Article 1 Parties to this agreement

Between the undersigned: 1° The simplified joint stock company GINGER with a capital of 2,020,800 euros, whose registered office is located at 52 rue du Faubourg Poissonnière, 75010 Paris, registered with the Paris Trade and Companies Register under number 309,706,992, and with VAT number FR86309706992. Hereinafter referred to as the "Data Controller", on the one hand, and 2° Any natural person browsing the Data Controller's website; Hereinafter referred to as the "Data Subject", on the other hand, it has been stated and agreed as follows: Article 2. Purpose This Privacy Policy applies, without restriction or reservation, between the Data Subject and the Data Controller. Its purpose is to provide information concerning the manner in which the Data Controller collects and processes certain personal data relating to the Data Subject, in accordance with current legislation and in particular European Regulation n°2016/679 and law n°78-17 (hereinafter referred to as the "Legislation"), in relation to the use of the website www.lestricotsdelea.com (hereinafter referred to as the "Site") by the Data Subject. Access to and use of the website are subject to compliance with the General Terms and Conditions of Sale, the Legal Notice and this Privacy Policy.

Article 3. Definitions

• Supervisory Authority means the French National Commission for Information Technology and Liberties (CNIL), an independent French public authority regulating data protection;
• Consent means any free, specific, informed, and unambiguous expression of will by which the Data Subject accepts, by a statement or by a clear affirmative act, that Data concerning him or her be processed by the Data Controller.
• Cookie means a file used to track the Data Subject's journey on the Site.
• Recipient means any natural or legal person, public authority, service, or other body that receives Data, whether or not it is a Third Party. However, public authorities that may receive Data, particularly in the context of an investigation, are not considered Recipients within the meaning of this definition.
• Data means any information relating to the Data Subject.
• DPO means the Data Controller's data protection officer, namely Cabinet Bouchara – Avocats (17 rue du colisée – 75008 Paris, info@cabinetbouchara.com), responsible for assisting the Data Subject in exercising his or her rights regarding his or her Data.
• File means any structured set of Data accessible according to determined criteria, whether this set is centralized, decentralized, or functionally or geographically distributed.
• Legislation means any law and regulation relating to Data protection, and in particular European Regulation n°2016/679 and law n°78-17.
• Browsing means the consultation, knowledge, ordering, and/or purchase of Products on the Site by the Data Subject.
• Data Subject means any natural person who browses the Site, as long as they can be identified, directly or indirectly, in particular by reference to an identifier, such as a name, an identification number, location data, an online identifier, or to one or more specific elements specific to their physical, physiological, genetic, psychological, economic, cultural, or social identity.
• Products means the products offered for sale and/or reservation on the Site by the Data Controller to the Data Subject.
• Pseudonymization means the processing of Data in such a way that it can no longer be attributed to the Data Subject without the use of additional information.
• Data Controller means the simplified joint stock company GINGER with a capital of 2,020,800 euros, whose registered office is located at 52 rue du Faubourg Poissonnière, 75010 Paris, registered with the Paris Trade and Companies Register under number 309,706,992, which alone determines the purposes and means of Processing.
• Site means the infrastructure developed by the Data Controller in computer formats usable on the Internet, including data of various kinds, and in particular texts, sounds, fixed or animated images, videos, databases, intended to be consulted by the Data Subject to learn about, reserve, order, and/or purchase Products (www.lestricotsdelea.com).
• Processor means any natural or legal person, public authority, service, or other body other than the Data Controller that processes Data on behalf of the Data Controller.
• Third Party means any natural or legal person, public authority, service, or other body other than the Data Controller, the Processor, and the persons who, under the direct authority of the Data Controller or the Processor, are authorized to process Data, and in particular tour operators, travel agencies, and booking systems.
• Processing means any operation or set of operations performed or not with the aid of automated processes and applied to Data or sets of Data, such as collection, recording, organization, structuring, storage, adaptation or modification, extraction, consultation, use, communication by transmission, dissemination or any other form of making available, reconciliation or interconnection, restriction, erasure or destruction.

AGREEMENT Article 4. Principles relating to Processing

In accordance with the Legislation, the Data Controller undertakes to comply with the following principles for each Processing:

• Lawfulness;
• Fairness;
• Transparency;
• Purpose limitation;
• Data minimization;
• Accuracy;
• Storage limitation;
• Integrity;
• Confidentiality;
• Accountability.

Article 5. Data processed

When browsing, the Data Controller collects and processes a certain amount of Data, including:

• Personal information (last name, first name, sizes, gender, postal address, email address, phone number, date of birth, age, date of registration and unregistration to the customer account and the Data Controller's newsletter, messages exchanged with the Data Controller);
• Banking information (payment method, credit card number);
• Information about your order (ordered product, delivery address, delivery tracking number, order price, purchase and delivery history);
• Technical information (browsing behavior on the Site, IP address, products added to the cart, collection of consent).

