1.1 This Privacy Policy (“Policy”) explains how we (as defined below) collect, share and use any information that, alone or in combination with other information, relates to you (“Personal Data”) when you (“you” and “your”) use our website ssense.com (the “Website”), or when you call us or answer our surveys.

1.2 This Policy also sets out the rights that you have in relation to the Personal Data that we process about you and how you can exercise them.

1.3 SSENSE treats compliance with its privacy obligations seriously. This is why we have developed this Policy, which describes the standards that DARRO applies to protect Personal Data.

1.4 For the purposes of this Policy, SSENSE (“DARRO”, “us”, “we”, or “our”) headquartered at 333 Chabanel Street W #900, Montreal QC H2N 2G1, Canada, acts as the data controller for the Personal Data that is collected via the Website. As a data controller, DARRO is responsible for ensuring that the processing of Personal Data complies with applicable data protection law, which includes the General Data Protection Regulation.

1.5 Please take the time to read this Policy carefully. If you have any questions or comments, please contact us by phone +34 677 637 600 or via email at dataprotection@darro.com.

3.1 We may disclose your Personal Data to the following categories of recipients:

(a) to our group companies for purposes consistent with this Policy, and in particular, so that they may contact you regarding products and services that may be of interest to you where you have given your consent. We take precautions to allow access to Personal Data only to those staff members who have a legitimate business need for access and with a contractual prohibition of using the Personal Data for any other purpose. Our group companies include: Atallah Group Inc., Atallah Group Limited, Atallah Hong Kong Limited, Atallah Group US Inc., GAI Services PTY Limited, Atallah International Inc.

(b) to our third party vendors, services providers and partners who provide data processing services to us, or who otherwise process Personal Data for purposes that are described in this Policy or notified to you when we collect your Personal Data. This may include disclosures to third party vendors and other service providers we use in connection with the services they provide to us, including to support us in areas such as IT platform management or support services, infrastructure and application services, marketing, data analytics. Our third party vendors, service providers and partners include, without being limited to: Riskified, Signifyd, Clearsale, HostedPCI, First Data (Payeezy/IPG), Paypal Express, PayPal Pro (Payflow Pro), Paysafe (Netbanx), Pazien, Google, Facebook, Bing, Commission Junction, Partnerize, Rakuten, MailChimp, Mandrill, SendGrid, SurveyMonkey.

(c) to any competent law enforcement body, regulatory, government agency, court or other third party where we believe disclosure is necessary (i) as a matter of applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person;

(d) to our auditors, advisors, legal representatives and similar agents in connection with the advisory services they provide to us for legitimate business purposes and under contractual prohibition of using the Personal Data for any other purpose;

(e) to a potential buyer (and its agents and advisers) in connection with any proposed purchase, merger or acquisition of any part of our business, provided that we inform the buyer it must use your Personal Data only for the purposes disclosed in this Notice;

(f) to any other person if you have provided your prior consent to the disclosure.

5.1 The Personal Data we collect from you is stored in our servers located in the United States.

5.2 We retain Personal Data we collect from you where we have an ongoing legitimate business need to do so (for example, to provide you with a service you have requested or to comply with applicable legal, tax or accounting requirements).

5.3 When we have no ongoing legitimate business need to process your Personal Data, we will either delete or anonymise it or, if this is not possible (for example, because your Personal Data has been stored in backup archives), then we will securely store your Personal Data and isolate it from any further processing until deletion is possible.

6.1 Your Personal Data may be transferred to, and processed in, countries other than the country in which you are resident. These countries may have data protection laws that are different to the laws of your country.

6.2 Specifically, our Website servers are located in the United States, and our group companies and third party service providers and partners operate around the world. This means that when we collect your Personal Data we may process it in any of these countries.

6.3 However, we have taken appropriate safeguards to require that your Personal Data will remain protected in accordance with this Policy. When transferring your Personal Data to Canada, we rely on the EU Commission’s adequacy decision 2002/2/EC available here. When transferring your Personal Data to the United States, we rely on the EU Commission’s EU-US Privacy Shield decision (available here) if the recipient is appropriately certified. In all other cases, we only transfer or make your Personal Data available to other entities of the SSENSE group or to our third party services providers in third countries where such transfer is necessary for the performance of a contract between you and SSENSE or the implementation of pre-contractual measures.

7.1 In some instances, we may use your Personal Data in order to better understand your preferences and to provide customized products or services to you. However, we do not make any decisions based solely on automated processing of such data, which either produce legal effects that concern you or similarly significantly affect you.

8.1 The services we provide on this Website are not intended for individuals below the age of 16. If you are under 16, please do not use or register on this Website.

9.1 You have the following data protection rights:

(a) If you wish to access, correct, update or request deletion of your Personal Data, you can do so at any time by contacting us using the contact details provided under the “How to contact us” heading below.

(b) In addition, in certain circumstances, as stipulated in the applicable data protection legislation, you can object to the processing of your Personal Data, ask us to restrict processing of your Personal Data or request portability of your Personal Data. Again, you can exercise these rights by contacting us using the contact details below.

(c) If we have collected and process your Personal Data with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect the processing of your Personal Data conducted in reliance on lawful processing grounds other than consent.

(d) You have the right to opt-out of marketing communications we send you at any time. You may unsubscribe from our newsletters or marketing notifications at any time by selecting the unsubscribe option in the “Email Preferences” section of your account, or by clicking the unsubscribe link at the bottom of every newsletter email. To opt-out of other forms of marketing (such as postal marketing or telemarketing), then please contact us using the contact details provided below.

(e) If you have a complaint or concern about how we are processing your Personal Data then we will endeavour to address such concern(s). If you feel we have not sufficiently addressed your complaint or concern, you have the right to complain to a data protection authority about our collection and use of your Personal Data. For more information, please contact your local data protection authority. (Contact details for data protection authorities in the European Economic Area, Switzerland and certain non-European countries (including the US and Canada) are available here.

9.2 We respond to all requests we receive from individuals wishing to exercise their data protection rights in accordance with applicable data protection laws.