Privacy and Cookies Policy

At Aqualung Group, as data controller, we are extremely cautious and concerned by the privacy of our clients and users. We are proud to work hard to ensure that our processing operations comply with all regulations applicable to protect your privacy.

It is important that you understand how we look after your Personal Data (as defined in section 2 below) and how we make sure that we meet our legal obligations to you under the applicable data protection laws (including associated guidance) (the "Data Protection Laws") which include the Data Protection Act 2018 and the General Data Protection Regulation ("GDPR") and the California Consumer Privacy Act (“CCPA”) for resident of California.

The present document applies to the processing activity carried out by us on your Personal Data when you navigate or share Personal Data with us on the Aqualung Group website: www.milproaqualung.com (hereinafter, the "Website") and describe the conditions under which your Personal Data is collected and processed by our company on the Website.

1. IDENTITY OF THE CONTROLLER

In this privacy policy, the terms "we", "our", and "us" are used to refer to:

Aqualung Corporate

300 Rue du Vallon, Les Vaisseaux – Bâtiment C

06560 Valbonne – Sophia Antipolis

(France)

Hereinafter "Aqualung".

We are a controller of your information, which means that we are responsible for looking after it. We will use your Personal Data fairly, lawfully and in a transparent manner, and in accordance with the Data Protection Laws.

2. THE PERSONAL DATA COLLECTED ON THE WEBSITE

By using our Website, you will transmit data to us, some of which are likely to identify you ("Personal Data").

This is particularly the case when you fill in forms to contact us.

This information shall contain in particular the following data:

• Your first name and surname;
• Your email address;
• Your phone number;

The mandatory or optional nature of the Personal Data requested from you, and the consequences if any of a failure to answer, are specified at the time of data collection with an asterisk (*).

Each time you visit our website, we may also automatically collect information and Personal Data about your computer for system administration including, where available, your IP address, your operating system and browser type and navigation data, as described in the next section below. Please see our cookies policy in sections 8 and 9 of this privacy policy for further information about what information may be automatically collected when you visit our websites.

3. PURPOSES OF THE PROCESSING ACTIVITY OPERATED ON YOUR PERSONAL DATA ON THE WEBSITES

We process your Personal Data through our Websites for the following purposes:

1. to be able to answer your queries;

2. to manage and track your orders;

3. to allow you to participate in interactive features on our websites, our apps, and in relation to our services, when you choose to do so;

4. to administer our websites and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes;

5. to analyze how you use the Website (including behavior patterns and the tracking of visits across multiple devices) to improve our own goods and services;

6. to establish more about our website users; and

7. to create and assist us in managing your account, improve your Website experience and ensuring that the Website content is presented in the most effective manner for you and for your computer;

8. to measure, understand or monitor the effectiveness of advertising, promotions, marketing material and content and any joint initiatives with our affiliates, suppliers, partners, subcontractors and other selected third parties;

9. to make suggestions and recommendations to you and other users of our Website or services about goods or services that may interest you or them; and

10. to comply with our legal and regulatory obligations and for the purposes of assisting with the prevention and detection of crime;

11. to answer your queries related to you rights as described in Section 7.

Data Protection Laws require that we meet certain conditions before we are allowed to use your data in the manner described in this privacy policy. To use your Personal Data, we will rely on the following conditions, depending on the activities we are carrying out:

• you have given consent to the processing of your Personal Data for one or more specific purposes, in which case you have the right to withdraw your consent for those specific purposes at any time;
• the processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; and the processing is necessary for our legitimate business interests, and we consider that the processing is reasonable (without unreasonably intruding on your privacy) to:
• provide you with goods and services as requested by you;
• to carry out research to understand our customers and how they use our products and services; and
• develop and improve our services to you and to our other Website users; and
• the processing of your Personal Data is necessary for compliance with a legal obligation to which we are subject.

4. RECIPIENTS OF YOUR PERSONAL DATA

Under this policy, "Aqualung Affiliates" means all the companies controlled directly or indirectly, by Aqualung Corporate (300 Rue du Vallon, Les Vaisseaux – Bâtiment C, 06560 Valbonne – Sophia Antipolis, France).

We may share your information with the other members within Aqualung and Aqualung Affiliates but only for the purposes specified in this privacy policy.

