Website ("returns.puma.com") 

This Data Protection Information provides information on the processing of your personal data whenever you visit this website in accordance with the EU General Data Protection Regulation (hereinafter "GDPR"). We would like to inform you that the service provided on the website under the domain "returns.puma.com" is exclusively provided to our business-to-business customers. This Privacy Policy also applies for our service providers, partners and contractors as well as suppliers. 

The website returns.puma.com allows business-to-business customers to manage and track their PUMA claims and returns easily and efficiently, in collaboration with the PUMA Sales and Customer Service teams. The website covers the end-to-end process from request creation to credit note creation. For customers to use the platform, business customer user accounts will be created by PUMA.  

1. Scope, data controller, data protection officer and definitions

1.1 Scope of this Data Protection Information This Data Protection Information applies to the use of this website, including any measures connected with the execution and recission of business-to-business claims and returns. Data processing on websites of other companies within the PUMA Group are not covered by this Data Processing Information. 

1.2 The Controller for the processing of your personal data Unless otherwise specified in this Data Processing Information, the Controller for the processing of your personal data is: PUMA SE PUMA Way 1 91074 Herzogenaurach Germany Email:  digitalsolutions-europe@puma.com  

1.3 Contact details of the Data Protection Officer Please send any questions concerning data protection to: Data Protection Officer PUMA SE PUMA Way 1 91074 Herzogenaurach Email dataprotection@puma.com (Please note: for exercising your data protection rights, please use the email addresses referred to in Section 6 to 7!) 

1.4 Definitions This Data Processing Information is based on the following terms under data protection law, which we have defined to facilitate understanding. 

• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons regarding the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). 
• Recipient means a natural person or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with Union or Member State Law shall not be regarded as recipients; the processing of those data by the public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; Examples of possible recipients: IT services providers or adverting partners; for more information please refer to Section 4) 
• PUMA Group means all enterprises that are affiliated with PUMA SE pursuant to Section 15 Aktiengesetz [German Stock Corporation Act]. 
• Personal data means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Examples of personal data: Name, contact details, IP addresses. 
• Controller means the natural person or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State Law, the controller or the specific criteria for its nomination may be provided for by Union or Member State Law. For the data processing activities described in this Data Protection Information, the Controller is PUMA SE (Section 1.2.). 
• Processing means any operation or set of operations which is on personal data or on sets of personal data, whether or not by automated means such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

2. Purposes and legal bases of our processing of your personal data

The legal basis for all data processing is stipulated in Art. 6 GDPR. We process your personal data accordingly for business processes, for the initiation, performance and recession of contractual relationships, upon legal obligations but also for upholding contractual relationships, for offering products and services, as well as for strengthening our customer relationship. 

Your consent can also constitute a permission for the processing of your personal data. In case your consent is asked for accordingly, we will inform you about the purpose of the data processing and your right of withdrawal. If your consent for processing personal data relates to special categories of personal data, we will specifically point this out to you in advance. 

Which data we process is determined by the respective context. 

If you visit our website, we process your personal data for the following purposes and by virtue of the following legal bases: 

2.1 Provision of the website and IT Security We process your personal data that is technically necessary to allow us to provide our websites to you and to guarantee stability and security when you visit this website. This includes the following personal data: 

• Requested files, transferred data volumes, downloads/ file exports 
• Geographical location 
• IP address 
• type and version of browser 
• operating system and platform 
• the complete Uniform Resource Locator (URL) 

This data processing is necessary for the purpose of our legitimate interest to guarantee IT security (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR). The data is immediately anonymized by shortening the IP address to not establish a connection to the user. 

This data processing is necessary for the purpose of our legitimate interest to adapt our website to your needs (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR). 

2.2 Use of your business customer account When you use your business customer account it requires you to provide personal data. This includes the following personal data: 

• First name, last name 
• Email Address 
• Company name and company address 

This data processing is necessary for the performance of a contract (provision of a business customer account) with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR). 

2.3 Data processing in connection with a claim and return request creation and tracking We process your personal data (e.g. contact details, shipping information) in connection with the claim and return request placement and return pick up organization via your account. 

This data processing is necessary for the performance of a contract with you (Legal basis: Art. 6 (1) sentence 1, lit. b GDPR). 

2.4 Other Processing We store all activities performed by a user on the website in logfiles. 

This data processing is necessary for the purpose of incident management and the purpose of our legitimate interest to improve the products and services we offer and carry out. (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR). 

