1. Name and contact details of the controller

This privacy policy applies to data processing by the

bonprix Handelsgesellschaft mbH,

Haldesdorfer Strasse 61, 22179 Hamburg

Phone: 040 - 64 62 321

E-mail: service@bonprix.net

Management:

Dr. Torben Hansen (Chief Executive Officer, Managing Director Sales), Dr. Kai Heck, Carolin Klar, Matthias Wlaka

2. Contact details of the data protection officer

You can contact our company data protection officer at

bonprix Handelsgesellschaft mbH,

Data Protection Officer

Haldesdorfer Straße 61

22197 Hamburg

E-mail: datenschutz@bonprix.net

3. Purposes of data processing, legal bases and legitimate interests pursued by the controller or a third party and categories of recipients

In the following, we present the data processing for which we are responsible in detail, structured according to the purposes of the data processing and the categories of recipients.

3.1. Provision of Company Information

On our corporate pages accessible at www.bonprix.de/corporate we provide you with the possibility to find out more about our company and our company activities and download the press releases provided by us in our press download area.

3.2. Online presence and website optimization (using cookies) including consent

Brief summary

As the operator of http://www.bonprix.de/corporate/ bonprix collects data on the behaviour of users on http://www.bonprix.de/corporate/ (tracking data). This includes, among other things, which individual sub-pages have been called up. For this purpose, bonprix and/or partners of bonprix may, among other things, set cookies in the browser used by the respective user. The collection of tracking data is only permissible if you have given your prior consent (§ 25 (1) TDDDG). You can give such consent by clicking on the "OK" button in the "Cookie Banner" displayed on http://www.bonprix.de/corporate/. However, the granting of consent is not necessary for the processing of such tracking data which is required for the offer of the website http://www.bonprix.de/corporate/ (§ 25 (2) TDDDG). This includes, for example, the setting of cookies for the purpose of displaying the shopping basket. The information about your usage behaviour can be used by bonprix, among other things, to show you interesting offers on http://www.bonprix.de/corporate/ or to advertise for you on other websites by means of personalised content (e.g. retargeting). Insofar as personal data about your usage behaviour on www. bonprix.de can also be used by other providers, e.g. for the purpose of "enriching own information", such use will also only take place in these cases if you have consented to this beforehand. In these cases, the further processing of the data collected on bonprix.de regularly takes place under the sole responsibility of the providers. The providers may transfer the data to the USA within the scope of this further processing. With regard to the USA, the European Court of Justice has determined that this is a country with an insufficient level of data protection. In this context, there is a particular risk that your data will be processed by American institutions/authorities for control and monitoring purposes without you having an adequate legal remedy against this. Tracking data that bonprix collects and stores itself is processed by bonprix exclusively in pseudonymised form. This prevents an allocation of the data to your person. If you would like to delete individual cookies set in your browser or would like to find out which service providers / suppliers have set cookies in your browser, you can do this via a "preference manager". Such a preference manager is available, for example, at www.youronlinechoices.com. You also have the option of setting your browser in such a way that it prevents cookies from being set or only allows certain types of cookies to be set. Details on the possibility of changing the settings of common browser types (including Google Chrome, Firefox) can be found in section 3.4.2. of this information on data protection.

3.2.1. Cookies - General information and consent requirement

Cookies are used on this website. Cookies are small text files that are automatically created by your browser and stored on your end device (laptop, tablet, smartphone or similar). Information is stored in the cookie that is related to the specific end device used. This does not mean, however, that we gain direct knowledge of your identity. Some of the cookies we use are deleted at the end of the browser session (so-called session cookies). Other cookies remain on your device and enable us to recognise your computer the next time you visit us (so-called permanent or cross-session cookies). These cookies in particular serve, among other things, to make our offer more attractive to you. Thanks to these files, it is possible, for example, for you to receive information on this website that is specifically tailored to your interests.

