Furla Privacy Policy

FURLA PRIVACY POLICY

This privacy policy explains how Furla S.p.A., a company established under Italian law, with registered office in Via Bellaria 3/5, 40068 San Lazzaro di Savena (Bologna) Italy, processes your personal data in accordance with European Regulation 2016/679 ("GDPR") and with the local data protection regulations applicable in any country, territory or location in which it operates (together with GDPR, the "Privacy Regulations"). The references to “personal data” in this Privacy Policy also encompass equivalent terms which are used in the Privacy Regulations, such as the term “personal information”.

a) when do we collect personal data?

Your personal data may be collected:

• at one of our stores and/or franchisees integrated in our CRM system (“Point of Sale”), by Furla, and/or any subsidiary and/or affiliated company integrated in our CRM system (“Affiliates”) - Affiliates and Points of Sale shall act as data processors - and

• on our Online Channels (as better defined below),

on the following occasions:

(1) if your personal data is necessary for the purchase of the product you have chosen, through Furla's websites or mobile applications or through any other online channel or social media related to Furla (the "Online Channels") along with the customer service and after-sale support, if the purchase is made through a Furla Online Channel or at a Furla Point of Sale.

(2) if you wish to receive information about our products, services, offers and promotions (Marketing) in accordance with the Privacy Regulations.

(3) if you give your consent to Data Profiling to enable us to personalize your shopping experience in our Points of Sale, on our Online Channels and receive offers in line with your taste and preferences.

b) who is the data controller?

The data controller is Furla S.p.A., with registered office at Via Bellaria 3/5, 40068 San Lazzaro di Savena (Bologna), Italy (“Furla”).

Your personal data may also be processed by our Affiliates and Points of Sale as independent data controllers for the specific purposes provided for by local legislation, for billing purposes and/or for all the activities falling under their competence based on Furla’s corporate global decisions.

c) what are the personal data we collect, the purposes and the legal foundations for data processing?

Your personal data shall be processed for the following purposes and based on the following legal foundations (where these apply under the Privacy Regulations in your territory):

If you have given your consent to both Marketing and Data Profiling (where required under the Privacy Regulations in your territory), the Marketing activity will consider the results of data processing based on the information we have acquired in order to provide you with personalized offers always in line with your taste and preferences.

Furla may also process your personal data deriving from your online browsing history, collected during your visits to our web pages or during your social interactions, by using tracking technologies such as "cookies" (for information on the use of cookies for data collection, see our Cookie Policy.

d) how are your personal data processed and protected?

Your personal data may be processed electronically or in paper form. Furla has adopted appropriate organisational and technical measures to ensure that your personal data is kept secure, confidential and used only for the purposes indicated in this Privacy Policy; Furla also allows you to fully exercise the rights guaranteed by GDPR or the rights provided under the applicable Privacy Regulations in your territory at any time.

Since it is not possible to guarantee security of data transmission over the Internet nor the 100% security of data storage systems, we invite you to avoid sending information more than that which is strictly required by Furla for the purposes described above, as it will be immediately erased.

It is your responsibility to protect your passwords and related access codes to the services offered by Furla, as indicated in the relevant terms and conditions. Furla will never ask you to communicate such information.

e) how long does furla keep your personal data?

Furla shall keep your personal data, collected in order to fulfil a legal obligation, execute a contract and in case of dispute, for a period not exceeding the period necessary for such purposes to be completed and, in any case, not exceeding the statutory limitation periods in your territory, after which it will be destroyed or rendered anonymous.

Furla shall keep your personal data collected for Marketing and Data Profiling purposes for a period of 7 years (as authorized by the Data Protection Authority in Europe) or for the relevant period required by law in your territory after which it will be destroyed or rendered anonymous.

f) is the provision of one’s personal data mandatory or optional and what are the possible consequences if a data subject refuses to provide it?

You must provide your personal data for the purposes indicated in point c) 2. (Performance of the Contract). If you do not give your consent to Furla to the processing of your personal data for said purposes, it will not be possible to proceed with the execution of the contracts and access the related services.

The provision of your personal data for the purposes set out in point c) 4. (Marketing) and 5. and 6. (Data Profiling) is instead optional. The failed provision of this data shall not result in any negative consequence for the data subject.

