Hong Kong Membership Program Privacy Notice

1. COLLECTION OF PERSONAL DATA.

We may collect Personal Data when you interact with us or any of our brands, such as when you:

• Submit the customer registration
• Purchase, return, reserve or try-on merchandise
• Consent to receive our promotional email, SMS/text messages, or other communications
• Information from your emails, texts, chats, video calls and voice calls with our sales associates
• Visit our stores
• Participate in our contests, sweepstakes or promotions
• Participate in one of our surveys or other customer research
• Contact or visit our Customer Service Department, or otherwise contact us or one of our service providers with a comment, question or complaint

In addition, we may collect and receive Personal Data about you from third parties, including our vendors and service providers. For instance, we may engage vendors and work with other partners to provide services to us or to you on our behalf (such as payment processors, cloud hosting and service providers).

When we collect your Personal Data we will indicate whether it is optional or mandatory for you to provide specific types of Personal Data. The collection of some Personal Data is mandatory for the purposes described in this Notice. If you do not provide us with such mandatory Personal Data, we may not be able to administer and manage our relationship with you (such as communicate with you or perform our contract with you), which in some cases may mean we are unable to continue with your engagement with us if applicable, or we may be prevented from complying with our legal obligations.

2. PURPOSES AND LEGAL BASES OF PROCESSING PERSONAL DATA

While the purposes for which we may process Personal Data will vary depending upon the circumstances, in general, we use Personal Data for the business purposes set forth in this section.

In this section, we also explain the purposes for which we collect and process your personal information, as well as the legal bases upon which we process Personal Data, as required by the Personal Data (Privacy) Ordinance (Cap. 486 of the laws of Hong Kong "PDPO").

a) Legal bases of processing under certain privacy laws Pursuant to the PDPO, in general, we process your Personal Data on the following legal bases:

• Performance of our contract with you: The Personal Data we collect may be used to perform our agreements with you, including the Terms and Conditions of our membership program.
• To comply with a legal obligation to which we are subject: The Personal Data we collect may be processed in order to comply with the law and our legal obligations.
• For our legitimate business interests: We may process Personal Data in furtherance of our legitimate business interests in protecting, maintaining and improving our service; developing new features and services; marketing and promoting our products; protecting our legal rights and interests; in support of mergers, acquisitions, reorganizations and other business transactions; and to generally operate and improve our business.
• With your consent: We may process Personal Data about you based on your consent, for example to send you marketing communications, surveys, news, updates and other communications. Where required by applicable law, we will obtain your consent to this Notice and our collection, use and disclosure of your Personal Data. You may be able to withdraw your consent at any time in accordance with applicable laws; please see Section 4. Your Rights and Choices below for information on how to withdraw your consent.

b) How we collect, use and process Personal Data Below we describe how we may collect and for what purposes we use Personal Data, including, where applicable, Personal Data we receive from third parties.

i. Customer registration When you subscribe for our membership program in one of our stores, we collect and use the Personal Data you provide, such as your name, birthday, email address and mobile phone number, for the purposes of registering your membership, managing and enabling you to enjoy our members' privileges.

ii. Purchasing, returning, reserving or trying-on merchandise When you purchase or return merchandise through one of our stores, we collect and use the Personal Data that you provide, such as your order, postal address, email address, mobile phone number, birth date and payment information, for the purposes of fulfilling your order, processing your return, and updating you on the status of your order/return. When you reserve or try-on merchandise in-store, we may collect Personal Data such as your name, telephone number, email address, location and the items you wish to reserve or try-on for the purposes of fulfilling your request.

Where applicable, the processing of your Personal Data for these purposes is necessary for the performance of a contract with you. We also use this Personal Data collected as necessary for our legitimate interests, including fraud detection, improving business operations, information security purposes, monitoring our sales, and aggregate analytic modeling.

iii. Promotion/marketing We intend to send promotional/marketing communications, ads and other information about our products (including the "American Eagle", "Aerie" and other brands distributed by us), services, news, offers, promotions and events (e.g. contests, sweepstakes and surveys) which we think may be of interest to you via email and other electronic means. We process your Personal Data for these purposes, and we obtain your consent to send you direct marketing communications (please see Section 3 below). You may unsubscribe from these communications by following the instructions in the message. If you have any questions about unsubscribing from our messages or would like assistance in unsubscribing from promotional messaging, please contact us as outlined below.

