Privacy Policy

PUMA’s Project3 Program

This Data Protection Information provides information on the processing of your personal data whenever you visit this website of PUMA SE (hereinafter “PUMA”, “we” or “us”) for an application for PUMA’s Project3 Program.

1. Scope, data controller, data protection officer and definitions 

Scope of this Data Protection Information

This Data Protection Information applies to the use of this website of PUMA SE for applicants who are training to run either the 2025 Boston Marathon or the 2025 London Marathon to apply for the opportunity to prepare for race day like an elite athlete. This Data Protection Information also applies to our service providers, partners and contractors as well as suppliers. PUMA SE does not request data from minors who have not reached the age of majority. Data processing on different websites as well as websites of other companies within the PUMA Group are not covered by this Data Protection Information. 

The Controller for the processing of your personal data

Unless otherwise specified in this Data Protection Information, the Controller for the processing of your personal data is: 

PUMA SE
PUMA Way 1
91074 Herzogenaurach
Germany
Email: Dataprotection[at]puma.com 

Contact details of the Data Protection Officer 
Data Protection Officer 
PUMA SE
PUMA Way 1
91074 Herzogenaurach
Email: Dataprotection[at]puma.com (Please note: For exercising your data protection rights please use the email addresses referred to in Section 8 to 10)

Definitions

This Data Protection Information is based on the following terms under data protection law, which we have defined to facilitate understanding. 

• GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

• Recipient means a natural person or legal person, public authority, agency or another body, to which the personal data are disclosed, whether a third party or not. However, public authorities which may receive personal data in the framework of a particular enquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by the public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing; 

Examples of possible recipients: Banks / payment providers, logistic firms and shipping service providers and IT services providers; for more information please refer to Sec. 8)

• PUMA Group means all enterprises that are affiliated with PUMA SE pursuant to Sec. 15 Aktiengesetz [German Stock Corporation Act]. 

• Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. 

Examples of personal data: Name, contact details, bank or credit card details.

• Controller means the natural person or legal person, public authority, agency, or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data; where the purposes and means of such processing are determined by Union or Member State law, the controller or the specific criteria for its nomination may be provided for by Union or Member State law. 

For the data processing activities described in this Data Protection Information, the Controller is PUMA SE, unless otherwise specified.

• Processing means any operation or set of operations which is on personal data or on sets of personal data, whether or not by automated means such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction. 

 
2. Purposes and legal bases of our processing of your personal data 

Processing of your data when you visit our websites

If you visit our website in order to apply for PUMA’s Project3 Program or otherwise actively transferring information to us (purely for informational purposes), we process your personal data for the following purposes and by virtue of the following legal bases: 

Provision of websites and IT security

We process your personal data that are technically necessary to allow us to provide our websites to you and to guarantee stability and security when you visit our websites. This includes the following personal data: 

• IP address

• type and version of browser

• operating system and platform 

• the complete Uniform Resource Locator (URL)

These personal data will be stored for security purposes in server log files, which will automatically be retained for as long as necessary to satisfy the purpose for which they were collected or to fulfill the transactions you have requested, unless a longer period is necessary to comply with our legal or regulatory obligations or to resolve disputes.

This data processing is necessary for the purpose of enabling you to use our websites (Legal basis: Art. 6 para. 1 s. 1, lit. b GDPR) as well as for the purposes of our legitimate interest to guarantee IT security (Legal basis: Art. 6 para. 1 s. 1, lit. f GDPR). 

3. Analytics and marketing tracking

Use of cookies 

On our website we use cookies. Cookies are small text files that are stored in the browsers of your end devices whenever you visit our websites. Through cookies, your actions and settings on our websites can be tracked, stored and recognized for the duration of the browser session or even after this. In addition to this, cookies and their respective cookie IDs allow your browser to be recognized. 

For more information about the use of cookies on our websites, the cookie categories and for individual settings please refer to our Cookies Preferences.

If your personal data is processed by cookies or other technical measures that store data on your end device or retrieve data from your end device, the legal basis for which in the following passages is consent in accordance with Art. 6 para. 1 sentence 1 lit. a GDPR, you give your consent in accordance with § 25 para. 1 TDDDG by activating the services in the cookie banner. The revocation of consent in accordance with § 25 para. 1 TDDDG is also carried out by deactivating the corresponding services in the cookie banner.

Squarespace analytics and performance cookies

We use Google Analytics on our websites, a web analysis service of Squarespace Ireland Limited, Squarespace House, Ship Street Great, Dublin 8, Ireland. 

