OUR PRIVACY POLICY AT A GLANCE

1. WHO WE ARE. We are Zara España, S.A. and Nikole, S.A. and we process your

personal data as joint controllers. This means that we are jointly responsible for how we

process and protect your data. See more.

2. WHAT WE USE YOUR DATA FOR. We will use your data (collected online

or in person), among other purposes, to manage your registration as a user, to manage

your purchases of products or services, to respond to your queries, and, if you wish, to

send you our customised communications. See more.

3. WHY WE USE YOUR DATA. We have legal standing to process your data for

various reasons. The main reason is that we need to process your data to perform the

contract that you accept with us when you register and when you make a purchase or

enjoy any of our services or functionalities. We also use your data for other reasons, for

example, to respond to your queries or to send you newsletters that you have asked to

receive from us. See more.

4. WHO WE SHARE YOUR DATA WITH. We share your data with service

providers who provide us with assistance or support, these being companies in the Inditex

Group or third party providers. See more.

5. YOUR RIGHTS. You have the right to access, rectify or delete your personal data.

In certain cases, you are also entitled to other rights, such as, for example, to object to us

using your data, or to transferring your data, as explained in depth below. See more.

We encourage you to read our full Privacy Policy below to understand in depth the manner in

which we will use your personal data and your rights over your data.

BEFORE YOU START …

• In this Privacy Policy, you will find all relevant information applicable to our use of our users' and

customers' personal data, regardless of the channel or means (online or in person) that you use to

interact with us.

• If you would like information about how we use cookies and similar devices that may be installed on the

terminals of our customers and users, we recommend you consult the Cookies Policy.

• We are transparent about what we do with your personal data, to help you to understand the implications

of the way in which we use your data, and the rights you are entitled to in relation to your data:

o We permanently make available for you all the information included in this Privacy Policy, that you

can check when you consider appropriate, and in addition,

o you will also find further information on how we use your data as you interact with us.

• These are some terms we regularly use in this Privacy Policy:

o When we speak about our Platform, we refer, in general, to any of the channels or means, digital

or in person, you may have used to interact with us. The main ones are:

▪ Our Website.

▪ Our App, this is, including both the mobile application you installed on your device and

others we may use in our Platform.

▪ In person, in any of our Brick-and-Mortar Stores.

1. WHO IS THE CONTROLLER OF YOUR DATA?

Your data controllers are:

▪ ZARA ESPAÑA, S.A., company currently operating in Spain the sale of LEFTIES brand products

("LEFTIES SPAIN"):

• Postal address: Avda. de la Diputación, Edificio Inditex, 15143, Arteixo (A Coruña), España.

• E-mail address of the Data Protection Officer: dataprotection@lefties.com

▪ NIKOLE, S.A ("NIKOLE"):

• Postal address: Avda. de la Diputación, Edificio Inditex, 15143, Arteixo (A Coruña), Spain.

• E-mail of Data Protection Officer: dataprotection@lefties.com

In other words, both LEFTIES SPAIN and NIKOLE (jointly “We”, “Us” or “the Joint Controllers”), are Joint

Controllers of the data. This means that we have regulated and are jointly responsible for processing and

protecting your personal data.

2. WHY DO WE PROCESS YOUR PERSONAL DATA?

Depending on the purpose for which we process your data from time to time, as explained below, we need to

process one or other data, which will in general be, depending on each case, as follows:

▪ your identity data (for example, your name, surname, image, language and country from which you interact

with us, contact data, etc.);

▪ economic and transactions information (for example, your payment or card data, information on your

purchases, orders, returns, etc.);

▪ connection, geolocation and/or browsing data (for example, the location data, the device identification

number or the advertising ID, etc.);

▪ commercial information (for example, if you have subscribed to our newsletter),

▪ information about your tastes and preferences.

Remember that, when we ask you to fill in your personal data to give you access to any functionality or service of

the Platform, we will mark certain fields as compulsory, since this is information that we need to be able to provide

the service or give you access to the functionality in question. Please take into account that, if you decide not to

make such data available to us, you may be unable to complete your user registration or may not be able to enjoy

those services or functionalities.

