Welcome to our website www.carolinaherrera.com (hereinafter, the “Website”).

Please read this Privacy Policy carefully.

1. Our commitments

Everyone has the right to protection of his/her their personal data, which is defined as any information that relates to an identified or identifiable living individual (hereinafter “Personal Data”). We respect users' right to be informed regarding the collection of, and other operations involving their Personal Data. In using data that may directly or indirectly identify you personally, we will apply a principle of strict necessity. For this reason, we have designed the Website in such a way that the use of your Personal Data will be kept to a minimum and will not exceed the purposes for which your Personal Data was collected and/or processed; we do not process your Personal Data when we can provide you with services through the use of anonymous or traffic data (such as marketing research made for improving our services, browsing data processed to provide you with customized contents or offers adapted to your preferred language, your location, etc.) or by other means which allow us to identify you, apart from when it is strictly necessary or upon request by competent public authorities or the police (for example, in case of traffic data or your IP address).

2. Data Controller

For the purposes of the Data Protection Legislation (as defined below) companies of the PUIG Group that may need to have access to and process the Personal Data collected on the Website for one of the purposes listed below shall be considered as separated and independent controller of your Personal Data. In this context, the following companies (hereinafter, jointly referred as to the “Companies”) shall be classified as controller of your Personal Data with respect to the following data processing activities:

• Marketing and other purposes: (including general Online Customer and Information/Complaint Services regarding the Website): ANTONIO PUIG SA. - a Spanish company with registered office at Plaza Europa 48-48, 08902 Hospitalet de Llobregat, Barcelona (Spain), incorporated with the register of trade and companies of Barcelona under number A08158289 (hereinafter referred to as “ANTONIO PUIG”)

• Online Sales: will be managed by the relevant Puig Selling Entity. The Puig Selling Entity, as defined in the applicable Terms and Conditions of Sale, shall act as the data controller with respect to the personal data collected and processed through the Website for commercial purposes, as it determined the purposes and means of such processing.

• Offline sales: As defined below, any data collected at a physical point of sale of PUIG may be processed by the selling entity for purposes related to the sale (including one-to-one communications), and by ANTONIO PUIG for marketing purposes (including newsletters and other communications). In such cases, the selling entity will act as the data controller for sales-related purposes, and ANTONIO PUIG will act as the data controller for marketing communications.

The Companies hereby undertake to treat all information provided online by a user as strictly confidential.

This Privacy Policy relates to personal information identifying any user when accessing our Website, using its services and/or filling in forms on our Website with or without purchasing any product from the local Online-Shops (“Personal Data”). This Privacy Policy helps you understand how the Companies collect and use your Personal Data and for which purposes and lists your rights in relation to your Personal Data.

For the accuracy of your provided Personal Data in our files, please communicate any changes to our Customer Service. Therefore, we can ensure that the information contained in our files is, always, up-to-date and accurate. We reserve the right to suspend or interrupt the provision of the requested services should you provide inaccurate Personal Data, without prejudice to any action allowed by law.

For any issues or questions relating to this Privacy Policy you can contact to our Customer Service:

• [email protected] (fragrances “CAROLINA HERRERA” and “CAROLINA HERRERA NY”);

• [email protected] (“Fashion CAROLINA HERRERA NY”);

• [email protected] (“Fashion CAROLINA HERRERA”).

3. Applicable law

Any and all Personal Data sent to the Companies through the Website and/or the course of the purchase of products will be collected and/or processed by the Companies pursuant to the applicable laws to the state/country of residence of the user, (i) residents of the European Economic Area, EU Regulation 2016/679 (“GDPR”) without prejudice however to any applicable local mandatory laws benefitting to consumers, in accordance with EU Regulation 593/2008 (“ROME I”); or (ii) any other conflict of laws rules applicable (together, “Data Protection Legislation”).

4. Purpose(s) of Processing of Personal Data and legal basis

The purposes for which the Companies collect and process Personal Data and the respective legal basis are listed below.

• Online Sales: Your Personal Data may be processed to provide the e-commerce services you subscribed to or reserved for registered users (as long as it is applicable and you provide the appropriate consent, if required separately), notably to fulfill placed orders for products, to contact you in case of any order issues or where we need to provide your Personal Data to our service providers to fulfill your order (herein the "Commercial Purposes"). This data processing is based on the fulfillment of our contractual obligations with the client in relation to the order. We may have access to third parties’ Personal Data which was directly disclosed by its Users, for example when a User bought a product to be sent to a friend, when the User paying for the product is different from the recipient of the product, or when User wishes to recommend to a friend a service of the Website or the sale of a particular product. In this case, please make sure you receive the consent of such individuals before disclosing their Personal Data to us and make sure you inform them about this Privacy Policy; you will be the only person liable in connection with the disclosure of information and data regarding such third parties if they have not provided you with their prior explicit consent for it and for any improper and unlawful use of that information. In any event, we shall fulfil any obligation to inform third parties required by law and, when necessary, shall request their explicit consent upon registering in their archives the Personal Data of the User indicated.