We may disclose your personal information:

• to business partners, suppliers and sub-contractors for the performance of any contract we enter into with them or you, for example where we use a third party to provide services to enable us to deliver goods and/or services to you;
• to analytics and search engine providers and other selected third parties that assist us in the improvement and optimisation of our Website;
• to our regulators, law enforcement or fraud prevention agencies, as well as our advisors (including legal advisors and auditors), courts, any other authorised bodies, for the purposes of investigating any actual or suspected criminal activity or other regulatory or legal matters etc;
• in the event of a merger, acquisition or other similar event, to a prospective buyer or otherwise of our business or assets, in which case we will disclose your personal data to such prospective buyer or otherwise of such business or assets;
• if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of Aqualung and Aqualung Affiliates, our customers, or others. This may include exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction; and;
• to legal advisors and otherwise in connection with legal proceedings in order to enforce or apply our rights under any contract.

We do not share your information with third parties for marketing purposes.

5. WHERE WE STORE YOUR PERSONAL DATA

All information you provide to us is stored on our secure servers, or those of our group.

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our websites and apps, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your Personal Data, we cannot fully guarantee the security of the Internet during the transmission of your data to our websites; such transmission is at your own risk.

Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access, including keeping security patches up to date wherever possible, and by constantly investigating new ways to keep data secure.

Transfers outside of the European Economic Area

If you are resident of the European Economic Area the data that we collect from you may occasionally be transferred to, and stored at, a destination outside the EEA, for example to a member of Aqualung based in the United States.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

In particular:

• We signed Standard Contractual Clauses within Aqualung and Aqualung Affiliates (an "appropriate safeguard") to ensure an adequate level of data protection;
• We control that transfers made by our Data Processors are made in compliance with the GDPR.

6. RETENTION OF YOUR PERSONAL DATA

We will use and/or store your data as long as it is necessary for the purposes listed above.

More precisely:

We will keep your personal data for as long as we need it to provide you with your requested service(s) or to meet our commercial or legal obligations. To determine the retention period of your personal data, we consider several criteria to make sure that we do not keep your personal data for long than is necessary or appropriate. These criteria include:

• The purpose for which we keep your personal data;
• The purpose for which we keep your personal data;
• Our legal and regulatory obligations in relation to that personal data;
• Whether our relationship with you is ongoing, for example, you have an active account with one or more of our brands, you continue to receive marketing communications,
• Whether you are no longer actively participating or engaging with our brands, for example, you do not have an active account, open our emails, visit our websites, or share user generated content;
• Any specific requests from you in relation to the deletion of your personal data; and
• Our legitimate business interests in relation to managing our own rights, for example the defence of any claims.

When we no longer need to retain your personal data, it will be deleted or be anonymised so that you can no longer be identified from it.

7. EXERCISING YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA

You have the right to access, to rectify, to restrict and, where applicable, to delete your Personal Data. You also hold the right to data portability.

You may also be entitled, on legitimate grounds, to object to the processing of any Personal Data relating to you.

Privacy Rights of California Residents

As a resident of California, you have rights under the California Consumer Privacy Act, California Civil Code § 1798.100 et seq., (with any implementing regulations and as may be amended from time to time, “CCPA”) relevant to your Personal Data (as defined under the CCPA), as well as other laws. The rights described herein are subject to exemptions under the CCPA and other limitations under applicable law.

California Consumer Rights under the CCPA: If your Personal Data is subject to the CCPA, you may have certain privacy rights with regard to that information.

You may have right to:

• Request that we provide you access to the following no more than twice in a 12-month period:
  • the categories and specific pieces of Personal Data that we have collected about you;
  • the categories of sources from which the Personal Data is collected;
  • the business or commercial purpose for collecting or sharing your Personal Information; and
  • the categories of third parties with whom we share your Personal Information; and
  • the categories of Personal Data that are sold (as defined under the CCPA) and the categories of third parties to whom the Personal Data was sold.
• Request that we delete your Personal Information, subject to exceptions under the CCPA or other applicable law; and

California residents also have the right not to receive discriminatory treatment for the exercise of any of the privacy rights conferred by the CCPA, as described in this section. Aqualung will not discriminate against you because you have exercised any of your rights under the CCPA.

How to exercise your rights?

