Version: 1.11

Published: December 2022

PRIVACY POLICY

FOR BANG & OLUFSEN GROUP


In this privacy policy it is explained what types of personal data we collect, for what purposes the data is collected, how it is processed and what rights you have in this regard. For visitors, users, and others who reside in the State of California, please find the California Privacy Policy further below.


This policy is applicable for Bang & Olufsen Group (also referred to as “B&O”, “we”, “us”, “our”) consisting of Bang & Olufsen A/S, Bang & Olufsen Allé 1, DK-7600 Struer, Denmark and its subsidiaries, including B&O Play a/s. For more information, please see our consolidated Group Annual Report.


Data controller and contact details

Bang & Olufsen A/S is the data controller and is responsible for the processing of your personal data.


You will find our contact information below:

Bang & Olufsen A/S, Bang & Olufsen Allé 1, DK-7600 Struer CVR no.: 41257911

E-mail: gdpr@bang-olufsen.dk


Shops

B&O operates with both own shops and authorized B&O dealers (independently owned shops). The independently owned shops will be processing their own customer data. For information about how your local dealer is processing your personal data, we kindly refer you to their privacy policy.


CONTENT

  1. TYPES OF PERSONAL DATA AND HOW WE USE YOUR PERSONAL DATA

  2. RETENTION OF YOUR PERSONAL DATA

  3. WHERE WE STORE AND PROCESS YOUR PERSONAL DATA

  4. OUR DISCLOSURE OF YOUR PERSONAL DATA TO THIRD PARTIES

  5. YOUR RIGHTS

  6. MISCELLANEOUS


  1. TYPES OF PERSONAL DATA AND HOW WE USE YOUR PERSONAL DATA


    When you engage with B&O via various channels, including our websites, our app(s) (“app”), dealers and customer support, we collect and process your personal data.


    Purchases

    Types of personal data:

  2. RETENTION OF YOUR PERSONAL DATA


    We keep your information for no longer than necessary for the purposes for which it is collected. The length of time for which we retain information depends on the purposes for which we collected and use it.


    Relevant personal information will be deleted after expiry of the below-mentioned periods, unless such data legitimately can be kept and processed for other processing purposes, which we have legal basis for.


    Purchases

    Personal information related to your purchase and product warranty information is kept and processed for a period of one (1) year following the expiry of your warranty, or if such data is legitimately processed for other purposes, such as providing y ou with personal benefits or customized direct marketing upon your consent, or for pursuing our legal claims, where maintaining such information is considered necessary. If you have created an account, we will keep the purchase and product warranty information until you delete your account or ask us to delete the information.


    Abandoned cart emails (only applicable for USA and Canada)

    Personal information related to items you have placed in your shopping cart is kept and processed for a period of 12 months.


    Account

    Personal information you have provided us with when creating an account, and other information you have added to your account will be kept until you delete your account. Personal information related to your use of our apps and product software update(s) is kept and processed for a period of three (3) years from the date you last have been active in using any of B&O apps or delete your account.


    Support Files

    Data uploaded from your products or apps as part of support are stored for 3 months.


    Improvement / Customer service / technical support

    Personal data related to our provision of personal benefits to you is kept and processed for a period of five (5) years from the date of your last purchase of B&O product. Personal data related to your feedback on our products and services is kept and processed for a period of two (2) years from the completion date of the given survey, questionnaire or feedback form.

    Telephone calls: The recordings are kept for a period of 30 days. Claims/complaints: Five (5) years after the occurrence of the complaint. Marketing

    Personal data related to our provision of direct marketing to you (House of Bang & Olufsen) and personal data related to

    your use of your B&O products is kept and processed until you unsubscribe or change our preferences on your account.


    To ensure that the information we keep about you is up-to-date, we may request you to log in to your account and update the information.


    After unsubscription, we will keep minimum data to be able to prove that we had a consent for two (2) years.


    Customer experience

    Customer experience data is kept and processed as specified in the User-Generated Content Terms.