Squarespace uses cookies that allow an analysis to be made on the usage of our websites. On behalf of PUMA, Squarespace may use this information for the purpose of evaluating your use of the website, compiling reports on website activity, analyzing the effectiveness of our digital advertising and improving its customization, and providing other services relating to website activity and internet usage to PUMA. 

You can find more information on terms of use and data protection at:

• https://www.squarespace.com/data-privacy

• https://www.squarespace.com/privacy

You can give your consent to Squarespace analytics and performance cookies in our cookie banner. You can revoke this consent at any time with effect for the future by deactivating Squarespace analytics and performance cookies in our Cookies Preferences. 

4. Application & Participation 

PUMA offers you the chance to apply for PUMA’s Project3 Program for the 2025 Boston Marathon or the 2025 London Marathon to prepare for race day like an elite athlete.

Your personal data will be processed with the submission of your application for PUMA’s Project3 Program.

You only need to provide us with the data that we require to review the applications, decide between the applicants and to and contact you if we have decided in your favor. 

The data required by us to perform the application process for PUMA’s Project3 Program under the applicable PUMA’s Project3 Program Guidelines are highlighted as mandatory fields. 

Unfortunately, you can only apply when you enter your data in the marked mandatory fields. Other, unmarked fields, however, are optional and you decide yourself whether you want to share further data with us. 

The application and participation in PUMA’s Project3 Program do not depend on your optional data and sharing optional data and has no effect on the application and participation.

If participating in PUMA’s Project3 Program involves receiving PUMA Sportswear (clothes and shoes), we ask for your name, your clothing or shoe size and your gender in addition to your email address as part of the notification of a decision in your favor.

If the goods are sent by mail, we need your home address in addition to your name. This will be requested as part of the notification of a decision in your favor.

In some cases, we might additionally ask for your age to ensure that you can legally participate in PUMA’s Project3 Program based on PUMA’s Project3 Program Guidelines. You will find further information on this in PUMA’s Project3 Program Guidelines that apply.

In the event of your application and participation, we process the data you provide to us solely for the purpose of performing PUMA’s Project3 Program and notifying you about our decision.

The applicable Guidelines may stipulate that we publish your name on our social media platforms (Instagram, Facebook, Twitter, ...) to announce you as a participant in PUMA’s Project3 Program.

We process your personal data based on your consent in accordance with Art. 6 para.  1 s. 1, lit. a GDPR and, where applicable, to fulfil a legal obligation in accordance with Art. 6 para. 1 s. 1, lit c GDPR. 

Your data will not be passed on to third parties, other than external partners that support us with the performance of the application process and PUMA’s Project3 Program in general. We have concluded a corresponding agreement with these external partners to ensure the security of the processed data.

Of course, you can exercise the rights to which you are entitled under data protection law against us at any time. You will find more detailed information on this in sections 8 to 10.

Personal data of the applicants will be stored for the purpose of performing the application process and PUMA’s Project3 Program and, if necessary, to comply with legal requirements. Personal data of other applicants will be deleted after the application process has ended.

5. Other processing 

Performance of internal audits 

Within the scope of audits within the PUMA Group, both at home and abroad, your personal data may be processed. During this process, we rely also on data from other sources, depending on the case (e.g. credit agencies). 

Your data may, under certain circumstances, also be appropriately processed in order to identify and rectify misconduct within the enterprise, and to implement compliance programs and compliance measures.

This data processing is necessary for compliance with our legal obligations (e.g. under the Stock Company Act) (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR) and/or for the purpose of our legitimate interest to check the processes and efficiency in the PUMA Group, to rectify misconduct and cases of fraud, to enforce and/or defend our rights, as the case may be, and to uncover any criminal offences, (Legal basis: Art. 6 para. 1 s. 1, lit. f GDPR).

Issuing of analyses 

On the basis of your data, which we process the meaning of Section 3 of this Data Protection Information, we may issue analyses. These serve as a basis for our business decisions, to improve our products and services, to adapt to the needs of our customers and to carry out marketing activities. The analyses issued on this basis no longer have any personal reference, which means it is no longer possible to trace them back to you.

This data processing is necessary for the purpose of our legitimate interest to improve the products and services we offer and carry out marketing activities (Legal basis: Art. 6 para. 1 s. 1, lit. f GDPR). 

6. Retention and erasure of your personal data 

We keep your personal data for as long and to the extent required for the purposes named in the respective section of this Data Protection Information. 

