1. The controller responsible for operating the Mammut website (hereinafter called the "Website") and the Mammut online store (hereinafter called the "Online Store"), as well as for collecting, processing and using your personal data in accordance with the applicable data protection provisions is Mammut Sports Group AG, Birren 5, 5703 Seon, Switzerland.

2. The contact information for our Data Protection Officer is as follows: Jost Spicher, MB Konzept GmbH, Hofstrasse 13, 52499 Baessweiler, Germany, spicher@mbkonzept.de ↗, 0049 2401 3992181.

1. The term "personal data" refers to all information relating to an identified or identifiable natural person. This includes, for example, your name, telephone number, postal address and e-mail address.

2. Personal data, as defined in the applicable data protection provisions, also include information concerning your use of the Website, which are collected, processed, stored and used by our Web servers to enable the provision and optimisation of our Website and ensure system security and for statistical purposes (the "User Data"). These include, inter alia, the connection data of the requesting computer (IP address), the pages that you visit on our Website, the date and length of your visit, the identification data of the type of browser and operating system used, the website from which you visit us and the length of time until the order is placed.

3. Apart from the User Data described in para. (2) above, we will only collect personal data if you voluntarily share them with us. The following data are collected when you open a customer account: title, name, postal address, e-mail address (“Registration Data”). When you place an order, the following additional data is collected: payment information, such as your bank details or credit card number, as well as data concerning the products ordered/the contents of your shopping cart (“Order Data”).

4. You have the option to update the data in your customer account anytime und to add further details (e.g. your telephone number or date of birth) on a voluntary basis.

5. If you subscribe to our Newsletter (see Section F. below), we will collect and process the following personal data: title, name, e-mail address.

6. The personal data collected from you (Registration Data, Order Data and User Data) are stored lawfully and as specified by the applicable data protection provisions. Your data will, of course, be treated confidentially.

1. Your Registration Data and Order Data will be used to perform the agreements concluded between you and us, particularly for delivering ordered products to the address provided by you. The legal basis for this processing is performance of the agreement, respectively conducting precontractual activities. The provision of these personal data is a contractual requirement. If you do not provide these personal data, you cannot set up a customer account or order any products, as applicable.

2. If we have received your e-mail address in connection with the purchase of a product or service, we will use your e-mail address for advertising similar products or services of our own. You can opt out of this use of your e-mail address for these purposes at any time without incurring any cost other than the applicable transmission costs at the basic rates. The legal basis for this processing is our legitimate interests in processing personal data for direct advertising.

3. Furthermore, provided you have given your consent, your data may be used for purposes of internal marketing research or designing our product line to meet our customers' needs, as well as for sending e-mails containing information about our offerings, i.e. products and services that may interest you (e.g., tours). For purposes of market research and to design our product line in a goal-oriented manner so as to meet our customers' needs on all our sales channels, your data, which have been collected via several different communications channels and systems for mail order, over-the-counter trade and online trade, will be merged into a centralised electronic customer database, analysed and used for marketing campaigns. The legal basis for this processing is your consent.

4. Provided you have given your consent, in addition to the data transmitted by you, automatically generated data will also be collected and utilised to design advertising tailored to you. These include, for example, e-mail receipt and read confirmations, information about the computer and operating system used, orders already placed, date and time of your visit to our website, as well as products viewed by you. The legal basis for this processing is your consent.

5. To the extent technically possible and reasonable, you can also use our website anonymously or under a pseudonym.

1. Your Registration Data, Order Data and User Data will be processed by persons in departments of Mammut who need to know the personal data.

2. Your Registration Data, Order Data and User Data will also be transmitted to affiliated companies of Mammut. Disclosure is made for the purpose of centralised storage, evaluation and management of administrative tasks, as well as for marketing purposes. The legal bases for the disclosure are the legitimate interests of Mammut, particularly internal management purposes, as well as marketing purposes. Switzerland is a third country according to the applicable data protection law, however, the EU Commission has issued an adequacy decision for Switzerland. Your data will be transmitted to Switzerland and stored there securely.

