The website Chrono.Shop is owned by JTC SA, headquartered at Rue des Musées 58, La Chaux-de-Fonds, Switzerland.

This Data Protection Information provides details about the processing of your personal data in connection with the offer and provision of our services (also referred to as "services"). It specifically concerns your use of our online presences, such as our websites, mobile applications (the "apps"), and other digital platforms (collectively, our "online platforms"), your visits to our stores, participation in events, contacts with our customer service, and interactions with us on social networks. It also informs you about our use of cookies and other technologies, as well as the rights you have under data protection legislation and corresponding contact possibilities.

In the context of other contacts or data processing, different or additional data protection information (including that of third parties) may apply. In these situations, please consistently read the Data Protection Information provided at the time of contact.

1. DATA CONTROLLERS AND CONTACT ADDRESSES

We place special importance on the responsible handling of our clients' data. We continuously make necessary changes to protect your personal data in accordance with current data protection legislation.

JTC SA is responsible for processing your personal data on the website www.Chrono.shop.

• JTC SA
• Rue des Musées 58
• CH-2300 La Chaux-de-Fonds
• Switzerland

The website Chrono.shop is owned by JTC SA, headquartered at Rue des Musées 58, La Chaux-de-Fonds, Switzerland. In this Privacy Policy, we use the term JTC SA (as well as "we", "our", and "us") to refer to the headquarters of JTC SA at the address mentioned above, as well as its affiliated companies and online stores.

If you have questions regarding our processing of your personal data and associated rights, or if you have suggestions to communicate, you can at any time send an email to the relevant data protection contact or, where appropriate, to the data protection officer at privacy@jtc.eu or contact them by mail at the address mentioned above, adding "Data Privacy".

2. SCOPE, PURPOSES, AND LEGAL BASES FOR PROCESSING YOUR DATA

Personal data is processed as part of your use of our services and associated features that we make available to you. Personal data refers to all individual data concerning you personally or that can be attributed to you (hereinafter also referred to as "Data"). This includes, for example, your name, address, email address, telephone number, or other information from your identity document. Information that does not allow the identification of a physical person does not constitute personal data.

We process personal data in compliance with current data protection legislation (e.g., the Swiss Federal Data Protection Act (DPA), the General Data Protection Regulation (GDPR), or the UK Data Protection Act of 2018) and other applicable local laws and regulations.

Processing refers to any handling of personal data, including collection, recording, organization, structuring, anonymization,
use, transfer, or deletion.

The processing of your personal data can only occur based on a valid legal principle. The processing of your data may be based, among others, on the following legal principles:

Fulfillment of a contract or implementation of pre-contractual measures: We require certain data from you, particularly for establishing or executing your contractual relationships with JTC SA.
Preservation of legitimate interests: JTC SA will process certain data to protect its own interests or those of third parties, provided your interests as the concerned person do not outweigh in each specific case.

Consent: We will need your prior consent to process certain data. You may revoke this consent at any time with future effect.
Compliance with a legal obligation: Furthermore, we process your personal data to comply with certain legal obligations, for example, provisions related to anti-money laundering or commercial and tax storage obligations.

The provision of certain data may be necessary within the framework of executing certain services. We will appropriately indicate which data is required in each case (e.g., using the notation *mandatory fields). In the absence of this personal data, we are generally unable to provide our services to you. Additionally, you might voluntarily provide us with information that is not strictly essential for placing and executing your orders. Such voluntary information is stored based on our legitimate interests.
Specifically, we process your personal data when using our services for the following purposes and on the basis of the following legal grounds:

2.1 EXECUTION OF ORDERS AND CONTRACTS

For the preparation, execution, and processing of our services and contracts (purchase or service requests, orders (including as a guest), purchases, exchanges, purchases using vouchers, implementation, repair and maintenance, exchange, registration on product wish and wait lists, organizing contests, events, and receptions, appointment scheduling, concierge services, etc.), and the communications we conduct with you in this regard, we collect your personal data and process it in our database. This particularly includes processing your data for accounting and payment processing, customer advice, goods delivery, returns, and processing of any guarantees/claims and mutual legal claims.

The information we collect about you generally includes your contact details (particularly your title, first and last name, address, phone number, and email address), as well as essential data related to the service provided (e.g., desired goods, product data, order data, purchase contract data, service data) and payment data (particularly billing address, payment method, payment details, and bank account data used for the purchase). We collect data directly from you when you place an order or during the conclusion and processing of a contract in one of our branches, or in case of corresponding requests via our online platforms (e.g., via contact forms or instant messaging) or by email, phone, Messenger, or mail. To the extent necessary to allow us to perform our services, we transmit certain contact and order or contract data to third parties (see section 6).