As soon as the data for the purposes named in the respective section is no longer required, we keep your personal data for the length of time, during which you can assert claims against us or we can assert claims against you (the statutory period of limitations is generally three years, starting with the end of the year in which the claim arises, e.g. the end of the year of purchase). 

In addition to this, we store your personal data for as long and to the extent we are obliged to do so by law. Corresponding obligations of proof and retention can be found, inter alia, in the German Commercial Code, the Tax Code and the Money Laundering Act. The retention periods may accordingly last up to ten years. 

7. Transfer of personal data and the categories of recipients

Your personal data may be transferred / disclosed to the following categories of recipients:

• Other companies within the PUMA Group within the scope of a group-internal, collaborative process. Such data processing, where applicable, is necessary for the purpose of our legitimate interest to run our administration activities efficiently and collaboratively, and to improve our products and services (Legal basis: Art. 6 para. 1 s. 1, lit. f GDPR). 

• IT Service providers who prepare the platforms, databases and tools for our products and services (e.g. our website, the sale of goods, the dispatch of newsletters and informative emails), issue analyses on user habits on our websites, carry out marketing campaigns, and process your personal data during the purchasing process on our behalf.

• For the analysis of your behavior on our website in connection with the use of Squarespace analytics and performance cookies, your personal data may be transferred to the USA.

• For the delivery of the goods for PUMA’s Project3 Program (including notifications about the delivery status of the orders) we transfer your personal data to the fulfilment and shipping service providers (e.g. DHL, UPS, Hermes etc.) engaged by us. The transfer of your personal data is based on the performances of a contract with you (Legal basis: Art. 6 para. 1 s. 1, lit. b GDPR).

• In case of legal disputes, we transfer your data to the competent court and, if you have engaged a lawyer, to the latter, in order to conduct the legal dispute. This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR) and/or for the purpose of our legitimate interest in the establishment and exercise of legal claims (Legal basis: Art. 6 para. 1 s. 1, lit. f GDPR).

• In addition to this, we only transfer your personal data if we are legally obliged to forward such data (e.g. to the police authorities within the scope of criminal investigations or to the data protection supervisory authorities). This transfer of personal data is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR).

We ensure that suitable safeguards (e.g., certification in the EU-U.S. Data Privacy Framework adopted by the EU Commission, conclusion of applicable EU Standard Contractual Clauses and, if necessary, additional measures) for adequate data protection are in place, if your personal data is disclosed to any recipients mentioned above, which are established outside the EU/EEA.

8. Right to object to data processing based on legitimate interests

We process your personal data within the meaning of the sections above, based on our legitimate interest, in particular to guarantee IT security on our websites, to adapt our website to your needs, to carry out analyses and marketing activities, to inform you about our products and services, to remind you of any purchasing processes that have not yet been completed, to increase the coverage of our products and marketing activities, to prevent fraud and abuse, to avoid payment defaults, to care for our customers, to safeguard, enforce and defend our legal interests (also before the courts, as necessary), and to carry out our internal management efficiently and collaboratively. For information about the balancing of interests carried out by PUMA, please contact Dataprotection[at]puma.com.

Notwithstanding the specific possibilities to object to data processing described in above sections (e.g. provided opt-out or unsubscribe links), you have the right to object at any time to the processing of your personal data on the basis of our legitimate interests pursuant to Art. 6 para. 1 s. 1, lit. f GDPR on grounds relating to your particular situation by sending an email to project3@puma.com. We will then no longer process your data for this/these purpose(s) unless our legitimate interests in processing overweighs or the processing serves to establish, exercise or defend legal claims. 

If you object to the processing of your data, we will process any collected personal data in this context in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR).

 
9. Right to withdraw consent 

If you have given us your consent for the processing of your personal data, you can withdraw this consent at any time. The withdrawal of your consent is effective for the future and shall not affect the lawfulness of processing based on consent before its withdrawal. 
Unless specifically regulated in above sections, please send your withdrawal of consent to project3@puma.com.

If you withdraw your consent, we process your personal data collected in this connection to answer your inquiry. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR). 

10. Your other data protection rights 

In accordance with the GDPR, you may demand at any time that we:

• provide you with information on your personal data that we process (Art. 15 GDPR),

• rectify (Art. 16 GDPR),

• erase (Art. 17 GDPR), 

• restrict (Art. 18 GDPR) and/or 

• export (Art. 20 GDPR)

• your personal data stored on our systems.

