Privacy Notice for the Atomic Newsletter and Personalized Advertising

The controller responsible for the processing of your personal data in connection with the Atomic newsletter and related personalized advertising is:

Atomic Austria GmbH
Atomic Straße 1
A-5541 Altenmarkt im Pongau
Austria

If you have any questions regarding data protection, you may contact our Data Protection Officer at privacy@atomic.com.

Newsletter, Marketing Communications and Personalized Advertising

If you subscribe to our newsletter or marketing communications, we use your data to send you information about Atomic products, services, offers and events via the communication channels you have selected, in particular by email or SMS.

We may also use your data to display advertising tailored to your interests on digital platforms such as Google or Meta.

The legal basis for this processing is your consent pursuant to Art. 6(1)(a) GDPR.

Electronic direct marketing communications are sent on the basis of your consent in accordance with Section 174 of the Austrian Telecommunications Act 2021 (TKG 2021).

What Data Do We Process?

Depending on the information you provide when subscribing and the information already linked to your Atomic profile, we may process in particular:

• your name and contact details, in particular your email address and telephone number;
• the communication channels you have
  selected;
• interests and preferences provided by you;
• information from your Atomic user profile;
• information about your interactions with Atomic;
• information about the delivery and use of our messages, in particular delivery, opens and clicks on links contained in messages;
• information about your interactions with our products and offers;
• information regarding the granting, modification and withdrawal of your consent.

We may combine this information in order to tailor marketing content and advertising more closely to your interests.

Newsletter Personalization

We aim to provide you with content and offers that are as relevant as possible. For this purpose, we may combine and analyze the data you provide, your interests, information from your user profile and your previous interactions with Atomic.

In particular, we may take into account which newsletters you open and which links and content within those newsletters you select.

Based on this information, newsletter content may be individually tailored to you. This includes, in particular, dynamic product recommendations and other content adapted to your interests.

The purpose of personalization is to make our marketing communications more relevant to you. It does not result in automated decisions that produce legal effects concerning you or similarly significantly affect you.

Measurement of Opens and Clicks

Our emails may contain tracking technologies such as tracking pixels and individualized links. These technologies allow us, in particular, to determine whether a message has been opened and whether, and which, links contained in the message have been clicked.

This information is associated with your profile and used for the purposes described in this Privacy Notice.

In addition to personalization, we use this information to a limited extent to manage our communications. In particular, we may:

• limit the frequency of communications;
• identify when there has been no
  interaction with our messages for an extended period;
• send reminder or re-engagement communications;
  and reduce or discontinue communications to recipients who remain inactive.

For example, a re-engagement communication may be triggered after a longer period during which no email open has been recorded.

Personalized Advertising on Google and Meta

With your consent, we may also use your contact details and information from your Atomic profile to display personalized advertising to you on platforms operated by Google and Meta.

For this purpose, we may in particular use services such as Google Customer Match and Meta Custom Audiences.

Identifiers such as your email address or telephone number may be transferred to the respective platform provider and matched against existing user accounts. Where technically provided for, such data is transferred using cryptographic hashing.

A successful match may allow us, in particular, to:

• recognize existing Atomic customers or newsletter recipients on the respective platforms;
• display Atomic advertising tailored to their interests;
• create target audiences for advertising campaigns;
• exclude certain individuals from specific advertising campaigns; and
• improve the relevance and effectiveness of our advertising.

For these purposes, information from your Atomic profile, your interests and your interactions with Atomic may also be taken into account.

For advertising on Google platforms, we may in particular use Google Customer Match, provided by Google Ireland Limited.

For advertising on platforms such as Facebook and Instagram, we may in particular use Meta Custom Audiences, provided by Meta Platforms Ireland Limited.

Google and Meta may also process data within their respective platforms for their own purposes. Further information is available in the privacy notices of Google and Meta.

The use of Google Customer Match and Meta Custom Audiences is based on your consent pursuant to Art. 6(1)(a) GDPR.

Salesforce Marketing Cloud

For the delivery, management and personalization of our marketing communications, we use services provided by Salesforce, in particular Salesforce Marketing Cloud, SFMC Personalization and Einstein.

Salesforce generally processes personal data on our behalf and in accordance with our instructions.

In the course of providing these services, personal data may also be processed outside the European Economic Area. Salesforce provides appropriate safeguards for such transfers.

Data Transfers Outside the EEA

When using Salesforce and the services provided by Google and Meta, personal data may be
processed outside the European Economic Area, in particular in the United States.

Where personal data is transferred to third countries, such transfers are carried out in accordance with the requirements of Art. 44 et seq. GDPR. Depending on the provider concerned, such transfers may be based in particular on an adequacy decision of the European Commission or on Standard Contractual Clauses pursuant to Art. 46 GDPR.

Further information about the safeguards used is available in the privacy information provided by the respective service providers.

Retention Period

We generally process your data for newsletter, personalization and advertising purposes for as long as your consent remains valid.

If you withdraw your consent or unsubscribe from the newsletter, we will discontinue the corresponding marketing communications and the use of your data for personalized advertising based on that consent.

Certain data may subsequently be stored in a suppression list where this is necessary to ensure that you do not receive further corresponding marketing communications.

Information relating to the granting or withdrawal of consent may also be retained where necessary to demonstrate compliance with our legal obligations.

Tracking and interaction data is retained only for as long as necessary for the purposes of personalization, communication management, re-engagement communications and personalized advertising described above.

Withdrawal of Consent

You may withdraw your consent at any time with effect for the future.

For emails, you may in particular use the unsubscribe link included in each marketing email. For SMS and other communication channels, the respective available opt-out mechanisms will be provided.

You may also contact us at privacy@atomic.com.

The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of your consent before its withdrawal.

The withdrawal also covers the use of your data for personalized advertising based on this consent, including Google Customer Match and Meta Custom Audiences.

Recipients of Your Data

For the purposes of our marketing communications and personalized advertising, personal data may in particular be disclosed to the following categories of recipients:

• companies within the Salesforce group for the delivery, management and personalization of our marketing communications;
• Google Ireland Limited in connection with Google Customer Match;
• Meta Platforms Ireland Limited in connection with Meta Custom Audiences;
• other technical service providers and subprocessors supporting the provision of these services.

Where companies within the Amer Sports Group are involved in the technical provision of the relevant systems, data may also be processed within the Amer Sports Group to the extent necessary for the purposes described above and permitted under applicable data protection law.

Your Rights

Subject to the applicable legal requirements, you have in particular the right to:

• obtain access to personal data concerning you;
• have inaccurate personal data corrected;
• have your personal data deleted;
• obtain restriction of processing;
• receive your data in a portable format; and
• lodge a complaint with a competent data protection supervisory authority.

You may also withdraw your consent at any time with effect for the future.

Further information about your data protection rights and the processing of personal
data by Atomic is available in our general Privacy Notice.