    User-generated content

    User-generated content is kept and processed as specified in the User-Generated Content Terms.


    Cookies

    Cookies are kept for maximum one (1) year.


    Visitors

    The contact details from visitors on our premises are kept for two (2) months.


    Supplier relations and other business contacts

    B&O will keep your personal information for as long as we maintain a relationship with you and thereafter for as long as there is a legitimate purpose for keeping your personal information, including where B&O is required under applicable law to keep the personal information. For marketing, we will keep the information for as long as you have given your consent.


  3. WHERE WE STORE AND PROCESS YOUR PERSONAL DATA


    As a general principle, your personal data is stored and processed within the European Economic Area (EEA). However, your personal data may be transferred outside EEA between the entities in the B&O, between B&O and its authorized dealers and certain types of third parties, as specified in the section ‘Our disclosure of your personal data to third parties’ within the purposes for which your personal data was collected.


    Personal data collected and processed in the People’s Republic of China is kept in accordance with applicable Chinese legislation.


    In case of transfer of your personal data to any third countries, as defined in General Data Protection Regulation (GDPR), valid law and regulations concerning such transfers are observed and relevant legal and security safeguards are ensured before such transfer by transferring to countries approved by the EU Commission as having an adequate level of protection, or by entering into an appropriately- drafted contract between B&O and the non-EEA entity receiving the data.


  4. OUR DISCLOSURE OF YOUR PERSONAL DATA TO THIRD PARTIES


    As a general principle, we collect and process data in order to facilitate or improve B&O’s products, services or offers. We do not share the said data with third parties, except to the extent stated in this privacy policy.


    We may disclose your personal data to third parties to the extent required by law, court order or a decision rendered by a competent public authority and for the purpose of law enforcement. In addition, we may share your personal data with the following third parties:


    1. Our group companies and authorized B&O dealers in order to deliver products and services to you, to ensure a consistent level of service across our products and services, to enhance our products, services and your customer experience.

    2. Third party vendors carrying out services on our behalf, including billing, sales, marketing, IT support, advertising, analytics, research, customer service, product service support, shipping and purchase order fulfillment, data storage, validation, security, fraud prevention, payment processing, and legal services. Such third party vendors have access to perform these services but are prohibited from using your personal data for other purposes.

    3. Music Streaming Services. When you initiate a connection with a third-party streaming service through B&O products, we may share information about you that is required to enable delivery of the third-party content.

    4. Third parties in order to establish, exercise or defend legal rights of B&O.

    5. Third parties in the event of any merger, sale, joint venture, assignment, transfer or other disposition of all or any portion of B&O’s

      assets or stock (including without limitation in connection with any bankruptcy or similar proceedings).

    6. Other third parties subject to your consent.


    When we disclose your personal data to a third party, we take all reasonable steps to ensure that those third parties are bound by confidentiality and privacy obligations with respect to the protection of your personal data. The disclosure is conducted in compliance with legal requirements, including entering into data processing agreements with the relevant third parties, to ensure that personal data is only processed in accordance with our instructions, applicable law and regulations and for the purpose specified by us and to ensure adequate security measures.


  5. YOUR RIGHTS


    Under the General Data Protection Regulation, you have a number of rights in relation to our processing of information about you. If you want to exercise your rights, you must contact us. Please note that prior to accessing and making changes to your account, we will need to verify your identity properly. If you have an account, you can also access your data by logging into your account at https://cloud.bang- olufsen.com


    Right to see information (right of access)

    You have a right to gain access to the information that we process about you and receive the personal data concerning you, which you have provided to B&O, in a structured, commonly used and machine-readable format and have the right to transmit those data to any third party, you should choose to.


    Right to rectification (correction): You have a right to have rectified incorrect information about you. We encourage you to update your personal data provided to B&O any time there are changes in your personal data. In order to ensure that your personal data processed by us is up-to-date we request you to check and, if relevant, update your personal data at least once a year.


    Right to erasure: In special cases, you have the right to have erased information about you before the time of our ordinary general erasure. Following deletion, your personal data will be deleted from servers of B&O without undue delay, while it might take a period of two (2) months to ensure complete deletion of any information that might be stored in our back-up.