Please send your request, stating at least your first and last name, either by email to project3@puma.comor in writing to PUMA SE, PUMA Way 1, 91074 Herzogenaurach, Germany.

If you exercise these rights against us, we will process your personal data in order to respond to your request. This data processing is necessary for compliance with a legal obligation (Legal basis: Art. 6 para. 1 s. 1, lit. c GDPR).

Irrespective of your abovementioned rights, you can lodge a complaint with a data protection supervisory authority, if you are of the opinion that the processing of your personal data by PUMA violates the GDPR (Art. 77 GDPR).

 
11. Changes to this Data Protection Information

The provisions of this Data Protection Information, including the referenced Cookie Information, shall apply in the version in force at the time the online shop is used. 

We reserve the right to supplement and modify the content of this Data Protection Information. The updated Data Protection Information applies from the time at which it was published on our websites. In case of substantive or material changes to the Data Protection Information, especially changes that affect the processing of your personal data already collected by us, we will inform you in advance (e.g. by email).
 

Additional Information for North America:

For users located in California, Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Nevada, Oregon, Texas, Utah, or Virginia see the U.S. State Privacy Notice below.

This U.S. State privacy notice supplements the Privacy Policy for PUMA’s Project3 Program.

CALIFORNIA PRIVACY NOTICE

Last Updated July, 2024 

California law provides consumers (that are California residents) with specific rights regarding their Personal Information. This California Privacy Notice (“California Notice”) supplements the PUMA Privacy Policy. It applies solely to California consumers and addresses Personal Information we collect online and offline. This California Notice does not apply to PUMA employees or personnel, except with respect to how to exercise rights. This California Notice uses certain terms that have the meaning given to them in the California Consumer Privacy Act of 2018 (as amended by the California Privacy Rights Act of 2020) and its implementing regulations.

Notice of Collection and Use of Personal Information. We may collect (and may have collected during the 12-month period prior to the last updated date of this California Notice) the following categories of Personal Information about you:

Categories of Personal Information PUMA Has Collected in the Preceding 12 Months

Categories of Personal Information We Collected About California Consumers:

• Identifiers such as name, physical address, alias, unique personal identifier, online identifier, IP address, email address, phone number, customer number, account name, ID card information, phone call records, payment information or other similar identifiers;

• Personal records such as signature, address, telephone number, credit or debit card information, financial information;

• Characteristics such as birthday, gender, sex, veteran or military status;

• Customer Accounts/Commercial information such as products or services purchased, obtained, or considered, and other purchasing or consuming histories or tendencies;

• Online usage information such as Internet and other electronic network activity information including, but not limited to, browsing history, search history, information on a consumer’s interaction with our website, application, or advertisement, user-generated/submitted content;

• Geolocation data such as physical location;

• Audio/visual and similar information such as audio recordings of customer service calls, visual recordings of consumers in stores; 

• Inferences Derived From Personal Information such as your purchase preferences, interests, characteristics, predispositions, behavior, attitudes, to create a profile reflecting your preferences and recommendations for products you may be interested in.

There may be additional information that we collected that meets the definition of Personal Information under California law but is not reflected by a category, in which case we will treat it as Personal Information as required by California law, but will not include it when we are required to describe our practices by category of Personal Information.

As permitted by applicable law, we do not treat de-identified data or aggregate information as Personal Information and we reserve the right to convert or permit others to convert your Personal Information into de-identified or aggregate information. We have no obligation to re-identify such information or keep it longer than we need it for our own purposes.

Because there are numerous types of Personal Information in each category of Personal Information, and various uses for each Personal Information type, our retention periods vary for each of the categories of Personal Information described above. The length of time for which we retain each category of Personal Information depends on the purposes for our collection and use and requirements pursuant to applicable laws. For more information on our retention practices, see the Protection and Retention of Information section of our Privacy Policy above.  

Categories of Sources of Personal Information that We Collected About California Consumers in the Preceding 12 Months:

• Directly from you. For example, when you create an account, make a purchase, browse our website, or use our app(s), interact with our third party social media pages or services, or apply for or accept an employment position with us.

• PUMA Affiliates. Other companies within the PUMA Group.

• PUMA Customers. Your friends, family or other parties. For example, if you are the recipient of a gift card, we may collect Personal Information such as your name and email address.

• Online Activity. Directly and indirectly from activity on the Services, and third-party social media pages and other services. For example, see the types of collection in the “Automatically Collected Information” section above.

• Social Networks.

• Advertising Companies.

