Release date: 13.02.2024

Data Protection Information

This Data Protection Information provides information on the processing of your personal data whenever you visit websites of PUMA United Kingdom Limited (hereinafter “PUMA”, “we” or “us”) and when purchasing goods from said websites.

1. Scope, data controller, data protection officer and definitions

1.1. Scope of this Data Protection Information

This Data Protection Information applies to the use of the websites of PUMA United Kingdom Limited, includ-ing the online shop and any measures connected for the execution and rescission of an online pur-chase, the creation of a customer account, the newsletter dispatch, further informative emails and customer services, and for our marketing activities on third-party websites. Data processing on websites of other companies within the PUMA Group are not covered by this Data Protection In-formation.

1.2. The Controller for the processing of your personal data

Unless otherwise specified in this Data Protection Information, the Controller for the processing of your personal data is:

PUMA UNITED KINGDOM LTD
Super G Steamboat Way
WF10 5XY Castleford
United Kingdom

1.3. Contact details of the Data Protection Officer

Data Protection Officer
PUMA Europe GmbH
PUMA Way 1
91074 Herzogenaurach
Email: [email protected] (Please note: For exercising your data protection rights please use the email addresses referred to in Section 5 to 7!)

1.4. Definitions

This Privacy Notice is based on the following terms under data protection law, which we have defined to facilitate understanding.

• Recipient means a natural person or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by the public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; 

Examples of possible recipients: Banks / payment providers, logistic firms and ship-ping service providers and IT services providers; for more information please refer to Section 4)

• PUMA Group means all enterprises that are affiliated with PUMA United Kindgom Limited (as Control is defined under section 1124 of the Corporation Tax Act 2010).

• Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

Examples of personal data: Name, contact details, bank or credit card details.

• Controller means the natural person or legal person, public authority, agency, or oth-er body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. 

For the data processing activities described in this Data Protection Information, the Controller is PUMA United Kingdom, unless otherwise specified (Section 1.2.).

• Processing means any operation or set of operations which is on personal data or on sets of personal data, whether or not by automated means such as collection, record-ing, organisation, structuring, storage, adaptation or alteration, retrieval, consulta-tion, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

2. Purposes and legal bases of our processing of your personal data

2.1. Processing of your data when you visit our websites

If you visit our websites in order to find out about products and services without registering for a customer account, purchasing products in our online shop or otherwise actively transferring information to us (purely for informational purposes), we process your personal data for the following purposes and by virtue of the following legal bases:

2.1.1. Provision of websites and IT security

We process your personal data that are technically necessary to allow us to provide our websites to you and to guarantee stability and security when you visit our websites. This includes the following personal data:

• IP address
• type and version of browser
• operating system and platform
• the complete Uniform Resource Locator (URL)

These personal data will be stored for security purposes in server log files, which will automatically be deleted after 7 days.

This data processing is necessary for the purpose of enabling you to use our websites (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR) as well as for the purposes of our legitimate interest to guarantee IT security (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.1.2. Provision of localised websites

We also process your personal data that are technically necessary to allow us to provide you with a localised version of the websites, in particular with regard to the language.

This data processing is necessary for the purpose of our legitimate interest to adapt our website to your needs (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.1.3. Website Analytics

2.1.3.1. Google Analytics

We use Google Analytics on our websites, a web analysis service of Google Inc. (“Google”). Google Analytics uses cookies (for more information on cookies please refer to Section 2.1.9 and our Cook-ie Information) that allow an analysis to be made on the usage of our websites. The information generated by the cookie on the use of our websites is, as a rule, transferred to a server of Google in the USA, where it is stored. However, as we use Google Analytics with the extension “anonymizeIP()”, Google will reduce the IP address of the website visitor within Member States of the European Union or in other states party to the Agreement on the European Economic Area before-hand, which excludes any direct association to you. Only in exceptional cases, is the full IP address transferred to a server of Google in the USA and shortened there. On behalf of PUMA, Google will use this information in order to evaluate the use of the websites, to prepare reports on the web-site activities, to analyze the impact and improve the customization of our digital advertisements, and to provide further services to PUMA connected with the use of the websites and of the Internet. The IP address transferred from the user’s browser with regard to Google Analytics is not merged with other data by Google. Further information on terms of use and data protection can be found under:

https://policies.google.com/terms

https://policies.google.com/privacy

This data processing is necessary for the purpose of our legitimate interest to carry out analyses in order to improve our website and our products, and to advertise our products on the Internet in a customized and efficient way (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Google Analytics Opt-out:

