Privacy Policy | LEAP&Co

LEAP&CO

Basic Information on Data Protection:

Joint Controllers	Employees	INDITEX (as defined in the Terms and Conditions) and/or the company of the Inditex Group that you are currently employed by (herein after “We”).
Joint Controllers	Service Providers	ITX MERKEN, B.V.,and/orthe Company of the Inditex Group where you are providing services through your employing company.
Purposes	Employees	We will use your personal data to manage your registration as a user of LEAP&Co application (hereinafter “LEAP&Co”), in accordance with the Terms and Conditions, as well as to manage the training plans and evaluations.
Purposes	Service Providers	We will use the personal data that your employer has provided us (corporate user id) in order to manage your registration as a user ofLEAP&Co as well as to allow your training in the Inditex Group's work procedures, which will be evaluated by your employer company.
Rights	You have the right to access, rectify or delete the data, as well as other rights, as detailed in the additional information.
Additional information	For further information, continue reading the information in your applicable section of this Privacy Policy,

Additional Information:

If you are an employee of the Inditex Group:

Joint Controllers: Your data controllers are ITX MERKEN, B.V., a Dutch company with registered address in Amsterdam, Nieuwezijds Voorburgwal 307, 1012 RM, tax identification number NL 855820627B01, and/or the Company of the Inditex Group that you are currently employed by.

In other words, both ITX MERKEN, B.V.,and the Company of the Inditex Group that you are currently employed by (jointly “We”, “Us” or “the Joint Controllers”), are Joint Controllers of the data. This means that we have regulated and are jointly responsible for processing and protecting your personal data.

Purposes and legal basis: We will process your personal data (given name, surname, employee number, store or office where you work, country, as well as any other data or information which you may provide as a result of using the app) in order to manage your registration as a user ofLEAP&Coand manage the training plans and evaluations available.

The use of LEAP&Co will be mandatory in those cases where training is compulsory either because it is required by law or because it is a requirement to vary the functions, keep or change the position of an employee; in such cases users are obliged to provide their personal data for the access, browsing and use of LEAP&Co. Refusal to use this app in such cases will result in the user not being able to join the employing company, keep or change its position or vary its functions.

We will process your data while the employment relationship is in effect and will therefore not keep them longer than necessary for the purposes described above, notwithstanding any conservation that may be necessary after the employment relationship has ended for the establishment, exercise or defence of potential claims and/or whenever so permitted by applicable legislation. In any case, the keeping of the personal data after the employment relationship has ended will imply that the Data will be duly kept with access restricted only to those persons with responsibility in the company to defend the claims or liabilities that may potentially arise.

Data recipients: To achieve the purposes set out in this Privacy Policy, We must give access to your data to the companies of the Inditex Group to the extent that these are involved in the development, execution and diffusion of LEAP&Co (whose activities are associated with the sectors of decoration, textiles, ready to wear garments and home furnishings, as well as any other of a complementary nature, including cosmetics and leather goods, as well as the development and provision of support for e-commerce activities) and to third parties that give support to Us, as technological services.

Rights:You may at any time exercise your rights of data protection (access, rectification, erasure, right to be forgotten, limit the processing, objection, portability, as well as any other that could correspond according to the applicable data protection regulation) as well as to contact the Data Protection Officer for any consult related with data protection, by sending an email to the address dataprotection@inditex.com, with the subject “LEAP&CO” and indicating the right you want to exercise. If necessary, we may request additional information proving your identity, which will be erased once the purpose of identifying you has been fulfilled.

We also inform you that you have the right to file a claim before the responsible data protection regulatory authority. If you have additional doubts about the processing of the personal data, please send an email to dataprotection@inditex.comindicating in the subject line "LEAP&CO".

Specific Market Provisions:We also want to inform you about the Specific Market Provisions that may be applicable to the present Privacy Policy. These provisions are included below in the Appendix to this document and are applicable to the use of LEAP&Co to the extent it may be necessary for full compliance with applicable local regulations. In case the Specific Market Provisions cease to be compulsory due to potential legislative changes under local regulations, they will no longer be applicable to the use of LEAP&Co. This Privacy Policy shall prevail over the Specific Market Provisions included in the Appendix below, unless so required by applicable local regulations.

If you are a service provider of the Inditex Group:

Joint Controllers:Your data controllers are ITX MERKEN, B.V., (a Dutch company with registered address in Amsterdam, Nieuwezijds Voorburgwal 307, 1012 RM, tax identification number NL 855820627B01) and/or the Company of the Inditex Group which you are assisting through your employing company. This means “We”, “Us” or “the Joint Controllers”, are jointly responsible for processing and protecting your personal data.

Purposes and legal basis: In addition to the information you have been provided by your employing company, please note Wewill process the personal data that your employer has provided us (corporate user id) in order to manage your registration as a user of LEAP&Co as well as to allow your training in the Inditex Group's work procedures, which will be evaluated by your employer company.

We are lawfully entitled to use your data for various reasons:(i) the execution of the Terms and Conditionsthat you accept when registering as a user of LEAP&Co and (ii) the execution of the services agreementbetween the Inditex Group´s company which you are assisting and your employing company, in relation to the working procedures of the Inditex Group that you must be familiar with in order to provide the service.

The use of LEAP&Co is therefore necessary for performing the services agreement entered into by your employer company, which means it is necessary for users to provide their personal data in order to access, browse and use LEAP&Co. Refusal to use this app in such cases will result in the consequences set out by your employer which may prevent the user from being able to provide the service agreed with the employer company.