If you give your consent to Furla to the processing of your personal data for said purposes (where required under the Privacy Regulations in your territory), you reserve the right to withdraw your consent at any time by sending an e-mail to privacy@furla.com.

g) how does furla share the personal data collected; how do furla global services work and with whom outside the eea can your personal data be shared?

Furla shall not disseminate, transfer and/or communicate your personal data to third parties who have not been appointed as data processors; with the exception of external suppliers, who provide consultancy services that require a large degree of operational autonomy and Public Authorities that may require access to the data and will process your personal data as independent data controllers.

Furla may share your personal data with specialized companies carrying out technical and organizational tasks necessary to manage relations with customers on behalf of Furla as data processors. These include companies that provide assistance, payment, shipping or storage services for the purchase of products or documentation relating to customer relations and companies that assess the quality of service and customer satisfaction or carry out marketing and profiling activities on behalf of Furla, including re-targeting activities also on a local basis.

The data you provide online, like your credit card details, will be processed exclusively by external suppliers acting as independent data controllers or data processors on behalf of Furla, according to the service offered.

If you give your consent to the processing of your personal data for Marketing and Data Profiling purposes, your personal data will be included in Furla's CRM database. The CRM data servers are located in Ireland, Microsoft Azure.

The CRM system allows Furla to share your personal data with the Affiliates and/or Points of Sale integrated in the CRM system – the latter being appointed data processors - both inside and outside the country of residence and both inside and outside the EEA. Furla provides its customers with the opportunity to receive offers in line with their interests and needs in all of the countries in which it operates. Your personal data shall be automatically accessible by the staff of the Affiliates and/or of Points of Sale.

For example: if you visit a Furla store in another country, your personal data shall also be accessible in that store, too.

In the case in which your personal data is transferred to countries other than your country of residence or to countries outside the EEA, your personal data shall be protected by appropriate security systems that are constantly updated and maintained in compliance with the applicable Privacy Regulations (e.g. availability of specific agreements on personal data processing and the non-EEA data processors have signed the Standard Contractual Clauses of the European Commission).

You can find a list of the subjects with whom your personal data is shared at the following link.

Where applicable in your territory, you can request a copy of the Standard Contractual Clauses of the European Commission by sending an email to: privacy@furla.com or by visiting the European Commission's website.

h) availability of automated decision making processes, including data profiling

If you give your consent to Data Profiling, Furla may process your personal data using automated tools. Please read carefully the table below to understand the rationale, relevance and expected consequences of this type of data processing:

i) your rights to privacy

Depending on the Privacy Regulations in your territory, you have the right to:

• obtain confirmation of the storage of your personal data (right to access);

• request Furla to have your personal data rectified;

• request that your personal data is erased;

• request that Furla limits the processing of your personal data;

• oppose the processing of your personal data (for marketing and data profiling purposes, such right may be exercised at any time);

• request the portability of your personal data in a structured and machine-readable format and transmit it to another Internet Service Provider;

• oppose being subject to a decision making solely based on automated data processing producing legal effects on the data subject, recalling the always available possibility to rely on the assistance of one of our employees;

• withdraw the consent previously given (in any case, this shall not prejudice the legitimacy of data processing prior to your consent withdrawal).

You have the right to lodge a complaint with the Data Protection Authority and/or other competent supervisory authority if you believe that your personal data have been processed in violation of the Privacy Regulations.

To exercise these rights, you may contact Furla by sending a request to the following e-mail address: privacy@furla.com.

With regard to any matter relating to the processing of your personal data and the exercise of your rights under the GDPR, you may contact the Data Protection Officer at Furla S.p.A., Via Tortona n.37, 20144 Milan (Italy), e-mail address: dpo@furla.com

j) SHARING OF DATA SCHEME (FOR JAPANESE CUSTOMERS)

If you give your consent to the processing of your personal data for Marketing and Data Profiling purposes, your personal data will be included in Furla's CRM database. The CRM system allows Furla to share your personal data with the Affiliates and/or Points of Sale integrated in the CRM system – the latter being appointed data processors – both inside and outside the country of residence and also both inside and outside the EEA. Furla provides its customers with the opportunity to receive offers in line with their interests and needs in all of the countries in which it operates. In particular, your personal data shall be automatically accessible by the staff of the Affiliates and/or of Points of Sale.

