Privacy Policy | THE OUTNET

Date: July 23 2026

THE OUTNET is committed to protecting and respecting your data protection rights. This notice describes what personal data we collect, how we will use that data and how we keep your data safe. For additional information on how we use cookies, please refer to our Cookie Notice. For all other information regarding our services, please refer to our Terms & Conditions of Sale.

In this Privacy Notice we will cover:

1. Who is the data controller?

2. What personal data do we process and where do we collect it from?

3. Why do we process your personal data and what is our legal basis for this?

4. Cookies, customisation, and online advertising

5. Who will process your data?

6. International data transfers

7. How long do we keep your data?

8. Your rights

9. Security

10. Contact us

11. Changes to this notice

Appendix A – Additional Information for Residents of the U.S.

Appendix B – Additional Information for Residents of Australia

Appendix C – Additional Information for Residents of the Kingdom of Saudi Arabia

Appendix D – Additional Information for Residents of the United Arab Emirates

Appendix E – Additional Information for Residents of Hong Kong

1. Who is the data controller?

The data controller for any personal data we hold about you is The Outnet IP, LLC, a Delaware incorporated entity with registered office at c/o United Corporate Services, Inc., 800 North State Street, Suite 304, Delaware, 19901 (“we”, “us”, or “our”). This Privacy Notice applies to our collection and use of personal data collected via our websites and apps that link to it (“Website(s)” and “App(s)”).

We are responsible for ensuring that your data is held securely, that you are given accurate information about how your data is used, and that your rights regarding your data are respected. The products we sell are not aimed at individuals under the age of 18, we do not promote our products to this market, and our Websites and Apps are not designed to be attractive to this market. We cannot identify individuals under this age on our database.

Please refer to our Terms & Conditions of Sale for more information. Please also read our Terms and Conditions of Account which apply to you when you register for an account on any of our Websites or Apps.

2. What personal data do we process and where do we collect it from?

We collect personal data in a number of ways depending on the nature of our relationship with you, as set out in this Privacy Notice. You are not required to provide us with any personal data but if you do not provide us with certain personal data we may be unable to provide services to you (e.g., we may be unable to accept an order or deliver goods to you).

Website and Apps. We collect data from you when you visit our Websites and Apps. The data we collect may include:

name,
email address,
marketing preferences,
telephone number(s) and shipping/billing address,
country of residence,
financial details,
day and month of birth,
favourite designers, and
information regarding your browsing and shopping behaviour.

Customer Surveys, Feedback, and Testimonials: Every now and again, we may ask you for your opinion on our services and the products you have purchased through our services. When we do research or surveys, we may use cookies (with your consent, where required by applicable law) and may combine the information collected by those cookies with your answers. If you give us feedback, we may use it to improve our services and we may publish it online or offline to promote our business and our services. We will ask for your permission before we publish it. If you wish to submit a comment or feedback on a blog or article featured on our services, we may (but are not obliged to) publish your comment online or offline to promote our business and our services. We will collect your name or username which will be displayed next to your comment and e-mail address, which will not be published, but which we may use to contact you in relation to your comment.

Social Networks: If you follow us or interact with us on any of our pages on third party social media platforms, such as Instagram, Facebook, X (formerly Twitter) and Pinterest, information you provide will be subject to the third party's privacy policy, as well as this Privacy Notice.

Mobile Services: When you request our mobile services, we may keep your mobile phone number, the make and model of your phone, the operating system used by your phone and details of your network operator, and we will link a unique identifier to your mobile phone number. We'll store your device language, app language, and country. We need this information in order to provide the features and services enabled through our mobile services and to administer our mobile service.

Customer Care Team. To ensure a high level of customer service to our clients, to enable the development of staff training and to manage queries, complaints or disputes we may process recordings of calls to our Customer Care teams, live chat messages, customer name, account ID and order ID, the pages you have viewed and items in your Shopping Bag and any other contact details you might provide to us during the course of the conversation.

Business Acquisition. In addition to the personal data we collect directly from you, we may also receive personal data about you in connection with the acquisition of assets or a business. Where this occurs, we receive such personal data from the seller as part of the transaction and process it in accordance with this Privacy Notice and applicable law. The categories of personal data we receive, and the purpose for which we use such personal data are the same as those described in this Privacy Notice.

Public Information. We may collect and process personal data from publicly available sources.

3. Why do we process your personal data and what is our legal basis for this?

The data we collect may be used to take your order, process payment and deliver your purchase to you. We also use it to deliver marketing communications, give access to services for registered users, personalise your visit to our site and provide assistance via our Customer Care team.