According to the legal requirements, the storage of information on end devices (desktops, mobile phones, tablets, etc.) - e.g. by setting cookies - as well as the retrieval of information from end devices (tracking) is only permitted if you have given your prior consent. The legal basis for this is § 25 (1) TDDDG. However, consent does not have to be granted if such storage/retrieval is necessary for the website offering. The legal basis for this is § 25 (2) (2) TDDDG. Necessity is given, for example, with regard to ensuring the following functionalities / achieving the following purposes:

• Transfer of information from input fields

• Ensuring system security

• Provision of content

• Compliance with legal requirements

• (including documentation of the granting / revocation of tracking opt-ins)

• General audience analysis

With regard to data processing that is necessary for the operation of the website, you do not have the right to object.

You can use the bonprix.de website without data being retrieved from or stored on your end device for purposes that are not necessary for the offer of this website. For this reason, only "basic tracking" is activated when you use this website - insofar as you do not give any further consent.

3.2.2. Intervention options / browser settings

Of course, you can set up your browser so that it does not store our cookies on your hard drive in the future or deletes cookies that have already been stored. To do this, proceed as follows:

In Internet Explorer:

1. select "Internet Options" in the "Tools" menu.

2. click on the "Privacy" tab.

3. Now you can make the security settings for the Internet zone. Here you can set whether and which cookies should be accepted or rejected.

4. confirm your settings with "OK".

In Firefox:

1. In the "Tools" menu, select "Settings".

2. Click on "Privacy".

3. In the drop-down menu, select the entry "Create according to user-defined settings".

4. now you can set whether cookies should be accepted, how long you want to keep these cookies and add exceptions, which websites you always or never want to allow to use cookies.

5. Confirm your settings with "OK".

In Google Chrome:

1. click on the Chrome menu in the browser toolbar.

2. Now select "Settings".

3. Click on "Show advanced settings".

4. Click on "Content settings" under "Privacy".

5. Under "Cookies" you can make the following settings for cookies:

• Delete cookies

• Block cookies by default

• Allow cookies by default

• Delete cookies and website data by default after closing the browser

• Allow exceptions for cookies from certain websites or domains.

In Safari:

1. go to "Settings" and select "Safari "

2. Under the topic "Privacy & Security" you will find the option "Always block cookies" under the item "Block cookies".

If you would like to delete individual cookies set in your browser or find out which service providers / suppliers have set cookies in your browser, you can also do this / find out via a "preference manager". Such a preference manager is available here, for example.

If you would like to delete individual cookies set in your browser or find out which service providers / suppliers have set cookies in your browser, you can also do this / find out via a "preference manager". Such a preference manager is available here, for example.

3.2.3. Consent management with the Hurra Consent and Tag Manager

We use a so-called consent and tag management tool (in the following "Privacy Center") of Hurra Communications GmbH, Wollgrasweg 27, 70599 Stuttgart to manage your settings and to document the consent of users of our services. The Privacy Center of Hurra is used, among other things, to store the cookie settings for the entire website. With the help of the Privacy Center, we store information about the categories of cookies as well as single vendors used by the website and whether users have given or revoked their consent to the use of each category or vendor. This allows us to prevent cookies from being set in each category or for a vendor in the user's browser if consent is not given for individual categories or vendors. The consents documented in this way via our Privacy Center have a lifespan of one year, so that the settings of returning visitors are saved.

You can view more information about your consent in our Privacy Center. Here you can also change your cookie settings.

3.2.4. Consents to the use of individual online services/the collection of tracking data

As already explained on the subject of cookies (section 3.4.1.), we collect and process data collected in connection with the use of cookies partly on the basis of your consent. You give this consent by clicking the "Ok" button on the banner displayed in our online shop that links to this consent text. By doing so, you give your consent for bonprix to store data on your end device (e.g. by setting cookies) or to retrieve data from your end device. Furthermore, by clicking on the "OK" button you give your consent to the use of certain advertising functionalities of third party providers whose use is in itself subject to consent. You also have the option of clicking "Settings" in the banner and managing your consent preferences there. You can subsequently change your consent and preferences at any time in our Privacy Center. A distinction is made there between "necessary cookies", "analytical cookies", "personalised cookies" and "marketing cookies". Any data processing that we carry out in connection with these advertising functionalities is described below.

All data processing covered by the consent given by you by clicking on the "OK" button serves the same purpose, namely that of "advertising".

Revocation of all consents

You can revoke all consents that you have given by clicking on the "OK" button shown in the banner at any time here.

