CHRISTIAN LOUBOUTIN GROUP BCRsCOMPLAINT MANAGEMENT PROCEDURE

1. CHRISTIAN LOUBOUTIN GROUP BCR’s CONTEXT
Under the provisions of EU Directive 95/46 and EU Regulation 2016/679 (“GDPR”), any transfer ofPersonal Data outside the European Economic Area (EEA) shall be framed by specific safeguards, witha view to make the use of the Personal Data compliant with European Data Protection Principles,
especially when there is a transfer of Personal Data to non-EEA countries which do not ensure anadequate level of protection.
In this context, the adoption of Binding Corporate Rules (“BCRs”) within the Christian Louboutin Groupis a mean to simplify the legal framework of the flows of Personal Data between Christian Louboutin
Companies worldwide, and to implement an adequate level of protection of the Personal Data.
The complaint handling procedure is an integral part of the BCRs according to the requirements set by
the Lead Supervisory Authority (the French Data Protection Authority or the “CNIL”) as it allows toensure their effectivity. Indeed, if a Data Subject believes that his/her Personal Data is not processedin accordance with the BCRs or Applicable Data Protection Law, he/she may register a claim with theChristian Louboutin Group to obtain adequate correction measures.
The purpose of this procedure is to explain how complaints brought by Data Subject whose Personal
Data is processed by a Christian Louboutin company (e.g. Employees, candidates, customers, suppliers,
other business parties and third parties) are dealt with. Therefore, this procedure describes the:−Roles and responsibilities of the Christian Louboutin Global Data Protection Officer as well asof all Christian Louboutin Employees.

−

Process for receiving, documenting, investigating and responding to data protection
commitments.

12. DESCRIPTION OF CHRISTIAN LOUBOUTIN GROUP COMPLAINTS MANAGEMENT PROCEDURE
2.1 III. Material & Geographical Scope
Any Data Subject considering that his/her Personal Data was not collected and/or processed inaccordance with the BCRs and/or Applicable Data Protection Law, may file a claim with the local
Christian Louboutin company.
Such claim may either deal with:-Purpose limitation, data quality, proportionality and legitimacy principles (see paragraph 2.2and Appendix 1 of the BCRs)
Transparency principle and right to information (see paragraph 5.1 of the BCRs)
Rights of access, rectification, erasure, blocking of data and objection to Processing (seeparagraph 5.2 of the BCRs)
Rights in case automated individual decisions are taken (see paragraph 5.3. and Appendix 1 ofthe BCRs)
Security and confidentiality principles (see paragraph 5.5 of the BCRs)
Restrictions on onward transfers outside of the Christian Louboutin Group of companies (seeparagraph 5.6 of the BCRs)
National legislation preventing respect of BCRs (see paragraph 7.2 of the BCRs)
Cooperation duties with Data Protection Authorities (see paragraph 6.6 of the BCRs)
Liability and jurisdiction provisions (see paragraph 6.4 of the BCRs)

This procedure is applicable to all Christian Louboutin companies worldwide which have adhered tothe BCRs.
2.2 Role and Responsibilities of the Global Data Protection Officer
The role of the Global Data Protection Officer is to:−−−−−

Review the data protection complaints forwarded by Employees in case of escalation (seebelow “Complaint escalation”);
Review the data protection complaints and the responses by the Employees in case of disputeby the complainant (see below “Dispute resolution”);
Work with Employees on their request or in case of escalation (see below “Handling of thecomplaint” and “Problem solving”) or dispute (see below “Dispute resolution”);
Respond to the Data Subjects regarding their complaint within a reasonable period of time(see below “Complaint handling delays”);
In case of delay in the response, inform the Data Subject of the delay together with the reasonsof the delay within the applicable timeframe (see below “Complaint handling delays”);

2−−Respond to the Data Subjects regarding the dispute within the applicable timeframe (seebelow “Dispute resolution”);
Review the reports of the Employees in order to take corrective actions and improve guidelines
and procedures within the Christian Louboutin Group, where the complaints might haverevealed a “gap” in terms of data protection.