In the context of concluding and executing certain orders/contracts (e.g., custom engravings, downloading information and documents into your customer account), it may happen that you transmit third-party personal data to us. You are responsible, in this regard, for the legality of transmitting this information to the concerned JTC SA company. We process these data solely to perform the services you entrust to us.

The basis for the above-mentioned data processing is the preparation

The execution of a contract or the preservation of legitimate interests of JTC SA or a third party.

2.2 PAYMENT, SHIPPING, AND INSURANCE

Depending on the contractual partner of your order, we collaborate with providers listed under "Payment" or "Shipping" in the footer of the website for the respective country for processing payments and shipments. In this context, we transmit your payment data and contact details to the concerned providers for the purposes of payment processing and shipping. For example, for certain types of delivery, we transmit the email address and/or phone number you provided during your order to the carrier for tracking or approval of delivery time (particularly in case of Express delivery). We do not store any payment data ourselves.
Specifically, we may offer you insurance solutions on our online platforms, to be subscribed directly with various providers. In this context, we transmit to the concerned provider the information provided for subscribing to the desired insurances.

Please also review the applicable security or privacy notices of these third-party providers.
This data processing is generally based on the execution of a contract concluded with you or on our legitimate interest. We have a legitimate interest in enabling communication between you and the concerned provider to ensure proper handling of the concerned contract. In principle, you have the right to object to the processing of your data based on our legitimate interest. In this regard, please refer to section 8 and send an email to the contact details mentioned in section 1.

2.3 CONTACT AND CUSTOMER SERVICE

We collect and process data in the context of contact and customer service as well as other interactions between you and us. The collected information includes your basic data and contact details (title, name, address, date of birth, email address, phone number), any additional data voluntarily provided (e.g., your interests and preferences concerning our product range; favorite brands, models, and materials; allergies to precious metals; preferences for hospitality; hobbies; information about family events such as your wedding date and significant dates of your loved ones; nationality; event participation; social media profiles) as well as your responses to contact activities and JTC SA's commercial and other business data (reservations, orders, purchases, exchanges, repairs, goods, prices, point of sale, time, etc.) transmitted and recorded in-store or by email, phone, or electronically (e.g., via Messenger or social networks).

We use this data to contact you in this context, offer you the best advice for your purchases on our online sales site, evaluate it for internal analysis or personalized marketing purposes, and, based on this information, send you targeted advertising in accordance with legal provisions, by email, mail, phone, or Messenger (please refer to section 3 for this).

If the legal basis for data processing in the context of contact and customer service is not the preparation and execution of a contract or the preservation of the legitimate interests of JTC SA or a third party, it is based on your consent. Your consent is valid until revoked. You can revoke your consent at any time with future effect (see section 3).

2.4 VISITS TO ONLINE PLATFORMS

During your visits to our online platforms, information such as the IP address of the connecting device, the name of the web page/file accessed, the website from which you visit the online platform (referrer URL), the date and time of the server request, the type and version of the browser, the operating system of the connecting device, and the search term used to find the website, for example via Google, may be stored.

We process this data based on our legitimate interest in making the online platforms available and securing the technical operation and the security of our computer systems. In this regard, we rely on our interest in allowing the uninterrupted use of our online platforms and their technical features. This data is processed automatically upon accessing our online platforms. We do not use this data to deduce your identity.

In principle, automatically collected data is deleted after 14 days, unless there is a legal basis for retaining it longer. In this case, we will delete the data as soon as the other legal basis no longer applies.

We cannot comply with an objection regarding the collection and storage of server log data because these data are absolutely essential for the proper functioning of the online platforms.

We also reserve the right to analyze and process data related to your use of the platform using cookies and other tracking technologies (in this regard, please refer to points 2.9-2.11 and our Cookie Guidelines) and, where technically possible, to link these data to an existing user profile (see point 2.8 below).

2.5 CUSTOMER ACCOUNTS AND LOGINS

Our online platforms offer you the possibility to create a personalized and password-protected customer account or, as far as your social networks offer it, to log in to these networks using your identifiers (e.g., Google, Twitter, or Facebook). During this registration, a user profile is created or assigned to an existing user profile from the data collected on the registration form or shared by the relevant social network provider, and all updated and collected data during subsequent interaction are recorded and managed in the Stempora CRM database (see point 4). Your customer account gives you the opportunity, to the extent this functionality is offered, to manage your contact data, view your transactions, create and manage your watch collections, indicate your marketing preferences and settings (in this regard, also see point 3). The scope of customer account features may vary depending on the online platform used. Generally, the same password gives you access to your customer accounts (e.g., web and app).

