1. INTRODUCTION

Selftitled recognizes the importance of protecting the privacy of your personal data. We have instituted strict policies and security measures to protect the information you provide us.

The purpose of this privacy policy is for you, as a customer to learn how Selftitled handles your personal data and for you to be able to feel secure that the processing is being carried out in accordance with your General Data Protection Regulation and other applicable data protection law. The privacy policy also describes your rights vis-à-vis us and how you can enforce those rights. By purchasing or receiving our products/services, you confirm that you have read and understood the content of this privacy policy.

This privacy policy is aimed towards you as a customer belonging to one or more of the following categories.

· Retail Customers (customers in our stores)

· Etail Customers (customers that shop online)

· Contact persons Supplier, Partner or Company Customer

· Account Holders (customers with a registered account on our website)

· Recipients of Newsletters

· Website Users

2 WHO IS RESPONSIBLE FOR THE PROCESSING OR YOUR PERSONAL DATA?

The Swedish company Selftitled AB, reg. No. 556719-7818 ("Selftitled" "We" "Us"), is the controller of your personal data. Selftitled affiliated companies (including other companies within the Selftitled group, joint ventures, franchisees and licensees) and selected suppliers may process your personal data on Selftitled's behalf and in accordance with Selftitleds' instructions as stated below and are thereby processors of your personal data.

You may contact Selftitled at any time, please find our contact details below.

Address: OUR LEGACY, Östermalmsgatan 26A, 114 26, Stockholm, Sweden

E-mail: privacy@ourlegacy.com

3. CATEGORIES OF DATA PROCESSED, PURPOSE AND LEGAL BASIS FOR PROCESSING

3.1 General

Below is a summary of the categories of data that we process, the purposes of processing the data and on what legal basis we are processing your data.

3.2 Retail Customers

If you make a purchase in one of our physical stores we may process your name, e-mail, and purchase history to provide customer service, process returns and give customer advice on any products you have bought. We will only collect the information if this is accepted by you. The legal basis for the processing is a balance of interests where our legitimate interest is to be able to provide customer service on any products you have bought. We will only collect the information if this is accepted by you. The legal basis for the processing is a balance of interests where our legitimate interest is to be able to provide customer service and facilitate the administration of returns, exchanges and complaints.

Your contact details i.e. your name, e-mail address and phone number, may also be processed for direct marketing purposes, namely to keep you informed via e-mail or other messenger services of our products, special events or promotions. The legal basis for the processing is a balance of interests where our legitimate interest is to market our products to existing customers.

3.3 Etail Customers

When you purchase a product online your name, e-mail, phone number and address (including street name, zip code, city and country) are used to process your order. The data is also processed so that Selftitled can process any returns, exchanges, and complaints as well as communicating with you regarding any questions or comments you may have regarding the product(s). The phone number is collected so that we can send a text message to you when the product(s) have arrived at your pick-up place. The legal basis for the processing is that it is necessary in order for Selftilted to fulfil its contractual obligations towards you.

Your purchase history is also stored so that Selftitled can process any returns, exchanges, and complaints as well as communicating with you regarding any questions or comments you may have regarding the product(s). The legal basis for the processing is a balancing of interests where Selftitled's legitimate interest is to facilitate the administration of returns, exchanges and complaints.

Your IP-address is stored for every order placed. IP-addresses are used for fraud risk checks. Selftitled only uses IP-addresses to the extent it is strictly necessary for preventing fraud and the legal basis for the processing is a balancing of interest where Selftitled's legal interest is to protect itself from fraud.

Information regarding returns is also stored for accounting purposes. This storing is based on a legal obligation.

If you submit your e-mail address for the "back-in-stock" function, we will process your e-mail address and what product(s) you wish to receive updates in relation to for the purpose of informing you when the product(s) of your choosing is back in stock and available for purchase. The processing is based on a balancing of interests where our legitimate interest is to provide our customers with updates regarding the availability of products of their choosing.

Your contact details, i.e. your name, e-mail address and phone number, may also be processed for direct marketing purposes namely to keep you informed via e-mail or other messenger services of products, special events or promotions. The legal basis for the processing is a balance of interests where our legitimate interest is to market our products to existing customers. We may use your contact details for direct marketing purposes for up to 12 months after your lates purchase subject to you ongoing right to opt-out.

Payments made for purchases on Selftitled's website are processed by a third-party payment service and such third party is the controller of the credit card information and other information relating to the payment. Selftitled does not collect or store any payment information.

3.4 Contact persons Supplier, Partner Company Customer

If you are the contact person at one of Selftitled's suppliers, partners or company customers ("Collaborator"), we will process your name, telephone number, email address and your role at the Collaborator. Selftitled processes the data for the purpose of being able to manage the relationship with the Collaborator, meaning e.g. for the administration and exercising of its rights and obligations under the agreement with the Collaborator, to place or manage orders or the provided services, and to otherwise enable Selftitled to communicate and conduct its business. The processing is based on a "balancing of interests" legal basis, where Selftitled's legitimate interest is to administer its contractual obligations and rights, communicate with and otherwise maintain a good relationship with the Collaborator.