3.2.4.1. Technically necessary cookies / necessary (no consent required)

These are technical cookies that are necessary for the proper functioning of our website and all the functions it offers. Among other things, they are responsible for integrating security functionalities, enabling of page display or saving your privacy settings. Your consent is not required for the use of absolutely necessary cookies on our website. For this reason, technical cookies cannot be individually deactivated or activated.

The legal basis for this data processing is Article 6 (1) (f) GDPR (legitimate interest).

3.2.4.1.1. mPulse (analysis tool from AKAMAI)

Bonprix uses the mPulse analysis tool from Akamai Technologies, GmbH ("Akamai") in order to be technically able to react to high load distributions and to protect the shop from attacks by third parties.

These technologies use cookies (text files) and beacons (graphic files), which are stored on your computer and which enable your use of the website to be analysed. The information generated by the cookies or beacons about your use of this website is transferred to Akamai servers in the USA and stored there. Akamai will use this information for the purpose of evaluating your use of this website for us in pseudonymised form, compiling reports on website activity for us and providing other services relating to website activity and internet usage to the website operator, including the protection of this website from unauthorised access, such as DDoS attacks. Akamai may also forward this data to third parties if Akamai is obliged to do so for legal reasons or if these third parties process this data on behalf of Akamai. Akamai will not use the data to identify individuals.

You can find more information on data protection at mPulse at https://www.akamai.com/legal/privacy-statement

The legal basis for this data processing is Article 6 (1) (f) GDPR (legitimate interest) and Section 25 (2) (2) TDDDG.

You can prevent the placement of cookies by mPulse by selecting the appropriate settings on your browser.

3.2.4.1.2. Hurra - Consent & Tag Manager

As already described in section 4.3, bonprix uses the consent and tag management tool of Hurra Communications GmbH, Wollgrasweg 27, 70599 Stuttgart, Germany, for consent management. In order to offer this service and to be able to ensure that cookies are set correctly in accordance with your consent, the provider sets cookies on your end device.

The legal basis for this data processing is Article 6(1)(f) GDPR (legitimate interest) and Section 25(2)(2) TDDDG.

You can find more information about the consent you have given in our Privacy Centre. You can also change your cookie settings here.

3.2.4.2. Consent for analysis cookies

Analytical cookies allow us to measure the performance of our website and our advertising campaigns. With their help, we determine the number of visits and the origin of the visits that come to our website. We process the collected data in aggregated form, so it is not possible to draw conclusions about a specific user of the website. If you deactivate the use of analytical cookies, we will not be able to analyse the performance of our website and optimise it for your visit.

The legal basis for this data processing is Article 6(1)(a) DSGVO (consent).

Revocation of the analysis cookies

You can revoke your consent to this category of data processing at any time here.

3.2.4.2.1. Consent for Google Analytics

For the purpose of the needs-based design and ongoing optimisation of bonprix.de and to support our marketing activities, data processing is carried out by Google Analytics on the basis of your consent granted. Google Analytics is a web analysis service of Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google"). Google Analytics uses so-called "cookies" (text files) which are stored on your terminal device and which enable an analysis of your use of the website.

To ensure the principle of data minimization, we use the so-called Server-Side Google Tag Manager (sGTM), a technology that enables us to manage and execute tags and tracking scripts on our server. This technology offers us the opportunity to increase data security and improve control over the data collected. The sGTM acts as a so-called proxy solution between our website and the third-party providers (e.g. Google) with whom we work. In this way, we can ensure that your user data (tracking data) is not sent directly to the third-party providers, but is anonymized and filtered before being forwarded to third-party providers.

The processing of the data after their transmission by bonprix to Google Ireland Limited shall be carried out by Google as the sole data protection controller. In this context, Google Ireland Limited as the sole data controller may store data about you in the USA. The European Court of Justice has determined with regard to the USA that it is a country with an insufficient level of data protection. In this context, there is a particular risk that your data will be processed by American institutions / authorities for control and monitoring purposes, without you being given an adequate legal remedy against this.

We have activated Google Signals in Google Analytics. If you have agreed to personalised ads in your Google account, the existing Google Analytics functions are updated with data that is summarised and anonymised for us. The reports help us to better assess the behaviour, wishes and interests of our customers. This allows us to optimise and adapt our services and products for you.

