In many cases, we will collect your personal information directly from your communications with us, either in an initial application or during subsequent stages of the recruitment process.

We may also collect your personal information from third parties such as recruitment agencies and public sources such as LinkedIn. We ensure that any third parties who provide us with your personal information have obligations to obtain that information in compliance with all applicable data protection laws, including informing you of the processing and obtaining your consent where necessary. We may also receive information about you from any references provide to support your application.

In certain situations, we share your personal data with partners, contractors and other third parties:

• Our Group – We may share information about you with other members of our group of companies, in particular with any local Dr. Martens group company relevant to the role for which you are a candidate and any group entity providing services such as IT systems to the wider group. Any sharing of information within our Group is covered by our Intra-Group Agreement. The relevant local companies are:

  Dr. Martens Airwair Spain S.L.U Dr. Martens Airwair Spain S.L. (Portuguese Branch) Dr. Martens Airwair Netherlands BV Dr Martens Airwair Denmark AnS Dr. Martens Airwair Italy SRL Dr. Martens Airwair France SAS Dr. Martens Airwair (Ireland) Limited

  Dr. Martens Airwair Belgium SA DM Airwair Germany GmbH DM Airwair Sweden AB DM Airwair Sweden AB (Danish Branch) DM Airwair Sweden AB (Norwegian Branch)

  Dr. Martens Airwair Korea Limited Dr. Martens Airwair Japan KK Dr. Martens Airwair Hong Kong Limited Dr. Martens AirWair Canada Inc. Dr. Martens Airwair USA LLC

• Suppliers and Service Providers – We share information with certain contractors, suppliers or service providers. They may process your personal data for us, for example, IT specialists and providers of cloud services. We conduct due diligence checks on these third parties and have contracts where they process personal data.

• Legal – Your personal information may also be shared if it is necessary on reasonable request by a law enforcement or regulatory authority, body or agency (including the policy) or in the defence of legal claims. We will not delete personal information if relevant to an investigation or a dispute. It will continue to be stored until those issues are fully resolved.

• Corporate Action – If we are reorganised or sold, information may be transferred to a buyer who may continue to progress the recruitment process.

Your personal information may be shared if it is made anonymous / de-identified, as in such circumstances the information will cease to be personal information.

California Consumer Privacy Act (CCPA) – Share / Sale of Personal Information

It is our policy that we do not sell your data – we are not data brokers, and we don’t exchange your information for money. We have shared the following categories of personal information in the preceding 12 months to third parties comprised of advertising networks and data analytic providers: identifiers; personal information categories from Cal. Civ. Code § 1798.80(e); internet or other similar network activity; and profile data. This sharing may result from targeting cookies you accept. The purpose of the notice of Right to Opt-out is to inform you that as a California resident, you have the right to direct us to stop selling your personal information, which is called the “Right to Opt-Out.” You may exercise your Right to Opt-Out by clicking “Do Not Sell or Share My Personal Information” at the footer of this website.

Authorized Agent for Opt-Out: If you use an authorized agent to exercise your right to opt-out of the sale of personal information, please note that Company requires that the authorized agent submit proof in the form of an authorization signed by you that the authorized agent has been authorized to act on your behalf.

We may, directly or indirectly through third-party entities around the world, process, store, and transfer all of the information you provide, including your personal information, as described in this Privacy Notice.

Your information may be transferred to and processed in countries both in and outside the EEA, including (but not limited to) Australia, Canada, Hong Kong, India, Japan and the United States. When transferring personal information internationally we ensure that appropriate measures apply, including technical and contractual measures, to ensure the personal data remains protected.

We will only transfer data collected in the UK or EU to jurisdictions outside the scope of the UK or EU General Data Protection Regulations (GDPR) in accordance with applicable data protection law and only where the appropriate safeguards set out in the GDPR are in place, in particular when a country provides an adequate level of data protection according to an adequacy decision made by the European Commission or by the use of Standard Contractual Clauses approved by the European Commission, and any necessary supplementary measures.

We are happy to provide you with copies of the regulator-approved Standard Contractual Clauses which you can request from us at dataprotection@drmartens.com.

Depending on where you are located, you may have certain rights under the data protection laws in your country or state. To exercise your rights under data protection laws, please contact our Data Protection Officer at the following email address: dataprotection@drmartens.com.