Where applicable pursuant to relevant privacy laws, our processing of your Personal Data for marketing and promotional purposes is based on your consent.

iv. Sweepstakes/contests/promotions We process the Personal Data that you provide if you choose to participate in one of our contests, sweepstakes or promotions for the purposes of conducting them and communicating with you, all as further described in the respective terms and conditions. Where applicable, the processing of your Personal Data for this purpose is as necessary for the performance of a contract with you.

If you consent, we may also process your photo and/or video recorded at any relating event where you participate. The processing of your Personal Data for this purpose is then based on your consent.

v. Customer surveys and other customer research If you consent, we process the Personal Data that you provide if you choose to participate in one of our customer surveys or other research tools to analyze and better understand how customers like you interact with our brands.

Where applicable, the processing of your Personal Data for this purpose is based on your consent.

vi. Customer Service We process the Personal Data you provide to us when you contact our Customer Service Department (name, telephone number, email address, purchase details) for the purposes of reviewing any issues you raise and responding to you. Depending upon the nature of your query, we may request additional Personal Data for the purposes of verifying your identity (e.g. birth date or banking details). We may record the audio information in customer service telephone calls, and may save and store written customer service interactions such as chat and email, for quality and training purposes and to meet our legal obligations.

As applicable, the processing of your Personal Data for these purposes is as necessary for the performance of a contract with you.

vii. Securing our business and complying with legal obligations We may process Personal Data to secure and protect our business, defend our legal rights, and comply with legal obligations. In addition, we may process Personal Data for our internal auditing, reporting, corporate governance, and internal operations purposes.

As applicable, the processing of your Personal Data for these purposes is as necessary to comply with legal obligations and for our legitimate interests.

viii. Managing our relationships with others We also process the above mentioned Personal Data to manage our relationship with vendors and third parties who assist us in providing our services or goods, for example, to ensure the proper performance of their tasks, to evaluate our work with them, and to ensure the smooth transition between different service providers.

As applicable, the processing of your Personal Data for these purposes is as necessary for the performance of a contract with you, and/or as it is necessary for our legitimate interests, namely, improving business operations, monitoring our sales, and securing the proper performance of our service providers.

3. DISCLOSURES AND SHARING OF PERSONAL DATA/USE AND PROVISION OF PERSONAL DATA IN DIRECT MARKETING.

Except as described in this Notice, we will not share your Personal Data with third party users (i.e. third parties that use the Personal Data for their own purposes). We may, however, share aggregated, non-personal or anonymous data, which cannot be used to identify you, with third parties. We may also share your Personal Data in the following circumstances:

Third Parties Providing Services: We may share your Personal Data with vendors that perform functions on our behalf or assist with our business operations to perform contracts with you, such as those that host or operate our platforms, process transactions and payments, fulfill orders or provide customer service; or other third parties that provide internal promotional assistance, and analyze our data. Additionally, we may share your Personal Data with vendors that manage our credit card or analyze data, or advertisers and "powered by" partners who power product reviews on our products or services. We may also share your Personal Data with other third parties, including our affiliates, that we work with to send marketing, conduct advertising campaigns, and provide other promotional assistance. These third parties may assist us in marketing and advertising our products, services, news, offers, promotions and events (e.g. contests, sweepstakes and surveys) which we think may be of interest to you, via mail and via email and other electronic means.

Affiliates: Your Personal Data may be processed by our affiliates, as well as for analytics, research and demographic studies, development, and to help us improve and tailor our services. Our affiliates are subject to this Notice when they use your Personal Data. We are responsible for managing the Personal Data that may be shared with our affiliates. In agreeing to this Notice, you consent to the transfer of your Personal Data outside of Hong Kong.