The information collected during the creation of a customer account generally includes your basic data and contact details (especially your title, first and last name, address, phone number, email address, password) and any other information you voluntarily enter in the customer account and the information and data provided or uploaded (for example, about your interests and preferences regarding the product range, your favorite brands/models, your reception preferences, your birth and marriage dates, your (collections of) watches and corresponding photographs), as
well as sales data and other commercial data from JTC SA (reservations, orders, purchases, exchanges, repairs, merchandise, prices, place of sale, time, etc.) that are transmitted and recorded in-store or via email, phone, or electronically.

In case of logging in via social networks, certain information such as your name, email address, and other public information from your social media profile is collected to facilitate future logins and personalize your user experience. We use this information exclusively for authentication and management of your account. Please keep in mind that we have no access to your password and have no control over your social media accounts. We advise you to regularly check the privacy provisions and privacy settings of your social media providers to stay informed about how your data is used by these providers.

Information about your behavior may be processed and attributed to your user profile if you are logged into your customer account while visiting the online platform (for example, information about your shopping cart and wish lists).

We reserve the right to record the IP address used and the time of access during registration and any new logins, as well as when using our online platforms. We store data based on our legitimate interests in protection against abuse and other unauthorized uses of our online platforms. In principle, the transfer of this data to third parties can only take place when it is necessary to assert our rights or when there is a legal obligation in this regard.

In principle, the creation of a customer account is voluntary, unless an account is necessary to use certain services. If the basis for processing data related to a customer account is not the preparation and execution of a contract or the preservation of legitimate interests of JTC SA or a third party, this processing is based on the consent you have expressed. Your consent is valid until its revocation. You can revoke your consent at any time with future effect (see point 3).

2.6 LOCATION DATA

Some of the services we offer (especially in the context of using our online platforms) may access and process location data. This occurs, for example, when you use the location feature to search for nearby sales points. Location data, which can be collected via your IP address, browser, GPS, sensors, signals, or Wi-Fi access points, are used to provide you with personalized and optimized service.

The processing of this data is based primarily on your consent. You have the option to revoke your consent to the processing of location data at any time by adjusting the corresponding settings on your device and/or by rejecting the concerned cookie settings (in this regard, please refer to our Cookie Guidelines). Please keep in mind that in this case, some features of our services may not be fully available.

2.7 DATA FROM THIRD-PARTY SOURCES

We may use data about you from public sources (e.g., social media profiles) to optimize our services (such as offering you targeted advice). Data from third-party sources can include information about your preferences, interests, and demographic data. We process this data based on our legitimate interests.

In principle, you have the right to object to the processing of your data from third-party sources. In this regard, please refer to point 8 concerning the right to object to data processing based on our legitimate interest.

Based on your consent (see point 3), we may also use data as part of what is known as "Customer Match" (also see point 2.11). In this context, we transmit encrypted data (e.g., an email address, phone number, or other identifying characteristics) to social media platforms (e.g., Facebook) or advertising platforms (e.g., Google), which compare these data with their own. If the comparison shows a match, it means the user is also active on this third-party platform. Based on the customer data comparison, a target group is created to tailor advertising campaigns to this audience, thereby improving the relevance and effectiveness of the advertising. Depending on the third-party platform used, different advertising formats such as social network ads or search engine advertising can be utilized.

You have the option to revoke your consent to Customer Match at any time by withdrawing your consent via the Preference Center (see point 3).

2.8 USER PROFILE

In the context of your interactions with us described in point 2, we create and maintain a user profile in our database (in this regard, please see point 4).
User profiles allow us to better understand the behavior and interests of our customers. This enables us to continuously improve our services and tailor them to your personal wishes as well as your interests and usage patterns.

We may associate user profiles with other customer data that we legally process (e.g., name, contact details, user and purchase behavior, including purchase history, demographic data, interests, and product range preferences such as favorite brands, models, and materials, reception preferences) or already attributed to existing profiles.
If the legal basis for processing data in the context of creating a user profile is not the preparation and execution of a contract or the preservation of the legitimate interests of
JTC SA or a third party, the creation of the profile is based on your consent. Your consent is valid until its revocation. You can revoke your consent at any time with future effect (in this regard, see point 3 and point 8).

2.9 COOKIES AND TRACKING TECHNOLOGIES

We use cookies and other tracking technologies on our online platforms (collectively referred to as "cookies"). In this regard, please refer to the relevant Cookie Guidelines, which are also available by clicking a link on the concerned online platform.

Cookies help us to understand how our online platforms are used and to improve the user experience. They can be used for various purposes, including ensuring the functionality of the platforms, analyzing visitor traffic, improving site performance, and delivering personalized content and advertising.

The use of cookies can involve processing data such as your IP address, the pages visited, the time of visit, and your interactions with the platform. Some cookies are essential for the functionality of the platform, while others are used for analytics or marketing purposes. You have the option to manage your cookie preferences, including opting out of non-essential cookies, through the settings on your browser or the preference center on our online platforms. However, please be aware that disabling cookies may affect the functionality and your experience of our platforms. Our Cookie Guidelines provide detailed information about the types of cookies we use, their purposes, and how you can control or delete them. We recommend reviewing these guidelines to understand our use of cookies and your options regarding them.