You can prevent the processing of your usage data (including your IP address) by Google Analytics generally, by downloading and installing the browser add-on available at the following link:

https://tools.google.com/dlpage/gaoptout

In addition, you can also prevent Google Analytics from collecting your usage data on our websites by clicking on the following link:

Click here to opt-out of Google Analytics

In this case a persistent opt-out cookie (name: “ga-disable-UA-[…]”) is set in your current used browser, that prevents your data from being recorded in the future when you visit our websites with this specific browser. If you use another browser, Google Analytics will be in principle enabled, unless the opt-out cookie is also set in this browser. Please note, that Google Analytics will be enabled again, if you delete the abovementioned opt-out cookie in your browser.

2.1.3.2. Adobe Analytics

We also use Adobe Analytics to collect statistical data on the use of our websites. We use this data in order to constantly improve and optimise the PUMA online shop and the products and services we offer, and thus make it more interesting for you to visit our websites.
When you use our websites, information that is transferred by your browser is collected and evaluated. This is achieved using cookies and similar tracking technology (e.g. “pixels”), that are embedded on each website. The following data may be collected: Request (name of the requested file), browser type/version, browser language, operating system, internal resolution of the browser window, screen resolution, java script enabling, Java on/off, cookies on/off, colour depth, referrer URL, IP address (is collected exclusively in an anonymised form and deleted again immediately after use), time of access, clicks, order values, shopping carts and anonymised form contents (for example, whether or not a phone number has been provided).
None of this data may be directly allocated to you. The thus collected data serves to create anonymous or pseudonymised usage profiles that form the basis for web statistics. The data collected by means of cookies from Adobe Analytics are never used to personally identify the visitors to our websites, nor are they merged with personal data of the profile owner, unless the user has given his/her express consent thereto in advance.

The data protection guidelines of Adobe Analytics can be found here:

• Adobe Analytics: http://www.adobe.com/privacy/analytics.html

This data processing is necessary for the purpose of our legitimate interest to carry out analyses and, based on these analyses, to improve our website, products and services (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Adobe Analytics Opt-Out:

The collection and storage of data by Adobe Analytics can be objected to at any time with future effect. For this purpose, please use the following links:

• Adobe Analytics: https://www.adobe.com/privacy/opt-out.html

In this case a persistent opt-out cookie for Adobe Analytics (name: “omniture_optout”) is set in your current used browser, that prevents your data from being recorded by this/these service(s) in the future when you visit our websites with this specific browser. If you use another browser, these services will be in principle enabled, unless the opt-out cookie(s) is/are also set in this browser. Please note, that these services will be enabled again, if you delete the respective opt-out cookie in your browser.

2.1.3.3. Meta Custom Audiences

When registering for the newsletter, we offer you the opportunity to give us your consent to the use of your e-mail address so that we can use it for the so-called Meta Custom Audiences by Meta Platforms Ireland Limited., Block J, Serpentine Avenue, Dublin 4 Ireland (“Meta”).

Your e-mail addresses are hashed before being sent to Meta and transmitted in this form.

Meta matches your email address with the accounts you have on Meta's social networks and creates an interest profile based on your user data.

Meta Custom Audiences helps us to show you personalized advertising for special offers and product releases.

https://www.facebook.com/business/help/744354708981227?id=2469097953376494

https://www.facebook.com/legal/terms/customaudience/

You can revoke your consent with effect for the future at any time by e-mail. Detailed information on exercising your right of withdrawal can be found in section 10.

2.1.3.4. Google Ads Customer Match

When registering for the newsletter, we offer you the opportunity to give us your consent to the use of your e-mail address so that we can use it for the so-called Google Ads Customer Match by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Your e-mail addresses are hashed before being sent to Google and transmitted in this form.

Google matches your email address with the accounts you have for the services provided by Google(e.g., YouTube, Gmail) and creates an interest profile based on your user data.

Google Ads Customer Match helps us to show you personalized advertising for special offers and product releases.

https://support.google.com/google-ads/answer/6379332

https://support.google.com/google-ads/answer/6334160

You can revoke your consent with effect for the future at any time by e-mail. Detailed information on exercising your right of withdrawal can be found in section 10.