If you work with Selftitled as a sole proprietorship (Sw. Enskild firma), Selftitled processes your name, telephone number, email address and personal identity number (since it is the same as the sole proprietorship's registration number). Selftitled processes the data for the purpose of being able to manage the relationship with the Collaborator, meaning e.g. administering and exercising its rights and obligations under the agreement with the Collaborator, place or manage order or the provided services, and to otherwise enable Selftitled to communicate and conduct its business. The legal basis for the processing is that is necessary in order for Selftitled to fulfil it contractual obligations towards the Collaborator.

3.5 Account Holder

You may sign up to become an Account Holder of Selftitled's Membership Club by subscribing to the services offered by Selftitled in its Membership Club. Signing up as an Account Holder is completely voluntary and is not a requirement for purchasing Selftitled's goods. When you subscribe to become an Account Holder, you will enter into an agreement with Selftitled.

When you sign up to become an Account Holder, Selftitled collects your name and e-mail to create and administer your account. Furthermore, your phone number and address (including street name, zip code, city and country) is collected and stored to make future purchases quicker and to provide you with relevant information regarding our products. Purchase history is stored to provide you with the possibility to review your purchases and returns and for us to send relevant information to you.

The legal basis for the processing of your data as an Account Holder is that it is necessary to fulfil a contractual obligation namely a service which includes (i) smoother order placements online, (ii) allowing you to access and review previous purchase and returns and (iii) access to relevant information regarding Selftitled's products and events.

As an Account Holder, you may choose to receive Selftitled's personalized newsletter and tailor-made marketing. When you opt-in to receive Selftitled's personalized newsletter and tailor-made marketing, Selftitled will process your name, e-mail address, cookie-id, purchase history and your activities on the website (including for example how you scroll and view different pages and your interaction with send outs such as newsletters and promotions). The purpose of the processing is to provide Account Holders with personalized newsletters and tailor-made marketing as wel as relevant information regarding Selftitled's products and events, as well as collaborators events. If you opt-in to receive Selftitled's personalized newsletter and tailor-made marketing at a later date than when you became an Account Holder, Selftitled may process such aforementioned personal data, for example your purchase history, as has been obtained by Selftitled from the date when you became and Account Holder.

For us to provide you with personalized newsletters, tailor-made marketing and relevant information regarding products and events, we combine the aforementioned personal data, analyse it and create a profile based on such analysis (so-called profiling). For example, we may combine your activity on your website (e.g. what part of the website you visit and what products you place in your shopping-cart) with how you have interacted with a promotion and your previous purchases in order to create a profile of what you might be interested in. This information is then incorporated into the marketing, making it tailor-made for your specific preferences. Selftiltled may also create a so-called customer lifetime value of you as a member, i.e. an estimation of your future interactions with us, based on the aforementioned profile.

Information about your activity on Selftitled's website and in relation to our send-outs, as well as how often you purchase goods and what specific goods you purchase, will be collected through the use of cookies and similar techniques such as pixels provided by third parties, see section 3.6. The placement of such cookies and similar techniques are described in our Cookie Policy ourlegacy.com/cookies

The legal basis for the processing of your data as an Account Holder is that it is necessary to fulfil a contractual obligation namely to provide the Account Holder with personalized newsletter and tailor-made marketing and access to relevant information regarding Selftitled's products and events, as well as collaborators events.

3.6 Newsletter Subscribers

If you have subscribed to our newsletters, we will use your e-mail to send out the newsletter. The legal basis for this processing is that it is necessary to fulfil a contractual obligation, namely the providing of the newsletter. The newsletter will be sent to you until you unsubscribe to the service.

Direct marketing, other than the newsletter itself can be sent to newsletter subscribers on the same basis as Etail and Retail customers who are not Account Holders.

3.7 Website Users

When you visit the website www.ourlegacy.com, we may process your IP-address to locate from where in the world you are visiting from. The purpose of the processing is to gather data for statistical purposes. The legal basis for the processing is a balance of interests where our legitimate interest is to improve our services through the use of statistics over visitors of the website.

Please note that your IP-address does not directly identify you as an individual. However, by cross-referencing your IP-address with additional available information, your identity may be revealed. Selftitled will not seek to identify you as a Website User.