2.10 USE OF THE SITE AND USER BEHAVIOR

When you use our online sales site, we collect, analyze, and use data about this usage and, in general, about your behavior. This particularly occurs, for example, when you purchase items in our online store or when you use our websites and applications (e.g., created then canceled shopping carts, watch lists, viewed items, search terms and results, submitted ratings, and comments). To do this, we use various technologies, the most important of which are mentioned below.

2.10.1 GOOGLE ANALYTICS / GOOGLE FIREBASE

If you have consented to the processing or if we can assert a legitimate interest in using certain specific features, we use Google Analytics and/or Google Firebase (see below), web analytics services from Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (hereafter "Google").
Google Analytics uses cookies. The information generated by cookies about your use of our online platforms is generally transmitted to a Google server in the United States for storage. The legal basis for processing is your consent. The use of other legal grounds is expressly reserved. Any data transfer to the United States is subject to the EU's standard contractual clauses concluded with Google LLC, the parent company of Google.

At our request, Google will use this data to evaluate how you use the online platforms, compile reports on online activities, and provide us with additional services related to platform use. We may use the processed data to create anonymous user profiles.

We use Google Analytics only with IP anonymization activated. This means that the user's IP address is shortened by Google within the member states of the European Union (EU) or in other states party to the Agreement on the European Economic Area (EEA). Only in exceptional cases do we transfer the entire IP address to a Google server in the United States, where it is shortened.

The data is deleted as soon as it is no longer needed for recording purposes. In our case, this generally occurs after 14 months.

You can revoke your consent to the use of Google Analytics at any time by changing your cookie settings. You can also refuse the recording and use of cookies by technical means by adjusting your browser settings or add-ons (also see our Cookie Guidelines). You can also object to the collection of data generated by cookies and related to your use of our online platforms (including your IP address) and the subsequent processing of this data by Google by downloading and installing the browser plug-in available at the following link: Google Analytics Opt-out Browser Add-on.

Additional information on Google's use of data, as well as various settings and revocation options, can be found on Google's websites via the following links:

• How Google uses information from sites or apps that use our services,
• Use of data for advertising purposes,
• Manage information used by Google to show you personalized ads.

We also use Firebase, an analytics and tracking tool for web and mobile applications offered by Google. The use of Google Firebase allows us to collect and process certain information about your use of our online platforms (e.g., device information, IP addresses, application usage data).

Google Firebase services may install "Instant IDs." Instant IDs are unique identifiers with a timestamp that allow linking different events or processes related to the application. These data are used for analysis and optimization of user behavior, e.g., evaluating error reports. According to Google, these Instant IDs do not process any data that identifies individuals. For Firebase Analytics, Google also uses the advertising identifier of the connecting device.

You can refuse the collection of data by Google Firebase at any time with future effect by disabling data collection for Firebase Analytics in the application settings or by limiting the use of the advertising identifier in your mobile device settings.

Android devices: Settings > Google > Ads > Reset Advertising ID
iOS devices: Settings > Privacy > Advertising > Limit Ad Tracking

You can review Google Firebase's Privacy Notice at the following address: Privacy and Security in Firebase.

2.10.2 WEB ANALYTICS TOOL

If you have consented to the use of cookies, we will utilize a web analytics tool.

This tool employs cookies that allow us to track the activity of randomly selected visitors to our website. It processes, in particular, the following data:
Mouse movements, clicks, scrolling behavior, information about your browser, type of device, operating system, language, screen resolution, IP address (anonymized).

This tracking is anonymous or pseudonymized, ensuring that we can never clearly identify the specific website visitor.
The web analysis performed by the tool is based on your consent and aims to tailor our website to your needs.

You can revoke your consent to web analysis by the tool at any time by adjusting the respective cookie settings. Additionally, you can technically refuse the recording and use of cookies by modifying your browser's settings or add-ons (for this, also refer to our Cookie Guidelines).

2.11 RETARGETING/REMARKETING

On our online sales site, we install the Remarketing or "Similar Audiences" feature of the Google Ads/Google Marketing platform (formerly known as DoubleClick by Google) by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("Google").

Google uses cookie/tracking technologies stored on your device to enable analysis of your use of the online platforms and to present you with advertisements for products and services that may interest you. According to Google, cookies installed for this purpose contain no personal data. The information collected about your use of the online platforms through cookie/tracking technologies is transmitted to a Google server in the United States for storage. If you are registered and logged into a Google service, Google can associate your visit to our online platforms with your account. Even if you are not registered with Google, it is possible that Google knows and uses your IP address to create and store user profiles about you. We use the functionality offered by Google for comparison with customer lists only with your prior consent (in this regard, please see point 2.7).