Legal Department
The role of the Legal Department is to:−−Provide advice on request to the Global DPO with regard to the data protection complaints
and determine with them what remediation steps need to be taken in order to comply withthe BCRs and Applicable Data Protection Laws;
Determine if the data protection complaint triggers reporting obligations internally orexternally.

All Christian Louboutin Employees
The role of the all Christian Louboutin Employees subject to the BCRs is to:−−

Forward any complaint they accidentally receive to the GLobal DPO;
Cooperate with the Global DPO, if necessary, in order to provide all necessary information
which would help to solve the problem.

2.3 Process for receiving, documenting, investigating and responding to data protection
commitmentsi.

Submission of a complaint

Christian Louboutin informs the Data Subjects of the existence of a right to lodge a complaint related
to its compliance with the BCRs and Applicable Data Protection Laws, especially via the ChristianLouboutin website accessible externally and via the rules and regulations of Christian Louboutin
displayed and accessible to Employees.
Each claim should be sent to the Christian Louboutin Group, either by:-post mail: 19 rue Jean Jacques Rousseau, 75 001 Pariselectronic mail: dpo.global@christianlouboutin.com

Please note that we have prepared a template form to ease the submission of your complaint which isavailable on www.christianlouboutin.com.
All contact details to which it is possible to address a claim to the Christian Louboutin Group shall beclearly identifiable by Data Subjects on www.christianlouboutin.com or directly by asking any Christian
Louboutin Group Employee.
3

ii.

Handling of the complaint

Global DPO must regularly check its email inboxes and postal mailboxes for data protection complaints.
Upon receipt of a data protection complaint, the Global DPO who received the data protection
complaint, is in charge of acknowledging receipt of the complaint (see Appendix 2) and assessing
his/her competency. Any complaint that is filed with the Christian Louboutin Group shall lead tosending a notice of receipt to the Data Subject, with a request for additional information if necessary
for the claim’s handling.
If the complaint relates to another Christian Louboutin company, the Employee who received thecomplaint must forward the complaint to the Global DPO.
The Global DPO shall then liaise with any person concerned by the claim’s object (operational service,legal service, technical service, etc.), in order to determine whether it is grounded and to define themost appropriate answer that should be given to the claimant.
If it is determined that the data protection complaint is unjustified, the Global DPO informs the Data
Subject that the data protection complaint is not a violation of Christian Louboutin’s compliance withthe BCRs or with Applicable Data Protection Laws. The Global DPO must provide an explanation of why
the data protection complaint is not a violation. In case the investigation of the Global DPO finds that
there was no failure to comply with the BCRs and/or Applicable Data Protection Laws, the Data Subject
will be informed in writing of the possibility to escalate the complaint to the Data Protection Authority.
iii.

If it is determined that the data protection complaint is justified, the Global DPO informs theData Subject that it is reviewing the circumstances surrounding the complaint. Problem solving

The Global DPO works with all competent Employees and concerned departments (e.g. HR, Customer
Services, Security department etc.) to review the circumstances surrounding the data protection
complaint. The Global DPO and the competent Christian Louboutin legal department determine what
remediation steps need to be taken in order to comply with the BCRs.
The Global DPO informs in writing the Data Subject of the measures that Christian Louboutin will takein order to solve the problem and respond to the request.
After determining the appropriate remediation activities, the Global DPO and the concerned
department are responsible for implementing the necessary changes. The Global DPO must obtainevidence that the remediation activities have been addressed and reviews with the competent
Christian Louboutin legal department (where existing).
Any Christian Louboutin Employee involved in the complaint handling process should cooperate andprovide requested available information in the most diligent way. In compliance with labor regulation,company policies and procedures, and employment contract, employees found to be negligent may
be subject to disciplinary action.
iv.

Documenting the operations

4Upon receipt, the Global DPO must document the data protection complaints, the decision on thejustified or unjustified character of the data protection complaint including the explanation of why thedata protection complaint was not justified, as well as the response containing the measures taken by
Christian Louboutin in order to prevent the problem form reoccurring.
v.