2.1.3.5. Emarsys

We use Emarsys for personalization, analytics, automation and email campaigns (sending newsletters). Emarsys works through cookies and tracking pixels which help us to create newsletters and tailored advertisements. If you give your consent to receive our newsletter and have fully completed the double opt-in process to verify your email address accordingly [or have entered your email address on our website in connection with a purchase in our web shop] your personal data will be collected by Emarsys and combined into a [pseudonymized] user profile which can be assigned to your email address. When you visit our website, the data collected by Emarsys can also be merged into a [pseudonymized] user profile if you had given your consent to receive our newsletters at one of our retail stores. Your email address will be pseudonymized by us. If you have given your consent for receiving our newsletter we will process your following data: if you have opened our newsletter, what you have clicked on, when and how much time have you been surfing on our website, what products and categories have you been looking at, what have you purchased on our web shop and when, from what category at what cost and have you completed the check-out process.

The data protection guidelines of Emarsys can be found here:

• https://www.emarsys.com/privacy-policy/

This data processing (evaluation of the newsletter and the measurement of success) is based on our legitimate interests - subject to your given consent - to ensure the secure and user-friendly operation of our newsletter system and thus serves both our business interests and your expectations to improve our website, products and services (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.1.4. Individual recommendations on our websites

When you visit our web pages, we use Google AdWords to process data on your user behaviour like watched products, content of shopping cart ect. in order to show you individual recommenda-tions on our websites based on this data. For further details on the processing of data by Google Adwords please refer to Google’s privacy policy under the following link:

https://policies.google.com/privacy

This data processing is necessary for the purpose of our legitimate interest to create a better user experience by tailored recommendations (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Individual recommendations Opt-out:

You can object to this data processing by clicking on the following opt-out link:

Google AdWords: https://adssettings.google.com

2.1.5. Recommendation of the most suitable product size

In order to be able to recommend the ideal product size according to your individual preferences, we offer the opportunity to use the optional service of FitAnalytics GmbH. For this service, FitAnalytics GmbH collects data which you voluntarily provide, such as height, weight, body shape, age and your personal wearing comfort. On this basis, FitAnalytics GmbH will provide you with a size recommendation. The data you provide is stored in a cookie of FitAnalytics GmbH, which is automatically deleted after 90 days. Further details on data processing by FitAnalytics GmbH are stated in the data protection information provided by FitAnalytics GmbH:

https://widget.fitanalytics.com/documents/privacy_en.html

During the purchasing process we receive information from FitAnalytics GmbH as to whether you have added a product to your shopping cart on the basis of a recommendation. However, FitAnalytics GmbH does not provide us with any personal data that you have provided to FitAnalytics GmbH. This data processing is necessary in order to provide you the service of FitAnalytics GmbH [Legal basis: Art. 6 [1] sentence 1, lit. b GDPR].

After the purchase has been completed, we provide anonymized data to FitAnalytics GmbH. This data contains information on whether you have actually purchased a product on the basis of a size recommendation and, if applicable, whether the sales contract was reversed due to an improper fitting.

2.1.6. Display advertising/retargeting on third-party websites

When you visit our websites, tags and cookies are set by our retargeting provider(s) to track which products you have viewed or purchased on our websites. With the help of this information we can then show you individual offers of PUMA products on third-party websites via our retargeting provider(s), and analyze the results to further improve our advertising. For further details on the processing of data by our retargeting provider(s) listed below, please refer to the corresponding privacy policy / policies:

• Google AdWords: https://policies.google.com/privacy
• Facebook Ads: https://www.facebook.com/about/privacy

This data processing is necessary for the purpose of our legitimate interest to advertise our prod-ucts on the Internet in a customized and efficient way (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).
Retargeting Opt-out:

You can object to this data processing by clicking on the following opt-out link(s) of the respective retargeting provider(s).

• Google AdWords: https://adssettings.google.com
• Facebook Ads: https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen

2.1.7. Affiliate Marketing/Conversion Tracking

We have also embedded cookies and similar tracking technology from our affiliate (network) part-ners into our websites. With these tools our affiliate (network) partners can recognize whether you came from one of our affiliate publishers (i.e. third party websites that advertise PUMA products) and then track if you perform a certain predefined “conversion” action (e.g. newsletter subscrip-tion or purchase of a product) on our websites in consequence.