Additional information on the analysis of your search and browsing behavior can be found at the following addresses:

• Goofle Privacy Policy
• Gogle Privacy and Terms
• Enterprise Advertising & Analytics Solutions.

You can disable personalized advertising based on your interests on Google by clicking the following link: Google - My Ad Center Help.

2.11.1 FACEBOOK PIXEL

Furthermore, we install services from Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereafter "Facebook") on our online platforms, such as Facebook Pixel, for retargeting/remarketing purposes.

If you visit certain of our online platforms and consent to it, a direct connection between your browser and the Facebook server is established via the Facebook pixel. Facebook receives information that you have visited our online platform(s), which allows us to make our Facebook activities more effective and, for example, display ads or advertisements only to visitors of our online platforms or to predefined customer groups ("Custom Audiences"). In addition, the Facebook Pixel allows us to analyze the use of the online platform(s) and offer content and advertising that might interest you. The data collected are systematically encrypted before being transmitted to Facebook and remain anonymous to us, meaning we do not see any personal data of individual users. We use the "Extended Comparison" feature of Custom Audience, which allows us to compare customer lists based only on your prior consent (please refer to point 2.7).

We are jointly responsible with Facebook for exchanging data that Facebook collects or holds through the pixel or similar functionalities for displaying personalized advertising information based on user interests, improving ad delivery, and personalizing features and content (but not for subsequent processing). For this purpose, we have entered into an additional agreement with Facebook. Under joint responsibility, users can therefore directly address Facebook with information requests and other concerned person's requests.

You can find more detailed information about the Facebook Pixel, its type, scope, purposes, legal bases, and options for objecting to data processing by Facebook, as well as your privacy settings, in Facebook's Privacy Guidelines available at https://www.facebook.com/about/privacy/ and https://www.facebook.com/business/learn/facebook-ads-pixel.

You can revoke your consent to our storage and use of cookies (including the Facebook Pixel) for retargeting/remarketing purposes at any time with future effect by modifying the relevant cookie settings. You can also technically refuse the recording and use of marketing cookies (including the Facebook Pixel) by adjusting your browser's settings or add-ons (please also refer to our Cookie Guidelines).

2.11.2 TIKTOK PIXEL

We implement tools provided by TikTok Technology Limited, 10 Earlsfort Terrace, Dublin, D02 T380, Ireland (hereafter "TikTok"), on our online platforms, such as the TikTok Pixel, for retargeting/remarketing purposes.

When you visit our online platforms and consent, a direct link is established between your browser and the TikTok server via the TikTok Pixel. In this context, TikTok receives information about your visit to our online platforms, such as information on certain interactions with our online platforms (clicks or viewed products), your IP address, and device and browser information. This allows us to more effectively manage our TikTok activities and, for example, to offer articles or advertisements only to visitors of our online platform(s). Additionally, the TikTok Pixel enables us to analyze the use of our online platforms and suggest advertisements about content and offers that might interest you. The data collected are anonymous to us, meaning we cannot see the personal data of individual users. We utilize the "Extended Comparison" feature of Custom Audience, which allows comparing customer lists, only based on your prior consent (see point 2.7).

TikTok's Privacy Policy, available at Tik Tok Privacy and the article About TikTok Pixel , provide additional information about the TikTok Pixel, its type, scope, purposes, and options for objecting to TikTok's data processing, as well as your privacy settings options.

You can revoke your consent to our storage and use of cookies (including the TikTok Pixel) for retargeting/remarketing purposes at any time in the future by modifying the relevant cookie settings. You can also technically refuse the recording and use of marketing cookies (including TikTok Pixels) by modifying your browser settings or add-ons (also refer to our Cookie Guidelines).

2.12 SOCIAL NETWORK FEATURES

Our online platforms contain links (hyperlinks) to our profiles on social media platforms and platforms of Facebook, LinkedIn, Instagram, Twitter, YouTube, and Pinterest. These services are offered by the following companies (hereafter referred to as "Social Network Operators"):

Facebook and Instagram platforms are operated by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland ("Facebook", "Instagram"); Privacy Policy: https://www.facebook.com/privacy/explanation

LinkedIn platform is operated by LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland ("LinkedIn"); Privacy Policy: Privacy Policy LinkedIn
Twitter platform is operated by Twitter International Company, One Cumberland Place, Fenian Street, Dublin 2, D02 AX07, Ireland ("Twitter"); Privacy Policy: Privacy Policy Twitter
YouTube platform is operated by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland ("YouTube" or "Google"); Privacy Policy: Goofle Privacy Policy

Pinterest platform is operated by Pinterest Europe Ltd., Palmerston House, 2nd Floor, Fenian Street, Dublin 2, Ireland ("Pinterest"); Privacy Policy: https://policy.pinterest.com/en/privacy-policy
The privacy notices of the social network providers linked above contain information on the nature and extent of data collection and the further processing and use of data by these social network providers, as well as your rights in this regard and available settings to protect your privacy.