3. For purposes of delivering goods and processing payments, we transmit the necessary data to logistics companies and payment service providers. These service providers are carefully selected and contractually obligated to treat your data confidentially and to use them exclusively for purposes of making the delivery or processing payment, as applicable.

4. Furthermore, unless this Data Protection Policy specifies otherwise, we will only disclose your personal data to third parties if we are authorised or obligated to do this based on legal provisions or official or court orders or if you have given us your express consent to do this.

1. If we are required to provide our service in advance, for example, in case of a purchase on account, we may carry out a credit check with a credit agency in order to uphold our justified interests on the basis of mathematical and statistical processes, if applicable. To this end, Mammut will provide your name, postal address, shopping cart, the invoice amount, your customer history (i.e., whether, by the time of the purchase, Mammut has had positive or negative payment experiences with you), and, if direct debit is used, your bank details and, if necessary, your date of birth, to carefully selected service providers. These service providers will verify whether any negative indicators exist regarding your credit and then determine your "score value". The "score value" utilises known empirical values and a mathematical statistical procedure, including the use of postal address data, to predict the risk of potential non-payment. If the outcome of the credit check is negative, you will only be offered the option to use payment methods in connection with which we do not provide our service in advance. If the outcome of the credit check is positive, we will provide the service in advance. The legal bases for the disclosure of your personal data to selected service suppliers and for processing the scoring value are our legitimate interests, particularly protecting against non-payment and preventing fraud, as well as the legitimate interests of consumers, such as protecting against excessive debt.

2. If you choose one of the payment options of our partner   ↗Klarna Bank AB (publ) ↗, Sveavägen 46, 111 34 Stockholm, Sweden, or its affiliate Billpay GmbH, you will be asked during the ordering process to agree to the transmission to Klarna / Billpay of the data necessary for the processing of the payment and for an identity and credit check. If you give your consent, your data (name, surname, street, house number, postal code, city, date of birth, telephone number and, in the case of direct debit purchases, the bank account details provided) and data relating to your order will be transmitted to Klarna / Billpay.

3. For the purpose of its own identity and credit checks, Klarna and Billpay or partner companies commissioned by Klarna or Billpay will transmit data to credit agencies (inquiry agencies) and receive information from them as well as, if applicable, credit information based on mathematical-statistical methods, in the calculation of which, among other things, address data are included. Detailed information on this and the credit agencies used can be found in the privacy policy of Klarna ↗ and Billpay ↗.

4. Klarna and Billpay may also use third party tools to detect and prevent fraud. Data obtained with these tools may be stored by third parties in encrypted form so that they can only be read by Klarna and Billpay. Only if you select a payment method of our cooperation partner Klarna and Billpay, this data will be used, otherwise the data will expire automatically after 30 minutes. The legal basis for processing and transmission is the consent.

1. If you register for the Mammut newsletter and have consented to receiving newsletters and advertising e-mails, we will use your e-mail address for internal advertising purposes. You can opt out of delivery of the newsletter and the use of your e-mail address for advertising purposes with prospective effect at any time by clicking on the link included in the newsletter or in the promotional e-mails or via e-mail to datenschutz@mammut.com ↗. We will also notify you separately of this right to opt out in the e-mail that accompanies our newsletter and in all other promotional e-mails. The legal basis for the processing of your personal data is your consent.

1. Our Online Store uses cookies to facilitate the operation of our website and to improve its ease of use. Cookies are small alpha-numeric text files that make it possible to recognise your computer if you visit the site again. User names and preferences can be provided such that you do not have to re-enter the data. The most common type of cookies used are called "session cookies". These are deleted once you close your browser. A number of these cookies are stored on your computer permanently. These "permanent cookies" enable the Website to recognise your computer when you call up the page again. You will find an overview and description of the cookies in our Cookie Guidelines ↗.

2. You can deactivate the use of cookies in your browser. However, this may mean that certain features and applications of the Website will not work as usual or to the fullest extent. The legal bases for the processing of your personal data in connection with cookies are legitimate interests or your consent.