This data processing is necessary for the purpose of our legitimate interest in analysing reach and success of our advertising campaigns on third party website (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR) as well as for the legitimate interests pursued by us (as an advertiser), the affiliate (net-work) partners and the affiliated third party website operators (publisher) in success-based billing of PUMA advertising measures published on third party websites (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Affiliate Marketing/Conversion Tracking Opt-out:

• https://publisher.tradedoubler.com/include/functions/optout.html

2.1.8. Use of cookies

On our website we use cookies. Cookies are small text files that are stored in the browsers of your end devices whenever you visit our websites. Through cookies, your actions and settings on our websites can be tracked, stored and recognized for the duration of the browser session or even after this. In addition to this, cookies and their respective cookie IDs allow your browser to be rec-ognised. For example, after leaving the website, you can reconstruct the content of your shopping card or be shown the last seen products.

For more information about the use of cookies on our websites, the cookie categories and for individual settings please refer to our Cookie Settings.

2.1.9. Customer care

Depending on the subject matter of your request, we will rely on your personal data that has been stored within the scope of other data processing activities in our systems (e.g. data that you have provided during a purchase, or your score value that we have received from the credit agency as part of the credit assessment process. If and to the extent that this is necessary to answer your query, we will also collect data from external sources (e.g. query with a shipping service provider as part of shipment tracking or an investigation request).

In context of requests concerning a (pre)contractual relationship with you, this data processing is necessary for the performance of a contract (provision of a customer service) with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR). If you wish to exercise your rights with respect to us, the corre-spondent this data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR). If you would like to receive information or complain about our products and services, the respective data processing is necessary for the purpose of our legitimate interest to respond to your information request / complaint (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.2. Email marketing

2.2.1. Email newsletter dispatch to subscribers

If you have subscribed to our email newsletter via “double opt-in” procedure we will send you from time to time newsletters to inform you about our products, services and promotions.

This data processing is based on your consent (Legal basis: Art. 6 (1) sentence 1, lit. a GDPR).

Withdrawal of consent:

You can withdraw your consent and unsubscribe from our newsletter at any time by sending an email with your unsubscribe request to our customer ([email protected]) and/or by clicking on the unsubscribe link which is contained in every newsletter.

2.2.2. Direct marketing emails to existing customers

After the purchase of goods we may – regardless of whether you have subscribed to our newslet-ter (see Section 2.2.1) – send you marketing emails for similar products and services.

This data processing is based on our legitimate interest to advertise our products and services (Le-gal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Objection to direct marketing emails:

You can object to this processing of personal data and unsubscribe from our direct marketing emails at any time by clicking on the unsubscribe link which is contained in every direct marketing email.

2.2.3. Personalization of direct marketing emails to existing customers

If you are a customer, we may personalize our direct marketing mails send to you based on your pref-erence/interest profile derived from data of your previous purchase(s) from the last two years.
This data processing is necessary for the purpose of our legitimate interest to tailor our direct market-ing emails to your preferences and interests and thus make our email marketing efforts more efficient (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Objection to our newsletter/direct marketing targeting

You can object to this processing of your purchase data for targeting of our newsletter/direct marketing emails to custom audiences at any time by sending an email with your unsubscribe request to [email protected] and/or by clicking on the unsubscribe link which is contained in every direct marketing email. In this case, you would then not receive any more newsletters from us.

2.3. Product ratings and reviews

We offer you the chance to review any (purchased) products on our websites. Your feedback helps other customers to make the right purchasing decision and enables us to continuously improve our products. If you would like to submit a review for one of our products, we will process your email address, your nickname and also the content of your review (e.g. reviewed product, star rating, title and text of review, recommendation). Your email address will be processed in order to verify and establish your identity. It may also be used by our customer service in order to reply to your feedback by email. If, before submitting your review, you have given your consent, we will send you an email notification when your review is published. Since your (star) rating and the content of your review will be published alongside your nickname on our websites, please ensure that you do not give any personal information in this.

This data processing is necessary for the purpose of our legitimate interest, namely customer ser-vice and recommendation marketing (Art. 6 (1) sentence 1, lit. f GDPR). Email notifications about the publication of the review are based on your prior consent (Art. 6 (1) sentence 1, lit. a GDPR).

2.4. Registration and setting up a customer account

When you visit our websites, you can create a customer account. The registration for a customer account requires you to provide personal data. Mandatory fields are marked accordingly in the in-put form.

This data processing is necessary for the performance of a contract (provision of a customer ac-count) with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR).