We must have a valid reason for processing your personal data and we may not collect, store or use data about you that is not compatible with that reason. In some jurisdictions, our processing must also be based on a lawful basis set out in applicable data protection law.

There are four lawful bases that we generally rely on for our use of your personal data (subject to certain variations in specific jurisdictions, including as set out in the Appendices to this Privacy Notice):

Performance of a Contract,
Our Legitimate Interests as a business,
A Legal Obligation we are required to follow, and
Consent which you provide to us (if you have given your consent to our use of your personal data, you are entitled to withdraw this consent at any time).

The data we process and, where applicable, the legal basis we use to process it is detailed below:

Performance of a Contract

Purpose	Personal data processed
When you purchase a product from our Websites and Apps we ask you for the personal data necessary to allow us to fulfil our contract with you including despatching your item and taking payment from you. Your personal data will also be used to manage your requests for customer service.	Contact details (name, address, postcode, phone number), financial details (credit and debit card details etc), delivery address.
When you register on the Websites, convert your guest account to a registered account or download the App we ask you for the personal data necessary to allow you to benefit from services reserved for registered users.	Name, email address, day and month of birth, designer and other preferences.
If you are a member of a reward programme with one of our partners, your personal data will be used to fulfil your reward including despatching your item, taking payment from you and managing your requests for customer service.	Contact details (name, address, postcode, phone number), financial details (credit and debit card details etc), reward value, partner programme, delivery address.
When you sign up to our Recommend a Friend scheme following a friend's referral.	Name, email address and order ID.
When you have referred a friend to get validation of the referral and the referral reward.	Name and email address.
We may capture images of your parcel and delivery location to provide proof of delivery.	Short-term storage of photographic image of delivery location, date, time and geographical coordinates.

Our Legitimate Interests as a business

Purpose	Personal data processed
Calls to our Customer Care team are recorded and live chat messages monitored to ensure a high level of customer service to our clients, to enable the development of staff training and to manage queries, complaints or disputes.	Recordings of calls to our Customer Care teams, live chat messages, customer name, account ID and order ID, the pages you have viewed and items in your Shopping Bag and any other contact details you might provide to us during the course of the conversation.
To understand customers' patterns, their needs, the products and services that they are interested in, we analyse shopping histories, browsing histories, customer demographics and market research information. In this way, we identify customers' groups or segments who display similar behavioural patterns. This helps us to offer an enhanced customer experience and to provide relevant products, personalised services and offers, and to better manage customers' relationships. It also helps us tailor the marketing that individuals receive in our marketing messages or are shown on our own and other websites and mobile apps, including social media.	Customer ID, e-mail address, browsing data, IP address, order history, products added to wish list or basket, age, gender, physical address, market research information such as attitudes to fashion, service needs and spend on designer clothing.
When we have a service message we need to send you via email confirming your order or returns or informing you of any changes that might affect your order, our service to you or changes to terms and conditions.	Name, email address, and order information.
When you save an item to your Shopping Bag, but don't check out, we'll send you an email service message to remind you that you haven't checked out.	Name, email address, item(s) saved in Bag.
When you make a purchase on any of our Websites or Apps, we will use some of your personal data to carry out anti-fraud activities: we have a legitimate interest in carrying out this activity to prevent and prosecute any fraudulent activity.	Name, billing and shipping address, email address, phone number, payment information, previous order history.
When you make a purchase, we may request feedback on your buying experience, typically via pop up surveys or email.	Name, email address, telephone number, products purchased, feedback comments.
To collect information on our brand influencers and understand their impact.	Publicly available data on your social network that includes name, username(s), posts, views, followers, shares, comments and bio descriptions and to which we may add further information such as contact details (phone number, email and address), industry category, territory, age, gender, favourite products or other relevant information.
We collect and utilise information about professionals in the fashion industry in order to send PR communications and event invitations.	Name, job role, job title and email address.
We may use your data to establish or exercise our legal rights or to defend against any legal claims.	Identification data and other personal data that may be relevant to the specific legal claim.

A Legal Obligation we are required to follow

Purpose	Personal data processed
When you make a purchase on our Websites and Apps, we are required to process your personal data to meet our legal obligations in accordance with the tax provisions and other statutory rules which apply.	Contact details and details of your financial transaction with us.
When we process your information in response to you exercising your data subject rights.	Name, contact information, purchase history, other information you have specifically requested.