1. This Website uses Google Analytics, a web analysis service of Google Inc. („Google“, www.google.com ↗), Econda Shop Monitor from Econda GmbH (“Econda“, www.econda.de ↗) and Bloomreach CDXP from BloomReach Inc.

2. Google Analytics uses "cookies", text files that are stored on your computer and make it possible to analyse your use of the Website. The information generated by the cookie regarding your use of this Website is normally transferred to one of Google's servers in the USA and stored there. IP anonymisation has been activated on this website, so the IP address of users will be abbreviated beforehand by Google within Member States of the European Union or in other States party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be transferred to one of Google's servers in the USA and abbreviated there. Google will utilise this information on behalf of the operator of this Website to analyse the use of this Website, compile reports on Website activity and to provide its operator with additional services related to the use of the Website and of the Internet. The IP address transmitted by your browser in connection with Google Analytics will not be combined with other Google data. You can find additional information about data protection at Google. You can prevent the storage of cookies by configuring your browser software appropriately; however, please note that, if you do this, you may not be able to use all of this Website's features to the fullest extent.
   You can also prevent the data generated by the cookie regarding your use of the Website (including your IP address) from being recorded and transferred to Google and from being processed by Google by downloading and installing the browser plugin via the following link ↗.
   

3. To ensure the tailored design and optimum performance of this website, as well as for marketing purposes, solutions and technologies from econda GmbH (www.econda.de) not only collect and store anonymised data but also utilize these data to compile usage profiles by means of pseudonyms. Cookies can be used for this purpose which make it possible for an Internet browser to be recognized. Usage profiles will only be stored together with data pertaining to the pseudonymous visitor with his or her express consent. IP addresses, in particular, are rendered indecipherable immediately after receipt, which makes it impossible to match a usage profile with an IP address. Visitors to this website can opt out here - at any time - of the collecting and storing of their data.
   

4. We use Bloomreach for personalization, analytics, automation and email campaigns (Bloomreach privacy policy ↗). Based on cookies and tracking pixels we create tailored newsletters and advertising. In case of given consent to receive our newsletter and have fully completed the double opt-in process to verify your email address or have entered your email address on our website, your personal data will be collected by Bloomreach and combined into a user profile that can be associated with your email address. If you visit our website, then the data collected by Bloomreach may also be combined if you have given your consent to receive our newsletters or become part of the member program in one of our offline stores.

1. On the Website, we use "social plugins", e.g. from Facebook, Twitter, Google etc., which bear the logo of the respective provider. These plugins are intended to better distribute the content of our website. The legal basis for this processing is our legitimate interest in distributing the content of our website.

2. Our website contains buttons that allow you to share content on the sites regarding the services of Facebook, Twitter and Google. Facebook, Twitter and Google are social networks that are not affiliated with Mammut. They have their respective registered offices at the following addresses:

• Facebook: 1 Hacker Way, Menlo Park, CA 94025, USA

• Twitter: 1355 Market Street, Suite 900, San Francisco, CA 94103, USA

• Google: 1600 Amphitheatre Parkway, Mountain View, CA 94043 USA

If you use the “share” buttons of Facebook, Twitter or Google, your device accesses the respective websites. As a result, your data are sent to the party associated with the “share” button. Your computer will use your browser to set up a direct connection to the provider's computer. The plugin's content is transferred by the provider directly to your computer and integrated into the web page by your browser. The provider thereby receives notification that you have called up the relevant Mammut Website. If you are simultaneously logged on to the respective provider, this provider may also add your visit to your profile. You can obtain more information about the collection, use and disclosure of your personal data by Facebook, Twitter and Google in their respective privacy statements, which you can access on their respective websites.

1. Your payment data are protected in the course of transmission to our servers by using SSL security procedures (Secure Socket Layer) in connection with 256-bit encryption. You can check the security of the connection using the information in your browser's URL display. If the start of the address line changes from "http" to "https", the connection is secure.

