The processing, privacy, and security of your personal data is of utmost importance to us.

We make every effort to provide you with personalized services that respect your wishes and privacy. The purpose of this Privacy and Personal Data Protection Policy (hereinafter referred to as the "Privacy Policy") is to provide you with clear, transparent, and comprehensive information about how the data you provide to us is used. This covers the data we may collect about you through various channels (store, customer service department, phageparis.com, social media, applications, and events), whether this data is shared with third parties, and the rights and options you have to maintain control over your personal data and protect your privacy.

Types of Data Collected by PHAGE

Personal Data: Refers to any information that identifies you directly (e.g., through your name) or indirectly (e.g., using your customer number). You must be over 16 years of age to provide us with your personal data. Personal data collected directly from you may include the following information:

Your name and contact details (in particular email address, phone number, postal address, social media ID) Your gender, age or age range and/or date of birth Your interests Your purchases (online or in-store) and repair services Your size measurements and style preferences Pages you visit on phageparis.com PHAGE events you attend Requests you make to our customer service department or public relations department

We may also collect data gathered from publicly available sources that is deemed to have been transmitted by you.

If you apply for a job at PHAGE, we may collect the following information:

Your name and contact details Your CV

Personal data requested by PHAGE is specified on the pages where personal data collection forms are located. If you do not complete these mandatory fields, PHAGE will likely be unable to respond to your requests and/or provide the products and services you have requested. Other information is optional and allows us to get to know you better and improve the messages and services we send you.

Channels Through Which Your Data is Collected and/or Received

Within the scope of our interactions, we may need to collect certain data through the following touchpoints:

Interactions with our store consultants Page clicks on phageparis.com Communications with customer service PHAGE events you attend Interactions with our public relations department Forms you fill out (online or in-store), survey or questionnaire forms you complete, or emails you send to us Third-party social media platforms (Facebook, Instagram, etc.) or applications whose use and data sharing you have consented to. You should always be aware that the terms of use and privacy policies of such third-party social media platforms are solely their responsibility. PHAGE social media pages you visit, comment on, or like Third-party data providers with whom you have shared information Search engine advertisements you click on

If you wish, you may contact our sales consultants via WhatsApp, WeChat, or a similar instant messaging application. Our sales consultants will be happy to answer your questions on these platforms. However, PHAGE cannot guarantee that your data or other information shared on these programs will remain confidential and secure, as these platforms are outside PHAGE's control, and PHAGE disclaims all responsibility in this regard.

Such data or information may be sent to locations outside the European Economic Area. For this reason, we recommend that you familiarize yourself with how these applications are used and their personal data protection policies.

Purposes for Which PHAGE Uses Your Data

Within the scope of our interactions and depending on the context in which your data is collected, we may use your data for the following purposes:

To manage your orders and take all necessary measures related to your online transactions, in particular to prevent fraud and payment deficiencies To manage personalized content, advertisements, or other PHAGE messages (online or through other means) To manage your profile To manage your online requests related to the PHAGE company To manage events you have registered for or attended To manage your job applications To manage our website and digital applications To improve our products and services

We may use your data, through third-party services (such as Facebook Custom Audiences, Google Customer Match, or similar services) or in collaboration with third-party social media platforms, to create profiles and manage your user experience in line with your preferences, or to offer you a more personalized experience or advertising related to our products. In this process, we may combine your data, including data we have collected (such as your email address), with your browsing data to conduct targeted advertising.

Such targeting is carried out through the technologies of our third-party partners, which allow us to associate the same user's browsing data across our website, social media platforms, or third-party sites, regardless of device. You may object to these processes by configuring your advertising settings from your social media accounts or by referring to our cookie policy.

Third-party social media platforms:

When acting as data processors (e.g., Facebook Custom Audiences and Google Customer Match), they undertake not to use your data for any other purpose and not to retain it after the processing is complete. When acting as independent data controllers (e.g., Facebook Ads Pixel), they process your data under their own responsibility for legal compliance.

For more information about the tools used by our social media partners:

Google Ads Policy Google Ads Customer Match Facebook Ads Customer Reach About Facebook Ads Pixel

Regarding your job applications, we use your data to manage and track your applications. We retain transaction histories and other sales documents for legal and governmental requirements and for our insurers and audits.

The legal bases for processing your data:

Your consent (e.g., to manage personalized marketing offers or to manage your online session with cookies) The performance of a contract (e.g., processing and tracking your orders, managing access to your customer account) A legal obligation (e.g., retaining sales invoices) Our legitimate interests (e.g., improving our products and services, preventing fraud, securing our tools, personalizing our marketing materials, and generating statistics related to our sales).

Data Retention Period

Your personal data is retained only for as long as necessary to fulfill the current purpose, meet your needs, or comply with our legal obligations. In general, your personal data is kept in our databases only for a reasonable period of time to fulfill the purposes stated above or for the retention period permitted by law.