Consent which you provide to us

Purpose	Personal data processed
For direct marketing by email and, from time to time, telephone, SMS or WhatsApp, along with the use of tracking technologies to confirm delivery, whether the message has been opened and whether links have been clicked. In each case, we will comply with applicable marketing laws (which may depend on the jurisdiction in which you are based).	Name, email address, browsing and purchase history, engagement with email and its content, date of consent.
Push notifications via our Websites and Apps to offer goods and services that may be relevant to you. These can be configured in your device or browser settings.	Products purchased, viewed or placed in cart; name; device ID or IP address; language used to navigate and country/version; information on the device and browser used; date and time consent to web push notifications was provided; account creation date; date of last visit to our site.
If you have consented to receive email communications from third parties, we may supply your email address to the relevant third parties, including social media or digital advertising companies (such as Facebook) so they can show you advertising tailored to your interests and purchase history.	Email address.
When you receive email marketing communications from us after entering a competition run by one of our affiliate partners.	Name and email address.
When you are contacted and sign up to take part in our market research programmes.	Name, email address and, depending on the type of research, other relevant information, for example age or place of domicile.

4. Cookies, customisation, and online advertising

With your consent, where required under applicable law, our Websites and Apps use cookies and similar technologies such as pixels and beacons to collect information. Such technology is widely used in order to make sites work, or work more efficiently, as well as to provide information to the owners of the site, for example, your language preference, sign-in information or usage of the site’s services and applications. Cookies may also be used to show you products and services based on your preferences as well as to allow third-party partners to deliver relevant advertising. Full information on cookies and how you can set your preferences can be found in our Cookie Notice.

5. Who will process your data?

Access to data will be limited to our staff who have been specifically trained and authorised for this processing. We may share your personal data with other companies in our corporate group, for the purposes described in this Privacy Notice.

Your personal data will also be transmitted to third parties that we use to provide certain services; these parties have been rigorously assessed for the way in which they manage personal data and may only use your data for the exact purposes that we specify in the contract with them (acting as Data Processors (or equivalent under applicable law in other jurisdictions) on our behalf). The third parties in question may belong to the following categories:

Companies such as payment service providers that help us to process your order.
Professional service providers, such as cloud hosting providers, customer relationship management (CRM) platforms, live chat and customer service platforms, email delivery suppliers, IT software providers, marketing and research agencies, analytics companies and website hosts who help us to run our business.
Advertising networks and ad-serving agencies who help us to deliver relevant advertising to you on our websites and on third-party websites and services.
Aggregated data that does not identify individuals is shared with internal teams, relevant service providers and brand partners for business planning purposes.

We will also share your personal data with third parties in the following categories that may process it as Data Controllers in their own right.

Companies that help us to deliver your purchases such as couriers and parcel delivery companies who deliver your goods.
Professional advisors such as lawyers, accountants, and auditors.
Credit reference agencies, law enforcement and fraud prevention agencies, so we can help tackle fraud.
Governmental bodies and regulators (to comply with our legal obligations and voluntarily where we consider in our sole discretion that sharing your personal data is in our business interests).

We may also transfer your personal data to a buyer or potential buyer if our assets are acquired by another organisation. The purchaser will be required by law to use your personal data only as described in this Privacy Notice.

6. International data transfers

Some of our group companies, and some of the third parties listed in the previous section 'Who will process your data?' may be located in countries outside of the jurisdiction in which you are based. Where necessary to comply with applicable law, we will ensure all transfers of personal data are adequately protected.

For example, if you are located in the United Kingdom (UK) or European Economic Area (EEA), and we transfer your personal data to a jurisdiction that does not offer an adequate level of data protection, as established by specific decisions of the European Commission and/or UK Secretary of State (as appropriate), then such transfer will be performed only: (i) after Standard Contractual Clauses have been put in place alongside any supplementary measures that are deemed necessary on a case-by-case basis; (ii) if the transfer is necessary for the purchase of goods offered on our Websites or Apps or for registration on the Website or App or use of services on the Website or App; or (iii) for the management of your requests.

For details of the appropriate safeguards in place for a particular transfer (or a copy of the same), please contact our Customer Care team using the details in Section 10.

7. How long do we keep your data?

We keep your personal data for a limited period of time in line with our data retention policy. The specific retention period will vary according to the reason for processing your personal data. After this period, your data will be permanently erased or otherwise irreversibly rendered anonymous.