In relation to personal data processed through the use of third-party cookies (including pixels), Selftitled is the joint controller of personal data processed with specific third-party provider of the cookie(s). Selftitled has entered into the following joint controller agreements:

Facebook Pixel

Selftitled and Facebook Ireland Ltd (“Facebook Ireland”) are joint controllers for the personal data processed in relation to the use of the Facebook Pixel. The purpose of the processing of personal data through the use of the Facebook Pixel is to measure and analyze your use of Selftitled’s website, targeting ad campaigns, deliver commercial and transactional messages and to improve Selftitled’s website and marketing.

Further information on how Facebook Ireland processes personal data can be found in Facebook Ireland’s Data Policy: https://www.facebook.com/about/privacy

Selftitled is responsible for enabling your data subject’s rights with regard to the personal data stored by Selftitled, please see Section 7. Facebook Ireland is responsible for enabling your data subject rights with regards to the personal data stored by Facebook Ireland.

Google Analytics

Selftitled and Google Ireland Limited (“Google Ireland”) are joint controllers for the personal data processed in relation to the use of Google Analytics. The purpose of the processing of personal data through the use of Google Analytics is to measure and analyze your use of Selftitled’s website, targeting ad campaigns, deliver commercial and transactional messages and to improve Selftitled’s website and marketing.

Further information on how Google Ireland processes personal data can be found here: https://policies.google.com/technologies/partner-sites.

Selftitled is responsible for enabling your data subject’s rights in relation to the personal data stored by Selftitled, please see Section 7. Google Ireland is responsible for enabling your data subject’s rights in relation to the personal data stored by Google Ireland.

3.8 Anonymized data

It can be noted that we may also use anonymized data for our internal marketing and demographic studies to analyze, profile and monitor customer patterns in order for us to be able to improve our products and services.

4. DOES SELFTITLED SHARE YOUR INFORMATION WITH OTHERS?

Selftitled does not sell or rent our customers’ personal data to any other entity.

We may share your data with affiliated companies including other companies within the Selftitled group, joint ventures, franchisees and licensees. If you have subscribed as an Account Holder and/or Newsletter Club Member with Selftitled, we may combine your data provided to us with data that you have provided to such affiliated companies, for the purpose of improving our services to you, and to enhance your shopping experience when visiting a Selftitled store in another country than your residence. The legal basis for the processing is that it is necessary for Selftitled’s performance of the services to Account Holders and/or Newsletter Club Members.

Selftitled may also share your data with selected suppliers who perform functions on our behalf such as fulfilling orders and delivery of orders, processing payments, carrying out promotional services or data management, to maintain our website, to distribute e-mails, to send out our newsletter, to provide client communications and to manage our customer database. As necessary, the personal data you provide to us may be processed by these third parties, solely on Selftitled’s behalf and in accordance with Selftitled’s instructions as data processors. We do not authorize any of our suppliers to make any other use of your personal data.

If Selftitled and/or its subsidiaries are subject to an actual or potential merger or acquisition or similar transaction, we may share your data with potential and actual buyer(s) and their financial and legal advisers, subject to such third parties undertaking appropriate confidentiality.

Selftitled may also disclose your personal data to a public authority where Selftitled is obligated to do so by law. In the event all or part of Selftitled’s operations are sold, Selftitled may transfer your personal data to a potential purchaser of the business.

5. TRANSFER OUTSIDE OF THE EU/EES

We may share your data with our selected suppliers, who may process your data in countries both inside and outside of the EU/EES when performing functions on our behalf as set out in section 4 above.

If you have subscribed as an Account Holder and/or Newsletter Club Member with Selftitled, we will share your contact details and information on previous purchases and shopping preferences with our affiliated companies both inside and outside of the EU/EEA (please see further under section 4).

Please note that countries outside of the EU/EEA may not provide an adequate level of protection for your personal data. Selftitled has however taken appropriate safeguards to ensure that the receiving parties of your data in countries outside of the EU/EEA shall provide an adequate protection of your data. Such safeguards may be that the receiving party has signed so called standard data protection clauses adopted by the EU Commission together with an assessment of whether the safeguards in the applicable standard contractual clause, in relation to the recipients country’s applicable law, grants the data subjects its rights in accordance with the GDPR.

Please contact us at privacy@ourlegacy.com if you want further information on what safeguards have been taken and if you want a copy of such safeguards.

6. HOW LONG DO WE KEEP YOUR DATA?

6.1 General

Notwithstanding anything to the contrary herein, Selftitled reserves the right to keep and process your personal data in accordance with this policy to the extent necessary to perform our contractual obligations to you, and to the extent we are required to process your data by law or in order to defend ourselves in a dispute, to prevent fraud or abuse, or to enforce our Terms and Conditions.

6.2 Retail and Etail customers

Your e-mail and phone number may be saved for up to 12 months from the last purchase for direct marketing purposes, subject to your ongoing right to opt-out. Thereafter it shall be deleted.

Purchase history will be stored during the return and exchange period for the purpose of administrating returns and exchanges.