This is cross-device tracking. Which means that your data can be analysed across devices. By activating Google Signals, data is collected and linked to the Google account. Google can thus recognise, for example, if you view a product on our website via a smartphone and buy it later via a laptop. From this and other data, it is then possible to create target groups for us. Thanks to the activation of Google Signals, we can then launch cross-device marketing campaigns, for example, which would otherwise not be possible in this form.

Please note that this data collection only takes place if you have allowed personalised advertising in your Google Account. This is always aggregated and anonymised data and never the data of individual persons. You can manage or delete this data in your Google account.

The legal basis for this data processing is Article 6 (1) (a) GDPR (consent).

Revocation

You can revoke your consent to this data processing at any time by deselecting Google Analytics in our Privacy Centre.

3.2.4.2.2. Consent for Hurra Analytics

This website uses technology from Hurra Communications GmbH, Wollgrasweg 27, 70599 Stuttgart (www.hurra.com) to collect and store data about your usage behaviour on our website for optimisation and marketing purposes. This data is used to analyse the behaviour of visitors and to create pseudonymous user profiles. For this purpose, cookies are used which enable the recognition of an internet browser on a repeat visit. However, the usage profiles collected by hurra.com technology are not merged with personal data about the bearer of the pseudonym without the explicit consent of the visitor. The IP addresses of visitors are shortened before storage, so that a personal reference is excluded and a combination of usage profiles with IP addresses is no longer possible.

The legal basis for this data processing is Article 6 (1) (a) GDPR (consent).

Revocation

You can revoke your consent to this data processing at any time by deselecting Hurra Analytics in our Privacy Centre.

3.2.4.3. Consent for cookies for personalization

We also use tracking data to adapt our shop to the needs and interests of our customers and thus provide you with a special shopping experience. By using personalised cookies, we can prevent you from being shown unwanted information such as inappropriate product recommendations or non-usable special offers. Furthermore, the use of personalised cookies allows us to offer you additional functionalities, such as product recommendations tailored to you.

Currently, no cookies are used for personalization purposes.

Revocation of cookies for personalisation

You can withdraw your consent to this category of data processing at any time here.

3.2.4.4. Consents for cookies for marketing purposes

Advertising cookies are used by us or our partners to show you relevant content or advertising both on our sites and on third-party sites. This allows so-called pseudonymous profiles to be created based on your interests. A direct identification of your person is usually not possible through this information, as only pseudonymised information is used. If you do not allow these cookies, you will receive less relevant content and advertising tailored to your interests.

Currently, no cookies are used for marketing purposes.

Revocation of cookies for marketing purposes

You can revoke your consent to this category of data processing at any time here.

3.4. Contacting us

Under the heading "Contacts" as well as in selected places in our corporate pages we offer you ways of contacting us. All personal data voluntarily provided by you in the course of your contact enquiry will be used exclusively to process your enquiry.

The legal basis for this data processing is Article 6 (1) (a), Article 6 (1) (b), Article 6 (1) (c) GDPR and Article 6 (1) (f) GDPR.

3.5. Corporate News

On our corporate pages, you also have the opportunity to register for our Press mailing List via corporate@bonprix.net (“Corporate News”).  If you register, you will receive topic-related Corporate News, which keeps you informed about important and interesting news and developments at bonprix. For this purpose, we collect your name, your publishing affiliation and your e-mail address with your consent. After submitting your registration, you will receive a confirmation email asking you to confirm your registration once again. Only after your final confirmation you are registered for receiving Corporate News(so-called double-opt-in procedure).

The legal basis of the processing is Article 6 (1) (a) GDPR.

Right of withdrawal

Of course, you can revoke your consent at any time at corporate@bonprix.net or with effect for the future, without incurring any costs other than the transmission costs according to the basic rates.

3.6 Fashion-Newsletter

On our corporate pages, we also offer you the opportunity to subscribe to our fashion newsletter at presse@bonprix.net. If you register, you will receive our newsletter on interesting and important developments in the fashion industry. For this purpose, we collect your name, your publishing affiliation and your e-mail address with your consent. After sending your registration, you will receive a confirmation email from us asking you to confirm your registration again. Only after this confirmation are you registered for the newsletter (so-called double opt-in procedure).