• Marketing Purposes: Whenever you expressly give us your consent on the Website, our social media pages, computerized devices in stores or when permitted by applicable laws without your consent (for example, by having previously purchased on our Website a similar product) your Personal Data may also be processed:

o To send you, through any communication channel, including but not limited to email, phone, SMS, postal mail, instant messaging services or any other current or future digital means, push notifications or other digital communications (including advertisements on social media platforms), containing commercial information and/or updates on our products, offers, exclusive sales, promotional campaigns, and/or information on events and similar initiatives organized by the Company. For this purpose, we occasionally may use your email address to customize ads for your interests or to generate a "lookalike audience" or similar audience through the Facebook, Instagram, Google, Snapchat, Pinterest or TikTok advertising platforms (“Third-Party Digital Businesses”) based on your consent. This allows us to target advertisements on those platforms to potential customers who appear to have shared interests or similar demographics to you, based on the platforms' own data. It is the policy of these Third-Party Digital Businesses to hash your email address prior to uploading it, match the hashed data against their own customers, generate the lookalike audience, then delete the uploaded email address and use it for no other purpose. We do not have access to the identity of anyone in the lookalike audience unless they choose to click on the ads. We are not responsible for these Third-Party Digital Businesses, including without limitation their data security practices and/or failure to comply with your or our opt-out instructions.

If you wish to opt out, please contact us as per the “Contact” section below or, alternatively, by clicking the 'unsubscribe' link which is included in all of our marketing communications.

o We may also collaborate with third parties to provide us with browsing data (“Traffic Data”) resulting from the use of the Website and of our services to provide us analytics services and serve the Company's ads and banners when you are browsing on apps and other websites. We do this by way of various ad exchanges and digital marketing networks. We and our advertising partners use various advertising technologies, for instance, ad tag, cookies, pixels, identifiers and web beacons (“Tracking Technologies”). This information may be used by the Company to analyse and track data, determine the popularity of certain content, deliver advertising and content targeted to your interests on our Website and other websites, and better understand your online activity. The ads and banners you see are based on information that we hold about you, or on your prior use of our Website, for example, products you have browsed previously, content you have read on our Website, or on the Company’s banners or ads that you have engaged with in the past. We may also work with and use services offered by Third-Party Digital Businesses to serve ads to you as part of a customized campaign on those third-party sites and platforms. As part of these ad campaigns, we or the Third-Party Digital Businesses may convert information about you, such as your email address and phone number, into a unique value that can be matched with a user account on these platforms to allow us to learn about your interests and to serve you advertising that is customized to your interests.

Legal basis is your consent to the respective Tracking Technologies which is obtained via our cookie management tool on our Website in which you can declare / withdraw your consent. Further information can be obtained in our Cookies Policy.

o We may offer sweepstakes, contests, and other promotions (each, a “Promotion”), including Promotions jointly sponsored or offered by third parties, which may require submitting Personal Data. If you voluntarily choose to enter a Promotion, your information, including Personal Data, may be disclosed to us, co-sponsors, service providers, and other third parties, including for administrative purposes and as required by law (e.g., on a winners list). By entering, you are agreeing to the official rules that govern that Promotion, which may include consent to additional or differing data practices from those contained in this Privacy Policy. Please review those rules carefully.

• Security Purposes: In addition, and based on our legitimate interest, your Personal Data may be processed for:

o detect fraudulent activity and to keep the Website and online sales away from attackers who may try to access your account by impersonating you. In particular, we may use IP address, device, profile, usage, and other data to prevent and detect malicious or unsafe activities (e.g. payment fraud, identity fraud, account hacking, phishing, incentive abuses); and monitor all actions that could cause fraud or in the commission of a criminal offence related to the payment method employed by you; if any irregularities are detected, we reserve our right to retain the data provided and share it with the competent authorities in order to carry out the relevant investigation.