Complaint handling delays

When a complaint is registered:i)ii)

iii)

it must be acknowledged in writing within 8 working days;
it must be handled by the Global DPO within one month (or within a shorter timeframe if
locally required by law, or if the seriousness of the breach requires special attention – e.g.
there is a suspicion that the Personal Data was stolen, lost or misused);if, on legitimate grounds and considering the complexity of the case, it is not possible toprovide an answer to the claim within one month, this period may be renewed for one
more month. The Data Subject shall receive a notification of such extension together withthe reasons for the delay within one (1) month of receipt of the request.

A claim’s handling delay by the Global DPO should not, in any case, exceed two months.
vi.

Dispute Resolution

The Global DPO shall reply to the Data Subject within one month in writing.
2.4. Data Protection Authorities (DPAs) involvement with resolving data protection complaints
Prior to referring a case to the relevant Supervisory Authority or competent jurisdiction, the Data
Subject shall be informed of the possibility to solve a claim through the internal complaint mechanism
described above and the BCRs Complaint Procedure.
If the Data Subject is not satisfied by the replies of the Global DPO or if the Data Subject prefers tobypass the available internal complaint mechanism, the Data Subject has the right to lodge a complaint
before the competent Supervisory Authority and/or the competent jurisdictions of the country of theGlobal DPO (see paragraph 6.3 of the BCRs).

3. REPORTING OBLIGATIONS
If the Global DPO is not personally in charge of handling complaints, he shall be regularly informed
about current procedures.
Each Christian Louboutin company having adhered to the BCRs and its Employees shall regularly reportto the Global DPO about the complaints settled at local level, with a view to take corrective actions
and improve guidelines and procedures implemented within the Christian Louboutin Group, where thecomplaints may have revealed a “gap” in terms of privacy compliance.

5

Elements of information regarding the complaints handling modalities shall also be brought toChristian Louboutin SAS’ (in its capacity of Head Controller) attention in the regular report transmitted
to it by Employees, in coordination with the Global DPO.
4. TRAINING ON DATA PROTECTION COMPLAINT HANDLING
Christian Louboutin provides training to its workforce on handling data protection complaints as partof the Christian Louboutin data protection training that is conducted regularly. The training on handling
data protection complaints outlines the commitments that Christian Louboutin has made to their Data
Subjects under their BCRs. The training outlines the methods by which Data Subjects can submit dataprotection complaints. In addition, the training outlines the responsibilities that certain members ofthe workforce have for receiving, responding to, and escalating data protection complaints made by
Data Subjects.

6

APPENDIX 1 – DATA PROTECTION COMPLAINT FORM (in case of verbal complaint, this form shallbe completed by the Christian Louboutin recipient of the complaint by phone)
Date of submission: MM/DD/YYYY
Name:Contact details:
Position of the complainant:☐ Job candidate☐ Employee☐ Supplier☐ Contingent Worker☐ Distributor/retailer☐ Website user
☐ Customer☐ Other: ____________________________________________ (please specify)
Location:
Current location of the complainant________________________(City, Country)
Location of the violation_____________________(City, Country)
Complaint:
Please describe your complaint, including as much detail as possible to help Christian Louboutin
investigate and resolve the matter.

7

APPENDIX 2 – ACKNOWLEDGING RECEIPT
To: _______________________ (Complainant)Subject: Your data protection complaint

Thank you for submitting your data protection complaint.
−The Christian Louboutin team in charge of data protection will investigate your complaint andprovide you with a response. Should you have additional questions or concerns at any point
during this time, please contact the Christian Louboutin Data Privacy Office at
dpo.global@christianlouboutin.com.