The legal basis for the processing is Article 6 paragraph 1 letter a) DSGVO.

Right of withdrawal

Of course, you can revoke your consent to receive our Fashion News at any time with future effect by emailing presse@bonprix.net, without incurring any costs other than the transmission costs at the basic rates.

4. Social media marketing and social plugins

Of course, you will not only find bonprix on our website. We also use various social media channels to specifically promote our company.

4.1. Social Media Marketing

For this purpose, we maintain our own corporate presences on Facebook, Pinterest, Instagram, Youtube, LinkedIn, XING und Kununu.

The underlying promotional purpose is to be regarded as a legitimate interest within the meaning of the GDPR. The responsibility for data protection-compliant operation is to be ensured by their respective providers.

The purpose and scope of the data collection and the further processing and use of the data by the respective provider as well as your rights in this regard and setting options for protecting your privacy can be found in the respective data protection information of the provider, which we link to below.

• Facebook and Instagram (Meta)

• X

• Youtube und Google+

• Pinterest

• LinkedIn

• XING und Kununu

You also have the opportunity to contact us directly via comments and chats on our social media company page and to recommend products to your friends. Furthermore, we offer the opportunity to participate in our attractive competitions at regular intervals. You can find more information on this topic under the item "Competition".

By logging out of the pages of social networks beforehand and deleting cookies that have been set, you can prevent social networks from assigning information about your visit to our site to your user account with the respective social network.

Unless otherwise stated below, the legal basis for this processing is Article 6 (1) (f) GDPR.

Unless otherwise stated below, we do not make any further use of your data and information.

4.2. Social Plugins

Our website uses so-called social plugins ("plugins") from various social networks to make the online shop personally usable. We offer you the opportunity to share our products and content on social networks such as Facebook, Pinterest or Instagram.

4.2.1. Facebook "Share"

Plugins of the social network Facebook by Meta Platforms Ireland Limited, 4 Grand Canal Square, Dublin, Ireland ("Meta") are integrated on this website. You can recognise the Facebook plugin by the "f" on our page.

If you click on the "Facebook button" while you are logged into your Facebook account, you can link the content of our pages to your Facebook profile. This allows Meta to associate your visit to our pages with your user account. We would like to point out that we have no knowledge of the content of the transmitted data or its use by Meta. Further information can be found here in the Facebook privacy policy.

4.2.2. X-Share (former Twitter)

A X button (X share button) by Twitter International Unlimited Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07 Ireland, is also used on this website. You can use this button to share content from bonprix.de/corporate via the X application. The button is a hyperlink. When the button appears on this website, no personal data is transmitted to the operator of X or other third parties. As soon as you use the X button, the operator of X learns what content is being shared and that the button has been used on this website. More information on the handling of personal data by the operator of X can be found here in the operator's privacy policy.

5. Data processing for application purposes

If you are interested in bonprix as a potential employer, you have the opportunity to find information about open positions and application possibilities on our website under the "Careers" section. Here, we also provide you with the option to apply directly online through our application form. Necessary data that we require for processing your application will be marked with (*) and explained on the spot. All personal data provided to us during your application will be used exclusively for the purpose of conducting the application process. If you are applying for an internationally advertised position, the data you provide will be processed jointly within the bonprix Group (bonprix Handelsgesellschaft mbH and its subsidiaries). We will store your data for 6 months or, if you have given us your consent, for a maximum of 2 years from the receipt of your application to cover future vacancies. You can find further information in our specific privacy notice for applicants here [PG1].5. Data processing for application purposes

If you are interested in bonprix as a potential employer, you have the opportunity to find information about open positions and application possibilities on our website under the "Careers" section. Here, we also provide you with the option to apply directly online through our application form. Necessary data that we require for processing your application will be marked with (*) and explained on the spot. All personal data provided to us during your application will be used exclusively for the purpose of conducting the application process. If you are applying for an internationally advertised position, the data you provide will be processed jointly within the bonprix Group (bonprix Handelsgesellschaft mbH and its subsidiaries). We will store your data for 6 months or, if you have given us your consent, for a maximum of 2 years from the receipt of your application to cover future vacancies. You can find further information in our specific privacy notice for applicants here.