In specific cases, a third party may have provided us with information about you by using a feature or service on

the Platform, for example by sending you a gift card or shipping an order to your address. In these cases, we only

process your data where relevant to this feature or service, as stated in this Privacy Policy.

In other cases, we may collect information passively, as we may use tracking tools like browser cookies and other

similar technology on our Platform and in communications we send you. Depending on how you interact with our

Platform, i.e., depending on the services, products or functionalities that you wish to enjoy, we will process your

personal data for the following purposes:

PURPOSE

+ info

1. To manage your registration as

user of the Platform

If you decide to become a registered user of our Platform, we need to

process your data to identify you as a user of the Platform and grant

you access to its various functionalities, products and services available

to you as a registered user. You may cancel your registered user account

by contacting us through Customer Service.

We hereby inform you that the data we gather regarding your activity,

which have been collected through the different channels of the Platform

and which include your purchases, shall remain linked to your account so

that all the information can be accessed together.

You have the possibility to use the login or sign in through a social

network or another collaborator that enables this service (social login)

when it is available on our login/sign in screen, either to link the social

credentials, as well as your name and email / phone number (you might

need to authorize it), will be imported from your social network or

collaborator account. By using this login option, these third parties may

PURPOSE

+ info

send us certain additional information about your public profile, such as:

your name, gender, approximate age or profile photograph, according to

the terms of use from the social network / collaborator, which we

recommend you read carefully. Unless you give us your authorization, we

will not retain this additional data. Likewise, the use of this functionality

may imply that you provide certain information about your activity to the

social network or the collaborator. In any case, we recommend that you

review your privacy settings and the privacy policies of the collaborator

or social network to learn how these third parties process your data.

2. For the development,

performance and execution of the

purchase or services contract that

you executed with Us on the

Platform

This purpose includes processing your data, mainly:

▪ To contact you for updates or informative notices related to the

contracted functionalities, products or services, including

quality surveys and to be able to establish the degree of

customer satisfaction with the provided service;

▪ To manage payment of the products that you purchase,

regardless of the payment procedure used. For example:

• If on purchasing any of our products through the Website or the

App, you opt to activate the functionality of save your payment

data and shipment address for future purchases (where this

feature is available), we need to process the indicated data for

activation and development of that functionality. Consent to the

activation of this functionality enables your autocompleted

payment data to appear in subsequent purchases so that you

do not need to introduce them in each new process, and these

data will be deemed valid and effective for subsequent

purchases. You may change or cancel your payment data at

any time through the section on payment information, either of

your Website registered user account, or of the My Account

section of the App.

▪ If it is available and you choose to use the functionality of the App

to pay your face-to-face purchases, we need to process your

data to activate it, so that you may start your purchases at the

Brick-and-Mortar Stores enabled for the purpose.

▪ Activate the mechanisms necessary to prevent and detect

unauthorised uses of the Platform (for example, during the

purchase and returns process as well as potential fraud being

committed against you and/or against us. If we consider that the

transaction may be fraudulent or we detect abnormal behaviour

which indicates attempted fraudulent use of our features,

products or services, this processing may result in consequences

such as the blocking of the transaction or the deletion of your

user account.

PURPOSE

+ info

▪ To manage potential exchanges or returns after you have

purchased and manage requests of availability information

for articles, reservations of products through the Platform,

depending on the availability of such options from time to time.

▪ For invoicing purposes and to make available to you the tickets

and invoices of the purchases you have made through the

Platform.

▪ To ensure that you are able to use other available

functionalities or services, such as the purchase, receipt,

management and use of the Gift Card or of the Gift Voucher,

and to afford you access and use of the Wi-Fi that we make

available to our customers at Brick-and-Mortar Stores.

▪ If you are a user of the InWallet App of the Inditex Group

("InWallet") and you have requested to link the account you have

on this Platform to your InWallet account, you authorize us to

share the information related to your orders and returns of online

purchases. The information collected by the InWallet App is

subject to its own terms and policies, which we suggest you to

review.