We will process your data while the service agreement with your employer company is in effect and will therefore not keep them longer than necessary for the purposes described above, notwithstanding any conservation that may be necessary after the service relationship has ended for the establishment, exercise or defence of potential claims and/or whenever so permitted by applicable legislation. In any case, the keeping of the personal data after the service relationship has ended will imply that the Data will be duly kept with access restricted only to those persons with responsibility in the company to defend the claims or liabilities that may potentially arise.

Data recipients: Your trainings will be shared with your employer, who will be solely responsible for its evaluation. To achieve the purposes set out in this Privacy Policy, We must give access to your data to the companies of the Inditex Group to the extent that these are involved in the development, execution and diffusion of LEAP&Co (whose activities are associated with the sectors of decoration, textiles, ready to wear garments and home furnishings, as well as any other of a complementary nature, including cosmetics and leather goods, as well as the development and provision of support for e-commerce activities) and to third parties that give support to Us, as technological services.

Rights:You may at any time exercise your rights of data protection (access, rectification, erasure, right to be forgotten, limit the processing, objection, portability, as well as any other that could correspond according to the applicable data protection regulation) as well as to contact the Data Protection Officer for any consult related with data protection, by sending an email to the address dataprotection@inditex.com, with the subject “LEAP&CO PROVIDERS” and indicating the right you want to exercise. If necessary, we may request additional information proving your identity, which will be erased once the purpose of identifying you has been fulfilled.

APPENDIX - SPECIFIC MARKET PROVISIONS

France:

Data Protection rights:

Users also have the right to determine the rules governing the destination of their data after their death.

Italy:

Data Protection Rights:

Under certain circumstances pursuant to Article 2-undecies of the Legislative Decree 10 August 2018, No. 101, implementing the GDPR in Italy, such as where it is necessary for the data controller/s to exercise legal claims before Courts, the exercise of Users privacy rights may be delayed, limited or excluded. In such a case, the data controller will provide the Users without delay with a reasoned statement and Users may still request that the Garante verifies that the referred delay, limitation and exclusion are based on legitimate grounds.

Germany:

Data Protection Rights:

- Access: The right of access is limited pursuant to Section 34 German Federal Data Protection Act ("FDPA"). The right of access does e.g. not apply if the data (a) were recorded only because they may not be erased due to legal or statutory provisions on retention, or (b) only serve the purposes of monitoring data protection or safeguarding data, and providing information would require a disproportionate effort, and appropriate technical and organizational measures make processing for other purposes impossible.

- Erasure: The right to erasure does pursuant to Section 35 FDPA, for instance, not apply if in the case of a non-automated processing erasure would be impossible or would involve disproportionate effort due to the specific mode of storage and if Users interest in erasure can be regarded as minimal. In such case, Users may have the right to restriction of processing.

Unites States:

If you are an employee of the Inditex Group, employment with ZARA USA, Inc. is “at will,” meaning employment may be terminated at any time, for any reason or no reason, with or without notice, either by the company or by the employee. This Privacy Policy does not create a contract for employment for any specific terms, and nothing in this policy shall be interpreted to be in conflict with or to eliminate or modify in any way, the at will employment status.

Nothing in this policy is intended to interfere with the rights of employees to engage in protected concerted activity, either with coworkers or others, communicate about wages, hours or terms and conditions of employment and any other rights provided under the National Labor Relations Act (“NLRA”) and to the extent that conduct is protected under the NLRA, this policy does not prohibit it.

Slovenia:

If you are an employee of the Inditex Group,when personal data is processed by ITX MERKEN, B.V. for the purposes related to employment relationship, personal data is processed on the basis of legitimate interests of ITX MERKEN, B.V., namely to manage HR matters on a group level.

Serbia:

Data recipients:

The data recipients will in some cases be foreign entities and your personal data may be transferred outside of the Republic of Serbia. As a rule, your personal data will not be transferred to any of the countries which are deemed as countries that do not provide an adequate level of personal data protection under the local law.

Data Protection Rights:

The responsible national data protection authority to which a complaint can be logged is the Commissioner for Information of Public Importance and Personal Data Protection.

Bosnia and Herzegovina:

If you are an employee of the Inditex Group,personal data of the employee may collect, process, use and provide to third parties only the responsible person of the employer in accordance with regulations related to personal data.

Hungary:

Right to lodge a complaint: Without prejudice to any other remedy, you have the right to lodge a complaint with the Hungarian supervisory authority (Nemzeti Adatvédelmi és Információszabadság Hatóság(NAIH), website:www.naih.hu).

Czech Republic:

If you are an employee of the Inditex Group, refusal to use the LEAP&Co. app (non- providing of personal data for access, browsing and use of the app) may not be the reason for termination of the employment relationship,unless passing the training is required by applicable law or regulations, or explicitly determined by the User’s employer due to mandatory requirements. It also may not be the reason for transferring an employee to another work (working position) than agreed in the employment agreement without other conditions being fulfilled unless the employee may not continue to carry out their current functions due to legal or mandatory requirements.

South Africa:

Data recipients:

The data recipients will in some cases be foreign entities and your personal data may be transferred outside of the Republic of South Africa. As a rule, your personal data will not be transferred to any entity in a foreign country which does not provide an adequate level of protection under local law or does not have binding corporate rules or a data transfer agreement in place providing for an adequate level of protection similar to that provided for in South Africa.

Taiwan

We will share the data with data recipients, which locate within or outside of Taiwan.

In addition to the rights mentioned above, under Taiwan Personal Data Protection Act, you also have the rightto request a copy of your personal data.