VIII. ADDITIONAL DISCLOSURES FOR INDIVIDUALS IN EUROPE

If you are located in the European Union (“EU”), European Economic Area (“EEA”), the United Kingdom (“UK”) or Switzerland, our legal basis for collecting and using the personal information described above will depend on the personal information concerned and the specific context in which we collect it.  In addition to the provision set out above in this Policy, the following provisions shall apply in accordance with the General Data Protection Regulation (“GDPR”):

1. Additional Disclosures

For individuals in the EU or EEA, following applies:

“Personal information” as set out in this Privacy Policy shall be understood as “personal data” and have the same meaning as set out in the GDPR. The term “processing” has also the meaning ascribed to it in the GDPR.

Category of Personal Data:	Purposes of Processing:	Legal Bases:
Identifiers, such as your name, user name, IP address, billing and shipping address, email address, telephone number, password and date of birth	Purposes set out in section II. 5. (a), (b), (d), (h) and (i)	Art. 6 (1) (b) GDPR (performance of a contract); Art. 6 (1) (f) GDPR (legitimate interest); Art. 6 (1) (a) GDPR (consent) Our legitimate interest is to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you.
Audio and visual data: phone recordings when you contact customer service or photos submitted in connection with a product review, videos and stories	Purposes set out in section II. 5. (b), (c), and (e) – (g), (i)	Art. 6 (1) (f) GDPR (legitimate interest); Art. 6 (1) (b) GDPR (performance of a contract); Art. 6 (1) (a) GDPR (consent) Our legitimate interest is to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you (e.g., to confirm your order, inform you about the shipping process or to provide customer support).
Commercial information, such as records of products purchased, purchase price, the date and location of the transaction and payment information	Purpose set out in section II. 5. (a)	Art. 6 (1) (b) GDPR (performance of a contract)
Employment status at an eligible organization, including photographs of your paystubs/pay slips or your work email address	Purpose set out in section II. 5. (j)	Art. 6 (1) (c) GDPR (legal obligation) and/or Art. 6 (1) (b) GDPR (performance of a contract)
Device and usage information: IP address, log-in information, browser type and version, browser plug-in types and versions, operating system and platform, your activity on our Websites, including URL clickstream to, through and from our Websites, download errors, length of visits to certain pages and page interaction	Purposes set out in section II. 5. (a), (c), (d), (f) and (i)	Art. 6 (1) (b) GDPR (performance of a contract); Art. 6 (1) (f) GDPR (legitimate interest); Art. 6 (1) (a) GDPR (consent) Our legitimate interest is to provide, maintain, and improve our products and services and conduct data analytics.
Contact information and information about participant feedback	Purposes set out in section II. 5. (d), (f) and (g)	Art. 6 (1) (f) GDPR (legitimate interest); Art. 6 (1) (a) GDPR (consent) Our legitimate interest is to provide, maintain, and improve our products and services, conduct data analytics, and communicate with you.
Aggregated or de-identified data regarding Website performance	Purposes set out in section II. 5. (a) and (f)	Art. 6 (1) (f) GDPR (legitimate interest) Our legitimate interest is to provide, maintain, and improve our products and services.

In addition to the information provided in section VI. above, the following applies:

Our Website is hosted and operated in the United States through us and our service providers, and the laws in the United States may differ from the laws in your country. By using the Websites, you acknowledge that any personal data concerning you, regardless of whether provided by you or obtained from a third party, is being provided to us in the United States and will be hosted on United States servers and processed in the United States, and you acknowledge that we will store and process your information to and in the United States, and possibly other countries. We will take all steps reasonably necessary to ensure that your personal data is subject to appropriate safeguards, such as relying on a recognized legal adequacy mechanism including EU standard contractual clauses where applicable, and that it is treated securely and in accordance with this Policy.  Our data processors are bound by appropriate contractual obligations to implement adequate security measures to protect security and confidentiality of personal data.

2.  Data Retention

We store personal data associated with your account for as long as your account remains active. If you close your account, we may retain some information about you and your purchases where we have an obligation to do so under applicable law (for example, to comply with applicable legal, tax or accounting requirements). We store other personal data which is not associated with your account as for as long as necessary to carry out the purposes for which we originally collected it in accordance with this Policy.

3. Your Privacy Rights

If you have questions about our privacy practices, please email [e-mail].

Visitors from the European Economic Area should contact KEEN Europe Outdoor BV (Netherlands) (the data controller) by telephone on the following telephone number: [phone].

If you reside within the EU or EEA, you have the following additional rights: (i) to have the processing of your personal data restricted, (ii) to lodge an objection against any kind of processing based on Art. 6 (1) (e) or (f) GDPR, and (iii) to withdraw at any time your consent on which a processing of your personal data is based.

To exercise your rights as set out in this section, submit this webform or contact us at [e-mail].

If you have a concern about our processing of personal data that we are not able to resolve, you have the right to lodge a complaint with the Data Protection Authority where you reside. Contact details for your Data Protection Authority can be found using the links below:

For individuals in the EEA: https://edpb.europa.eu/about-edpb/board/members_en

For individuals in the UK: https://ico.org.uk/global/contact-us/

For individuals in Switzerland: https://www.edoeb.admin.ch/edoeb/en/home/the-fdpic/contact.html