▪ To be able to offer you through the App specific services (such

as item finder, reserve a fitting room, etc.) available in some

Brick-and-Mortar Stores, we may process your location and

contact data.

3. To meet requests or applications

that you make through the

Customer Support channels

We only process the personal data that are strictly necessary to

manage or resolve your request or application.

If you contact us via telephone, the call may be recorded for quality

purposes and so that we can respond to your request.

If it is available and you choose to communicate with Customer Support

through the chat service of a social network or another collaborator, some

of your personal data such as your name or user name, will be imported

from your social network or collaborator account. Also, bear in mind that

the data you submit on this service will be available to your social network

or collaborator and subject to their privacy policies, therefore We

recommend you to review your privacy settings and to read the social

network or collaborator privacy policies to obtain more detailed

information about the use they make of your personal data when using

their services.

4. For marketing purposes.

This purpose includes the processing of your data, mainly, for:

▪ Personalise the services we offer you and enable us to give you

recommendations based on your interactions with LEFTIES on

PURPOSE

+ info

the Platform and an analysis of your user profile (for example,

based on your purchase and browsing history).

▪ If and when you subscribe to our Newsletter, we will process your

personal data to manage your subscription, including to send

customised information on our products or services through

various means (such as e-mail or SMS). We may also make

available to you this information through push notifications in

case you have activated them in your device.

▪ Accordingly, please take into account that this data processing

implies analysis of your user or customer profile to

establish your preferences and therefore which products and

services are most fit to your style when sending you

information. For example, based on your purchases and

browsing history (i.e., depending on the articles that you

clicked), we will make you suggestions on products that we

believe may interest you and, if you are a registered user, we

will provide you with the "recover cart" functionality.

▪ Remember that you may unsubscribe from the Newsletter

at any time without cost through the "Newsletter" section of the

Platform, in addition to through the instructions that we provide

you with in each notice. If you do not want to receive push

notifications, you can deactivate this option in your device.

▪ Show you ads on the Internet which you may see when visiting

websites and apps, for example, on social media. The ads you

see may be random, but on other occasions they may be ads

related to your preferences or purchase and browsing history.

▪ If you use social media, we may provide the companies with

which we collaborate certain information so that they, as joint

controllers, can show you our brand ads and, in general, offer

you and users like you advertisements which take into account

your profile on said social media sites. If you want information

about the use of your data and how advertising works on social

media, we recommend you review the privacy policies of the

social media sites on which you have profiles.

▪ We also use your data to carry out measurement and segment

analyses on the ads which we show users on some of our

collaborators’ platforms. To do this we collaborate with these

third parties who offer us the necessary technology (for

example, cookies, pixels, SDK) to use these services. Keep in

mind that we may need to provide them with certain information

or some form of identifier each time (for example, the

advertising ID associated with the device, an identifier

associated with a cookie, etc.) If you would like more

PURPOSE

+ info

information in this respect, please review our Cookies Policy.

Likewise, you can reset your advertising ID or disable

personalised ads on your device, adjusting your preferences in

settings section of your device.

▪ Data enrichment: When we gather your personal data from a

variety of sources, we may consolidate them under certain

circumstances for the purpose of improving our understanding of

your needs and preferences related to our products and services

(including for the purposes of analyses, generating user profiles,

marketing studies, quality surveys and improving our interactions

with our customers). This refers, for example, to the way we may

combine your information if you have a registered account and,

using the same email linked to your account, you make a

purchase as a guest, or to information which is automatically

compiled (such as IP and MAC addresses or metadata) which

we may link with the information you have provided us directly

through your activity on the Platform or in any of our stores (for

example, information related to your purchases, whether in brick-

and-mortar stores or online, your preferences, etc.).

▪ To perform promotional actions (for example, for the

organization of competitions or to send the list of items stored to

the e-mail you designate). On participating in any promotional

action, you authorise us to process the personal data that you

have shared with us depending on the promotional action and

disclose them through different media such as social networks or

the Platform itself. In each promotional action in which you

participate you will have available the terms and conditions

where we will be providing more detailed information about the

processing of your personal data.