Without limitation to any other rights we may have to retain your personal data under any applicable law, we may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

8. Your rights

Depending on the jurisdiction in which you are based, you may have certain rights in relation to your personal data. For example, if you are based in the EEA or UK, you may have the following rights under data protection law:

The right to request a copy of the personal data that we hold about you.
The right to ask us to correct any inaccuracies in the personal data we hold about you.
The right to withdraw your consent to processing (including marketing).
The right to object to our processing of your personal data on the basis of our legitimate interest.  
The right to request the deletion of your personal data in certain circumstances.
The right to data portability (i.e., to transfer certain of your data to another entity in a commonly used machine readable format).
The right not to be subject to automated decision making including profiling which produces legal or substantially similar effects. We use profiling to make relevant and tailored recommendations to you. Profiling is the automated processing of personal data to evaluate certain things about an individual, for example, people who are interested in particular designers or products. We do not use automated decision-making processes that would have a potentially damaging effect on you. But if we did, you may have the right to obtain human intervention, express your point of view, obtain an explanation of the decision and challenge it.
The right to complain to us (in which case we will deal with all complaints in line with our complaints procedure and respond without undue delay) or to the relevant data protection regulator in your jurisdiction (as set out below).

To exercise any of these rights you can sign in to your account, contact our Customer Care team using the details in Section 10 or write to our Data Protection Officer (DPO) by email to DPO@theoutnet.com. Please note that these rights are not absolute, and we may refuse to comply with requests where permitted by applicable law.

You can also review and update your personal details at any time by logging into “My Account” on our Website, where you can change your details, shipping information, email preferences and saved payment methods.

To opt out of marketing communications, you can update your preferences in “My Account”, click “unsubscribe” in any marketing email, or contact our Customer Care team. If you opt out of marketing, we will still contact you for service-related communications.

If you believe that we are processing your data in breach of data protection law or this Privacy Notice, you have the right to lodge a complaint with the Supervisory Authority of the jurisdiction in which you are located. If you are located in an EEA jurisdiction, details of the relevant Supervisory Authority can be found here: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en. If you are located in the UK, the relevant Supervisory Authority is the Information Commissioner’s Office: https://ico.org.uk.

If you are located in a jurisdiction other than the EEA or UK, then your rights may differ. Please also see the jurisdiction-specific Appendices to this Privacy Notice for more information about specific jurisdictions.

As we are established outside of the European Union and United Kingdom, we are required to appoint representatives in the EU and UK to act as a point of contact for residents of the EEA or UK whose data we process. We have appointed: (i) The Outnet Operations (IT) S.r.l as our representative in the EU; and (ii) The Outnet Operations (UK) Limited as our representative in the UK. Our EU and UK representatives can be contacted via our Customer Care team using the details in Section 10.

9. Security

We are committed to taking appropriate technical, physical and organisational measures to protect personal data against unauthorised access, unlawful processing, accidental loss or damage, and unauthorised destruction.

In particular, we use security measures that employ pseudonymisation or encryption of your data to ensure the confidentiality, integrity, and availability of your data as well as the resilience of the systems and services that process them. When you place an order or access your account information, we use Secure Socket Layer (SSL) encryption to protect your data during transmission. We have the ability to restore the availability and access to personal data in the event of a physical or technical incident. Furthermore, we undertake to test, verify and regularly evaluate the effectiveness of technical and organizational measures in order to ensure continuous improvement in the safety of processing.

Our Websites and Apps may contain links to websites operated by other organisations. These websites have their own privacy and cookie notices, and we encourage you to read them. We are not responsible for the privacy practices of websites run by other organisations, and you use those websites at your own risk.

10. Contact us

To contact our Customer Care team, please email us at privacy@theoutnet.com or call us on the following numbers:

USA: +1 888 968 8638
United Kingdom, EU, and MENA: +44 800 011 4250
Australia and APAC: +61 1800 876 265

11. Changes to this notice

We keep our Privacy Notice under regular review in order to reflect changes in our services and in data protection law. This Privacy Notice was last updated on July 23 2026. We will contact you if we make significant changes in the Privacy Notice.

APPENDIX A – ADDITIONAL INFORMATION FOR RESIDENTS OF THE U.S.

This Appendix A applies to consumers residing in U.S. states that have enacted comprehensive privacy legislation, including California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Delaware, Iowa, New Jersey, New Hampshire, Nebraska, Maryland, Minnesota, and other states with similar laws. The rights and disclosures below are provided in accordance with state privacy laws to the extent applicable to THE OUTNET and our relationship with you.