If you make a complaint Selftitled may save your data to the extent necessary to handle the complaint. Selftitled may also save the complaint information as such for the remaining period under which the customer is entitled to make a complaint in order to prevent a customer from filing two complaints and being compensated twice for the same defect.

The information regarding your purchase, including any returns, exchanges etc., shall be stored as long as legally required by applicable law.

E-mail addresses used for the back-in-stock function will be stored until the product(s) for which the Etail Customer signed up for is back in stock and a notification regarding the same has been delivered.

6.3 Account Holder

If an Account Holder has not made any purchases or logged into its account during a consecutive period of 36 months, Selftitled will contact you and ask whether you wish to keep the account. Unless you confirm that you want to keep the account, the data in the account will be deleted within three (3) months unless we need to keep it for other purposes that are legally justifiable.

6.4 Newsletter Subscribers

The information will be saved until you unsubscribe from the newsletter, which you can do at any time. Please find more information about how to unsubscribe from the newsletter in section 8.

6.5 Website Users

Your IP-address will be stored as long as it is necessary for Selftitled to conduct the fraud check risks.

Personal data processed through the use of cookies and similar techniques for marketing purposes will be stored for up to 24 months, for more details please see our Cookie Policy ourlegacy.com/cookies

7 YOUR DATA SUBJECT RIGHTS

In this section 7, we have summarized your data subject rights to request access, portability, rectification, erasure of your personal data, to restrict the processing of your personal data, to object to processing, and your right to lodge a complaint with the supervisory authority.

If you want to exercise your rights, please send us an e-mail to privacy@ourlegacy.com. Please note however that if you want to lodge a complaint with the supervisory authority, you need to contact the authority directly.

Right of access

You have the right to obtain confirmation of whether personal data concerning yourself are being processed and, where that is the case, access to the personal data and information regarding, inter alia, the purpose of processing, the categories of personal data concerned, the categories of recipients to whom your data have been or will be disclosed, and the envisaged period of time for which personal data will be stored (or the criteria for determining this).

Right of rectification

You have the right to request rectification of inaccurate personal data concerning yourself, and to complete incomplete data.

Right of erasure

Under certain circumstances you are entitled to request that we erase your personal data or restrict our processing of your data, namely in the following events.

· When it is no longer necessary for us to process your data taking into consideration the purposes for which it was collected.

· When our processing is based on your consent and you have withdrawn your consent, and there is no other legal basis for the processing of your data.

· When our processing of your data is based on a legitimate interest legal basis and you object to such processing, and there is no overriding legitimate ground for our processing.

· When you have objected to our processing of your data for direct marketing purposes.

· When your personal data has been unlawfully processed.

· When the personal data must be erased for compliance with a legal obligation that applies to us.

· When the personal data collected concerns a child (under 13 years of age) in relation to the offer of information society services.

Right to objection - direct marketing and profiling

You have the right to object at any time to our processing of your personal data for direct marketing purposes, which includes profiling to the extent that it is related to such direct marketing. If you object to our processing of your personal data for direct marketing purposes, including profiling, we will cease such processing of your data.

Data portability

If our processing is based on your consent or if the processing is necessary for our performance of a contract with you, you have the right to request that the data which you have provided to us shall be provided to you in a structured, commonly used and machine-readable format and you also have the right to transmit such data to another controller.

Right to lodge a complaint with supervisory authority

Please note that if you consider the processing of your data to be in violation of applicable data protection laws, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence or the place of the alleged infringement (see http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm).

8 HOW DO I UNSUBSCRIBE FROM SELFTITLED'S NEWSLETTERS AND E-MAILS?

If you no longer wish to receive our newsletters or other e-mails, you can unsubscribe as indicated in the particular communication, i.e. by using the unsubscribe link which is included on all newsletters and other e-mails. You may also contact us at privacy@ourlegacy.com

9 IS IT MANDATORY TO PROVIDE PERSONAL DATA?

When you purchase our products online, or sign up for an account with Selftitled, we will inform you which data is mandatory by marking certain fields with a symbol (*). The provision of mandatory data is necessary for Selftitled to be able to fulfil our contractual obligation to you, for example processing your order, or fulfilling the account services.

When you purchase our products in our physical stores, you do not have to provide any personal data.

10 CHILDREN'S PRIVACY AND LEGAL PURCHASE AGE

Selftitled does not wish to collect personal information from anyone under the age of sixteen (16). If you are under eighteen (18), we require that you inform and get your parents’ or guardians’ consent before purchasing anything or provide any personal data to us at ourlegacy.com or any other website related to Selftitled.

11 COOKIES

We use cookies on our website. Please see our separate Cookie Policy ourlegacy.com/cookies

12 MODIFICATIONS

Selftitled reserves the right to occasionally make changes to our privacy policy or practices. We will post the updated policy on our website, and thus we encourage you to review this page from time to time.

Last date for modification: November 2023