    Right to restriction of processing or objections: In certain cases, you have a right to have restricted the processing of your personal data. Also, you have the right to object to processing of your personal data collected and processed for purposes of the legitimate interests pursued by B&O, for instance, when we provide you with relevant product software updates, make your future purchases easier by remembering your shipping details, or when we conduct analytics and statistics on your use type, date and frequency of B&O products.


    Right to withdraw your consent: Some of B&O’s processing activities will be based on your consent. In such case, you will have the right to withdraw your consent at any time. Where you have given consent to the processing of your personal data, you are free to withdraw your consent at any time. Withdrawal will not affect the lawfulness of the processing which has already taken place on the basis of your consent. If you choose to withdraw your consent, processing of your personal information will cease and the data will be erased.


    Further information: You can read more about your rights in the Danish Data Protection Agency's guidelines on the rights of data subjects. You can also read more about your rights in English by visiting ICO’s webpage. You can also contact us.


    Right to complain

    If you want to complain, please contact us.


    If you are not satisfied with the outcome of your complaint or with handling of your complaint at B&O, you can lodge a complaint with the Danish Data Protection Authority. Contact details: E-mail to dt@datatilsynet.dk or www.datatilsynet.dk


  6. MISCELLANEOUS


Third party websites, plug-ins and services

Websites, apps and products of B&O may contain links to third party websites, plug-ins, for instance social media login plug-in, or services, for instance voice control functionality provided by Amazon or Google. In regards to your use of voice enabled B&O products, please note that B&O does not collect or process any sound recordings on its own behalf, but only makes available third party services.

If you choose to use these websites, plug-ins or services, you may disclose your information to those third-parties. B&O is not responsible for the content or practices of those websites, plug-ins or services. The collection, use, and disclosure of your personal data will be subject to the privacy policies of these third parties and not this privacy policy. We urge you to read the privacy and security policies of the relevant third-parties.


Data security

B&O is committed to protecting the security of your personal data. We use necessary organizational, technical, and administrative measures to protect your personal data under control of B&O, such as control of access, transmission, input and availability and the separation of data.


Access to a number of online services at B&O are protected by access restrictions based on user name and password. It is important that you always choose a password which is hard to guess for others, and protect your password against disclosure.


Your personal details and your credit card details, if you have provided such to B&O remain encrypted in B&O’s secure web servers. Credit card information is directed to one or more approved and certified service provider(s), and will not be stored for longer than it takes to process the data. All external transmissions of personal data facilitated by B&O are protected by encryption.


All data storage and processing at computer facilities of B&O as well as at business partner facilities are subject to written contracts.

If you have reason to believe that your interaction with B&O is no longer secure (for example, if you feel that the security of any account you might have with B&O has been compromised), please notify us of the problem immediately by contacting us.


Use by children

B&O does not target and is not intended to attract children. Accordingly, our online services, including personal accounts on websites and apps provided by B&O that collect any personal data are not directed at and should not be accessed by individuals under the age of sixteen (16), and we request that such individuals do not provide any personal data to B&O. Minors must obtain express consent from parents or legal guardians prior to accessing or providing any personal data. If notified by a parent or guardian or discovered by other means, that a child under the age of sixteen has provided his or her personal data to B&O, we will cancel the child’s account, if any, and delete the child’s personal data in our possession.


Changes to our privacy policy

B&O may modify or update this privacy Policy when necessary to reflect changes in B&O products and services, changes in applicable legislation, regulations or practice and to address customer feedback. Accordingly, please review it periodically. Date of the latest update is always provided at the top of the document.


If there are material changes to this Privacy Policy, we will notify you either by posting a notice or by sending you a notification.


Sale of personal data

We do not, and will not, sell your personal data.


California Privacy Rights

Visitors, users, and others who reside in the State of California are also subject to our California Privacy Notice.