Your information, sources and purposes: Please refer to the Sections 2, 3, and 4 of the main Privacy Notice for a description of the personal data we may collect about you (or have collected in the preceding 12 months), the sources of such information, and the purposes for which we may use such information. We do not collect or process sensitive personal data for purposes of inferring characteristics about consumers. To the extent we process deidentified information, we will maintain and use the information in deidentified form and will not attempt to reidentify the information unless permitted by applicable law.

Retaining your information: We will retain your personal data for the time period reasonably necessary to achieve the purposes described in this Privacy Notice, or any other notice provided at the time of collection, taking into account applicable statutes of limitation and records retention requirements under applicable law.

Disclosing your information: We may have disclosed your personal data to certain categories of third party that we use to provide our services, as described in Section 5 of the main Privacy Notice.

Your rights: Subject to exceptions under applicable law, you may have certain choices regarding our use and disclosure of your personal data, as described below:

Access: You have the right to request, twice in a 12-month period, that we disclose to you the personal data we have collected about you, including the categories of personal data, the categories of sources from which the personal data is collected, the business or commercial purpose for collecting, selling, or sharing personal data, the categories of third parties to whom we disclose personal data, and the specific pieces of personal data we have collected about you.
Correction: You have the right to request that we correct the personal data we maintain about you, if that information is inaccurate.
Deletion: You have the right to request that we delete certain personal data we have collected from you.
Opt-Out of Sale or Sharing: You have the right to opt out of the sale or sharing of your personal data for cross-context behavioural advertising. You can opt-out of cookie-based selling/sharing by contacting our Customer Care team using the details in Section 10 or broadcasting the Global Privacy Control signal. For more information about how to use the Global Privacy Control signal, please see https://globalprivacycontrol.org/. These browser and device based opt-out mechanism apply to the browser and device you are using and will apply to the website domain on which you submit the request. If you clear your cookies or use a new browser or device to access the site, please submit a new request to re-apply your opt-out choice. Note that even if you opt out of sale or sharing, you may still be served advertisements and receive marketing emails from us and our service providers. If you would like to opt out of the sale or sharing of personal information that does not involve browser- or device-based technologies, you may submit a request using the email mechanism available at https://www.theoutnet.com/en-us/page/policies/do-not-sell/. Where you submit an opt-out request through this mechanism and we are able to identify you, we will apply your opt-out request to your personal information as maintained by us, rather than only to a particular browser or device.
No discrimination: If you choose to exercise any of your rights under applicable U.S. state privacy laws, you have the right to not receive discriminatory treatment by us.

California residents – “Shine the Light”: In addition, under California Civil Code Section 1798.83, if you are a California resident and your business relationship with us is primarily for personal, family or household purposes, you may request certain data regarding our disclosure, if any, of personal data to third parties for the third parties’ direct marketing purposes. To make such a request, please send an e-mail message to privacy@theoutnet.com with “Request for California Privacy Information” in the subject line. You may make such a request up to once per calendar year. If applicable, we will provide you, by e-mail, a list of the categories of personal data disclosed to third parties for their direct marketing purposes during the immediately preceding calendar year, along with the third parties’ names and addresses.

Exercising your rights: To exercise your rights on behalf of yourself or another individual, you can: contact us directly using the details in Section 10 of the main Privacy Policy. If you exercise your rights, we may require you to provide certain information to verify your identity (such as your name, email address, phone number and/or address) or the authority of any third person acting on your behalf.

APPENDIX B – ADDITIONAL INFORMATION FOR RESIDENTS OF AUSTRALIA

This Appendix B supplements the content of the general Privacy Notice above and applies if you are based in Australia or otherwise where Australian privacy laws apply.

A reference to personal data in the Privacy Notice includes a reference to personal information as defined under the Privacy Act 1988 (Cth), being information or an opinion about an identified individual, or an individual who is reasonably identifiable:

a) whether the information or opinion is true or not; and

b) whether the information or opinion is recorded in a material form or not.

You may request access to any of the personal information we hold about you by contacting us using the details provided in Section 8 of the Privacy Notice. We reserve the right to charge a reasonable fee for the costs of retrieval and supply of any requested information.

We will take all reasonable steps to ensure that the personal information we collect, use or disclose is accurate, complete and up to date. To ensure your personal information is accurate, please notify us of any errors or changes to your personal information and we will take appropriate steps to update or correct such information in our possession.

Your personal information may be disclosed to overseas recipients, including those located in the United States of America, the European Union, and the United Kingdom.

