Ref. Data Protection" as reference on the envelope (in case of opting for postal mail) or in the subject line (if you opt for email), stating that you wish to revoke your consent to the receipt of promotional messaging by electronic means.

5. DATA TRANSFER

Your data shall not be transferred, sold, leased or otherwise made available to any third party, except to those San Patrick service providers who perform specific services for us (such as sending out the San Patrick newsletter to service providers, to marketing or customer service providers, or to providers of storage or data and database management services, and so on), but in no case may it be employed for their own purposes.

6. INTERNATIONAL DATA TRANSFER

San Patrick is an international brand with stores around the world, meaning that your data may be processed outside the European Union or the European Economic Area (EU and EEA, respectively), for example, by the company's own stores located in the United States, among others, or by international suppliers who may provide their services from outside the EU.

Regardless, we shall ensure that any such data processing is consistently protected under appropriate security protocols and through the mechanisms provided for by prevailing norms and legislation, which may include, among others:

Model Clauses approved by the EU: These are contracts approved by European regulators which provide sufficient guarantees to ensure that data processing meets the requirements established by the EU General Data Protection Regulation.
Third-party certifications: For example, Privacy Shield, a framework agreement between the EU and the United States that establishes a standardized framework for the processing of data in accordance with the requirements of the EU General Data Protection Regulation.

You may request additional information at any time about the protocols in place in each case.

7. DATA PROCESSING AND RETENTION PERIOD

Customer Account data, and therefore all data related to your interactions with us, including any inquiries you have made to us, appointments you have requested, events you have attended, preferences and tastes provided about dresses, answers on satisfaction surveys, shall be retained by us for a period of five (5) years from the date of your last interaction with us, understanding as such the use of our website, reading our electronic messages, or visiting any of our stores, among others .

Also, if you have subscribed to our newsletter, we shall process your data until we deem that, by any means available according to the technology existing at any given time, you no longer have an interest in our products (such as in the event you do not use your user account to browse our website, or not open our emails). In any case, you may unsubscribe from the newsletter at any time.

At the end of the period indicated in the first paragraph of this section (seven (7)), or whenever any of the above conditions hold, we shall retain your data, duly blocked, for the period of time necessary to comply with our legal obligations (e.g., the Consumer and User Defense Act, as well as mercantile or tax law, may require us to retain certain data for a specific period of time). In addition, whenever possible, we shall also store them for statistical or market research purposes in an anonymous format.

8. EXERCISING YOUR RIGHTS

You may choose to object to any of the data processing indicated above at any time without any negative impact on your status as a customer or San Patrick contact.

Please note that if, in the course of your visit to any store you provide additional data to any company other than a member of the PRONOVIAS GROUP, you must exercise your rights to that data before that third party in accordance with the information that, pursuant to law, must be provided at the time your data is gathered.

Similarly, you may exercise your rights of access, rectification, deletion, limitation and/or portability in relation to the data you have provided to any member company in the PRONOVIAS GROUP by giving written notice addressed to San Patrick at the firm's postal address, San Patrick, Calle Om, 16, Polígono Industrial Mas Mateu, s/n, 08820 El Prat de Llobregat (Barcelona), or via email addressed to privacy@pronovias.com.

In addition, you may file a complaint with the San Patrick Data Protection Committee if you consider that San Patrick has processed your data in a manner which contravenes this General Privacy Policy, or any other prevailing and applicable norm or legislation, by sending an email addressed to gdprcomitee@pronovias.com as well as, in the event you do not receive a response or that you do not agree with the information received, filing the appropriate complaint with the competent Supervisory Authority.

Note that we may ask you for documentation proving your identity to carry out your request, provided that local regulations in force so require.