Privacy Notice

When we say “Decathlon” (“we”, “us” or “our”) in this privacy notice, we are referring to Decathlon Sports Ireland Limited and its holding company Decathlon S.E. based in France. We process personal data in a manner that respects individuals' privacy rights and complies with legal obligations. This notice reflects our data protection and privacy policy and displays our compliance with applicable data protection laws, including the EU General Data Protection Regulation (GDPR) and the Irish Data Protection Act 2018.

This Privacy Notice is structured as follows: It explains the categories of personal data we collect. How we receive such data and how long we keep it for. The ways in which we use your personal data. It tells you about possible international transfers, and safeguards. It explains the rights you may have, how to exercise them. And it tells you how to make a complaint. This Privacy Notice supplements other privacy notices and policies, which we, from time to time, may make available to you, and is not intended to override them. We have a separate Cookie Notice which you can find here Cookie Policy. We regularly review this Notice and any changes made will be posted on our website.

Your data is yours! We are transparent about the personal data we process! You can find information about the processing relating to your personal data in this notice, along with where, when, how, and why we process your data, and what your rights are.

Unless otherwise stated below, Decathlon Sports Ireland Limited St Margaret's Road, Ballymun, Dublin 11, D11 X2NC, Ireland Company Number: 589659 is the 'controller' of your personal data. This means that we are responsible, under data protection laws, for deciding the purposes and means for which we process your personal data.

This policy applies to all physical locations and online sites operated by Decathlon, including but not limited to our stores and websites. It applies to all employees, contractors, online and in-person visitors, customers and prospective customers, and anyone whose personal data we process.

We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows: Important: Our website is not intended for children, and we do not knowingly collect and/or process children's data.

We may collect your personal data through: There are some circumstances where we need to collect personal data by law, or under our Terms and Conditions. If you do not provide that personal data when requested, you may not be able to purchase products from us.

We process your personal data to manage your purchase (we may need your delivery address or invoicing address, for example) and to avoid fraudulent transactions (to prevent purchases made with a stolen bank card, for example). We also process the data linked to your means of payment! Want to know more? In this Notice you will find a case-by-case explanation of how we process your personal data. Where we process your personal data on the basis of our or a third-party’s legitimate interest we will ensure that this legitimate interest does not outweigh your interests or fundamental rights and freedoms.

In some circumstances, it may be necessary for us to process or transfer your personal data outside the European Economic Area (EEA) for the purposes described in this privacy notice. Rest assured, such transfers are carried out very carefully. Why do we transfer your data? The transfer of your data outside the European Economic Area (EEA) is chiefly explained by the location of other DECATHLON entities worldwide and of our service providers. To offer you a high-quality service, we outsource certain operations to specialised service providers (e.g. web hosting). Some of these service providers are established outside the EEA. How are these data transfers governed? We comply with applicable data protection law when transferring your personal data outside of the EEA, such as by ensuring that the country or territory where your personal data will be processed is deemed, by the European Commission, to have an adequate level of protection for personal data. If no such adequacy decision is in place, we have measures in place (standard contractual clauses approved by the European Commission, for example) to ensure that your personal data receives an adequate level of protection.

Our website and mobile app may include links to third-party websites, plug-ins and apps. You should read the privacy notices of those third-party sites to obtain information about how your personal data is processed by them. Clicking on those links or enabling those connections may allow third parties to collect or share data about you. We do not control these third parties and are not responsible for their privacy statements. Similarly, if you use any third-party websites, apps or services to access our services, your usage is subject to the relevant third-party’s terms and conditions, privacy policy and cookie policy. We process pseudonymous behavioral identifiers (browser storage tokens and server-side clickstream data) within our private Google Cloud Platform infrastructure to optimize and personalize your internal website search results. This profiling and predictive product re-ranking occurs strictly on the basis of your explicit consent under the category 'Personalisation Usage' and for the continuous improvement and training of our search machine learning algorithms.

We keep your personal data for no longer than is necessary, based on the purposes set out in this notice and for the purposes of complying with any legal or regulatory requirements, or in order for us to establish, exercise or defend our legal rights. When determining the appropriate period to retain personal data, we consider various factors, including relevant regulatory guidance, specific legal or regulatory obligations and applicable statutory limitation periods. In general, your data will be deleted 3 years after our last contact with you. CCTV Data is retained for 28 days, unless we need to retain it for a longer period for a specific reason. In some circumstances, we will anonymise your personal data for research and statistical purposes

We implement a range of appropriate technical and organisational measures to ensure the security of personal data and to protect it against unauthorised or unlawful processing, accidental loss, destruction or damage. These measures are designed in accordance with the principles of data protection by design and by default, and are regularly reviewed to ensure they remain effective. They include access controls, encryption, secure storage systems, staff training, and internal policies that promote data minimisation and accountability. Our approach takes into account the nature, scope, context and purposes of processing, as well as the risks to individuals’ rights and freedoms, and demonstrates our commitment to data protection.

You have a number of rights. Some apply to all data processing concerning you, while others depend on the lawful basis on which the personal data is processed for (contract, legal obligation, consent, legitimate interest, etc.). Right of access:You have the right to access your personal data, together with information about our processing of that personal data. Right of rectification:You can request to have any incomplete or inaccurate personal data corrected. Right to object:You have the right to object to the use of your Personal Data or the way in which it is processed where we have determined it to be necessary for the purposes of our legitimate interests. Right to erasure:This is the right to be forgotten, applicable under certain conditions. Right to portability:In some circumstances you have the right to have your personal data ported. Right of restriction:This right entitles you to request that we suspend processing of your personal data under certain conditions. Right to withdraw your consent:If you provided your consent for a specific purpose, you have the right to withdraw your consent at any time. Right not to be subject to automated decision making and profiling:This applies where a decision is based solely on automated processing. You can exercise your rights by contacting us in one of the following ways: By email: help.ireland@decathlon.com By post: “Decathlon – Personal Data Protection, St. Margaret's Road, Ballymun, Dublin 11, D11 X2NC”. To ensure your request is processed efficiently, please include: The type(s) of processing your request pertains to The right(s) you wish to exercise A copy of your ID for security purposes We aim to respond to all legitimate requests within one month. In complex cases, we may take longer to complete your request but we will keep you updated.

Our Contact Information (Data Controller)Decathlon Sports Ireland Limited St Margaret's Road, Ballymun, Dublin 11, D11 X2NC, Ireland Our Data Protection Officer: If you have any questions or concerns regarding this notice or our handling of your personal information, you may contact our Data Protection Officer (DPO) at: By email: privacy.ireland@decathlon.com By post: "Decathlon - Data Protection Officer, St. Margaret's Road, Ballymun, Dublin 11, DX11 X2NC" Our Supervisory Authority You have the right to lodge a complaint with any Supervisory Authority: Name:Data Protection Commission Address:6 Pembroke Row, Dublin 2, D02 X963, Ireland Online:https://www.dataprotection.ie/en/contact/how-contact-us

This policy is reviewed annually or upon significant changes in legislation, technology, or operational use. Version control and revision history are maintained.

Version Date Comments 1.0 April 2022 Initial draft policy 2.0 October 2024 Style updated 3.0 July 2025 Updated DPC postal address 4.0 October 2025 Annual review. Revision of layout for improved transparency. Separation of Cookie Notice into a separate document. 5.0 March 2026 Updated the Analytics and Advertising section.