If you have a complaint about a suspected breach by us of the Australian Privacy Principles (“APPs”) or an applicable registered APP code, we request that you contact us using the contact details provided in Section 8 of the Privacy Notice. We will investigate the complaint and determine whether a breach has occurred and what action, if any, to take.

If you are dissatisfied with how we handle your complaint, you may lodge a formal complaint with the Office of the Australian Information Commissioner in writing:

By mail to: Director of Compliance
Office of the Australian Information Commissioner
GPO Box 5218
Sydney NSW 2001
Online via the Office of the Australian Information Commissioner’s website: www.oaic.gov.au

APPENDIX C – ADDITIONAL INFORMATION FOR RESIDENTS OF THE KINGDOM OF SAUDI ARABIA

This Appendix C supplements the content of the main Privacy Notice above and applies if you are resident in the Kingdom of Saudi Arabia (the “KSA”) or otherwise where KSA privacy laws apply. It sets out matters required under the Personal Data Protection Law (“KSA PDPL”) and its Implementing Regulation issued by the Saudi Data & AI Authority (“SDAIA”) that are not addressed in the main Privacy Notice or where the position differs. Although we are established outside the KSA, the KSA PDPL may apply to us where we collect and process the personal data of individuals residing in the KSA.

Legal bases for processing: The legal bases referred to in Section 3 of the main Privacy Notice correspond to equivalent legal bases under the KSA PDPL. Where we rely on our legitimate interests, the KSA PDPL does not permit this basis to be used to process sensitive personal data, and requires us to carry out and document a prior assessment confirming that our interests do not override your rights and interests. Where we process sensitive personal data or make solely automated decisions about you, the KSA PDPL requires us to obtain your explicit consent. A separate consent is obtained for each processing purpose.

Your rights: In addition to Section 8 of the main Privacy notice, you have the following rights in relation to your personal data under the KSA PDPL:

The right to be informed about how we collect your personal data, our legal basis for collection and processing, how such data is processed, stored, and destroyed, and to whom it will be disclosed.
The right to access your personal data held by us, either by logging into “My Account” on our Website, or by submitting a written request to us.
The right to request destruction of your personal data where it is no longer necessary for the purpose for which it was collected.
The right to request that inaccurate, incomplete, or outdated personal data be corrected, completed, or updated.

If you suffer material or moral damage as a result of a violation of the KSA PDPL by us, you may seek proportionate compensation.

To exercise any of the rights set out above, please contact our Customer Care team using the details in Section 10 of the main Privacy Policy or write to our Data Protection Officer (DPO) by email to DPO@theoutnet.com.

We will respond to your request within 30 days of receipt. Where the complexity or volume of requests requires it, this period may be extended by a further 30 days. In such cases, we will notify you in advance of the extension and the reasons for it. We will take appropriate steps to verify your identity before acting on any request.

International data transfers: Some of our group companies and service providers may be located outside the KSA, meaning that your personal data may be transferred to or processed in countries outside the KSA. Any such transfer is subject to the following conditions:

the transfer does not prejudice national security or the vital interests of the KSA;
the recipient country or organisation ensures an adequate level of protection for personal data, at least equivalent to the level guaranteed by the KSA PDPL and its Implementing Regulation, in accordance with the SDAIA’s requirements; and
the transfer of personal data is limited to the minimum that is necessary to achieve the relevant purpose.

Your personal data may be transferred to recipients in the United States of America, the European Union, the United Kingdom, and other jurisdictions in which our group companies and service providers operate. We take steps to ensure that appropriate protections are in place for all such transfers in accordance with KSA law.

For more information about the safeguards in place with respect to a particular transfer, please contact us using the details in Section 10 of the main Privacy Policy.

Data breach notification: We are required under the KSA PDPL to notify the SDAIA within 72 hours of becoming aware of a personal data breach that may cause harm to your data or your rights. We will notify you without undue delay in clear and simple language, describing the breach, the potential risks, the measures we are taking to address those risks, and our contact details.

Retention and destruction of personal data: We retain your personal data only for so long as it is necessary to achieve the purpose for which it was collected, in accordance with Section 7 of the main Privacy Notice and the KSA PDPL. Where a legal basis requires retention for a specific period (e.g., with respect to tax or regulatory obligations), we will retain the data for that period, after which it will be destroyed.

When we destroy personal data, we use methods that render it permanently unreadable and irretrievable, and notify any third parties to whom the data has been disclosed and request its destruction, where required under the KSA PDPL.

Supervisory authority and complaints: If you have a complaint about how we process your personal data that we have not resolved to your satisfaction, you have the right to submit a complaint to the SDAIA as the competent supervisory authority under the KSA PDPL via the National Data Governance Platform: www.dgp.sdaia.gov.sa.