• Service Providers who provide services on our behalf such as those used to fulfill orders, process your payments and requests, verify your information, monitor activity in connection with our Services, provide analysis and analytics, maintain databases, administer and monitor emails and marketing, administer and send mobile messages, serve ads on this and other services, and provide consulting services.

• Third Parties such as data providers, operating systems and platforms.

• Government Entities and other public sources.

We may use Personal Information for other Business Purposes in a context that is not a “sale” or “share” under the CCPA, such as disclosing it: (i) to our Service Providers, Contractors, Vendors or Processors that perform services for us; (ii) to the consumer or to other parties at the consumer’s direction or through the consumer’s action.

Business or Commercial Purposes for Which We Collected, “Sold,” or “Shared” Personal Information of California Consumers in the Preceding 12 Months: Business Purposes: (1) performing services and providing products, (2) quality control or safety, (3) internal research, (4) auditing interactions, (5) debugging, (6) short-term transient use, and (7) security and fraud prevention. Additional business purposes include disclosing PI to third parties for other than a “sale” or “share” or one of the foregoing business purposes as required or permitted by applicable law, such as to our vendors that perform services for us, to the government or private parties to comply with applicable law or legal process, and to the consumer or other parties at the consumer’s request, as well as for the additional purposes explained in our Privacy Policy or at the time of collection (“Other Business Purposes”). 

Commercial Purposes: In addition, we may process Personal Information for our commercial purposes which are to advance our commercial interests, such as by encouraging another person to buy a product or enabling or effecting a commercial transaction. 

For more detailed examples of our business and/or commercial processing purposes see the Use of Information section of our Privacy Policy and the Purposes for which Personal Information is Processed section of our State Notice. 

Categories of Third Parties to Whom Personal Information was “Sold”, “Shared” or Disclosed in the Preceding 12 Months:

While we do not sell (as “sell” is traditionally defined) your Personal Information to third parties, we do share information with third parties such as Advertising Companies for advertising purposes which may be considered a “sale” of “personal information” under California law.

We may disclose PI to our service providers, other vendors (including those that facilitate interest-based and other advertising and marketing), affiliates, and/or third parties to which we “sell” or “share” your Personal Information including without limitation, the following Categories of Personal Information and the Categories of Recipients in the preceding 12 months:

Identifiers
Business Purpose Disclosure: Service providers for services related to payment processing, data accuracy, fraud detection and security, order processing and management, logistics, shipping, customer relationship management, web and mobile development, email marketing and advertising Sale/Share: Marketing and Advertising providers

Personal records

Business Purpose Disclosure: Service providers for services related to payment processing, data accuracy, fraud detection and security, order processing and management, logistics, shipping, customer relationship management, web and mobile development, email marketing and advertising Sale/Share: None

Characteristics 

Business Purpose Disclosure: Service providers for services related to data accuracy, fraud detection and security, customer relationship management, web and mobile development, email marketing and advertising 

Sale/Share: None

Customer Account Details / Commercial Information
Business Purpose Disclosure: Service providers for services related to order processing and management, logistics, shipping, customer relationship management, email marketing and advertising
Sale/Share: Marketing and Advertising providers

Online Usage Information
Business Purpose Disclosure: Service providers for services related to order processing and management, logistics, shipping, customer relationship management, email marketing and advertising
Sale/Share: Marketing and Advertising providers

Geolocation Data
Business Purpose Disclosure: Service providers for services related to order processing and management, logistics, shipping, customer relationship management, email marketing and advertising
Sale/Share: Marketing and Advertising providers

Audio/Visual and Similar Information 

Business Purpose Disclosure: Service providers for services related to security, loss prevention, asset protection, traffic pattern analysis, data accuracy, fraud detection, order processing and management, logistics, shipping, customer relationship management, web and mobile content development, email marketing and advertising.

Sale/Share: None

Inferences Derived From Personal Information

Business Purpose Disclosure: Service providers for services related to web and mobile development and site personalization, email marketing and advertising
Sale/Share: None

California Consumer Privacy Rights

California residents may have certain rights pursuant to California law, as described below.  

1. Right to Know (Access and Portability Rights)

2. Right to Correct

3. Right to Deletion

4. Right to Opt Out of Sale or Sharing

5. Right to Nondiscrimination 

6. Right to Limit Use of Sensitive Information

I. Right to Know. If you are a consumer who resides in California you have the right to request, twice in a 12-month period, a report that details the categories of Personal Information collected about you, the categories of sources from which the Personal Information is collected, the purposes for collecting the Personal Information, the categories of Personal Information that we disclose for a business purpose, sell or share and the categories of third parties with whom the information is shared, and the specific pieces of Personal Information collected about you.  To exercise your rights, please see the “Exercising Your Rights” section of this California Notice.