For example: if you visit a Furla store in another country, your personal data shall also be accessible in that store, too.

You can find a list Furla Affiliates and/or Points of Sale here.

Furla will share the following personal data: name, date of birth, gender, address, country of residence, nationality, data relating to hobbies, job, interests, purchase data and chronology (e.g. purchased products, place, date and time of purchase, delivery data), products visualized and data regarding your purchase behaviour on our Online Channels.

Furla may process and share the data that you provide through the app for the purposes illustrated in points c) of this Privacy Policy.

Furla S.p.A. is the data controller and the entity in charge of management of the personal data.

k) DATA SHARING SCHEME (FOR AUSTRALIAN CUSTOMERS)

If you reside in Australia, you have a legal right under the Privacy Act 1988 (Cth) to request access to your personal data which is held by us. You also have a right to seek correction (including correction of any errors) of your personal data. If you would like to request access to, or correction of, your personal data, please contact us using our contact details in Section (i) above. If you request access to, or the correction of, your personal data, we will respond to your request within a reasonable period after the request is made. Access to your personal data will be provided in accordance with any applicable laws and is subject to any exemptions which might apply under those laws.

If you believe that we have breached this privacy notice or have otherwise interfered with your privacy, you may write to us with your complaint using the contact details in Section (i) above. We take all privacy complaints seriously and will endeavour to resolve any issues in a timely and fair manner. If you are not satisfied with our response, you have the right to lodge a complaint with the Office of the Australian Information Commissioner.

l) DATA SHARING SCHEME (FOR CANADIAN CUSTOMERS)

If you reside in Canada, you have a right to request access to your personal data which is held by Furla and the right to request its modification (including the correction of any errors). If you would like to request access to, or correction of, your personal data, please contact Furla’s privacy compliance contact point, based in Milan, Via Tortona n.37, 20144 at the following e-mail address: privacy@furla.com. We will respond to your request within a reasonable period after the request is made. To protect against fraudulent requests for access to your personal data, we may ask you for additional information to confirm that the person making the request is you or is authorized to access your personal data. For example, we may require you to verify your identity before you access your personal data. Access to your personal data will be provided in accordance with applicable laws and is subject to any exemptions which might apply under those laws.

We reserve the right to transfer all personal data we have about you in the event of mergers or acquisitions with third parties.

Some or all of the personal data we collect may be sent to or stored on servers located outside of Canada, in particular, in the European Union. Data protection laws in EU or other non- EU countries may differ from those in Canada. As a result, this information may be subject to access requests from governments, courts, or law enforcement in those jurisdictions according to laws in those jurisdictions.

By providing us with personal data, you understand and expressly agree that we may transfer your data outside of Canada or your jurisdiction of residence. If you do not agree to this transfer, we ask that you do not provide us with personal data.

We reserve the right to modify this Privacy Notice at any time. By accessing or using Furla’s website or providing us with your personal data after such changes, the user consents to this Privacy Notice, as amended. Please periodically review this Privacy Notice so that you are continuously updated on the personal data we collect, how we use it, and with whom we share it.

m) DATA SHARING SCHEME (FOR CALIFORNIAN CUSTOMERS)

We provide this section pursuant to the California Consumer Privacy Act of 2018 (“CCPA”) and other California privacy laws.

The CCPA and other California privacy laws provide California residents with specific rights regarding California Personal Information. This section describes the rights California residents have and explains how California residents can exercise those rights.

Access to California Personal Information and Data Portability Rights

California residents may request that we disclose certain information about our collection, use, process and disclosure of their California Personal Information over the past twelve months. If we receive and confirm a verifiable consumer request from a California resident pursuant to the Exercising CCPA Rights section below, we will disclose to that California resident one or all of the following depending on the scope of the request:

• The categories of personal information we collected about that California resident over the past twelve months.

• The categories of sources for the personal information we collected about that California resident over the past twelve months.

• Our business or commercial purpose for collecting that personal information over the past twelve months.

• The categories of third parties with whom we share that personal information over the past twelve months.

• The specific pieces of personal information we collected about that California resident over the past twelve months.

