PRIVACY STATEMENT

We are Arion Retail Group B.V. and Arion Retail Group Denmark ApS (together the “Arion Group” and each a “Data Controller”).

It is important to us to give you clear and transparent information about the personal data we collect from you, why it is needed, and how it is used.

Overview

This privacy statement answers the following questions:

1. Does this privacy statement apply to you?
2. What types of personal data do we collect?
3. For what purposes do we use your personal data? And what is the legal basis for such processing?
4. Who has access to your personal data?
5. How long will we keep your personal data?
6. What measures do we take to protect your personal data?
7. Where do we store your personal data?
8. What rights can you exercise in relation to your personal data?
9. What if I have other questions?

1. Does this Privacy Statement apply to you?

This privacy statement applies to you if you:

• Make a purchase in any of the stores of the Arion Group.
• Sign up to receive direct marketing messages from the Arion Group.
• Sign up as a member of the lululemon membership loyalty program.

2. What types of personal data we use?

We collect the following personal data about you:

• Contact details: Such as your name, e-mail address, phone number and address.
• Financial details: Total amount spent, buying history, bank account number.
• Other: Date of birth, gender, tourist flag, hobby/favorite sport, favorite store.

3. For what purposes do we use your personal data? And what is the legal basis for such processing?

We will process your personal data for the following purposes:

• To provide our services to customers and collect payment: We process your personal data to be able to provide our services, sell our products and collect payment, which is necessary for the performance of the contract, cf. Article 6(1), litra (b) GDPR, entered into between the customer and the Data Controller.
• To communicate with you and keep you informed about our products, offers and events We process your personal data to be able to communicate with you about our services and products and send you direct marketing messages personalized to your predicted preferences on the basis of your prior purchases and interests, provided that you have consented to such marketing, cf. Article 6(1), litra (a) GDPR. If you withdraw your consent, we will store documentation for your consent, which pursues a legitimate interest of the Data Controller, cf. Article 6(1), litra (f) GDPR. We also process your personal data to be able to send you customer surveys regarding your experience with us, which pursues a legitimate interest of the Data Controller, cf. Article 6(1), litra (f) GDPR, and it is assessed that the Data Controller’s interest in processing the personal data overrides your interests. You can always withdraw your consent, although this will not affect the lawfulness of the processing before your consent has been withdrawn.
• To keep our records complete and accurate. We make an effort to ensure that your personal data is correct and complete, which pursues a legitimate interest of the Data Controller, cf. Article 6(1), litra (f) GDPR, and it is assessed that the Data Controller’s interest in processing the personal data overrides your interests.
• Dispute resolution. We may process personal data for the purposes of resolving disputes, complaints or legal procedures, which pursues a legitimate interest of the Data Controller, cf. Article 6(1), litra (f) GDPR, and it is assessed that the Data Controller’s interest in processing the personal data overrides your interests.
• To comply with the law. We may have to process your personal data to comply with the law or a judicial order, cf. Article 6(1), litra (c) GDPR.

4. Who has access to your personal data?

We may share your personal data with the following categories of third parties:

• Group companies.
• Service providers and suppliers assisting in our business activities, including for example hosting providers and suppliers of IT services.
• External advisers.
• Public authorities to the extent required by law, court order or if necessary to establish, exercise or defend our legal rights.

5. How long will we retain your personal data?

• Purchase data is retained for a period of two years after your last purchase.
• Personal data processed to send direct marketing will be retained until your consent is withdrawn or has not been used by us for one year. Documentation for your consent will be retained for two years after its last use by us.

Personal data may be retained for a longer period than stated above if required, including for example in case of a dispute.

6. What measures do we take to protect your personal data?

Data Controller has taken appropriate technical and organizational measures to protect your personal data against accidental or unlawful processing, including by ensuring that:

• your personal data is protected against unauthorized access;
• the confidentiality of your personal data is assured;
• the integrity and availability of your personal data will be maintained;
• personnel is trained in information security requirements;
• actual or suspected data breaches are reported in accordance with applicable law.

7. Where do we store your personal data?

Due to the nature of the services, we will transfer your personal data to locations outside the European Union. Specifically, your personal data will be processed in the following countries outside the European Union:

• -United States
• -Israel

When personal data is transferred outside of the European Union, such transfer of personal data will either be subject to the European Commission’s standard contractual clauses or the EU – U.S. Data Privacy Framework.

You can request a copy of the agreement covering the transfer of personal data by sending an e-mail to lulucph@arionretail.com.

8. What rights can you exercise in relation to your personal data?

You can exercise a number of rights in relation to your personal data, which are explained below. In each case, please use the contact details below if you would like to exercise any of your rights.

Right of access

You have the right to obtain access to the personal data we process about you and to obtain additional information on how we use it. Your personal data will usually be provided to you electronically.

Right to rectification

We take reasonable steps to ensure that the information we process about you is accurate and complete. Nevertheless, you have the right to obtain rectification of your personal data.

Right to erasure

You have the right to obtain erasure of your personal data, for instance if the personal data we collected is no longer necessary for the original purpose or if you withdraw your consent.

Right to restriction of processing

You are entitled to obtain restriction of the processing of your personal information, for instance if the personal data we hold about you is inaccurate or if we no longer need to use your personal data.

Right to data portability

You have the right to receive your personal data in a structured, commonly used and machine-readable format and have it transmitted to another controller of your choice.

Right to object

You have the right to object to processing which is based on our legitimate interests. Unless we have a compelling legitimate ground for the processing, we will no longer process the personal data on that basis when you file an objection.

Rights relating to automated decision-making

You have the right not to be subjected to automated decision-making, including profiling, which produces legal effect for you or has a similar significant effect. If you have been subject to an automated decision and do not agree with the outcome, you can contact us using the details below and ask us to review the decision.

Right to withdraw consent

We may ask for your consent to process your personal data in specific cases. When we do this, you have the right to withdraw your consent at any time.

Right to file a complaint

You have the right to file a complaint with the Danish Data Protection Agency, Datatilsynet, (lead supervisory authority) on its website www.datatilsynet.dk – or the data protection authority in your country.

9. What if I have other questions?

If you would like to contact us in regard to the processing of your personal data, please send an e-mail to lulucph@arionretail.com.

We may update this Privacy Statement from time to time without notice to you, unless we implement material changes, so please check regularly. This version of the Privacy Statement was published on 12/03/2025.