II. Right to Correct. If you are a consumer who resides in California you have the right to correct inaccurate Personal Information we hold about you. To exercise your rights, please see the “Exercising Your Rights” section of this California Notice.

III. Right to Deletion. If you are a consumer who resides in California you have the right to request that we delete any of your Personal Information that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request, as explained below, we will delete (and direct our service providers to delete) your Personal Information, unless an exception applies. If an exception applies, we will inform you of that and limit retention and use to the permitted purpose. To exercise your rights, please see the “Exercising Your Rights” section of this California Notice.

IV. Right to Opt Out of Sale or Sharing. If you are a customer who resides in California, you also have the right to opt out of the “sale” or “sharing” of your Personal Information. While we do not sell (as “sell” is traditionally defined) your Personal Information to third parties, we do disclose information to third parties for advertising purposes which may be considered a “sale” or “sharing” of “Personal Information” under California law for which you are entitled to opt-out. California residents may opt out of the “sale” or ”sharing” of Personal Information by submitting a Do Not Sell or Share My Personal Information request. To exercise your rights, please see the “To exercise a Do Not Sell or Share My Personal Information request” under the “Exercising Your Rights” section of this California Notice below. Note that you also can use the Global Privacy Control (“GPC”) to signal your opt-out preference as explained in the Exercising Your Rights section below. We do not knowingly sell Personal Information of consumers under the age of 16.

V. Right to Nondiscrimination. You have the right to not receive discriminatory treatment for the exercise of your privacy rights under California law.

Financial Incentives

We offer various financial incentives that might qualify as a “financial incentive” program under the CCPA. For example, we may provide discounts, coupons and other benefits for customers who sign up to receive our marketing emails. When you participate in a financial incentive, we may collect Personal Information from you, such as identifiers such as your name and email address and commercial information such as your purchase history. Participation in financial incentive program is optional for California consumers and any terms and conditions will be made available at the point of opt-in or in a confirming email. You can opt into a financial incentive by following the sign-up or participation instructions provided, and you have the ability to opt-out of the financial incentive, or our subsequent use of your Personal Information in connection with a financial incentive, at any time by contacting us as set out above, or as otherwise described in program terms, or by making a deletion request. If we condition the benefits on any limitation of your California privacy rights (e.g., you must consent to continued receipt of marketing to receive ongoing benefits), the benefits provided will be reasonably related to the value of the Personal Information provided, as will be more fully explained in the program terms. If you do not believe that the value you receive is reasonably related to the value of your applicable Personal Information, do not participate.

VI. Right to Limit the Use or Disclosure of Sensitive Personal Information. Except with regard to our HR data subjects (i.e., California job applicants and current or former employees and independent contractors), we only process sensitive Personal Information for purposes that are exempt from choice under California law. If you are a HR data subject who resides in California, you may request PUMA limit sensitive Personal Information processing to certain purposes and if you do so we will explain in a response what processing purposes California law does not allow you to limit. To exercise your rights, please see the “Exercising Your Rights” section of this California Notice.

You may also obtain information on how to make, and may submit, a request by asking a manager at any of our California retail locations. We will not discriminate against you for exercising any of the rights that are provided to you under California law. 

Exercising Your Rights

To exercise your rights to know, delete, correct, and/or limit our processing of sensitive Personal Information, please submit a verifiable consumer request to us by either:

• Calling us at: 1-888-565-PUMA (7862) (tel:1-888-565-7862)

• Submitting a Customer Privacy Rights Request Form

• Emailing us at: consumerprivacy.us@puma.com, or

• Writing to us at:

PUMA
Attn: Privacy Officer
455 Grand Union Boulevard
Somerville MA, USA 02145

To exercise a Do Not Sell or Share My Personal Information request: 

• Opt-out for non-cookie Personal Information: To opt-out of the sale/sharing of your non-cookie Personal Information (e.g., your email address), you may make an opt-out request here.  