In some cases, your rights are limited by relevant laws, and we may be required by law or regulation to keep your information even if you object to us doing so.

EEA and UK

If you are in the EEA or the UK, you have the following rights under the applicable data protection laws:

• You have the right to ask us to confirm if we are processing your information.

• You have the right to ask for access to your information.

• You have the right to ask us to transmit your information to other companies.

• In case we process information about you that is incorrect, you have the right to ask us to correct your information.

• You have the right to ask us to delete your information or restrict how we process your information and in certain cases to object to our processing of your information.

• If we process your information based on your consent, you have the right to withdraw your consent at any time. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

You have the right to complain to the relevant supervisory authority where you are located. If you are located in the UK, the relevant supervisory authority is the Information Commissioner’s Office (https://ico.org.uk/). You can locate the contact information of the relevant EEA supervisory authority here https://edpb.europa.eu/about-edpb/about-edpb/members.

South Korea

If you are in South Korea, you have the following rights under the Personal Information Protection Act:

• You have the right to be informed about the collection and use of your information
• You have the right to ask for access to your information
• In case we process information about you that is incorrect, you have the right to ask us to correct your information
• You have the right to ask us to delete your information or restrict how we process your information

Hong Kong

If you are in Hong Kong, you have the following rights under the Personal Data Protection Ordinance:

• You have the right to be informed about the collection and use of your personal information
• You have the right to ask for access to your information
• In case we process information about you that is incorrect, you have the right to ask us to correct your information

Japan

If you are in Japan, you have the following rights under the Act on the Protection of Personal Information:

• You have the right to be informed about the collection and use of your personal information
• You have the right to ask for access to your information
• In case we process information about you that is incorrect, you have the right to ask us to correct your information
• You have the right to ask us to delete your information or object to how we process your information

USA – California

If you are a resident of the U.S. State of California, you have the following rights under the California Consumer Privacy Act:

• You have the right to be informed about the collection and use of your personal information.

• You have the right to request access to your personal information, including being provided with the specific pieces of information

• In case we process information about you that is incorrect, you have the right to ask us to correct your information

• You have the right to ask us to delete your information

• You have the right to opt-out from the “sale” of your information to third parties. Dr. Martens does not sell any information as described by the CCPA and CPRA in relation to the personal information processing to which this notice applies.

• You have the right to ask us to transmit your information to other companies.

• You have the right to not be discriminated against for exercising any of the rights under California privacy laws.

You can submit requests using the following by calling 800-810-6673 or by contacting our Data Protection Officer at the following email address: dataprotection@drmartens.com.You may also exercise your Right to Opt-Out by clicking “Do Not Sell or Share My Personal Information” at the footer of this website.

Canada

If you are in Canada, you have the following rights under the Personal Information Protection and Electronic Documents Act:

• You have the right to ask for access to your personal information

• In case we process information about you that is incorrect, you have the right to ask us to correct your information

• If we process your information based on your consent, you have the right to withdraw your consent at any time. The withdrawal of your consent will not affect the lawfulness of processing based on consent before its withdrawal.

Depending on the province you are in, you may also have further rights under provincial laws.

We are committed to keeping your personal information safe. We’ve got physical, technical, and administrative measures in place to protect personal data from loss, prevent unauthorised access or use of your information, including any modification, disclosure, damage, alteration, destruction or other misuse.

Our website, newsletters, email updates and other communications may, from time to time, contain links to and from the websites of others including our partner networks, advertisers, and other group companies and/or social networks as offered to you and supported by your browser.

The personal data that you provide through these websites is not subject to this notice and the treatment of your personal data by such websites is not our responsibility. If you follow a link to any of these websites, please note that these websites have their own privacy notices which will set out how your information is collected and processed when visiting those links. For more information about the purpose and scope of data collection and processing in connection with social sharing features, please visit the privacy notices of entities through which you chose to share.

This notice will be changed or updated from time to time.

If we change anything important about this notice (the information we collect, how we use it or why) we will highlight those changes at the top of the notice and provide a prominent link to it for a reasonable length of time following the change. We will also notify you in advance of the changes taking effect so that you understand what impact the changes may have on you.