• Recipient: The Companies and certain entities appointed by the Companies that will also process Personal Data relating to the Website’s Users and the Online Sales (hereinafter the "Processors"). The above-mentioned Processors have been chosen because of their experience in processing Personal Data and they provide sufficient guarantees regarding compliance with Data Protection Legislation (including the technical security measures governing the processing to be carried out). In processing the Personal Data for Commercial Purposes, the Processors shall act only under the instructions from the Companies. We regularly check that our Processors comply with our instructions and that they continue to provide sufficient guarantees regarding their full compliance with Data Protection Legislation on Personal Data processing.

The Processors of your Personal Data for Commercial Purposes are:

• Customer service, for purposes related to the shipping, delivery and return of products purchased on the Website and customer service to users of the Website;

• Computer services, for purposes related to hosting Companies servers;

• Payment platforms, for purposes related to the payment method and its execution;

• Logistic services, for purposes related to shipping and delivery and return of the products purchased on the Website.

• Marketing services, for the analysis of use of our Website, sending communications, managing advertising content, etc.

Aside from the Processors appointed for Personal Data processing, your Personal Data will be made available also to third-parties, independent controllers, for purposes related to supplying services requested by Users (for example, for purchase transactions) or for purposes of third parties. For more information on the matter, see section 5 (To Whom Your Personal Data Will Be Disclosed).

Moreover, your Personal Data may be disclosed to the police or to judicial authorities, according to applicable laws and upon a formal request by such entities, for example in the event we need to prevent fraud on the Site (anti-fraud services).

You can always withdraw your consent regarding the data processing for Marketing Purpose by informing us using the contact information provided in clause 9 below.

5. What Happens if You Do Not Disclose Your Personal Data to us?

Granting your Personal Data to us (in particular, your personal details, your e-mail address, your address, your Credit/Debit Card numbers and bank code and your telephone number) is necessary for processing your order for the purchase of products on the Website, supplying other services provided on the Website upon your request, or when your Personal Data is needed to fulfil obligations required by law or regulations. The refusal to provide us with some of your Personal Data necessary for performing the above purposes may consequently prevent us from processing your order for the purchase of products sold on the Website, sending you requested Newsletters or fulfilling obligations required by law and other regulations etc. Therefore, failing to provide Personal Data may constitute, in some cases, a legitimate and justified reason for not processing your order for the purchase of products sold on the Website or not providing the Website’s services.

Disclosure of further Personal Data to us other than that required for fulfilling legal or contractual obligations and to be properly browse our services with necessary traffic data is, on the contrary, optional and does not have any effect on the use of the Website and of its services or on the purchase of products on the Website. We will inform you at every step whether disclosing your Personal Data to us is compulsory or optional by marking with an appropriate symbol (*) the information that is compulsory, or data needed for the purchase of products on the Website.

6. To whom your Personal Data will be disclosed?

Personal Data will be disclosed to third-party companies that provide, on behalf of the Companies, specific information technology-, marketing and other services as data Processors or to other recipients (for example, for purchase transactions) of Personal Data collected by us that process your Personal Data only for the Commercial Purposes as independent data controller and, in any case, according to applicable laws and regulations.

Your Personal Data may also be shared between the Companies, the Companies distributors, and Carolina Herrera’s licensees with registered offices in EU countries or non-EU countries for their own Marketing Purposes.

If you wish to receive marketing communications from CH Carolina Herrera, you may actively select the CH Carolina Herrera option on our website forms, if you do so, please note that your data may be shared with STL – Sociedad Textil Lonia, S.A. In this case, STL will act as the data controller of your personal data and its processing will be subject to STL’s own Privacy Policy.

Notwithstanding the foregoing, Personal Data will not be disclosed to any other third-parties or disseminated or transferred without informing our Users of such disclosure / dissemination /transfer, and, in any case, in accordance with the applicable laws.

7. Security Measures and length of conservation

We have adopted security measures to protect Personal Data against accidental or unlawful destruction, accidental loss, alteration, unauthorized disclosure, or access and against all other reasons for data processing that do not comply with our Privacy Policy.

For the best possible protection of your Personal Data outside the limits of our control and management of the same, it is advisable that your computer be provided with software devices that protect network data transmission/receipt (such as updated antivirus systems) and that your Internet service provider take appropriate measures for the security of network data transmission (such as, for example, firewalls and anti-spam filtering).

We will only hold your Personal Data for so long as is necessary for us to fulfil the purposes set out in this Privacy Notice (e.g., in case of online sales for as long as required by local tax, corporate and warranty laws; in case of a consent as long as you revoke your consent). Where we no longer need to process your Personal Data for the purposes set out in this Privacy Notice, then we will delete your Personal Data from our system.