• Opt-out for cookie Personal Information: To opt-out of the sale/sharing of such Personal Information, you need to exercise a separate opt-out request on our cookie management tool by selecting the “Cookie Settings” link in the footer of this website. This is because we have to use different technologies to apply your opt-out of cookie Personal Information and to non-cookie Personal Information. Our cookie management tool enables you to exercise such an opt-out request and enable certain cookie preferences on your device. You must exercise your preferences on each of our websites you visit, from each browser you use, and on each device that you use.  Since your browser opt-out is designated by a cookie, if you clear or block cookies, your preferences will no longer be effective and you will need to enable them again via our cookie management tool.  Beware that if you use ad blocking software, our cookie banner may not appear when you visit our services and you may have to use the link above to access the tool.

• Use of Global Privacy Control: Businesses are required to process global privacy control (“GPC”) signals, which is referred to in California as opt-out preference signals (“OOPS”), which are signals sent by a platform, technology, or mechanism, enabled by individuals on their devices or browsers, that communicate the individual’s choice to opt-out of the sale and sharing of Personal Information. To use an OOPS/GPC, you can download an internet browser or a plugin to use on your current internet browser and follow the settings to enable the OOPS/GPC.  We have configured the website to receive and process GPC signals. We process OOPS/GPC with respect to sales and sharing that may occur in the context of collection of cookie Personal Information by tracking technologies online by third-party digital businesses and apply it to the specific browser on which you enable OOPS/GPC. We currently do not, due to technical limitations, process OOPS/GPC for opt-outs of sales and sharing in other contexts (e.g., non-cookie Personal Information).  We do not: (1) charge a fee for use of our service if you have enabled OOPS/GPC; (2) change your experience with any product or service if you use OOPS/GPC; or (3) display a notification, pop-up, text, graphic, animation, sound, video, or any interstitial in response to the OOPS/GPC. To learn more about the GPC, please visit https://globalprivacycontrol.org/. If you delete cookies or reset your device, you may need to set your preference again to ensure we continue to honor your preferred choice.  

You may also obtain information on how to make, and may submit, a request by asking a manager at any of our California retail locations.

Verifying and Fulfilling Requests

To protect your privacy and comply with the California law, and except in connection with a Do Not Sell or Share request, we will need to verify your request (i.e., verify you). The verifiable consumer request must:

• Provide sufficient information that allows us to reasonably verify you are the person about whom we collected Personal Information, and in the cases more sensitive or important Personal Information we require that be done to a high degree of certainty. We do this in a number of ways depending upon how we have interacted with you in the past, as more fully described in the next section. For security purposes, we will not collect sensitive Personal Information as part of the verification process. We do not use Personal Information you provide during verification for purposes other than to facilitate and keep a record of your request.

• Describe your request with enough detail that allows us to properly understand, evaluate, and respond to it.

We may not be able to fully respond to your right to know, deletion, or correction requests if we cannot verify your identity consistent with the standards for verification and security and confirm that the Personal Information relates to you. Once we receive your request, we are required to verify that you are the person that is the subject of the request, or an authorized agent property acting on behalf of a specific consumer. How we do this will depend on the content of the consumer relationship with us and the sensitivity of the Personal Information. Typically, this consists of matching identifying information provided by you with the information we have about you in our records. 

Upon making a request, you will be asked to provide your full name, email address, shipping address and telephone number. Providing accurate information that matches our records is necessary so that we can locate the correct information within our systems and among our service providers. To verify your request, we may ask you to submit evidence beyond your basic Personal Information in order to prove your identity, especially if you seek to delete Personal Information or obtain copies of it. You may submit this information simultaneously with your initial request (by email) or after your request (as a second step). For requests of specific pieces of sensitive Personal Information about a consumer, we will verify your identity to a reasonably high degree of certainty; whereas for requests to know the categories of Personal Information collected and used about a consumer, we will verify your identity to a reasonable degree of certainty. We may give you options, such as (i) submitting a signed statement and a redacted copy of identifying information (such as a government-issued ID), or (ii) verifying your identity with a third party verification company that we may hire for this purpose. If we ask you to verify your identity, you must promptly cooperate with our efforts so that we can fulfill your request. If you do not comply, your request cannot be fulfilled; and if you delay in complying, the fulfillment of your request is likely to be delayed, and may be denied, as a result. If we cannot verify your identity, we will not be able to fully respond to your request. However, if we cannot verify you sufficiently to provide specific pieces, we will treat the request as a categories request, and if we cannot reasonably verify you for that, we will refer you to this Notice for our general practices. If we cannot sufficiently verify you as necessary for a deletion request, we will give you the opportunity to opt-out of sale.