2.6 Use of cookies On our website we use cookies. They serve to make our offering more user-friendly, more effective and secure. Cookies are small text files that are stored in the browsers of your end devices whenever you visit our website. Through cookies, your actions and settings on our websites can be tracked, stored and recognized for the duration of the browser session or even after this. In addition to this, cookies and their respective cookie IDs allow your browser to be recognized.  

Most of the cookies are session-cookies, which are deleted automatically after each visit. Permanent cookies are automatically deleted from your computer when they are no longer valid, which is usually after six months, or they delete themselves before validity has ended. 

Our use of cookies is primarily based on our legitimate interest in data processing (Art. 6 (1) sentence 1, lit. f GDPR); in most cases, however, we obtain your consent in advance (Art. 6 (1) sentence 1, lit. a GDPR), which you can of course withdraw at any time via the privacy settings. 

3. Retention and erasure of your personal data

We store your personal data only for as long as it is required for the applicable processing purposes. As soon as the data for the purposes is no longer required, we might keep your personal for the length of time, during which you can assert claims against us or we can assert claims against you (the statutory period of limitations is generally three years, starting with the end of the year in which the claim arises, e.g. the end of the year of purchase). 

In addition to this, we store your personal data for as long and to the extent we are obliged to do so by law. Corresponding obligations of proof and retention can be found, inter alia, in the German Commercial Code, the German Tax Code and the German Money Laundering Act. The retention periods may accordingly last up to ten years. 

4. Transfer of personal data and the categories of recipients

Your personal data may be transferred / disclosed to the following categories of recipients: 

• IT Service providers who prepare the platforms, databases and tools for our products and services, and process your personal data during the claim and returns process on our behalf. 
• In connection with the feature that enables you to organize the pick-up of a return, the provided shipping information and contact details are shared with the logistics company. 
• In the case of legal disputes, we transfer your data to the competent court and, if you have engaged a lawyer, to the latter, in order to conduct the legal dispute. This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR) and/or for the purpose of our legitimate interest in the establishment and exercise of legal claims (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR). 
• In addition to this, we only transfer your personal data if we are legally obliged to forward such data (e.g. to the police authorities within the scope of criminal investigations or to the data protection supervisory authorities). This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR). 

5. Obligation to provide personal data

Certain personal data is necessary for the initiation, performance and recession of a contractual relationship, as well as the fulfilment of related contractual and legal obligations. The same applies to the use of this website and the various functions within. 

Please be aware that the use of this website and the underlying contractual relationship cannot be guaranteed without the provision of the above-mentioned personal data. 

6. Right to object to data processing based on legitimate interests

If we process your personal data according to Section 2 of this Data Protection Information on the basis of our legitimate interests (Legal basis: Art. 6 (1) sentence 1, lit. f GDPR), you can - without prejudice to, if applicable, specific unsubscribe / opt-out possibilities provided in Section 2 - object to the respective data processing at any time on grounds relating to your particular situation by sending your request to digitalsolutions-europe@puma.com . We will then no longer process your data for this / these purpose(s) unless our legitimate interests in processing overweighs or the processing serves to establish, exercise or defend legal claims. 

If you object to the processing of your data, we will process any collected personal data in this context in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR). 

7. Your other data protection rights

In accordance with the GDPR, you may demand at any time that we: 

• provide you with information on your personal data that we process (Art. 15 GDPR), 
• rectify any of your personal data (Art. 16 GDPR), 
• erase (Art. 17 GDPR), restrict (Art. 18 GDPR) and/or export (Art. 20 GDPR) any of your personal data stored on our systems. 

Please send your request by email to digitalsolutions-europe@puma.com. 

If you exercise these rights against us, we will process your personal data in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 (1) sentence 1, lit. c GDPR). 

Irrespective of your abovementioned rights, you can lodge a complaint with a data protection supervisory authority, if you are of the opinion that the processing of your personal data by PUMA violates the GDPR (Art. 77 GDPR). 

8. Links to third parties

On this website links to websites of other parties are -visibly- included. As far as links to websites of other providers are available, we have no influence on their contents. Therefore, no guarantee or liability can be assumed for these contents. The respective provider or operator of these sites is always responsible for the contents of these sites. The linked pages were checked for possible violations of law and recognizable infringements at the time of linking. Illegal contents were not recognizable at the time of linking. However, a permanent control of the contents of the linked pages is not reasonable without concrete evidence of a violation of the law. If we become aware of any infringements of the law, such links will be removed immediately. 

9. Changes to this Data Processing Information

The provisions of this Data Processing Information shall apply in the version in force at the time this website is visited and the service is used. 

We reserve the right to supplement and modify the content of this Data Processing Information. The updated Data Processing Information applies from the time, in which it was published on this website. 

Version 0.1 (Release Date: 28.03.2024)