If you click on the corresponding symbols of these social network providers, you will be automatically redirected to our profile on the respective network. To use the features of the concerned network, you may need to log into your account on that network. If you do not want a social network provider to associate your click on a link leading to their offer with your user account, you must log out of the concerned service before clicking on the link. Even if you are not logged into the social network provider, data may be sent to them by cookies when you click on a link. Where we are jointly responsible with the provider for certain data processing, we conclude an agreement to this effect. The provider can provide you with information about the essential content of this agreement. For more information on data processing by the different social network providers, please refer to their respective privacy policies.

Additionally, our online platforms may contain what are known as plugins from social network providers (e.g., Facebook, Twitter, Pinterest, Google+) (including "thumbnails" or "like" buttons). These buttons conceal a link to the respective social network platform.

If you select one of the offered functions and click on the symbol of the concerned social network provider, a direct connection will be established between your browser and the server of the concerned social network platform. This indicates to the social network provider that you have visited our platforms with your IP address and clicked on the link. If you access a link to a social network platform while logged into your account with the concerned provider, the content of our site could be linked to your profile with the concerned social network provider, meaning the provider could directly associate your visit to our website with your user account. If you wish to prevent this, you must log out before clicking on the corresponding links. Your profile is in any case associated with the platform if you log into the concerned social network provider after clicking on the link.

2.13 ABUSE CONTROL

The manufacturer's indications impose on us the contractual obligation to sell member models only to end customers and approved contractual partners. Moreover, the sale of certain models to the same customer is limited to a certain number of items. To verify compliance with these provisions and to prevent abusive requests and unauthorized sales (e.g., receiving stolen goods and plagiarism), we compare order data with customer information already recorded in our database on our platform. Identification can also be carried out by presenting and, if necessary, copying a valid identity document. In case of suspected abuse, we can also conduct appropriate investigations as required (e.g., comparison of personal information provided with an identification document, comparison with data from public sources and information files). It may also be necessary, for the purposes mentioned above, to transmit your basic data to the product manufacturer.

Additionally, we process data from surveillance systems (e.g., video surveillance) in our stores to protect our employees, customers, and goods. Any distinct data protection notices communicated in the context of the sales transaction regarding the use of such surveillance systems also apply.

The legal basis for this processing is the protection of the legitimate interests of JTC SA or a third party. The concerned manufacturer and ourselves have a legitimate interest in preventing unauthorized trade/resale and abusive requests, as well as in preventing and investigating criminal offenses and ensuring the security of business operations. You can object to the processing of your data under the conditions referred to in point 8.

2.14 COMPLIANCE WITH LEGAL OBLIGATIONS

Under specific conditions, we are required to collect data on the identity of a contractual partner or persons or economic beneficiaries acting on its behalf for identification purposes in accordance with anti-money laundering regulations (usually the name, place, and date of birth, nationality, home address, data on business relationships, and possibly additional data on the contractual partner) and to conduct an identity verification using valid identity documents. In this context, it may be necessary to collect and process data from public sources (e.g., public registers, the Internet) as well as to take and keep copies of a valid identity document. The legal basis for this data processing is compliance with legal obligations related to the relevant anti-money laundering provisions.

Furthermore, we process personal data to ensure compliance with other legal obligations, for example, to fulfill documentation and retention obligations imposed on us by tax and commercial law.

The legal basis for this processing is compliance with the relevant legal obligations.

3. MARKETING

3.1 GENERAL MARKETING

On our contact and registration forms, you have the option to provide broad consent for the processing and use of your data and to be contacted through communication channels you specify, especially via email, phone (including Messenger), online platforms (e.g., Push notifications), and/or social networks ("General Consent"). In this context, we collect and store the following data (* Mandatory data): email address*, title*, first name*, last name*, phone number, address, country.

As part of our comprehensive marketing communications, based on your permission and the data recorded by us and included in your user and/or customer profile (refer to point 2.8 and 2.5), we will send you personalized information about our products, services, and related benefits and advice. Our goals include:

• Analyzing, evaluating, and optimizing our services based on usage.
• Providing personalized content and recommending exclusive products and offers based on your transactions, service usage, and interests.
• Informing you about services related to purchased products.
• Inviting you to exclusive events.
• Assessing the usage and success of marketing activities.
• Making our and our partners' advertisements more interesting and thus communicate with you on other channels (e.g., social media platforms and advertising networks) (remarketing/retargeting).
• Providing social network services.
• Conducting and evaluating our email campaigns.
• Sending customer surveys and evaluating them.