2.5. Data processing in the case of orders in the online shop

In addition, we process your personal data in connection with the purchase of goods in our online shop.

2.5.1. Purchase and payment of goods in the online shop

We process your personal data (i.a. contact details, shipping and payment information) if you pur-chase goods in the online shop. If you purchase goods for another person (third party), we process the personal data of the third party provided by you (name and any contact details) for the dispatch of the goods to the third party. Please ensure that the third party has been sufficiently informed by you about the processing of their data at PUMA, and that you are authorised to provide such data.

This data processing is necessary for the performance of a contract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR).

2.5.2. Shopping cart abandonment emails

If you have started an ordering process using your customer account, but have not concluded it, we will send you a reminder email to the email address stored in the customer account, regarding the purchasing process initiated by you.

This data processing is necessary for the purpose of our legitimate interest to remind you of any purchasing processes that you have not yet completed (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

Objection to shopping cart abandonment emails:

You can object to this processing of personal data and unsubscribe from our shopping cart aban-donment emails at any time by sending an email with your unsubscribe request to [email protected] and/or by clicking on the unsubscribe link which is contained in every shopping cart abandonment email.

2.5.3. Fraud and credit check

Before concluding the purchase contract, we carry out a fraud and credit check. This is done to ena-ble us to offer you a choice of different payment methods and at the same time to protect ourselves against the default of payment of the invoice. As part of the credit check, we i.a. check all previously made orders in your customer account. It is also checked whether the delivery address differs from the billing address, whether the delivery address is new or if the order should be delivered to a pack station. For orders made in Germany, Austria, Switzerland and the Netherlands, we also obtain a credit report during our credit check. The credit report can contain, firstly, information about any current payment delinquencies, e. g. from public debtor registers, or data from court collection proceedings. Secondly, the credit check can also list so-called score values, which are calculated based on a scientifically recognised mathematical and statistical procedure and are used to assess the credit risk. The credit rating agency also uses the above data for other enterpris-es (e.g. other online traders) for the purposes of checking addresses and/or identity checks, and for any scoring applications based on these. Your address data is also included in the probability values.

If you do not agree with the payment method(s) you have been offered, you can contest the deci-sion stating your point of view either by letter or by sending an email to [email protected]. We will then check the decision taken once again, in consideration of your point of view.

In addition to that we will check, based on your device on pre-defined rules, if the order should be categorised as being suspected of fraud. If there is any suspicion of fraud, we will additionally carry out an individual check on the order. The result of this manual fraud check can either be positive, which would lead to the order being approved. If, however, the suspicion of fraud remains, we may decide to cancel the order, depending on the particular case.

This data processing necessary for the purpose of our legitimate interest to avoid default of pay-ment and fraud (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.5.4. Cancellation of purchase

In any case of cancellation of the purchase (e.g. withdrawal of contract) we will process your per-sonal data for returning the goods and refunding the purchase price.

This data processing is necessary for the performance of a contract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR) and/or for compliance with a legal obligation (Legal basis: Art. 6 (1) sen-tence 1, lit. b GDPR lit. c GDPR).

2.5.5. Invitation emails for product rating and review

We would like to know if you are satisfied with your purchased PUMA goods. For this purpose, we process your email and purchasing data (e.g. goods purchased and date of purchase), in order to send you an email within one month after the purchase, inviting you to rate and review your purchased product (further information on data processing in connection with the submission of prod-uct reviews can be found in Section 2.3).

This data processing is necessary for the purpose of our legitimate interest in good customer ser-vice and marketing.

Objection to product rating and review invitation emails:

You can object to the receipt of such invitation emails from the start, by clicking on the opt-out but-ton under the following link:

https://www.bazaarvoice.com/legal/privacy-policy/#opting-out

In this case a persistent opt-out cookie (name: “NoCookie[EU]”) is set in your current used brows-er, that prevents your data from being processed for invitation emails when using this specific browser. If you use another browser, data transfer to Bazaarvoice will be in principle enabled, unless the opt-out cookie is also set in this browser. Please note, that data transfer to Bazaarvoice will be enabled again, if you delete the abovementioned opt-out cookie in your browser.

If you have already received an email inviting you to evaluate the product, you can decline the fu-ture receipt of such emails by clicking on the opt-out button/link contained in each invitation email.