Article 6. Context of Processing Data may be collected and processed by the Data Controller on various occasions, including:

• Purchase of Products on the Site;
• Reservation of Products on the Site;
• Contact with the Data Controller;
• Newsletter subscription;
• Creation of a customer account;
• Publication of reviews relating to Products;

Browsing on the Site.

Article 7. Processing details

Purpose of Processing Concerned data Legal basis for Processing Data retention period

Management of Product purchases, deliveries, invoicing, and accounting standards First name, last name, email address, postal address, phone number, delivery address, order placed, delivery tracking number, sizes, Products purchased, registration and unregistration date, payment method, order and delivery history, credit card number, IP address Contract, legal obligation, and legitimate interest of the Data Controller to establish, exercise, and defend its rights in court 10 years from the date of Product purchase EXCEPT 15 months from the date of Product purchase for banking data (immediately for the visual cryptogram) Management of Product reservations First name, last name, email address, phone number, sizes, collection of consent, IP address, Products purchased, reservation history Consent of the Data Subject 3 years from the date of Product reservation request Creation and management of customer accounts First name, last name, email address, postal address, phone number, sizes, date of customer account creation, date of customer account deletion, collection of consent, IP address Consent of the Data Subject 3 years from the Data Subject's last connection to their customer account OR immediately upon deletion of their customer account Management of commercial relations and prospecting First name, last name, email address, postal address, phone number, purchase and delivery history, collection of consent, IP address Consent of the Data Subject and legitimate interest of the Data Controller in promoting its Products 3 years from the Data Subject's last contact or from the end of the commercial relationship

Newsletter management Email address, first name, last name, phone number, collection of consent Consent of the Data Subject Upon unsubscription Securing and improving the Site IP address, browsing data Legitimate interest of the Data Controller to improve the Site and manage the Site, secure and administer the Site, prevent fraud and malicious acts. 13 months Management of complaints and customer service First name, last name, email address, postal address, phone number, purchase history, exchanges, IP address, collection of consent Consent of the Data Subject and legitimate interest of the Data Controller in improving its Products and customer service. 3 years from the Data Subject's last contact Site statistics and personalized advertising IP address, browsing data, collection of consent Consent of the Data Subject 13 months

The Data Controller reserves the right to anonymize the Data being Processed before deleting it. The anonymized data may then be Processed for statistical purposes.

Article 8. Recipients of the Data

In principle, the Data Controller is the sole Recipient of the Data. However, the Data Controller may transfer the Data to Recipients, particularly in the context of managing Product purchases by the Data Subject, and/or to any public authority that requests it, particularly in the context of an investigation. The Data Controller undertakes to require its Processors to provide sufficient guarantees regarding the implementation of appropriate technical and organizational measures so that the Processing complies with legal and regulatory requirements and guarantees the protection of the Data Subject's rights, especially in the event of Data transfer outside the European Union.

Furthermore, the Data Controller may communicate to any Recipient or Third Party the Data that is being Processed when a legal obligation to do so exists or when the Data Controller believes in good faith that it is necessary to:

• Respond to any claim against it;
• Comply with the requirements of the judicial and/or administrative order and/or the Supervisory Authority;
• Enforce any contract to which the Data Subject is a party;
• Safeguard the vital interests of any natural person;
• Perform a task carried out in the public interest.

In the event of the Data Controller being acquired by a Third Party, the Data Controller reserves the right to share the Data with the acquiring Third Party, subject to this Third Party's compliance with this Privacy Policy.

Article 9. Data Subject's Rights regarding the Data

The Data Subject has a number of rights regarding the Data, which they can exercise, unless a legislative or regulatory exception applies, by making a request to the DPO at the following address: CABINET BOUCHARA – AVOCATS DPO Department 17 rue du Colisée – 75008 PARIS info@cabinetbouchara.com The DPO will assist the Data Subject in exercising their rights regarding the Data with the Data Controller. In case of reasonable doubt about the identity of the Data Subject making a request to exercise their rights regarding the Data, the DPO may request a copy of an official identity document to support the request. Requests will be processed as soon as possible and no later than within the deadlines set by the Legislation.

Article 9.1. Right of access

The Data Subject has the right to obtain from the Data Controller confirmation as to whether or not Data concerning him or her are being processed, and, where that is the case, access to the Data and the following information:

• The purposes of the processing;
• The categories of Data;
• The Recipients or categories of Recipients to whom the Data have been or will be disclosed, in particular Recipients in third countries or international organizations;
• Where possible, the period for which the Data will be stored, or, if not possible, the criteria used to determine that period;
• The existence of the right to request from the Data Controller rectification or erasure of Data, or restriction of processing of Data concerning the Data Subject, or to object to such processing;
• The right to lodge a complaint with a supervisory authority;
• Where the Data are not collected from the Data Subject, any available information as to their source;
• The existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Data Subject.