▪ To disseminate in the Platform or through our channels in the

social networks photographs or pictures that you shared publicly,

provided that you expressly give us your consent for the purpose.

5. Analysis of usability and

quality to improve our services

If you access our Platform, we inform you that we will treat your browsing

data for analytic and statistic purposes, i.e., to understand the manner

in which users interact with our Platform and with the actions we

implement on other websites and apps, so we can improve our services..

In addition, we occasionally perform quality surveys and actions to

know the degree of satisfaction of our customers and users and detect

those areas in which we may improve.

3. HOW ARE WE LEGALLY PERMITTED TO PROCESS YOUR DATA?

The legal terms on which we are permitted to process your personal data also depends on the purpose for which

we process them, as explained in the following table:

Purpose

Legal standing

1. To manage your Platform

user registration

We process your data because this is necessary on the terms regulating

the use of the Platform. In other words, for you to be able to register as a

user on the Platform, we need to process your personal data, since we

would otherwise be unable to manage your registration.

We consider we have a legitimate interest to link to your account your

purchases and the data collected through different channels of the Platform

about your activity.

If you opt to use the access or login through a social network, we are legally

permitted to process your data given the consent that you give when

authorising the assignment of your data from the social network.

2. Development, performance

and making of the purchase or

services contract

We process your data because their processing is necessary for us to make

the purchase or services contract with you.

Certain processing of data related to the purchase process is activated only

because you request or authorise it, as is the case of the storage of payment

data for future purchases or the processing of data necessary to scan the

till receipts through the Wallet section of the App or to provide you with the

Coming Soon / Back Soon functionalities (where these functionalities are

available). In these cases, our processing of your data is supported by your

own consent. In addition to this, we process your location data when you

provide us your consent in order to offer you specific services through the

App when visiting some of our Brick and Mortar Stores.

We consider that we have a legitimate interest to carry out the necessary

verifications to detect and prevent potential fraud or fraudulent uses of the

Platform, for example when you make a purchase or return. We understand

that the processing of these data is positive for all the parties involved: for

you, as it allows us to put in place measures to protect you against

attempted fraud perpetrated by third parties; for Us, as it allows us to avoid

unauthorised uses of the Platform; for all our customers and society, as it

also protects their interest by ensuring that fraudulent activities are

discouraged and detected when they do occur.

Purpose

Legal standing

3. Customer Support

We consider that we have legitimate interest in answering the requests or

queries raised by you through the existing different contact channels. We

understand that the processing of these data is also beneficial to you to the

extent that it enables us to assist you adequately and answer to the queries

raised.

When you get in touch with us, in particular, for the management of incidents

related to your order or the product/service acquired through the Platform,

the processing of your data is necessary to perform the purchase

contract.

When your request is related to the exercise of your rights on which we

inform you below, or to claims on our products or services, we are legally

permitted to process your data for compliance with our legal obligations.

4. Marketing

We are legally permitted to process your data for marketing purposes due

to the consent that you give us, for example when you accept receiving

customized information through multiple channels, when you accept

receiving push notifications on your device, when you configure it in the

privacy settings of your device, when you consent through the cookies

settings, when you configure your mobile device´s settings to allow

personalised ads, or when accepting the legal terms and conditions to

participate in a promotional action or to publish your pictures on the Platform

or on our social networks' channels.

To offer you personalised services or to show you customised information,

whether on our Platform or those of third parties, as well as to engage in

data enrichment, we consider that we have a legitimate interest to conduct

a profiling with the information that we have about you (such as your

browsing, preferences or purchase history) and the personal data that you

have provided us, such as the age range or language, since we understand

that the data processing of these data is also beneficial to you because it

allows you to improve your user experience and access the information in

accordance with your preferences.

5. Analysis of usability and

quality

We consider that we have a legitimate interest in analysing the Platform

usability and the user's satisfaction degree, since we understand that the

processing of these data is also beneficial for you because the purpose is

to improve the user experience and provide a higher quality service.