• The categories of personal information about that California resident that we disclosed for a business purpose, to the extent we have made such disclosures over the past twelve months.

Deletion Request Rights

Subject to certain exceptions, California residents may request that we delete the California Personal Information we collected about them. If we receive and confirm a verifiable consumer request from a California resident pursuant to the Exercising CCPA Rights section below, we will delete and direct our service providers to delete that California resident’s California Personal Information, unless an exception applies.

Exercising CCPA Rights

To request that we exercise the access, data portability, and deletion rights described above, please submit a verifiable consumer request to us by emailing us at privacy@furla.com.

We will deliver our written response through email. Any disclosures we provide will only cover the 12-month period preceding the date we receive your verifiable request. For data portability requests, we will select an industry-acceptable format to provide your California Personal Information.

Unless a request is manifestly unfounded or excessive, we will not charge a fee to process or respond to your verifiable consumer request. If we determine that a request is manifestly unfounded or excessive, we will tell you why we made that decision and reserve the right to either refuse to act on your request or charge you a reasonable fee to complete your request.

In order to protect your California Personal Information, please note that:

• only you or an authorized agent registered with the California Secretary of State that you authorize to act on your behalf, may make a verifiable consumer request related to your California Personal Information.

• you may only make a verifiable consumer request for access or data portability twice within a 12-month period.

• the request must provide sufficient information that allows us to reasonably verify you are the person about whom we collected California Personal Information or an authorized representative.

• the description of the request must provide sufficient detail that allows us to properly understand, evaluate, and respond to it.

We cannot respond to your request or provide you with California Personal Information if we cannot verify your identity or authority to make the request and confirm the California Personal Information relates to you. Although you may use an authorized agent to submit a request to opt-out on your behalf, we may deny a request from an authorized agent that does not submit proof with the request that they have been authorized by you to act on the consumer’s behalf.

You are not required to create an account with us to make a verifiable request. We will only use California Personal Information provided in a verifiable consumer request to verify the requestor's identity or authority to make the request.

As described above, where we are processing personal information received from or collected on behalf of our business customers, we may act as a “service provider” as defined in the CCPA and have no direct relationship with the individuals whose personal information we process under these circumstances. If we receive your personal information from or on behalf of one of our business customers or if we process your personal information on behalf of one of our business customers and you would like to make an inquiry or complaint, please contact the business customer that you interact with directly.

Direct Marketing Disclosure Request Rights

California residents who have an established business relationship with us may request information regarding third parties, if any, to whom Furla may have disclosed personal information (as defined by Cal. Civ. Code § 1798.83(e)(7)) for the direct marketing purposes of those third parties during the preceding calendar year. Any such disclosures that we may have made over the prior calendar year are not inconsistent with our statement that we do not and will not ‘sell’ your California Personal Information as the CCPA defines ‘sell’. Any disclosures we make are invariably done with your knowledge or following your request that we do so.

If you have questions about how Furla complies with applicable California privacy law, would like to submit a request, or would like to make a complaint about this notice, please contact us via email at: privacy@furla.com

Affiliates integrated in furla CRM system

Points of sale integrated in Furla CRM system

To receive a list of all data processors, send a request to the following e-mail address: privacy@furla.com

Privcay policy updated on March 11^th, 2025

CONSENT TO THE PROCESSING OF YOUR PERSONAL DATA

This registration confirms that I have read and understood this Privacy Policy and that I am at least 16 years old.

I give my consent to the collection, processing and transmission of my personal data abroad in compliance with this Privacy Policy:

- for Marketing Purposes (including the receipt of newsletters and information on events, discounts, invitations to events, greetings messages and exclusive promotions regarding Furla products and services both by automatic means such as e-mail, text messages and social media and by telephone contact on fixed or mobile networks)

□ Yes □ No

If you want to have your preferences about the communication channels rectified, please write to the following address: privacy@furla.com

For Data Profiling activities (analysis of purchase habits for the purpose of receiving personalized offers based on my interests or, in case of combined consent to Marketing activities, the receipt of personalized marketing promotions).

□ Yes □ No

I understand that I reserve the right to withdraw my consent at any time by sending an e-mail to privacy@furla.com and that, given the global reach of this programme, my personal data may also be processed in locations outside my country of residence.

[A1]To include in paper cards