Complaints must be submitted to the SDAIA within 90 days of the date on which the relevant incident occurred or the date on which you became aware of it. The SDAIA may consider complaints submitted after this period where there are reasonable circumstances that prevented timely submission.

Before submitting a complaint to the SDAIA, we encourage you to contact us first using the details in Section 10 of the main Privacy Policy so that we have the opportunity to address your concerns. We will investigate and respond to all complaints in good faith and without undue delay.

Updates to this Appendix: We keep this Appendix C under regular review to reflect changes in our processing activities and KSA data protection law. We will notify you of any material changes in accordance with Section 10 of the main Privacy Notice. This Appendix C was last updated on July 23 2026

APPENDIX D – ADDITIONAL INFORMATION FOR RESIDENTS OF THE UNITED ARAB EMIRATES

This Appendix D supplements the main Privacy Notice above and applies to individuals residing in the United Arab Emirates (the “UAE”). It sets out matters required under Federal Decree by Law No. (45) of 2021 Concerning the Protection of Personal Data (“UAE PDPL”) that are not addressed in the main Privacy Notice or where the position differs. Although we are established outside the UAE, the UAE PDPL may apply to us where we process the personal data of individuals residing in the UAE.

Legal bases for processing: The UAE PDPL does not recognise legitimate interests as a lawful basis for processing personal data. Accordingly, where the main Privacy Notice refers to processing based on our legitimate interests, we will instead rely on one of the following alternative bases recognised under the UAE PDPL as set out below when processing your personal data as a UAE resident:

Consent: where you have given your clear, specific and unambiguous consent to the processing of your personal data. You may withdraw your consent at any time, and such withdrawal will not affect the lawfulness of processing carried out before it.
Performance of a contract: where processing is necessary to perform a contract to which you are a party, or to take measures at your request with the aim of concluding, amending or terminating a contract.
Legal obligation: where processing is necessary to fulfil specific obligations imposed on us under the laws in force in the UAE.
Protection of your interests: where processing is necessary to protect your vital interests.
Public interest: where processing is necessary to protect the public interest.
Legal claims: where processing is necessary to initiate any procedures of legal claim or defence of rights, or is related to judicial or security proceedings.

Where we process sensitive personal data, we will obtain your explicit consent for each specific processing purpose, unless an exemption under the UAE PDPL applies.

Your rights: In addition to Section 8 of the main Privacy Notice, you have the following rights in relation to your personal data under the UAE PDPL:

The right to request erasure of your personal data where it is no longer necessary for the purpose for which it was collected, where you have withdrawn your consent, or where you object to the processing and there is no overriding lawful ground.
The right to restrict and stop processing where you contest the accuracy of your data or where the processing violates the agreed purposes.
The right to object to decisions resulting solely from automated processing, including profiling, particularly where such decisions have legal effects or significantly affect you. You have the right to request human intervention in the review of such decisions.

International data transfers: Some of our group companies and service providers may be located outside the UAE, meaning that your personal data may be transferred to or processed in countries outside the UAE. Under the UAE PDPL, such transfers are permitted where:

the recipient country or territory has legislation addressing personal data protection that includes substantive provisions, measures, controls and rules relating to the protection of privacy and confidentiality, and the data subject’s ability to exercise their legal rights, and has a judicial or regulatory authority capable of imposing appropriate measures on the controller or processor;
the UAE is party to a bilateral or multilateral agreement with the recipient country relating to the protection of personal data;
a contract or agreement is in place which places obligations on the recipient to adopt measures, controls and requirements equivalent to those set out in the UAE PDPL; or
you have given your explicit consent to the transfer, provided the transfer does not contradict the public or security interest of the UAE.

Data breach notification: Under the UAE PDPL, we are required to notify the relevant UAE authority if we become aware of any breach or violation in relation to your personal data that would prejudice its privacy, confidentiality or security. We will also notify you where the breach would prejudice the privacy and confidentiality of the security of your personal data, informing you of the measures we are taking to address the breach.

Retention and destruction of personal data: We retain your personal data only for so long as it is necessary to achieve the purpose for which it was collected, in accordance with Section 7 of the main Privacy Notice and the UAE PDPL. Where a legal basis requires retention for a specific period (e.g., with respect to tax or regulatory obligations), we will retain the data for that period, after which it will be destroyed.