CALIFORNIA PRIVACY POLICY


This California Privacy Policy applies solely to visitors, users, and others who reside in the State of California. The California Privacy Policy supplements the Privacy Policy above. To the extent any provision in this California Privacy Policy conflicts with a provision of the Privacy Policy, the California Privacy Policy shall govern with respect to visitors, users, and others who reside in the State of California.


California Shops

B&O operates with both own shops and authorized B&O dealers (independently owned shops). The independently owned shops will be processing their own customer data. For information about how your local dealer is processing your personal data, we kindly refer you to their privacy policy.


TYPES OF PERSONAL DATA AND HOW WE USE YOUR PERSONAL DATA

Please read section 1 (Personal data we collect and process) in the Privacy Policy for information about which types of personal data we treat and how we use your personal data.


Sale of personal data

We do not, and will not, sell your personal data.


YOUR RIGHTS

California residents have the following rights:


  1. Right to know about personal data collected or disclosed

    You have the right to request that we disclose certain information to you about our collection and use of your personal data over the past 12 months. Once we receive and confirm your verifiable consumer request (instructions and description below), we will disclose to you:

  2. Right to request deletion of personal data

    You have the right to request that we delete any of your personal data that we collected from you and retained, subject to certain exceptions. Once we receive and confirm your verifiable consumer request (instructions and description below), we will delete, and direct our service providers to delete, your personal data from our records, unless an exception applies.


    We may deny your request to delete your personal data if retaining the information is necessary for us or our service providers to:

  3. How to exercise your right

    To exercise your right to know about, access, or delete personal data, please submit a verifiable consumer request to us by either: Emailing us at: gdpr@bang-olufsen.dk

    Written letter to: Bang & Olufsen A/S, Bang & Olufsen Allé 1, DK-7600 Struer, Denmark


    Only you or a person registered with the California Secretary of State that you authorize to act on your behalf may make a verifiable consumer request related to your personal data. You or your authorized agent may only make a verifiable consumer request for access or data portability twice within a 12-month period.


    Your verifiable consumer request must:

    1. Provide sufficient information that allows us to reasonably verify you are the person about whom we collected personal data, or an authorized representative;

    2. Describe your request with sufficient detail that allows us to properly understand, evaluate, and respond to it.


    We cannot respond to your request or provide you with personal data if we cannot verify your identity or authority to make the request and confirm the personal data relates to you. Making a verifiable consumer request does not require you to create an account with us. We will only use personal data provided in a verifiable consumer request to verify the requestor’s identity or authority to make the request.


    Response timing and format:

    We will confirm receipt of a request within 10 days and provide information about how we will process the request. We endeavor to substantively respond to a verifiable consumer request within 45 days of its receipt. If we require more time (up to 90 days), we will inform you of the reason and extension period in writing. Any disclosure we provide will only cover the 12-month period preceding the

    verifiable consumer request’s receipt. The response we provide will also explain the reasons we cannot comply with a request, if applicable. For data portability requests, we will select a format to provide your personal data that is readily useable and should allow you to transmit the data from one entity to another entity without hindrance.


    We do not charge a fee to process or respond to your verifiable consumer request unless it is excessive, repetitive, or manifestly unfounded. If we determine that the request warrants a fee, we will tell you why we made that decision and provide you with a cost estimate before completing your request.


  4. Right to Non-Discrimination

    We will not discriminate against you for exercising any of your rights under the California Consumer Protection Act. Unless permitted by the California Consumer Privacy Act, we will not:


California Shine the Light Law: California Civil Code Section 1798.83 permits our visitors who are California residents to request certain information regarding our disclosure of personal data to third parties for their direct marketing purposes. To make such a request, please contact gdpr@bang-olufsen.dk


Online tracking: Please note that our websites do not support “Do Not Track” browser settings and do not currently participate in any “Do Not Track” frameworks that would allow us to respond to signals or other mechanisms from you regarding the collection of your personal or non-personally identifiable data.


B&O does not offer any financial incentive programs to consumers and do not estimate consumer’s data present a significant value to

B&O, as we do not sell your personal data.