Compliance with Legal Obligations: We may also disclose your Personal Data if we believe we are required to do so by law, or that doing so is reasonably necessary to comply with legal processes; when we believe it is necessary or appropriate to disclose Personal Data to law enforcement or other governmental or regulatory authorities or the courts (in any relevant jurisdiction worldwide), such as to investigate actual or suspected fraud or violations of law, breaches of security, or breaches of this Notice; to regularly exercise our rights in judicial, administrative or arbitration proceedings (as applicable in Brazil); to respond to any claims against us; and, to protect the rights, property, or personal safety of us, our customers, or the public.

Corporate Transactions: In addition, your Personal Data may be disclosed as part of any proposed or actual merger, sale, and transfer of AEO HK, assets, acquisition, bankruptcy, or similar event.

We intend to: a) use your name, contact details and products purchase records held by us for direct marketing; b) conduct direct marketing in relation to the following classes of products that we and our affiliates may offer: apparel, intimates, activewear, accessories, footwear, and personal care products. The foregoing products may be our brands or brands distributed by us under licensing arrangements. Direct marketing messages and emails will be sent out by us using the @pacifica.com.hk domain name, through AEO HK Whatsapp business account and other communication channels.

4. YOUR RIGHTS AND CHOICES.

This section describes the choices and rights you have with respect to your Personal Data and how to exercise them.

a) Opt-out of marketing communications. You may opt-out of marketing emails by: (i) contacting us by email or postal mail as set forth below in Section 7, Contact Us, or (ii) following the removal instructions in the communication that you received. If you opt out of direct marketing communications, we may to the extent permitted by applicable law still send you non-promotional communications, such as those about your account or our ongoing business relations. For example, if our service is temporarily suspended for maintenance, or your payment could not be processed, we might send you an email.

b) Withdraw your consent. In all cases where we process your Personal Data based on your consent, you may withdraw consent for each individual purpose at any time without reasons. Please contact us by email at the email address set forth below in Section 7. Contact us. Please keep in mind that certain services will not be available if you withdraw your consent, or otherwise delete or object to our processing of certain Personal Data.

c) Review and correct your Personal Data. Subject to the conditions set out in the PDPO, you have the right to request access to and correction of your Personal Data held by us. You may contact us by email at the email address as set forth below, in Section 7. Contact Us.

Submitting Requests. Privacy requests should be directed to our privacy team as set forth below in Section 7. Contact Us. We will respond to your request, and we will inform you if we do not intend to comply with your request. We also may ask you for additional information so that we can confirm your identity or verify your request.

5. SECURITY AND RETENTION

We have implemented administrative, technical, and physical measures to help protect the Personal Data we collect from loss, theft, misuse and unauthorized access, disclosure, alteration and destruction. However, no website or Internet transmission is completely secure. Thus, we cannot and do not guarantee that unauthorized access, hacking, data loss, or other breaches will never occur.

In general, we retain your Personal Data as long as necessary for purposes for which the Personal Data was collected and is used by us, as stated in this Notice, and as otherwise necessary to fulfill our legal obligations, resolve disputes, maintain appropriate business records, enforce our agreements or for such longer period as required by applicable law. The retention period depends on the information and the reason for which we have collected it. For example, we keep records of customer purchases and transactions in accordance with the relevant return and exchange periods under our return policy.

6. CHANGES.

We may update this Notice from time to time. If we make changes, we will notify you by revising the date at the top of the Notice and, in some cases, we may provide you with additional notice (such as adding a statement to our homepage or sending you a notification). Where required to do so by applicable law, we will seek your consent to such changes. We encourage you to review this Notice whenever you interact with us to stay informed about our data practices and the ways you can help protect your privacy.

7. CONTACT US.

As it relates to questions you might have about this Notice or if you have a complaint or concern that we may have failed to adhere to this Notice, please contact us at cs@pacifica.com.hk. The English version of this Notice shall control.