ECCO Sko A/S—Page 56

ECCO Sko A/SPERSONAL DATA PROTECTION POLICY 1. INTRODUCTION 1.1 Background The protection of fundamental rights and freedoms of natural persons is fundamental to the ECCO Group (hereinafter referred to as “ECCO”). This includes natural persons’ rights to the protection of their Personal Data (also referred to as their “Privacy”). Since ECCO is collecting and processing more and more personal data about its employees, consumers, and other partners, it is considered important that ECCO makes a clear commitment to protect such personal data and to implement appropriate measures to ensure that the personal data processed by ECCO is done in a lawful manner and with appropriate physical, technical, and organisational security measures in place to protect this data against accidental or unlawful destruction, or accidental loss, alteration, unauthorised disclosure or access. Furthermore, legislative requirements related to the processing and protection of personal data is constantly evolving all over the world, and it is becoming increasingly important that ECCO can demonstrate compliance with the provisions of legislation relating to personal data. 1.2 Purpose This Personal Data Protection Policy (“Policy”) determines how the ECCO Group in general shall ensure the protection of the personal data it collects and processes in relation to its employees, consumers, customers, and other data subjects. 1.3 Scope This Policy applies to all ECCO Group entities, including ECCO Holding A/S, ECCO Sko A/S and any subsidiaries hereof. 2. POLICY STATEMENTS 2.1 General Data Processing Principles ECCO shall ensure that Personal Data is: (a) processed lawfully, fairly, and in a transparent manner in relation to the data subject (the principle of lawfulness, fairness, and transparency); (b) collected for specified, explicit, and legitimate purposes and not further processed in a way incompatible with those purposes (the principle of purpose limitation); (c) adequate, relevant, and limited to what is necessary in relation to the purposes for which it is collected and processed (the principle of data minimisation); (d) accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay (the principle of accuracy); (e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed (the principle of storage limitation); (f) processed in a manner that ensures appropriate security of the personal data, including protection against unauthorised or unlawful processing, and against accidental loss, destruction or damage, using appropriate technical or organisational measures (the principle of integrity and confidentiality). 54Page 55Page 57