The legal basis for processing your applicant data is Article 88(1) of the GDPR in conjunction with Section 26 of the BDSG, or for internationally advertised positions, Article 6(1)(b) of the GDPR. The legal basis for storing your applicant data beyond that is Article 6(1)(a) of the GDPR.

6. Compliance Whisleblower Portal

Our corporate pages also guide you to the Otto Group's digital whistleblower portal “SpeakUp!”, where you can report potential violations of legal or internal regulations directly, confidentially and, if you wish, anonymously, 24 hours a day and worldwide.

The legal basis for this processing is Art. 6 para. 1 lit. c) GDPR in conjunction with § 10 Whistleblower Protection Act (HinSchG).

Further information can be found in our special data protection notice for whistleblowers here.

7. Recipients outside the EU

With the exception of the processing operations for which we inform you about the possibility of transferring data to recipients based outside the EU in this privacy policy, we do not transfer your data to recipients based outside the European Union or the European Economic Area. The data transfers take place on the basis of so-called standard contractual clauses of the EU Commission.

8. Duration of storage

The duration of the storage of the data collected about you depends on the purpose for which we process the data. The data is stored for as long as is necessary to achieve the purpose for which it was collected. Insofar as we have to store certain categories of data for a certain period of time due to legal obligations (e.g. obligations under tax law), the continued storage of the data after its storage is no longer necessary for the achievement of the respective purpose is exclusively for the purpose of fulfilling the legal obligation. In this case, the data will be blocked for access.

Exemplary naming of storage durations

Data in the customer account: Unlimited storage of master data in case of customer activity. The customer account is deleted after 6 years of inactivity.

Data in the group's internal credit agency: Basically 3 years. Information on outstanding claims for remuneration is deleted when these have been fulfilled. Insofar as these are not fulfilled, the continuation of storage is reviewed after 4 years.

Use of data for marketing purposes (without tracking): 6 years.

Consents: Permanent storage as long as the consents are used continuously (e.g. permanent sending of email newsletters).

Information on the use of data for third-party advertising purposes for the purpose of providing information: 2 years.

Tracking data: 2 years.

Chat logs: 6 months.

Data for the purpose of implementing (advertising) objections: Unlimited storage.

9. Your rights as a data subject

You have data subject rights in connection with the processing of personal data by us. For example, you have the right to request information about the data we have stored about you. You can also revoke any consent you have given us and object to individual data processing. You also have the right to have incorrect data corrected and to request that we send you certain data in a standard electronic format. You also have the right to have the data we hold about you deleted. Please note in this regard that we may be obliged for legal reasons to continue to store the data despite the assertion of your right to deletion. In addition, in individual constellations we have an interest in continuing to store your data that outweighs your interest in its deletion (e.g. if we still have outstanding claims against you).

10. Your rights in detail

In addition to the right to revoke your consent given to us, you have the following further rights if the respective legal requirements are met:

the right to information about your personal data stored by us (Article 15 GDPR), in particular you can request information about the processing purposes, the category of personal data, the categories of recipients to whom your data has been or will be disclosed, the planned storage period, the origin of your data if it has not been collected directly from you;

the right to have inaccurate data corrected or to have accurate data completed (Article 16 GDPR);

the right to delete data stored by us (Article 17 GDPR), insofar as no legal or contractual retention periods or other legal obligations or rights to further storage are to be observed by us (e.g. if we still have outstanding claims against you);

the right to restrict the processing of your data (Article 18 GDPR), insofar as the accuracy of the data is disputed by you, the processing is unlawful, but you refuse its erasure; the controller no longer requires the data, but you need it to assert, exercise or defend legal claims or you have objected to the processing in accordance with Article 21 GDPR;

the right to data portability (Article 20 GDPR), i.e. the right to have selected data stored by us about you transferred in a common, machine-readable format, or to request the transfer to another controller;

the right to lodge a complaint with a supervisory authority. As a rule, you can contact the supervisory authority of your usual place of residence or workplace or our company headquarters.

You can assert the aforementioned rights to which you are entitled vis-à-vis us via our customer service by post at bonprix Handelsgesellschaft mbH, Haldesdorfer Str. 61, 22179 Hamburg, Germany, subject “Corporate” or by e-mail at corporate@bonprix.net.