Your personal details such as name and surname, email address, payment details (hereinafter “Data”) provided when you make a monetary donations to the MR PORTER Health In Mind Fund Powered By Movember (the "Donation"), will be processed by THE NET‑A‑PORTER GROUP LIMITED (part of the YOOX NET‑A‑PORTER GROUP) trading as “MR PORTER” (company number 3820604) of 1 The Village Offices, Westfield London, Ariel Way, London, W12 7GF (“MR PORTER”), as controller of the data processing (hereinafter “Controller”) in accordance with the Data Protection Act 2018 and the General Data Protection Regulation (EU) 2016/679 regarding the protection of personal data, as it forms part of the law of England and Wales, Scotland and Northern Ireland by virtue of section 3 of the European Union (Withdrawal) Act 2018 under the name of United Kingdom General Data Protection Regulation, and the relevant legislation for its implementation (hereinafter referred to together as the “Regulation”) and with this notice.

1. PURPOSE AND DURATION OF PROCESSING

MR PORTER as Controller will process the Data provided by you during the Donation, for the purposes and duration as described below:

(i) Data Collected when you make a Donation

**Purpose - **Collection of log entry data (such as payment reference, amount donated, name of the charity to which you donate) for purposes relating to the execution of the Donation.

**Duration - **Retention of Data for the time period strictly necessary for the duration of the Donation Period, as defined in the terms and conditions of the Donation initiative.

(ii) Assistance with the Donation process

**Purpose - **Receiving, managing and responding to any support queries you may arise in relation to your Donation. For these purposes MR PORTER may access the log entry date described in point (i) and the payment information you provided during your purchase on MR PORTER site right before the Donation.

**Duration - **Processing and retaining these support requests within the time period established by the law.

(iii**) Fulfilment of legal obligations, as well as the right of the Controller to exercise its rights, such as the right to a legal defence**

**Purpose - **Compliance with and fulfilment of obligations imposed by laws, regulations, European Union regulations, orders, requirements and/or requests from the relevant Authorities or from any other party with a right to do so on the basis of secondary regulatory and legal provisions, as well as the exercising of MR PORTER's legal rights, such as the right to a legal defence.

Duration - Processing and retaining these data within the time period established by the law and for the time strictly necessary for the exercise or defence of legal claims.

2. LAWFUL BASIS DATA FOR PROCESSING

The processing of Data for the purposes set out in points (i) and (ii) of the preceding paragraph will be carried out by MR PORTER, in order to perform the contract, namely, to process your Donation and provide assistance with it without requiring your express consent (as per article 6.1 point (b) of the Regulation).

The processing of Data for the purposes set out in point (iii) is carried out to fulfil legal obligations and to protect MR PORTER in case of litigation, and therefore does not require your express consent.

3. DATA COMMUNICATION AND DIFFUSION

Data will be processed by MR PORTER using manual, telematic and computer-based tools, which will nonetheless provide adequate measures to guarantee security and to impede access by non-authorised parties. Data may be transferred exclusively for the purposes described above, to the following subjects, with headquarters in the European Union or in the UK:

a) for the processing of your Donation Data will be transferred by the Controller MR PORTER to Adyen, MR PORTER’s Data Processor for payment services, as also defined in the terms and conditions of the Donation initiative. All the Donations will be transferred via Adyen to Movember who will receive the data in quality of autonomous data controller in compliance with the applicable data protection laws. Please consult Movember’s Privacy Policy at the following link;

b) subjects whose authority to access the Data is recognised by law or by secondary legislation.

You may request the full list of subjects to whom your Data will or may be transferred at the following address: privacyteam@ynap.com 

4. YOUR RIGHTS

We remind you that in the cases established by data protection laws, you have the right to:

a) obtain information regarding the existence of Data and the reason for its processing, how long it will be retained, and the subjected to whom it will be transferred;

b) receive the Data collected regarding you in a standard, interoperable format that is readable by electronic devices;

c) limit or oppose some or all processing at any time;

d) have incorrect personal data rectified or incomplete personal data completed;

e) have Data deleted within a reasonable time frame.

Finally, we also remind you that you have the right to contact the UK Data Protection Authority (Information Commissioner's Office, Wycliffe House - Water Lane, Wilmslow, Cheshire, SK9 5AF) to exercise your rights regarding the processing of your Data.

5. CONTACTS FOR EXERCISING YOUR RIGHTS

MR PORTER has named a Data Protection Officer (DPO), in line with the Regulation, who can be contacted with any questions regarding Data processing at the following email address: DPO@ynap.com

You can exercise your rights as listed in the preceding paragraph by writing to this email address.