Last update: 27 October 2025

PRIVACY NOTICE – HIGHLIGHTS

SCOPE – DATA CONTROLLER

This privacy notice applies to the collection and processing of personal data of our customers and users of the VF Distance Shopping process at the point of sale.

The company indicated on the payment receipt acts as the Data Controller, namely VF Italia S.r.l., with registered office at Via Varesina 162, 20156, Milan (MI), Italy.

WHAT INFORMATION WE PROCESS

We process the personal data you provide when you:

• Interact with us via WhatsApp chat or calls (e.g., booking an appointment for a Distance Shopping experience)

• Purchase products from us through the Distance Shopping process at a participating store

• Contact the store

WHY WE USE YOUR INFORMATION

We collect and process your personal data to:

• Manage the booking process

• Complete and manage your purchases and respond to your requests

• Improve our products and services

We do not sell or share your personal data with anyone.

PARTIES WITH WHOM WE SHARE YOUR INFORMATION

The store may share your personal data with:

• Third-party providers, such as Adyen, who help us deliver the Distance Shopping experience (these recipients act on our behalf and only according to our instructions)

• Third parties in the event of legal proceedings, requests by courts or authorities, other legal obligations, to defend our rights, or in case of merger, acquisition, or transfer of assets.

If any of these recipients are located outside the EEA, we ensure your personal data is always adequately protected (if the destination country is not recognized by the EU Commission as providing an adequate level of protection, we cover the data transfer with appropriate safeguards).

MANDATORY VS. OPTIONAL INFORMATION

Some of your personal data is required to complete the purchase or provide the requested service. If you refuse to provide such data, it will not be possible to complete the purchase or provide the requested service.

HOW TO CONTACT US

For any questions or requests regarding the use of your personal data, or to exercise your rights, you can contact us at privacy_europe@vfc.com.

HOW LONG WE KEEP YOUR INFORMATION

We retain your personal data only for as long as necessary to achieve the purposes indicated. This period may extend up to 10 years after the end of the contractual relationship with you (statute of limitations for legal actions in most EEA countries), unless applicable law provides for a shorter or longer retention period.

YOUR RIGHTS

You may exercise your rights under data protection law at any time, including (if applicable) the right of access, rectification, restriction, deletion, objection (including the right to object at any time and free of charge to the processing of your personal data for direct marketing purposes), the right to data portability, and the right to withdraw consent. You also have the right to lodge a complaint with the competent supervisory authority.

FULL PRIVACY NOTICE

What is this document about? What happens to my personal data when I interact with the VF Group?

This privacy notice (“Privacy Notice”) applies to any collection and processing of personal data carried out when you make a purchase via Distance Shopping at a store (hereinafter “we” or “VF Group”), including when you contact our customer service for after-sales support or specific inquiries.

By providing us with your personal data, for example when booking a Distance Shopping session, visiting our stores, or contacting our customer service, you confirm that you have read and understood how we collect, process, use, and disclose your personal data as described in this Privacy Notice.

For certain processing activities, we need your consent to collect and process your personal data. When your consent is required, we will ask you to electronically confirm your consent before submitting personal data by selecting the appropriate checkboxes. Your affirmative action in selecting the relevant box and your continued use of the VF Distance Shopping process indicate your acceptance of the processing described in this Notice. Our records of your consent, the date, and any future updates to this Notice will be considered written and conclusive proof of your consent.

You will also be provided with this Notice – and, when specific processing activities require your consent, you will be asked to provide it – when you contact our customer service or provide your personal data through interactions in our stores.

We collect and process your personal data in compliance with all applicable data protection laws and regulations, including, for example, European Union laws such as the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and national implementing provisions; if you are in the United Kingdom, the GDPR as incorporated into UK law (“UK GDPR”), as well as rules and guidance issued by competent data protection authorities, where applicable (together, “Data Protection Laws”).

Who controls the processing of my personal data? Who is responsible?

The data controller of your personal data when you purchase goods from us is the local VF Group entity that sells the goods through the Distance Shopping process. This local entity is also the controller of personal data you provide when interacting with our customer service. The relevant VF company is indicated on your purchase receipt, namely VF Italia S.r.l., Via Varesina 162, 20156, Milan (MI), Italy.

The VF Group Data Protection Officer can be contacted through our Privacy Office Europe at privacy_europe@vfc.com.

What personal data is processed?

Information you voluntarily provide:

We collect and process:

• Personal data you provide when interacting with us via phone and/or WhatsApp chat, e.g., booking a Distance Shopping appointment. These data may include your name, email address, phone number.

• Personal data you provide when purchasing goods from us (at a participating store via Distance Shopping) or interacting with the store for customer support. These data may include:

  • Your name, email address, phone number

  • Transaction details, including shipping address

  • Information about why you contacted customer service

For what purposes is my personal data processed?

We collect and process your personal data for the following purposes:

Managing your purchases of goods (via Distance Shopping with our store):

• This includes all activities related to purchasing goods, such as delivery, invoicing, returns and exchanges, refunds (if applicable), and payment-related activities.

Providing customer service:

• Providing after-sales services

• Responding to your inquiries, questions, communications, or feedback

• Internal training and improvement of our customer service

Other purposes:

• Fraud prevention, through internal procedures to verify transaction regularity, protect our financial integrity, and protect you from misuse or fraudulent purchases

• Complying with applicable laws and regulations and evaluating or defending a legal right

What is the legal basis for processing my personal data as described in this document?