If you wish to exercise your rights, you may submit a request by emailing GDPR-FR@aqualung.com.

or by post at :

Aqualung Corporate

GDPR Key Contact

300 Rue du Vallon, Les Vaisseaux – Bâtiment C

06560 Valbonne – Sophia Antipolis

(France)

We will respond to any request received from you within one month from the date of the request. If your request is not sufficiently precise or does not include all elements enabling us to answer your request, Aqualung may ask you to provide additional elements.

CCPA exercise of rights

If you are resident in California and you wish to exercise your rights, you may submit a request by emailing GDPR-USA@aqualung.com. If you choose to submit your request via email and if you are resident in California, you must include “CCPA Request” in the subject line and clearly provide us with the following information: what type of request you are making, your full name, email address, and shipping address. You may only make one request per email. Aqualung is required to provide you with access to your Personal Data or delete your Personal Data only in response to verifiable consumer requests. We will compare the information you provide by telephone or via email with any information we may have in our possession in order to verify your request. We may also contact you to request additional information in relation to your request. The information you provide must match the information we have in our possession. This measure is in place to help ensure that Personal Data is not disclosed to any person who does not have the right to receive it. The information collected through this process will be used for verification purposes only. Please note that you may authorize an agent to exercise any of these rights on your behalf by contacting us by email at GDPR-USA@aqualung.com. If you use an agent, we will take measures to verify your agent’s authorization similar to the verification described above for fulfilling any access or deletion requests. We may require more information to ensure proper verification of you and your agent’s identity and authorization.

California residents may also ask us to provide them with :

• a list of certain categories of personal data that we have disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year, and
• the identity of those third parties. California residents may make one request per calendar year.

In your request, please include a subject line that states “CA Shine the Light Request”, state that you are a California resident, and provide a current California address for our response.

8. COOKIES

We use various cookies on the Website for website analysis and improvement. When you visit our Website, cookies may be placed on your computer or smartphone.

What is a cookie?

A "cookie" is a small text file placed in your browsing software to facilitate your browsing through our Website.

Different types of cookies are placed on the Website:

Technical cookies required to run the Website in the best possible manner. You may refuse and delete, as specified below, these cookies through your browser's parameters, but your user experience will necessarily be disrupted. This technical cookies include:

• • Session cookies, which allow the ordinary browser session and use of the Website (for instance, allowing the authentication in the personal user area). Session cookies are only set temporarily: when you close the browser, the cookies will be removed;
  • Functional cookies, which allow the user to browse the Website according to a set of selected criteria (for instance, products selected for the purchase) in order to improve the service provided.

Analytics cookies, aimed at adapting the Website to the users' needs, assessing the number of visits and pages viewed as well as the activity of our users. These cookies help us enhance our services to offer you the best possible user experience.

Third party cookies, used for improving the interactivity of the Website. These third parties shall be deemed as the solely responsible for any infringement of the applicable legislation or contractual obligations, which may result through the use or disclosure of said cookies. Aqualung has no access and/or control over the information provided by the cookies of such third parties. This information is completely controlled by the third parties according to their relevant privacy policy. The Website rely on several services offered by third party websites, which include: Sharing buttons (Facebook, Twitter, Google+, Youtube)

List of cookies:

9. MANAGEMENT OF COOKIES

During your first visit on the Website, a banner informs you of the use of cookies on the Website and invites you to accept such cookies. The cookies will only be deposited if you accept them or continue your browsing on other web pages of the Website or by selecting an element of the Website (i.e. image, link, logo, search button, etc.), which will be understood as your acceptance of the use of cookies.

You can, at all times, parameter the cookies used on the Website. Your browser can also be set up to inform you of the cookies placed on your browsing software and to ask you to accept them or not. You can accept or refuse the cookies one by one or refuse them systematically. We remind you that the setting of the cookies is likely to changes the way you access to our contents and services requiring the use of cookies. Please bear in mind that the removal of certain cookies is likely to change the way you access to our services.

Each navigation software has its own cookie management settings. The procedures are described in the Help Menu of the software:

• For Internet Explorer™: click here
• For Safari™: click here
• For Chrome™: click here
• For Firefox™: click here
• For Opera™: click here

Except for strictly necessary cookies that are required for the operation of our Website, all cookies will expire after a maximum of two years.

10. CHANGES TO THIS PRIVACY POLICY

We will take all measures necessary to communicate any changes to this privacy policy to you and will post any updated privacy policies on this page. This policy was last reviewed and updated in January 2022.