2.5.6. Dunning process, collection and enforcement and/or defence of legal claims

In the case of outstanding amounts owed to us, we will advise you accordingly by email, SMS, letter or by phone, and under certain circumstances, will send you a dunning letter. If and to the extent that you still fail to make the payment, we will initiate a credit collection procedure.

The credit collection procedure will be carried out by a credit collection agency engaged by us. If necessary to carry out the credit collection procedure, the credit collection agency will carry out address enquiries, thereby availing itself of public registers in order to locate you as a debtor.

In the case of a legal dispute with you, we will process your personal data to enforce and/or defend our rights. If and to the extent necessary for the legal dispute, we will thereby rely also on data from other sources (e.g. public registers).

This data processing is necessary for the performance of a contract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR) as well as for the purpose of our legitimate interest in preventing the abuse of our services and in establishment and exercise of legal claims (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.6. Other processing

2.6.1. Performance of internal audits

Within the scope of audits within the PUMA Group, both at home and abroad, your personal data may be processed. During this process, we rely also on data from other sources, depending on the case (e.g. credit agencies).

Your data may, under certain circumstances, also be appropriately processed in order to identify and rectify misconduct within the enterprise, and to implement compliance programmes and com-pliance measures.

This data processing is necessary for compliance with our legal obligations (e.g. under the Stock Company Act) (Legal basis: Art. 6 (1), sentence 1, lit. c GDPR) and/or for the purpose of our legiti-mate interest to check the processes and efficiency in the PUMA Group, to rectify misconduct and cases of fraud, to enforce and/or defend our rights, as the case may be, and to uncover any crimi-nal offences, (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.6.2. Issuing of analyses

On the basis of your data, which we process the meaning of Section 2 of this Data Protection Infor-mation, we may issue analyses. These serve as a basis for our business decisions, to improve our products and services, to adapt to the needs of our customers and to carry out marketing activities. The analyses issued on this basis no longer have any personal reference, which means it is no long-er possible to trace them back to you.

This data processing is necessary for the purpose of our legitimate interest to improve the products and services we offer and carry out marketing activities (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).

2.6.3. Prize Competitions & Raffles

PUMA offers you the chance to participate in prize competitions and raffles on this Website, as well as in our stores, on Social Media like Instagram, Facebook, TikTok, with our Affiliate Partners, in Newsletters, or similar.

Your personal data will be processed with your participation. In all our prize competitions and raffles, you only need to provide us with the data that we require to perform the raffle and to notify you of your win. Typically, this is your email address, but additional data might be required based on the applicable terms and conditions of certain raffles.

If the raffle is about winning PUMA Sportswear (clothes and shoes), we ask for your name, your clothing or shoe size and your gender in addition to your email address. In order to be able to collect the prize from us, we may also ask you to inform us of the store of your choice, where you can pick up your prize by giving your name. If the prize is sent by post, which can be in case you can win tickets, vouchers or other non-cash prizes, we need your home address in addition to your name. In some cases, we might additionally ask for your age to ensure that you can legally participate in the raffle based on the applicable terms and conditions. You will find further information on all this in the terms and conditions that apply.

The data required by us to perform the raffle under the applicable terms and conditions are highlighted as mandatory fields. Unfortunately, participation in the raffle is not possible without entering your data in the marked mandatory fields. Other, unmarked fields, however, are optional and you decide yourself whether you want to share further data with us. Participation in the raffle does not depend of your optional data and has no effect on the performance of the raffle.

In the event of your participation, we process the data you provide to us in the raffle solely for the purpose of performing the raffle and notifying the winner. The same applies if you provide us with data based on terms and conditions for raffles on social media (Instagram, Facebook, Twitter, ...), e.g. by uploading a photo or posting articles, linking hashtags, using handles or commenting on our campaigns. The applicable terms and conditions may stipulate that we publish your name and address on our social media platforms (Instagram, Facebook, Twitter, ...) to announce you as a winner and your prize.

Please note, that your data will be deleted after the raffle.

Within the scope of our raffles you also have the opportunity to give us your consent to the use of your data for advertising. Your consent to advertising has no effect on your participation in the raffle. If you give us your consent to receive advertising, such as newsletters per email, usually by ticking a checkbox, we will process your data, especially your email address, also to send you offers and information about our products by email. You can withdraw your consent at any time. Further information on data processing when receiving our newsletter can be found under the section “Newsletter”.

