Legal basis: this processing is based, where required by applicable law, on the consent you have given via the appropriate opt-in disclosure. To facilitate your understanding of the processing activities carried out by the above mentioned subjects as Controllers or Joint Controllers, we have prepared this document explaining which processing activities are carried out autonomously by each company. Herein below we specify which categories of personal data are collected; in the following paragraph we will explain for what purposes each category of data is processed by each Data Controller or by the Joint Controllers as appropriate (hereinafter also “Personal Data” if processed jointly). Your Personal Data may be processed by each Data Controller or Joint Controller to defend their rights or take legal action or make claims against you or third parties, including the prevention of fraud.

Right to object: in addition to the rights listed above, you always have the right to object at any time to the processing of your Personal Data carried out by the Data Controller or Joint Controller for the pursuit of its legitimate interest.

This is information that is not directly associated with individuals, but which by its very nature could, through processing and association with data held by third parties, allow these users to be identified. Finally, each Data Controller or Join Controller may need to comply with a specific legal provision to which it is subject or to defend its own right in court. employees and collaborators of the Data Processors designated by the Data Controllers or Joint Controllers, including (i) the companies managing the online store and who will be entitled to view, modify and update the Personal Data entered in the CRM systems through which the Data Controllers or the Joint Controllers carry out the processing activities for marketing and profiling purposes (ii) the companies managing the storage of the Personal Data of the Data Controllers or Joint Controllers based on agreements or local regulations;

Please consider that said processing activities are not intended for minors and the Data Controllers do not knowingly collect or solicit personal data from anyone under the age of 16. If you are less than 16 years old, please refrain from provide any personal data. This does not affect the applicable contract law such as the rules on the validity, formation or effect of a contract in relation to a child. The companies collecting and processing personal data as autonomous data controllers (hereinafter the “Data Controllers” or the “Companies”) or as joint controllers are:The Personal Data (either electronical and paper copies) will be stored for the time necessary to achieve the purposes for which they were collected. In particular, the following rules will apply:

The companies collecting and processing personal data as autonomous data controllers (hereinafter the “Data Controllers” or the “Companies”) or as Joint Controllers are: a. Purposes related to the obligations established by laws or regulations, by decisions/requests of competent authorities or by supervisory and control bodies To facilitate your understanding of the processing activities carried out by the above-mentioned subjects as Controllers or Joint Controllers, we have prepared this document explaining which processing activities each Company carries out autonomously by each company.to receive the copy of the Personal Data you provided us (so-called “data portability”) and to have data transmitted to another controller, if technically possible; If you believe that the processing of your Personal Data is carried out in breach of the provisions of the GDPR, you have the right to lodge a complaint with the Supervisory Authority or to start the appropriate legal actions before the competent courts. Loyalty Data: your data collected as part of the “House of Diesel” loyalty program, whose Regulation is available at the following link, and based on your engagement with the brand (e.g., social media “like”, “comment”, “share”, “save”, “follow Diesel’s official account”, “share photos on community platform”, “create Wishlist and e-store avatar” etc.); The cancellation process is carried out periodically on the basis of the customer's request or at the expiry of the retention period, through an automatic flow that involves the data bases concerned; otherwise, Personal Data will be permanently anonymized; the hard copies will be destroyed by using appropriate devices.

Legal basis: this processing is based on the performance of a contract for joining the loyalty program to which you are a party; the provision of the Personal Data listed above is necessary for this purpose, since otherwise Diesel will not be able to process your request. Your Personal Data may be processed by each Data Controller or Joint Data Controller to defend their rights or take legal action or make claims against you or third parties. In this paragraph we further explain for what purposes each category of data is processed by each Data Controller or Joint Controller. 3.1 PURPOSES OF DIESEL USA Inc. (DIESEL)

Loyalty Data: : your data collected as part of the “House of Diesel” loyalty program, whose Regulation is available at the following link, and based on your engagement with the brand (e.g., social media “like”, “comment”, “share”, “save”, “follow Diesel’s official account”, “share photos on community platform”, “create Wishlist and e-store avatar” etc.);