4. HOW LONG WILL WE KEEP YOUR DATA?

The time for which we will keep your data will depend on the purposes for which we process them, as explained

below:

Purpose

Time for which the data are kept

1. To manage your Platform

user registration

We will process your data for the time during which you remain a registered

user (meaning, until you decide to unsubscribe).

2. Development, performance

and execution of the purchase

or services contract

We will process your data for the time necessary to manage the purchase

of the products or services that you buy, including potential returns,

complaints or claims related to the purchase of the product or service in

question.

Sometimes, we will only process the data until the time when you decide,

as is the case of payment data that you requested us to store for future

purchases (where this feature is available).

3. Customer Support

We will process your data for the time necessary to meet your request or

application.

4. Marketing

We will process your data until you unsubscribe or cancel your subscription

to the newsletter.

Likewise, we will show you personalised ads until you change your device,

browser and or cookies settings so that permission to do so is revoked.

If you participate in promotional actions, we will keep the data during a six

(6) months period from the end of the action.

5. Analysis of usability and

quality

We will process your data occasionally for the time during which we proceed

to carry out a specific quality action or survey or until we anonymise your

browsing data.

Notwithstanding the fact that we will process your data for the time strictly necessary to achieve the purpose in

question, we will subsequently keep them duly stored and protected for the time during which liability may arise for

their processing, in compliance with legislation in force from time to time. Once each of the potential actions is time-

barred we will proceed to delete the personal data.

5. DO WE SHARE YOUR DATA WITH THIRD PARTIES?

To achieve the purposes mentioned in this Privacy Policy, we must give access to your personal data to entities

of the Inditex Group and to third parties that provide us with support in the services that we offer your, i.e.:

▪ financial institutions,

▪ anti-fraud detection and prevention entities,

▪ technological and analytical service providers,

▪ providers and partners of services related to logistic, transport and delivery and/or their partner

establishments,

▪ providers of customer support related services,

▪ service providers and collaborators related to marketing and publicity, such as advertising agencies,

advertising partners or social media that in certain cases may act as joint controllers.

For service efficiency purposes, some of these providers are located in territories outside the European Economic

Area that do not offer a level of data protection comparable to that of the European Union. In such cases, we inform

you that we transfer your data with adequate safeguards and always keeping your data safe, using the most

convenient international data transfer tools, in example the Standard Contractual Clauses and any relevant

supplementary measures. You may consult the content of such Standard Contractual Clauses through the

following link: https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/model-contracts-

transfer-personal-data-third-countries_en

In addition, we inform you that we need to share your data with our parent company, Industria de Diseño Textil,

S.A. (Inditex, S.A.), Inditex Group holding company, for compliance with the obligations of the parent company.

In the event that we sell or transfer all or a portion of our business or assets to other company within or outside the

Inditex Group, or have any other business operation implemented as a consequence of corporate reorganizations,

we may disclose your personal data to the prospective receptor of such business or assets. Should such a sale or

transfer occur, we will use reasonable efforts to direct the transferee to use personal information you have provided

to us in a manner that is consistent with our Privacy Policy. In this case, we consider that we have legitimate interest

consisting on the reorganization of our corporate structure.

Furthermore, if you choose to use the Platform in different markets (i.e. by creating registered user accounts in

different markets with the same e-mail address), We may need to disclose or transfer the information linked to your

account or your activity to the companies of the brand operating in those markets, to the extent they are directly

involved in the achievement of any of the purposes described in the section 2. We consider this is necessary in

accordance with our mutual interests and preferences.

6. WHAT ARE YOUR RIGHTS WHEN MAKING YOUR DATA AVAILABLE TO

US?

We undertake to keep your personal data confidential and to ensure that you may exercise your rights. Bearing

that in mind, we Joint Controllers have agreed that you may exercise your rights free of charge by writing us an e-

mail to a single e-mail address (dataprotection@lefties.com), simply informing us of the reason for your request

and the right that you wish to exercise. If we consider this necessary to be able to identify you, we may request you

to provide a copy of a document evidencing your identity.

In addition, we may offer you with the possibility to exercise your rights and setting your privacy preferences when

using some of our services, or by making available specific channels within our Platform.