2. Furthermore, all service providers used for purposes of processing payments are PCI-DSS certified (Payment Card Industry Data Security Standard). By complying with the PCI Data Security Standards, they fulfil the most stringent requirements of e-Commerce industry standards. More information about this is available, for instance, at www.pcisecuritystandards.org ↗.

1. We will keep your personal data as long as necessary to perform the requested service for you. If we no longer need your personal data for purposes of complying with our contractual or statutory obligations, we will delete the data from our systems or anonymise them appropriately so that any identification is impossible, unless we must retain information, including your personal data, in order to comply with statutory or official obligations to which we are subject, e.g., statutory retention periods indicated in the Commercial Code or the Tax Code, which generally last for 6 to 10 years or, if we have to safeguard evidence for the statutory limitations periods, which are normally 3 years, but may last up to 30 years.

1. Under the applicable data protection provisions, you have, where applicable, the right to (i) information regarding your stored data, (ii) correction, (iii) restriction, (iv) deletion, (v) opt out, (vi) data portability and (vii) revocation of your consent. You can find more detailed information about the various individual rights in the Appendix to this Data Protection Policy. You also have the right to submit a complaint to a supervisory authority.

2. Should you have any additional questions concerning data protection and the exercise of the above rights, please e-mail us at privacy@mammut.com ↗ ↗. Of course, you may also use the contact details provided in the Legal Information section of our Website or the contact forms provided on the Website and in the Online Store. Mammut will process and use the information provided by you exclusively for purposes of handling your request.

1. Mammut Sports Group Inc. reserves the right to amend this Privacy and Data Protection Policy from time to time. 

If you have granted your consent for certain data processing operations, you can revoke your consent prospectively at any time. This type of revocation does not affect the lawfulness of the processing performed based on the consent until the time of revocation.

Under the applicable data protection provisions, you have, where applicable, the right to (i) information (ii) correction, (iii) deletion, restriction on processing, (iv) data portability and/or (vii) opt out of the processing. The aforementioned rights may be restricted under national data protection provisions. Specifically: 

(i) Right to information: You have, where applicable, the right to require us to confirm whether personal data concerning you are being processed and, if so, you have the right to receive information about these personal data. The right to information includes, in particular, the purposes of the processing, the categories of personal data processed and the recipients or categories of recipients to whom the personal data are disclosed. Moreover, you have the right, where applicable, to receive a copy of the personal data processed. However, this right is not unlimited, as the rights of other persons may restrict your right to receive a copy. The right to information is restricted by Section 34 of the Federal Data Protection Act (FDPA). 

(ii) Right to correction: You have, where applicable, the right to require that incorrect personal information concerning you be corrected. Taking into account the purposes of the processing, you have the right to require that incomplete personal data be completed, including by means of a supplementary declaration. 

(iii) Right to deletion (“right to be forgotten”): Under certain conditions, you have the right to require us to delete personal data concerning you, and we are required to delete such personal data. The right to deletion is restricted by Section 35 FDPA. 

(iv) Right to restriction of the processing: Under certain conditions, you have the right to require us to restrict the processing of your personal data. In this case, the relevant data will be marked and used by us only for certain purposes. 

(v) Right to data portability: Under certain conditions, you have the right to receive, in a structured, conventional and machine-readable format, the personal data that you have provided to us concerning you, and you have the right to transmit these data to another controller without interference from us. 

To exercise these rights, please contact us as described in L.2.

You have the right to opt out, on grounds relating to his or her particular situation, at any time to the processing of personal data that concerning you which is based on Art. 6(1)(e) (data processing in the public interest) and (f) (data processing based on legitimate interests) General Data Protection Regulation. If you opt out, we will no longer process your personal data unless we can demonstrate that we have compelling legitimate grounds for the processing which override your interests, rights and freedoms or the processing serves the establishment, exercise or defense of legal claims.

Where personal data are processed for direct marketing purposes, you have the right to opt out, at any time, of the processing of personal data concerning you for the purpose of such marketing. This also applies to profiling to the extent that it is related to such direct marketing.