Supervisory authority and complaints: If you have a complaint about how we process your personal data that we have not resolved to your satisfaction, you have the right to complain to the relevant UAE authority.

Before submitting a complaint to the UAE authorities, we encourage you to contact us first at privacy@theoutnet.com so that we have the opportunity to address your concerns. We will investigate and respond to all complaints in good faith and without undue delay.

Updates to this Appendix: We keep this Appendix D under regular review to reflect changes in our processing activities and UAE data protection law. We will notify you of any material changes in accordance with Section 10 of the main Privacy Notice.

APPENDIX E – ADDITIONAL INFORMATION FOR RESIDENTS OF HONG KONG

This Appendix E supplements the content of the main Privacy Notice above and applies if you are located in the Hong Kong Special Administrative Region (“Hong Kong”) or otherwise where the Personal Data (Privacy) Ordinance (Cap. 486) of the laws of Hong Kong (the “PDPO”) applies to our handling of your personal data. In the event of any inconsistency between this Appendix E and the main Privacy Notice in its application to you, this Appendix E prevails.

Data user: A reference to personal data in this Privacy Notice includes a reference to “personal data” as defined under the PDPO. References in this Privacy Notice to the “data controller” shall, in respect of Hong Kong, be read as references to the “data user” within the meaning of the PDPO.

Provision of personal data: If you do not provide your personal data when requested, we may be unable to accept or fulfil an order, process payments, create or administer your account, provide services requested by you, respond to your enquiries or requests to exercise your rights, or comply with applicable legal requirements. We will not use your personal data for any purpose other than the purpose for which it was collected or a directly related purpose, unless we have obtained your consent as required under the PDPO or such use is otherwise required or permitted by applicable law.

Direct marketing: We intend to use your personal data (including your name, contact details (such as your email address and telephone number(s)), demographic information, customer or account identifiers, marketing engagement information, preferences, and browsing and purchase history) for direct marketing of the following classes of marketing subjects: fashion, apparel, accessories, luxury goods, and related products and services available through our Websites and Apps, and related offers, promotions, rewards and events.

We will not use your personal data for direct marketing unless we have received your consent. You may communicate your consent through the response channel presented when we request your consent, and we will not charge you for doing so. Unless we have provided you with a separate written notice and obtained your written consent in accordance with the PDPO, we will not provide your personal data to another person for use by that person in its own direct marketing. That notice will specify the kinds of personal data to be provided, the classes of recipients, the classes of marketing subjects, whether the data will be provided for gain, and the response channel through which you may provide your written consent free of charge.

You may at any time and free of charge withdraw any consent you have given and require us to: (i) cease using your personal data for direct marketing; and/or (ii) cease providing your personal data to any other person for use in direct marketing and notify any such person accordingly. To do so you can update your preferences in “My Account”, click “unsubscribe” in any marketing email, or contact our Customer Care team.

Disclosure to governmental bodies and regulators: For individuals in Hong Kong, the statement in Section 5 of the main Privacy Notice concerning voluntary disclosures to governmental bodies or regulators where this is in our business interests shall not authorise us to disclose personal data for a purpose other than the purpose for which it was collected simply because we consider such disclosure to be commercially desirable. We will make such disclosures only where required or permitted by applicable law, for the purpose for which the personal data was collected or a directly related purpose, or where we have obtained your consent as required by the PDPO.

Your rights: You have the following rights in relation to your personal data under the PDPO:

The right to ascertain whether we hold personal data about you, and to request access to a copy of that data (we will respond within 40 days of your request and may charge a fee for complying with a data access request, which shall not be excessive).
The right to request the correction of personal data that is inaccurate (we will respond within 40 days of your request).
The right to be given reasons if a data access request or data correction request is refused, and to object to any such refusal.
The right to withdraw, by written notice to us, any consent you have previously given to the use of your personal data.

Transfers outside Hong Kong: Your personal data may be transferred to, stored and processed in jurisdictions outside Hong Kong, including the United States of America, the United Kingdom and the European Union, as described in Section 6 of the main Privacy Notice. Where we transfer your personal data outside Hong Kong, we will take appropriate steps to protect it, including by implementing appropriate contractual safeguards where appropriate, so that it continues to receive a standard of protection comparable to that described in this Privacy Notice.

Complaints: If you have a complaint about how we have handled your personal data under the PDPO, we encourage you to contact us first using the details in Section 10 of the main Privacy Policy so that we have the opportunity to address your concerns. You also have the right to lodge a complaint with the Office of the Privacy Commissioner for Personal Data at: https://www.pcpd.org.hk.