8. Transfer of your Personal Data to other countries

The Personal Data we collect from you is currently held within the European Union (‘EU’), except personal data which is collected via Cookies on the Website of the Companies. However, it is possible that in the future such Personal Data may be transferred, stored and/or processed outside the EU.

By submitting your Personal Data, you agree to this transfer, storing and/or processing. Please note that some cookie providers and data recipients may be in the United States or other countries which may have a lower level of data protection. For further information, click on "Cookie Settings” in the Cookie Banner. However, we will take reasonable steps to ensure that your Personal Data is given equivalent protection in accordance with the Data Protection Legislation, by implementing adequate contractual conditions in our agreements with business partners dealing with transfer of Personal Data to ensure that Personal Data are processed according to our instructions, and in such a way to maintain their integrity and security.

9. Your right in relation to your Personal Data

We set out below a summary of the rights available to you in connection with your Personal Data.

For your convenience, and without prejudice to certain formal requirements set out in the Data Protection Legislation, you can exercise any of these rights by contacting us at: [email protected].

• Right to withdraw your consent:

You may withdraw the consent you give to the Companies for processing your Personal Data at any time. Please note, however, that where you do withdraw your consent or otherwise object to our processing of your Personal Data then this may affect our ability to provide you with goods and services or affect the functionality of our Website.

In addition, if you want to stop receiving future marketing messages, communications, and materials at any time, you can do so alternatively by clicking the 'unsubscribe' link, which is included in all our email marketing messages.

• Right to access your Personal Data in our possession:

You are entitled to obtain, at any time, confirmation from us as to whether or not we are processing your Personal Data and, where that is the case, access such Personal Data.

Moreover, you are entitled to receive from us information on the source of your Personal Data; the purposes and way of processing your Personal Data; the logic involved in any electronic data processing; details of the data controller and of the data processors; the names of the entities and categories of entities to whom your Personal Data may be disclosed or who may access your Personal Data, for example, as a data controller or a party so appointed.

• Right to have inaccurate Personal Data rectified:

You have the right to obtain from us without undue delay the rectification of inaccurate Personal Data that we hold and which, which concerns you. This includes the right to request that incomplete Personal Data is completed.

• Right to erasure:

You have the right to obtain from us the erasure without undue delay of Personal Data that we hold, and which concerns you, in the circumstances as provided by Data Protection Legislation.

• Right to restriction of processing:

You have the right to restrict the way we process your Personal Data in the circumstances as provided by Data Protection Legislation.

• Right to data portability:

You have the right to receive from us the Personal Data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format and have the right to transmit those data to another controller without hindrance from us. This right shall include the right to require us to transmit the relevant Personal Data to another controller on your behalf, where technically feasible. This right only applies to personal data that: (i) we gain your consent to process; or (ii) we obtain to perform our contractual obligations to you, and in each case to the extent we process your Personal Data by automated means.

• Right to lodge a complaint about us:

You are entitled to lodge a complaint with the Agencia Española de Protección de Datos (AEPD) – www.aepd.es, which acts as the lead supervisory authority for the Companies. You may also contact the competent data protection authority of your habitual residence, place of work or the place of the alleged infringement, if you consider that the processing of your personal data infringes applicable Data Protection Legislation.

10. Opt-in/Opt-out

Each time your consent is required, the Companies will inform you in advance and will give you the option to either provide or refuse your consent for the use of your Personal Data, including your e-mail address, for the above purposes, by ticking the appropriate boxes.

We wish to inform you that we may process your Personal Data also without your consent in certain circumstances, such as when such processing is necessary for performing a legal obligation to which we are subject or when such processing is necessary for performing obligations undertaken in contracts with the users.

11. Contacts

You may contact the Companies at any time at the following email address [email protected] for any concern or question regarding this Privacy Policy and your Personal Data provided to the Companies, or of you wish to receive further information on how we process your Personal Data.

You can also contact our Data Protection Officer at [email protected] or by writing to us at: Puig Brands, S.A. - Data Protection Officer, Plaza Europa, 46/48, 08902, L'Hospitalet de Llobregat, Barcelona, Spain.

12. Amendments and updating of this Privacy Policy

We may amend or simply update all or part of this Privacy Policy, including when amendments are made to legal provisions or regulations, which govern data protection and protect your rights. The amendments and the updating of the Privacy Policy shall be binding as soon as they are published on the Website in this section. Therefore, you are requested to regularly access this section to check the publication of the most recent and updated Privacy Policy.

Last update: July 2025

© ANTONIO PUIG, S.A.U. 2025. All rights reserved.