We document your consent to global marketing approaches to comply with legal requirements. The documentation of consent and the processing of data entered during consent are therefore based on our legitimate interests.

You can revoke your consent for the collection, processing, and use of your data for marketing purposes and refuse partial or full contact from JTC SA at any future date by accessing the Preference Center in the Preference Settings of your JTC SA customer account, clicking the unsubscribe link in our emails, or contacting our customer service (see our contact details in point 1) / your sales advisor.

Please note that we will evaluate your user behavior in relation to our advertising emails. For evaluation purposes, the emails we send contain "web beacons" (also known as tracking pixels/spy pixels) and encrypted links. Web beacons are one-pixel image files linked to our online platforms that, along with encrypted links, allow us to evaluate your use of our advertising emails (i.e., Open Tracking or Click Tracking). This is based on the collection of technical information, e.g., about your browser, system, IP address, and the timing of viewing emails or links using web beacons and links associated with your email address, linked to a unique identifier, and can be attributed to your user profile.

Disabling standard image display in your email inbox makes Open Tracking via web beacons impossible. In this case, our advertising emails will not be fully displayed, and you may not be able to use all features of the site. Manually configuring image display will result in the above-described tracking. The only way to avoid "Click Tracking" is not to click on the links in the concerned email.

3.2 EXISTING CUSTOMER ADVERTISING COMMUNICATIONS

To the extent we collect your data in the context of an order placed or a purchase made by you (provided the law permits us), we reserve the right to send you advertising emails containing information on similar goods and services. In this context, we generally process the following data: email address, title, first name, surname, and/or address.

This processing is carried out for advertising purposes based on authorization and to preserve our legitimate interest in maintaining customer relationships and consequently in disseminating advertising communications.

We also reserve the right to send you mail as part of our existing customer relationship, provided you do not object to such communication.

You can object to advertising communications in the context of the customer relationship at any time. In this case, you will no longer receive advertising information from us about our goods and services based on our legitimate interest. A written contact (e.g., via email) to the contact details in point 1 is sufficient to exercise your right to object. Of course, every advertising email also contains an unsubscribe link.

4. CRM DATABASE AND INFORMATION ON JOINT RESPONSIBILITY

JTC SA implements centralized systems for the harmonious provision of online platforms, financial and resource planning, customer management, marketing activities, order execution, and data analysis. These systems enable the administration, maintenance, and harmonious processing of customer data, order and contract data, and other data from various sources (e.g., data on the use of online platforms and your interactions with us) to the extent mentioned in point 2 and for the indicated purposes.

Areas of Responsibility: JTC SA, based in Switzerland, is primarily responsible for operating and administering the systems and managing the customer and order data stored in them, as well as for data protection-related matters (e.g., information or deletion requests from customers). Data collection and updating in the systems, such as customer registration, order processing, or contract execution, and communication with customers in this regard, usually occur through JTC SA's respective branches or online platforms, which are responsible in this context. All companies process personal data in accordance with the current data protection legislation.

Data Security: JTC SA, based in Switzerland, is primarily responsible (refer to point 1) for ensuring an adequate level of security for personal data in the centralized systems and for implementing suitable protection measures and adhering to fundamental data protection principles (e.g., through authorization management and access control, implementation of a deletion concept, Privacy by Design).

Information and Reporting Obligations: The current Privacy Policy enables the responsible JTC SA to fulfill its information obligation (see point 1). JTC SA is also responsible for complying with any legal obligations to report potential data protection incidents, with all companies striving to support each other as needed and provide all necessary information for this purpose.

If you wish to assert your data protection rights (e.g., by submitting an information or deletion request), you can always contact the relevant data protection officer or data protection contact person at the details mentioned in point 1. As necessary to process your information or other request, JTC SA will inform and support each other and immediately share all necessary information.

If you have further questions about the joint responsibility agreement, you can always contact the relevant data protection officer or data protection contact person (see point 1).

5. DATA RETENTION PERIOD

Unless otherwise stated, your personal data are deleted or, in individual cases, anonymized, as long as they are no longer necessary for the indicated services or purposes, if there is no longer a legal basis for further processing, or if deletion is necessary to comply with a legal obligation. Additionally, it may be necessary to retain your data longer if required to fulfill a legal obligation (e.g., retention obligations in tax and commercial law, which can be up to 10 years depending on local legislation) or for other legitimate reasons (e.g., to assert legal rights). Customer data collected based on your consent will be deleted if there is no legal basis for further processing upon revocation of your consent.