We process your personal data for the purposes described above based on one of the following legal bases:

• Processing is necessary for the performance of a contract with you or to take pre-contractual steps at your request (Article 6.1(b) GDPR)

• Processing is necessary for the purposes of our legitimate interests or those of our affiliates or third parties, provided such interests do not override your fundamental rights and freedoms (Article 6.1(f) GDPR). Legitimate interests include managing and maintaining our contractual relationship with you, responding to your specific requests, seeking your feedback to improve our products and services, or conducting general marketing activities

• When your specific consent is required for processing your personal data, data will be processed based on such consent (Article 6.1(a) GDPR)

How long will my personal data be processed?

Personal data will not be kept longer than necessary to achieve the specific processing purposes described in this document. This period may extend up to 10 years after the end of the contractual relationship (statute of limitations for legal actions in most EEA countries), unless applicable law provides for a shorter or longer retention period.

Is my personal data safe?

We are committed to protecting the security and confidentiality of your personal data. We implement – and require any service providers or processors acting on our behalf and under our instructions to implement – appropriate technical and organizational measures to prevent loss, accidental destruction, unauthorized access, misuse, or improper use of data. Systems and software are configured so that personal and identifying data are used only when necessary to achieve the specific processing purpose.

We use a variety of advanced security technologies and procedures to protect personal data. For example, user data is stored on secure servers in controlled locations. For transmitting some data over the Internet, encryption techniques such as Secure Socket Layer (SSL) are used.

However, no electronic transmission or storage of information is 100% secure. Despite our security measures, we cannot guarantee that data loss, misuse, or alteration will never occur.

Where does my personal data go? Who are the recipients, where is it transferred, and for what purposes?

Personal data collected via WhatsApp chat and calls, in the context of Distance Selling by our store and customer service, are stored on servers provided and managed by third-party storage and hosting providers, located in the EU and/or UK. Some data collected in-store may be stored locally. All such data may be shared with recipients as detailed below.

Personal data is shared within the limits and conditions specified in this Privacy Notice, subject to your specific consent where required by applicable data protection laws:

• Your data may be accessed internally by staff who need it to perform their duties in relation to the processing purposes specified

• Your data may be accessed by third-party service providers acting on our behalf and under our instructions (processors). These include:

  • Third-party providers for payment processing through our e-commerce platform, e.g., Adyen

  • Third-party providers supporting the Distance Shopping process and all pre- and post-sales activities, including order processing, marketing, financial services, inventory management, and customer relationship management

A list of these processors, with locations, is available upon request from our Privacy Office.

• Your data may also be shared with other VF Group companies within the EEA for processing on behalf of the controllers identified above.

• Your data may be shared with institutions, authorities, banks, financial institutions, professionals, independent consultants, business partners, or other legitimate recipients as allowed by law (e.g., legal proceedings, court or authority requests, other legal obligations).

• Your data may be shared with third parties in case of mergers, acquisitions, or transfers of assets, products, websites, or operations.

Except as above, personal data will not be shared with third parties not connected to us or performing a commercial, professional, or technical function for us, and will not be used for third-party marketing.

Transfers are based on the legal bases identified above. Recipients may be located in countries outside where the data was collected, but transfers will primarily occur within the EEA or countries recognized by the EU Commission (or, for the UK, under UK GDPR adequacy rules) as having an adequate level of data protection.

If a recipient is outside the UK or EEA without adequacy, we will implement appropriate safeguards, e.g., EU Standard Contractual Clauses or binding corporate rules. Copies of these safeguards are available from our Privacy Office.

Am I required to provide my personal data? What happens if I refuse?

Except for navigation data, providing personal data may be required to execute a contract (e.g., Distance Shopping purchase) or respond to inquiries, requests, or feedback. Refusal may prevent us from performing the contract or providing the requested services or products.

What are my rights and how can I exercise them?

You have the right to exercise your rights under applicable data protection laws at any time, including:

• Right of access, rectification, restriction, deletion, objection (including objection to direct marketing, free of charge)

• Right to data portability

• Right to withdraw consent

You also have the right to lodge a complaint with the competent supervisory authority. A summary of your rights and how to exercise them is in Appendix 1.

For questions or requests regarding your personal data, contact privacy_europe@vfc.com.

Can this Privacy Notice be updated?

We may update or modify this Privacy Notice at any time, in whole or in part, to the maximum extent permitted by law. The version on the VF website is the current version. Updates will be communicated via email when applicable.

Appendix 1 – Data Subject Rights

As a data subject whose personal data is processed as described above, you have a number of rights:

• Right of Access: Confirm whether your data is processed and request access to it, including categories, purposes, and recipients. Multiple copies may incur a reasonable fee.

• Right to Rectification: Correct inaccurate or incomplete data.

• Right to Erasure (“Right to be forgotten”): Request deletion of your data under certain circumstances; if deletion is not technically feasible, data will be irreversibly anonymized.

• Right to Restrict Processing: Request processing limitation in specific circumstances; data will only be stored or processed with your consent or for legal purposes.

• Right to Data Portability: Receive your data in a structured, commonly used format and transmit it to another controller if technically feasible.

• Right to Object: Object to processing for specific reasons; VF must stop processing unless legitimate grounds prevail.

• Right to Object to Direct Marketing: Object at any time to processing for direct marketing, including profiling.

• Right not to be subject to automated decisions: Except in certain cases, you have the right not to be subject to decisions based solely on automated processing.

• Right to Withdraw Consent: Revoke consent at any time with future effect; prior processing remains lawful.

To exercise these rights, submit a written request with proof of identity to privacy_europe@vfc.com. Requests are free unless manifestly unfounded or excessive, in which case a reasonable fee may be charged.

You also have the right to lodge a complaint with the competent supervisory authority.