In particular, notwithstanding the purpose or legal basis we use to process your data, you have the following rights:

• To request access to your personal data that we hold. We remind you that where you are a Platform

registered user you may also consult this information in the relevant section of your online account.

• To request that we rectify the personal data that we hold. Please bear in mind that if you are a

registered user on the Platform, you may also access the relevant personal data section of your online

account to change or update your personal data. In any case, please take into account that, on actively

making your personal data available to us through any procedure, you guarantee that they are true

and accurate, and you undertake to notify to us any change or modification of your data. You will be

liable for any loss or damage caused to the Platform or to the person responsible for the Platform or to

any third party by reporting erroneous, inaccurate or incomplete information in the registration forms.

Please remember that, as a general rule, you must provide us only with your own data, not with those

of third parties, other than to the extent otherwise permitted in this Privacy Policy.

• To request that we erase your personal data to the extent that they are no longer necessary for the

purpose for which we need to keep processing them, as we have explained above, or when we are no

longer legally permitted to process them.

• To request that we cancel or limit the processing of your personal data, which entails that in certain

cases you can request us to temporally suspend the processing of the data or that we keep them longer

than necessary.

If you have given us your consent to process your data for any purpose, you also have the right to withdraw

such consent at any time. Some of the circumstances in which you may withdraw your consent are detailed in

section 2 where we explain for which purposes we process your data.

Should you not wish us to send information to third parties to show you ads, you can do it through several means

such as changing your preferences on your device changing your preferences on your device, browser and/or

cookies settings, reviewing the privacy policies and settings of the social media sites on which you have profiles or

sending us an email to the above mentioned email address informing us of your request.

When we are legally permitted to process your data due to your consent or to for the purposes of a contract, as

explained in section 3, you will also have the right to request the portability of your personal data. This means

that you will have the right to receive the personal data that you made available to us in a structured, commonly

used and machine-legible format, to be able to transmit them to another entity directly without impediments on our

part.

In addition, where the processing of your data is based on our legitimate interest, you will also have the right to

object to the processing of your data.

Finally, we inform you that you have the right to file a claim before the responsible data protection regulatory

authority, in particular, before:

▪ the Spanish Data Protection Authority (https://www.agpd.es/portalwebAGPD/index-ides-idphp.php).

7. WHAT HAPPENS WHEN YOU PROVIDE US WITH DATA OF THIRD

PARTIES OR IF A THIRD PARTY HAS PROVIDED US WITH YOUR DATA?

We offer functionalities or services that require us to process the personal data of a third party that you, as a user

or as a customer, must provide us with, such as in the case of activation and sending of the Gift Card or the

management of the application for the Gift Voucher (where these features are available), or when you authorise a

third party to collect an order in our stores or partner establishments. If you provide us with personal data of third

parties or if it is necessary that we request them for a third party to collect an order in your name, you confirm that

you informed them of the purposes and of the manner in which we need to process their personal data.

If a third party has provided us with your data or you have provided them yourself as a result of a feature or service

requested by one of our users, we will use them to manage the feature or service in question in each case, within

the limits of the purposes listed in this Privacy Policy, a link to which is always included in our communications.

8. CHANGES TO THE PRIVACY POLICY

We may amend the information contained in this Privacy Policy when we consider this appropriate. Should we do

so, we will notify you by various procedures through the Platform (for example, through a banner, a pop-up or a

push notification), or we may even send you a notice to your e-mail address when the change in question is relevant

to your privacy, for you to be able to review the changes, assess them and, as the case may be, object or

unsubscribe from ay service or functionality. In any case, we suggest you to review this Privacy Policy from time to

time in case minor changes are made or we make any interactive improvement, taking the opportunity that you will

always find it as a permanent point of information on our Website and our App.

9. INFORMATION ON COOKIES

We use cookies and similar devices to facilitate your browsing in the Platform, understand how you interact with us

and, in certain cases, to be able to show you advertisements in accordance with your browsing habits. Please read

our Cookies Policy to understand with greater detail the cookies and similar devices that we use, their purpose,

how to manage your preferences, as well as other information of interest.