Kind regards,Christian Louboutin Data Privacy Office8

APPENDIX 3 - DEFINITIONS"Applicable Data Protection Law" shall mean the legislation protecting the fundamental rights andfreedoms of individuals and, in particular, their right to privacy with respect to the Processing of
Personal Data applicable to a Data Controller located in any country where Christian Louboutin is
located and in which the Local Data Exporter is established.
"CHRISTIAN LOUBOUTIN Group" shall mean Christian Louboutin SAS, a French Société par Actions
Simplifiée, having its principal offices at 19, rue Jean-Jacques Rousseau 75001 Paris, registered on theCommercial Registry of Paris under the number 38074265000027, and any other company controlled
by Christian Louboutin SAS, with a company being considered as controlling another: (a) when it holds
directly or indirectly a portion of the capital which provides the majority of the voting rights in general
meetings of shareholders of this company; (b) when it holds solely the majority of the voting rights inthis company by virtue of an agreement concluded with other partners or shareholders and which is
not contrary to the interest of the company; (c) when it determines de facto, by voting rights which itholds, the decisions in the general meetings of shareholders of this company; (d) when it is a partneror shareholder of this company and holds the power to nominate or to revoke the majority of membersof the administrative, management or supervisory bodies or (e) in any event, when it holds, directly or
indirectly, a portion of voting rights greater than 40% and when no other partner or shareholder holds
directly or indirectly a portion which is greater than its own.
“CHRISTIAN LOUBOUTIN Companies” or “Company(ies)” shall mean all Companies part of theChristian Louboutin Group which have signed the present BCRs intra-group agreement (Appendix 4) intheir capacity to be bound to the BCRs either as Data Exporters or as Data Importers.
"CHRISTIAN LOUBOUTIN Data Privacy Office" shall mean the team located within the Head Controller
who is in charge, within the Christian Louboutin Group at worldwide level, for managing businessawareness and compliance with applicable data protection law and applicable privacy policies,procedures and guidelines, that are implemented within the Christian Louboutin Group and inparticular, the BCRs.
“Controller” or “Data Controller” shall mean the natural or legal person, public authority, agency or
any other body which alone or jointly with others determines the purposes and means of theProcessing of Personal Data.
“Data Protection Authority” shall mean an independent body which is in charge of: (i) monitoring theProcessing of Personal Data within its jurisdiction (country, region or international organization), (ii)providing advice to the competent bodies with regard to legislative and administrative measuresrelating to the Processing of Personal Data, and (iii) hearing complaints lodged by citizens with regard
to the protection of their data protection rights.
“Data Subject” shall mean an identified or identifiable natural person to whom Personal Data relates.
An identifiable natural person is one who can be identified, directly or indirectly, in particular byreference to an identifier such as a name, an identification number, location data, an online identifier
or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural orsocial identity of that natural person.
“Data Transfer” shall mean any transfer of Personal Data from a Company to another Company. A
transfer can be carried out via any communication, copy, transfer or disclosure of Personal Data9through a network, including remote access to a database or transfer from a medium to another,whatever the type of medium (for instance from a computer hard disk to a server).
“Employees” are all people which perform, or performed in the past, duties for the Christian Louboutin
Group, in exchange for wages or a salary, according to an employment contract (where applicable orrequired by law) or any other assimilated agreement (such as internship agreement) and under asubordination relationship. This also includes directors, trainees, apprentices, contingent workers andassimilated status.
“General Data Protection Regulation” (or “GDPR”) shall mean Regulation (EU) 2016/679 of theEuropean Parliament and of the Council of 27 April 2016 on the protection of natural persons withregard to the Processing of Personal Data and on the free movement of such data, and repealing
directive 95/46/EC.
"Global Data Protection Officer" shall mean the senior level manager who is responsible, within theCHRISTIAN LOUBOUTIN Group at a global level, for managing business awareness and compliance with
Applicable Data Protection Law and Christian Louboutin privacy policies, procedures and guidelines,
especially the BCRs. Christian Louboutin’s Global Data Privacy Officer reports directly to or is part ofthe Management Board.
“Personal Data” shall mean any information relating to an identified or identifiable natural person(“Data Subject”); an identifiable natural person is one who can be identified, directly or indirectly, inparticular by reference to an identifier such as a name, an identification number, location data, anonline identifier or to one or more factors specific to the physical, physiological, genetic, mental,economic, cultural or social identity of that natural person.
“95/46/EC Directive” shall means Directive 95/46/EC of the European Parliament and of the Councilof 24 October 1995 on the protection of individuals with regard to the Processing of Personal Data andon the free movement of such data.
“2002/58/EC Directive” shall mean Directive 2002/58/EC of the European Parliament and of theCouncil of 12 July 2002 concerning the Processing of Personal Data and the protection of privacy in theelectronic communications sector (as amended)

10

ANNEXE 4 – COMPLAINT PROCEDURE CHART

11