6. DATA RECIPIENTS

In addition to instances where certain client data is transferred to service providers as mentioned in this Privacy Policy, your data may be shared with the following recipients as necessary for the provision of our services, if we have obtained your consent, or if legally permitted. Specifically, your data may be shared with:

We may engage external providers (notably postal and shipping service providers, credit institutions and payment service providers, insurance companies, travel service providers, credit checking agencies and debt collection services, marketing agencies, direct mailing service providers, web, cloud, and IT service providers, data destruction companies) and external advisors (e.g., law firms, anti-money laundering officers, auditors, tax consultants) for contract execution, service provision, and to fulfill legal obligations. The sharing of your data with these service providers is consistently in accordance with applicable legal provisions and, for order processing, under the relevant contract. In some cases, you may enter separate contracts with individual service providers (e.g., payment and insurance service providers). Please also review their security and privacy policies through the provided links.

It may be necessary to share your personal data with manufacturers or brands for warranty purposes, in the context of global events or actions, for limited production goods, waiting lists, certified goods, and special models. The legal basis for this transfer generally involves contractual execution or legitimate interest arising from the stated purposes.
With JTC SA companies.

Transfer of personal data in the context of mergers, acquisitions, and business disposals.

Additionally, we may need to transfer your personal data to other recipients, such as certain authorities, for fulfilling legal obligations (e.g., supervisory, financial, or judicial authorities).

7. DATA PROCESSING IN THIRD COUNTRIES

When transferring your personal data to third countries outside of Switzerland, the European Union (EU), and the European Economic Area, except in exceptional cases permitted by law, we ensure beforehand that the recipient guarantees an adequate level of data protection or that you consent to the data transfer. An adequate level of data protection is assured in case of standard contractual clauses or the presence of so-called "Binding Corporate Rules" (BCR). We transmit and process data in Europe and the United States.

8. YOUR RIGHTS

The rights outlined in this section may be subject to certain exceptions or additional requirements under current data protection legislation.

Right to Information: You may request information at any time about the personal data we process about you. Providing information is contingent upon respecting the rights and freedoms of other individuals who may be impacted by the data transmission.

Right to Rectification: You can request the correction of incorrect personal data or the completion of personal data stored by us.

Right to Withdrawal: You can generally request the deletion of your personal data that we record, as long as the processing is not necessary to exercise a right to freedom of expression and information, to fulfill a legal obligation, for reasons of public interest, or to assert, exercise, or defend legal claims.

Right to Restrict Processing: You can request that the processing of your personal data be restricted. This is particularly applicable if you dispute the accuracy of the data we have stored about you or if you object to the processing. In such cases, we are required to restrict data processing for the duration of the review of your request.

Right to Data Portability: You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format, or to demand their direct transfer to another controller, to the extent technically feasible. This right exists only insofar as the processing is based on your consent or a contract and is carried out by automated means.

Right to Object to Data Processing Based on Legitimate Interest: You can object at any time to the processing of your personal data for reasons arising from your particular situation, insofar as we process your data to protect our legitimate interests. In the case of legitimate objection, we are obliged to cease further processing of your data, unless it is necessary for compelling, essential, or statutory reasons, or to assert or exercise legal claims or defend against legal actions. This right of objection may be subject to limitations under current data protection legislation.

Right to Object to Direct Marketing: To the extent that we process your personal data for direct marketing purposes, you have the right at any time to object, without limit, to the processing of your data for such purposes. This applies regardless of any particular situation. The same applies to profiling, insofar as it is associated with such direct advertising. In the event of an objection, processing for direct marketing purposes is immediately terminated.

Right of Revocation: To the extent that we process personal data based on your consent, you have the right to revoke such consent at any time. Such revocation leads to the cessation of data processing that was previously based on your consent. If you wish to revoke your consent to the use of certain cookies, please refer to our instructions in the Cookie Policy.

To exercise your privacy rights, please contact the data protection officer or the competent authority. You can find their contact details in section 1 of this Privacy Policy. Please note that under current data protection legislation, the exercise of the aforementioned rights may be structured or limited differently or subject to different conditions. To verify the identity of the

individual exercising your rights under this section 8, JTC SA may, in individual cases, require the presentation of supporting documents and adjust the processing accordingly.

9. RIGHT TO LEGAL RECOURSE

If you believe that our processing of your personal data violates data protection legislation, you have the right to file a complaint with the supervisory authorities, particularly in the member state where you have your habitual residence, your place of work, or the location of the alleged violation.

10. SECURITY

We implement technical and organizational security measures to protect your personal data, particularly against potential or foreseeable cases of manipulation, loss, disruption, or unauthorized access. These security measures are regularly adjusted in line with technological advancements and market developments.
Our employees are bound by confidentiality obligations.

11. MODIFICATIONS

From time to time, it may become necessary to amend this Privacy Policy. We reserve the right to make changes at any time.

We advise you to stay informed about the current version of this Privacy Policy whenever you revisit our online platforms.