We process your personal data based on your consent in accordance with Art. 6 sec. 1 lit. a GDPR and, where applicable, to fulfil a legal obligation in accordance with Art. 6 sec. 1 lit c GDPR. Your data will not be passed on to third parties. In individual cases we are supported by external service providers with whom we have concluded a corresponding agreement to ensure the security of the processed data.

Of course, you can exercise the rights to which you are entitled under data protection law against us at any time. You will find more detailed information on this under the section “Your Rights”.

3. Retention and erasure of your personal data

We keep your personal data for as long and to the extent required for the purposes named in this Data Protection Information (Section 2).

As soon as the data for the purposes named in Section 2 is no longer required, we keep your per-sonal data for the length of time, during which you can assert claims against us or we can assert claims against you (the statutory period of limitations is generally three years, starting with the end of the year in which the claim arises, e.g. the end of the year of purchase).

In addition to this, we store your personal data for as long and to the extent we are obliged to do so by law. Corresponding obligations of proof and retention can be found, inter alia, in the Money Laundering Regulations. The retention periods may accordingly last up to ten years.

4. Transfer of personal data and the categories of recipients

Your personal data may be transferred / disclosed to the following categories of recipients:

• Other companies within the PUMA Group within the scope of a group-internal, col-laborative process. Such data processing, where applicable, is necessary for the pur-pose of our legitimate interest to run our administration activities efficiently and col-laboratively, and to improve our products and services (Legal basis: Art. 6 (1) sen-tence 1, lit. f GDPR).
• IT Service providers who prepare the platforms, databases and tools for our products and services (e.g. our website, the sale of goods, the dispatch of newsletters and in-formative emails), issue analyses on user habits on our websites, carry out marketing campaigns, and process your personal data during the purchasing process on our be-half.
• For the analysis of your behaviour on our website, we transfer your personal data to specialised service providers. Data is transferred to third party coun-tries. In order to guarantee adequate protection of your personal data, EU standard contractual clauses within the meaning of Art. 46 (5) sentence 2 GDPR are used. You can find information on EU standard contract clauses at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF.
• In order to offer you localised versions of our websites, we transfer your personal da-ta to a third-party service provider in the USA. In the case of the USA, the EU Com-mission has not decided that there is a suitable level of data protection within the meaning of the GDPR; such an adequacy decision (Art. 45 GDPR) has not been taken. The third-party service provider is, however, subject to the EU-U.S. Privacy Shield. This means that adequate protection of your personal data is guaranteed. You can re-trieve the full text of the US Privacy Shield Framework at the following link:

https://www.privacyshield.gov/servlet/servlet.FileDownload?file=015t00000004qAg

• In order to carry out the credit and fraud check, we transfer your personal data to specialised service providers, generally to informa Solutions GmbH. In certain circum-stances, data may be transferred to outside the EU / EEA. In order to guarantee ade-quate protection of your personal data, EU standard contractual clauses within the meaning of Art. 46 (5) sentence 2 GDPR are used. You can find information on EU standard contract clauses at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF.
• If you purchase or evaluate products on our websites, we will forward your personal data to our third-party service provider of customer feedback platforms, located in the USA. In the case of the USA, the EU Commission has not decided that there is a suitable level of data protection within the meaning of the GDPR; such an adequacy decision (Art. 45 GDPR) has not been taken. In order to guarantee adequate protec-tion of your personal data, we have used EU standard contractual clauses within the meaning of Art. 46 (5) sentence 2 GDPR. You can find information on EU standard contract clauses at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF.
• If you purchase products on our websites, we offer you various payment methods. In order to process a payment and, if necessary, a refund of the purchase price, we transfer your personal data, depending on the chosen payment method, to banks, payment service providers, financial service providers and credit card companies. The respective data transfers to such recipients are based on the performance of a con-tract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR). In certain circumstances, data may be transferred to the USA. In the case of the USA, the EU Commission has not decided that there is a suitable level of data protection within the meaning of the GDPR; such an adequacy decision (Art. 45 GDPR) has not been taken. In order to guarantee adequate protection of your personal data, EU standard contractual claus-es within the meaning of Art. 46 (5) sentence 2 GDPR are used. You can find infor-mation on EU standard contract clauses at http://eur-lex.europa.eu/LexUriServ/LexUriServ.do?uri=OJ:L:2010:039:0005:0018:DE:PDF.
• If you choose “PayPal” as the payment method for a purchase, we transfer your per-sonal data to the USA. In the case of the USA, the EU Commission has not decided that there is a suitable level of data protection within the meaning of the GDPR; such an adequacy decision (Art. 45 GDPR) has not been taken. This transfer of personal data is necessary for the performance of a contract (provision of payment method “PayPal”) with you (Legal basis: Art. 6 (1) sentence 1, lit. b in conjunction with Art. 49 (1) sentence 1, lit. b and c GDPR).
• Should you be unable to meet your payment obligations, we transfer your personal data to collection agencies that carry out the collection procedure on our behalf. This transfer of personal data is necessary for the performance of a contract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR) and for the purpose of our legitimate interest in an efficient accounts receivable management.
• For the delivery of your purchased products on our website (including notifications about the delivery status of the orders) we transfer your personal data to the fulfilment and shipping service providers (e.g. DHL, UPS, Hermes etc.) engaged by us. The transfer of your personal data is based on the performances of a contract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR).
• In the case of legal disputes, we transfer your data to the competent court and, if you have engaged a lawyer, to the latter, in order to conduct the legal dispute. This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR) and/or for the purpose of our legitimate interest in the establishment and exercise of legal claims (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR).
• In addition to this, we only transfer your personal data if we are legally obliged to forward such data (e.g. to the police authorities within the scope of criminal investigations or to the data protection supervisory authorities). This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sen-tence 1, lit. c GDPR).