The Data Controller shall provide a copy of the Data undergoing Processing and reserves the right, in return for providing this copy, to charge a reasonable fee based on administrative costs for any additional copies requested by the Data Subject.

Article 9.2. Right to erasure and rectification

The Data Subject has the right to obtain from the Data Controller the rectification and/or erasure of inaccurate or outdated Data without undue delay, unless a contrary situation prevents the exercise of this right, and in particular:

• The exercise of the right to freedom of expression and information;
• Compliance with a legal obligation;
• Public interest in the area of public health, archives, scientific or historical research or statistics;
• The establishment, exercise or defense of legal claims.

Article 9.3. Right to object

The data subject shall have the right to object, on grounds relating to his or her particular situation, at any time to processing of personal data concerning him or her which is based on the performance of a task carried out in the public interest or the necessity of the legitimate interest of the Data Controller. In such a case, the Data Controller shall no longer process the Data, unless the Data Controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the Data Subject or for the establishment, exercise or defense of legal claims. Furthermore, the Data Subject has the right to object at any time to the Processing of Data carried out for prospecting purposes by the Data Controller, insofar as the Data Subject is linked to such prospecting. Finally, where Data are processed for scientific or historical research purposes or statistical purposes, the Data Subject, on grounds relating to his or her particular situation, shall have the right to object to processing of Data concerning him or her, unless the processing is necessary for the performance of a task carried out for reasons of public interest.

Article 9.4. Right to restriction of processing

The Data Subject has the right to obtain from the Controller restriction of processing where:

• The accuracy of the personal data is contested by the Data Subject, for a period enabling the Controller to verify the accuracy of the personal data;
• The processing is unlawful and the Data Subject opposes the erasure of the personal data and requests instead the restriction of their use;
• The Controller no longer needs the personal data for the purposes of the processing, but they are required by the Data Subject for the establishment, exercise or defence of legal claims;
• The Data Subject has objected to processing pursuant to Article 9.3, pending the verification whether the legitimate grounds of the Controller override those of the Data Subject.

The Data Subject who has obtained restriction of processing shall be informed by the Controller before the restriction of processing is lifted.

Article 9.5. Right to data portability

The Data Subject has the right to receive the Data that he or she has provided to the Data Controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another data controller without hindrance from the Data Controller, where:

• The Processing is based on the Data Subject's Consent or on the performance of a contract to which the Data Subject is party;

The Data Subject, when exercising their right to data portability, has the right to obtain that the Data be transmitted directly from the Data Controller to another data controller, when this is technically possible.

Article 9.6. Right to lodge a complaint with the Supervisory Authority

The Data Subject has the right to lodge a complaint with the Supervisory Authority if they consider that they are subject to unlawful Data Processing by the Data Controller.

Article 9.7. Right to define directives on the fate of Data

The Data Subject has the right to define directives on the fate of the Data after their death with the Data Controller, who will use all its technical means to enforce this wish.

Article 9.8. Withdrawal of consent:

"In cases where processing is based on consent, the Data Subject may withdraw their consent to the processing of their data at any time, in accordance with Article 7 of the GDPR."

Article 9.9. Right not to be subject to a decision based solely on automated processing:

"The Data Subject has the right not to be subject to a decision based solely on automated processing, in accordance with Article 22 of the GDPR; no such decision is applied by LES TRICOTS DE LEA."

Article 10. Data Security

The Data Controller takes appropriate technical and organizational measures to protect the Data against destruction, loss, alteration, misuse, and unauthorized access, modification, or disclosure, whether these actions are voluntary or accidental. These technical and organizational measures aim to ensure the confidentiality, integrity, availability, and resilience of the Site and the information systems where the Files are stored. To secure the User's Navigation, the Site is SSL (Secure Socket Layer) encrypted.

Article 11. Modification of the Privacy Policy

The Data Controller reserves the right to occasionally modify this Privacy Policy, in particular the list of Recipients in Article 8. In the event of a substantial modification of this Privacy Policy, the Data Subject will be personally informed of the new Privacy Policy. The Data Subject is invited to regularly consult this Privacy Policy to become aware of any modifications to it. The Data Subject may send their questions about this Privacy Policy to the DPO at the following address: info@cabinetbouchara.com.

Article 12. Invalidity of the Privacy Policy

If any of the provisions of this Privacy Policy should prove null and void with regard to an existing legal rule or a final judicial decision, it would then be deemed unwritten, without however leading to the nullity of the entire Privacy Policy or altering the validity of its other provisions.