If you are a customer (i.e., you have purchased a PHAGE product): Your data is retained for a period not exceeding five years from your first purchase. This period is renewed with each interaction with PHAGE (e.g., if you make a new purchase). For prospective customers (i.e., you have never purchased a PHAGE product but are interested in the PHAGE brand): Your data is retained for three years from the date it was collected. This period is renewed with each interaction with PHAGE (e.g., if you attend an event). If you have contacted the public relations department: Retained for a period not exceeding ten years from the date of first contact. This period is renewed with each interaction with PHAGE (e.g., if you request information from the PHAGE company). If you have submitted a job application (i.e., applied for a position advertised by PHAGE): Your data is retained for two years from the date of your application.

If cookies have been installed on your computer, they cannot be stored for more than 13 months.

When your personal data is no longer needed, it is deleted from our systems and records or anonymized in a way that prevents your identification.

Recipients and Transfer of Your Data

Your data is directed to the PHAGE departments that process your requests. We ensure that your personal data is only accessible when authorized and necessary for the purposes stated above. Your data is not shared with third parties for marketing purposes. However, when necessary and where possible in a format that does not directly identify you, your information may be shared in the following circumstances:

PHAGE Affiliates and Related Companies: With other PHAGE affiliates or related companies in order to provide you with the same personalized service worldwide. Trusted Third-Party Service Providers: Other entities within the LVMH Group, acting solely as subcontractors on our behalf and in accordance with our instructions. Service providers delivering products, secure payment and fraud prevention platforms, vendors assisting with event organization, IT service providers, web marketing and public relations agencies, vendors providing customer service support. Payments are managed by CyberSource Corporation. This company is US-based and provides us with services to accept payments, prevent fraud, and secure payment data. Your order details, name, email address, delivery information, phone number, and payment information are shared with trusted providers such as CyberSource and FORTER for fraud screening services. FORTER, as a data controller, may use and process your personal information in accordance with applicable privacy and data protection laws. For more information, you can access FORTER's privacy policy at: FORTER Services Privacy Policy. Management Changes or Legal Reasons: During management changes, for legal reasons, or with your prior consent, with third parties. Third-Party Subcontractors for Interest-Based Advertising: To serve interest-based advertisements based on your use of our website or data collected from you.

Use of Your Social Media Login Credentials: You may choose to log in using your social media credentials. In this case, you will have shared your profile information with us. However, please be reminded that these social networks operate under their own privacy policies.

Cross-Border Data Transfers: When personal data is transferred outside the European Economic Area (EEA), we ensure that adequate protection is provided. When this level of protection cannot be guaranteed, we obtain your prior consent, establish a contractual framework with the recipient, and/or implement the necessary measures to ensure an adequate level of protection abroad.

Measures Taken to Protect the Privacy of Your Data

PHAGE has implemented appropriate technical and organizational measures to ensure that your personal data is protected in a confidential and secure manner against loss, destruction, corruption, unauthorized access, or unlawful disclosure. PHAGE's computer systems are secured with physical and digital protection methods that meet the highest industry standards.

In accordance with French law and European Union personal data protection regulations, procedures are applied to protect data collected through the website both physically and electronically. PHAGE's service providers and contractors are bound by written agreements committing them to implement adequate security measures to protect your personal data in accordance with applicable regulations.

Cross-Border Access and Storage Your data may be accessed, transferred, or stored outside the European Union. This is carried out securely when PHAGE or our trusted service providers' employees need to access your data (for example, a store other than your primary store may access your purchase history, or a trusted service provider may access your data for fraud prevention purposes). All such operations are carried out in accordance with applicable laws, and the utmost care is taken to ensure that third parties comply with the commitments set out in the Privacy Policy.

Employee Confidentiality PHAGE employees who are in positions that allow access to your personal data are required to sign a confidentiality agreement.

Security of Financial Data The financial institution designated by PHAGE stores all financial information you provide through the website in a secure environment. Transactions completed through the website are protected by SSL (Secure Socket Layer) encryption.

Your Rights Under the European General Data Protection Regulation (GDPR)

The following is a summary of the rights you have under this regulation:

• Right to Information You have the right to receive clear, understandable, and transparent information about how your personal data is used and about your rights. All of this information is contained in our Privacy Policy.

• Right of Access You have the right to access the personal data that PHAGE holds about you.

• Right to Rectification You have the right to have your personal data corrected if it is inaccurate or out of date, and to have incomplete data completed.

• Right to Erasure / "Right to be Forgotten" You have the right to request the deletion or destruction of your personal data. However, this right may be limited due to legal reasons or the necessity for PHAGE to retain your data in accordance with its legitimate interests.

• Right to Withdraw from Direct Marketing At any time, you may request to stop receiving messages related to our promotions, news, or events. To do so, you may use the link included in every email sent to you.

• Right to Withdraw Consent for Consent-Based Data Processing If the processing of your data is based on consent, you have the right to withdraw that consent at any time.

You also have the right to contact your country's data protection authority to lodge a complaint regarding PHAGE's data and privacy protection practices.

Contact

If you have any questions about this Privacy Policy or PHAGE's personal data protection practices, or if you wish to exercise any of the rights mentioned above, please contact us at the following email address:

phage@phageparis.com