5. Right to object to data processing based on legitimate interests

We process your personal data within the meaning of Section 2, based on our legitimate interest, in particular to guarantee IT security on our websites, to adapt our website to your needs, to carry out analyses and marketing activities, to inform you about our products and services, to remind you of any purchasing processes that have not yet been completed, to increase the coverage of our products and marketing activities, to prevent fraud and abuse, to avoid payment defaults, to care for our customers, to safeguard, enforce and defend our legal interests (also before the courts, as necessary), and to carry out our internal management efficiently and collaboratively. For information about the balancing of interests carried out by PUMA, please contact [email protected].

Notwithstanding the specific possibilities to object to data processing described in Section 2 (e.g. provided opt-out or unsubscribe links), you have the right to object at any time to the processing of your personal data on the basis of our legitimate interests pursuant to Art. 6 (1) sentence 1, lit. f GDPR on grounds relating to your particular situation by sending an email to [email protected]. We will then no longer process your data for this/these purpose(s) unless our legitimate interests in processing overweights or the processing serves to establish, exercise or defend legal claims.

If you object to the processing of your data, we will process any collected personal data in this con-text in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR).

6. Right to withdraw consent

If you have given us your consent for the processing of your personal data, you can withdraw this consent at any time. The withdrawal of your consent is effective for the future and shall not affect the lawfulness of processing based on consent before its withdrawal.
Unless specifically regulated in Section 2, please send your withdrawal of consent to [email protected].

If you withdraw your consent, we process your personal data collected in this connection to answer your inquiry. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR).

7. Your other data protection rights

You may demand at any time:

• access to you personal data and to certain other supplementary information on your personal data that we process;
• require us to correct any mistakes in your personal data which we hold;
• require the erasure of personal data concerning you in certain situations;
• receive the personal data concerning you which you have provided to us, in a structured, commonly used and machine-readable format and have the right to transmit those data to a third party in certain situations;
• otherwise restrict our processing of your personal data in certain circumstances

For further information on each of those rights, including the circumstances in which they apply, see the Guidance from the UK Information Comissioner's Office (ICO) on indivduals rights.

Please send your request, stating at least your first and last name, either by email to [email protected] or in writing, to PUMA Online Shop, Post box 201101, 48092 Münster, Germany.

If you exercise these rights against us, we will process your personal data in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR).

Irrespective of your abovementioned rights, you can lodge a complaint with a data protection su-pervisory authority, if you are of the opinion that the processing of your personal data by us violates applicable data protection laws.

8. Changes to this Data Protection Information

The provisions of this Data Protection Information, including the referenced Cookie Information, shall apply in the version in force at the time the online shop is used.

We reserve the right to supplement and modify the content of this Data Protection Information. The updated Data Protection Information applies from the time, in which it was published on our websites. In case of substantive or material changes to the Data Protection Information, especially changes that affect the processing of your personal data already collected by us, we will inform you in advance (e.g. by email).

9. Tracking Pixel

Disable Tracking Pixel