If you are a California resident, we will make commercially reasonable efforts to accommodate your request within 45 days. We may, however, extend the timeframe to total of 90 days, if an extension is reasonably necessary. We reserve the right to deny any request, in whole or in part, to the extent permitted by applicable law, but will explain the basis for that in our response to you. We will fulfill a right to know request from an individual up to two times in any twelve-month period. As permitted by California law, if a request is unduly burdensome or unfounded, we may reject it or condition further efforts on payment of reasonable costs. If we determine that the request warrants a fee, or that we may refuse it, we will give you notice explaining why we made that decision. You will be provided a cost estimate and the opportunity to accept such fees before we will charge you for responding to your request. Some Personal Information we maintain about consumers is not sufficiently associated with enough Personal Information about the consumer for us to be able to verify that it is a particular consumer’s Personal Information when a consumer request that requires verification pursuant to the verification standards is made (e.g., clickstream data tied only to a pseudonymous browser ID). Accordingly, we do not include that Personal Information in response to those requests.

Consistent with California law and our interest in the security of your Personal Information, we will not deliver to you your driver’s license number or other government-issued id number, financial account number, any health or medical identification number, an account password, security questions or answers, or unique biometric data generated from measurements or technical analysis of human characteristics in response to a privacy rights request; however, you may be able to access some of this information yourself through your account if you have an active account with us.

Requests from Authorized Agents

California law permits an authorized agent to exercise any of the above California privacy rights on an individual’s behalf, subject to certain requirements. If you submit a request, other than opt-out of sale, on behalf of a consumer other than yourself, you will be required to demonstrate your legal authority to act on behalf of that person, and we may contact you and/or the consumer for verification purposes as permitted by California law. As permitted by California law, we may require that you provide information necessary to verify the identity of the person who is the subject of the request, or that such person verify his/her own identity directly with us before we fully respond to your request as an authorized agent. We reserve the right to deny requests, including an opt-out of sale request, where we reasonably suspect that the request is fraudulent. For the protection of our customers, we must receive all information requested and must verify an agent’s legal authority to our satisfaction consistent with what California law requires or permits before we can fulfill a request by an authorized agent.

ADDITIONAL DISCLOSURES FOR CALIFORNIA RESIDENTS

California HR Data Subjects

California HR data subjects can learn more about our data practices as relates to them by contacting us via email at consumerprivacy.us@puma.com. 

California Do Not Track Notice

California law requires us to let you know how we respond to web browser Do Not Track (DNT) signals. Because there currently is no industry or legal standard for recognizing or honoring DNT signals, we don't respond to them at this time. A DNT signal is not a global privacy control signal. For more information on global privacy control, see the Exercising Your Rights section above. 

California’s Shine the Light law

If you are a California resident, you are entitled once a year, free of charge, to request and obtain certain information regarding our disclosure, if any, of certain categories of Personal Information to third parties for their own direct marketing purposes in the preceding calendar year. To request the above information, please Contact Us and identify yourself as a California consumer making a “Shine the Light” request. Please note that we currently do not disclose any Personal Information to third parties for their direct marketing purposes under California’s Shine the Light law.

California Minor Eraser

Additionally, if you are a registered user under the age of 18 and a resident of California, you may request removal of content you have posted to our online services. Requests can be made by Contacting Us. Please note that making such requests does not ensure complete or comprehensive removal of the content. For example, we may retain the information for our own internal records, and it is also possible that a third party we do not own or control may copy the posting and repost it elsewhere.

ADDITIONAL STATE-SPECIFIC PRIVACY NOTICE

COLORADO, CONNECTICUT, DELAWARE, FLORIDA, IOWA, MONTANA, NEBRASKA, NEW HAMPSHIRE, NEW JERSEY, OREGON, TEXAS, VIRGINIA, UTAH PRIVACY NOTICE

Effective Date: December, 2024

This State-Specific Privacy Notice (“State Notice”) supplements the PUMA Privacy Policy. It applies only to consumers located in Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia and addresses Personal Information we collect online and offline. This State Notice does not apply to PUMA personnel or job applicants.  

This State Notice uses certain terms that have the meaning given to them in the applicable laws and implementing regulations in Colorado, Connecticut, Delaware, Florida, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Texas, Utah and Virginia. 

In addition of what is already disclosed in the general section of this Privacy Policy, please find the following additional information relevant for the State Notice. 

Categories of Personal Information Collected: 

We may process the categories of personal information listed in the Information We Collect and How and California Privacy Notice sections of our Privacy Policy.  

Purposes for which Personal Information is Processed: 

We may process the Personal Information we collect about you for the purposes listed in the Use of Information section of our Privacy Policy and as outlined below: