Website Privacy Notice

This notice relates to the Varley Group (“we”, “our”, “us”). We operate in the United Kingdom as Varley Clothing Limited (registered in England and Wales with company number 07827645), in the European Union as Varley Clothing B.V (registered in the Netherlands with Chamber of Commerce number 83328939) and in the United States as Varley Clothing Inc. (registered in Delaware with entity number 3803955), with a parent company Varley International Holdings Limited (registered in England and Wales with company number 12075176).

This privacy notice will inform you about how we collect and use your personal information. It will also tell you about your privacy rights and how the law protects you.

Please note:

1. this policy does not form a contract between an individual and us;

2. we do not use automated processing, including profiling, which produces legal effects concerning you or significantly affects you. We work with Insider (paragraph 4) but the effects of that processing are to only enhance user experience of our retail offering;

3. to the extent necessary we will share personal data across the Varley Group;

4. we have CCTV at our stores. That policy is separate and available on request.

For the purposes of EU and UK data protection law, we are a “controller” of your personal information. This means that we make decisions about how and why your information is used and have a responsibility to make sure your rights are protected when we do so.

1. What does this notice cover?

2. What personal information do we collect?

3. How is your personal information collected?

4. Sharing your information

5. Where is your information accessed?

6. How long do we keep your information?

7. How we keep your personal information safe

8. Further information for UK and EEA data subjects

1. What does this notice cover?

This notice describes how Varley Group uses your personal information when you visit and submit information through our websites.

We operate the following websites:

• https://uk.varley.com for our customers in the United Kingdom and the rest of the world.;
• https://eu.varley.com for our customers in the European Union; and
• https://www.varley.com for our customers in the United States, the Americas

It is important that you read this privacy notice together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you so that you are fully aware of how and why we are using your personal information.

If you have any questions, please contact us using the details in the Who we are and how you can get in touch section.

1. What personal information do we collect?

When we refer to “personal information”, we mean information that can be used to identify, or can be directly linked to, a person. This can be disclosed to us on our website, via third parties such as Epsilon or during visits to our stores. We collect personal information about you, including:

Identity information - This is information relating to your identity such as your name.

Contact information - This is information relating to your contact details such as email address, physical address, telephone numbers.

Account information - This is information relating to your account (including username and password).

Financial information - This is information you use when making a purchase on our website.

Device information - This is information relating to the browser or device you use to access our website, such as your IP address, browser type and version, time zone setting and location, browser plug-in types an versions, operating system and platform and other technology on the devices you use to access our websites. We typically collect this information through the use of cookies and similar technologies. For more information, please see our cookies notice.

Marketing information - This is information relating to your marketing and communications preferences

Communications information - Any other personal information you provide to us directly in the course of communicating with us.

Profile information - This is information including your username and password, purchases or orders made by you, your interests, preferences, feedback and survey responses.

Sensitive Personal Information

Under data protection legislation, certain personal information is considered more ‘sensitive’ (e.g., information relating to race, religion, political affiliation and health). This is also known as ‘special category data’. We do not collect any sensitive personal information about you.

3. How is your personal information collected?

We collect and retain personal information about you that you have given us in different contexts, for example:

• Direct interactions such as where you create an account with us, use our website, subscribe to our newsletter and/or correspond with us by post, phone, email or otherwise.
• Third parties’ services we receive personal information from analytics providers such as Google Analytics. We also receive data from Epsilon (see below) with contact details of consumers who Epsilon consider would be interested in receiving our House Brochure.

4. Sharing your information

Our business involves working with a number of third party service providers and partners some of which will receive personal data who will then process the personal on our behalf for the purposes set out in this policy. Before we commence working with such parties we will assess the security, processes and systems adopted by these third parties. By way of example we use third party providers for website hosting and development services, applicant tracking system solutions, email marketing services and cloud storage services.

In particular, there are three third party service providers to whom we may disclose your personal information:

• to Epsilon Abacus (registered in the UK as Epsilon International UK Ltd), a company that manages the Abacus Alliance on behalf of UK retailers. The Abacus Alliance helps participating retailers to understand the behaviour and preferences of their customers. Therefore, you may be contacted by a third party retailer. You are free to opt out of that marketing. You can learn more about how Epsilon Abacus processes your personal information in their privacy notice, which is available here: https://www.epsilon.com/abacus/services-privacy-policy;
• to Klarna in order to assess whether you qualify for their payment options and to tailor payment options to you. You can learn more about how Klarna processes your personal information in their privacy notice, which is available here: https://cdn.klarna.com/1.0/shared/content/legal/terms/Klarna/en_gb/privacy
• to Insider a company that uses AI-driven segmentation, analysis of browser behaviour, predictive modelling, and automation to personalise Varley’s homepage and website content. Offering each browser bespoke homepage content enhances user experience and optimises engagement. You can learn more about how Insider processes your personal information in their privacy notice, which is available here Insider privacy policy | Insider

As part of our business we may have to share personal data in the following circumstances:

• to government authorities and/or law enforcement officials if required for the purposes above, if required by law or if required in order to protect our legitimate interests (e.g. for tax regulation purposes);
• as part of a sale of shares i.e. a merger or acquisition, or other transfer of all or part of our assets including as part of a bankruptcy proceeding;
• with our professional advisors, lawyers, accountants and auditors;
• in connection with any or potential legal, litigation or regulatory process

5. Where is your information accessed?

Our websites cater for customers all around the world (in particular in the UK, US and EU). We have dedicated staff in the UK and the US.

Varley Group has retail .

6. How long do we keep your information?

We will only keep your personal information for as long as we need it to achieve the purposes for which we collected it, to comply with our legal and regulatory obligations, to exercise our legal rights and to protect ourselves from legal claims.

To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information, whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.

7. How we keep your personal information safe

To protect your privacy, we will make sure your personal information is kept securely and disclosed only to relevant organisations or representatives who need to access it to perform their roles. We use appropriate organisational, technical and administrative measures to protect personal information within our organisation.If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the Who we are and how you can get in touch (contact us) section below.

8. Further information for UK and EEA data subjects

This section is part of the privacy notice as it applies to UK and EEA data subjects.

Legal basis for data collection

We will only use your personal information when the law allows us to. Usually, we will use your personal information in the following circumstances:

• where we need it to perform a contract we are about to enter into or have entered into with you;
• where it is necessary for our ‘legitimate interests’ (or those of a third party) and your interests and rights do not override our interests;
• where you have given us your consent;
• where we need to comply with the law.

When we refer to our ‘legitimate interests’, we mean our ability to:

• provide our goods and services to you;
• communicate with your purchases from our websites or retail stores, about your Varley account or in response to a query from you;
• undertake marketing and build marketing strategies; and
• study how our website is used and make improvements to it.

The information below sets out in detail the types of data we collect and the purposes and legal bases for processing the data. It applies where we are processing data of individuals in the UK and the EEA.

Data we collect

Purpose To provide you with our goods and services

Type of data Identity information, Contact information, Account information, Financial Information, Communications information

Lawful basis for processing including legitimate interests Our legitimate interests in providing our goods and services

For the performance of a contract with you

Purpose To provide you with a response when you use our contact function on our website

Type of data Identity information, Contact information, Account information

Lawful basis for processing including legitimate interests Our legitimate interests in promoting and developing our business

Purpose To use data analytics to improve our website, products/services, customer relationships and experiences and to measure the effectiveness of our communications and marketing

Type of data Device information, Profile information

Lawful basis for processing including legitimate interests Our legitimate interests to define types of customers for our products and services, to keep our website updated and relevant, to develop our business and to inform our marketing strategy

Purpose To provide you with information relating to our goods and services and other information that we think you might be interested in as well as ways to contribute - you can unsubscribe to emails using the link in the email

Type of data Identity information, Contact information, Account Information, Marketing information, Profile information

Lawful basis for processing including legitimate interests For our legitimate interests and, where necessary, on the basis of your consent

Purpose To communicate with you and handle concerns and queries

Type of data Identity information, Contact information, Account information, Communications information

Lawful basis for processing including legitimate interests Our legitimate interests in providing good customer service and complying with our legal obligations

For the performance of a contract with you

To comply with laws

Purpose To enable you to partake in a prize draw, competition or complete a survey

Type of data Identity information, Contact information, Profile information, Communications information

Lawful basis for processing including legitimate interests For the performance of a contract with you

Necessary for our legitimate interests to study how our customers use our products and services, to develop them and grow our business

Purpose Generally to protect our legal rights and comply with laws

Type of data All of the above

Lawful basis for processing including legitimate interests Our legitimate interests and to comply with laws

Direct marketing

Where you have provided consent, we will contact you by e-mail to send you our newsletter and keep you updated on products and features that you may be interested in.

You can opt-out from receiving our marketing communications or update your contact preferences at any time by clicking the unsubscribe button on the bottom of any email from us or by writing to us at support@varley.com.

Although the majority of our marketing uses email we recognise that some prefer other communication methods. When you register you can agree to receive communication by SMS. We also publish a House Brochure which we are very happy to post.It is important for us that our community lets us know how we can keep in contact. Our website has these communication options so please update accordingly.

International transfer of data and personal information

Where we need to share your personal information with people or entities outside the UK or EEA, such recipients might be subject to data protection laws which offer less protection than European data protection law. Where this is the case, we take steps to ensure your personal information is protected by entering into contracts that have been approved by the relevant authorities (such as controller to controller EU “standard contractual clauses” along with the Information Commissioner’s international data transfer addendum to those clauses). As referred to above where necessary we conduct due diligence on third parties regardless of where they are located.

Cookies

Our websites use cookies to enhance your experience while using those sites. Cookies are small text files that are placed on your computer by websites that you visit. They are widely used to make websites work, or work more efficiently, as well as to provide information to the owners of the site. For further details about our use of cookies, please visit our Cookie Notice here.

Your data protection rights

If you are in the UK or the EEA, you have the right:

• to request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are processing it lawfully;
• to correct, delete or restrict (stop any active) use of your personal information;
• to request the transfer of your personal information to you or to a third party in certain circumstances. We will provide your personal information to you (or the third party you have chosen) in a structured, commonly used, machine-readable format;
• to object to the processing of your personal information in certain circumstances;
• to withdraw consent where you have given us consent to use your personal information. If you withdraw consent we will stop using your personal information immediately, unless we are required to process it for a different purpose (for example, the information is necessary to comply with a legal obligation). If you decide to withdraw your consent, this will not affect the lawfulness of our processing before your consent was withdrawn;
• to opt out of marketing communications we send you at any time. You can exercise this right by clicking on the “unsubscribe” or “opt-out” link in the marketing e-mails we send you.

These rights may be limited, for example if answering your request would reveal personal information about another person or if you ask us to delete information which we are required by law to keep. If you still have concerns, you have the right to complain to the data protection authority (see below for further details).

To exercise any of these rights, or to make a complaint to us, you can get in touch using the details set out in the Who we are and how you can get in touch (contact us) section below. Please note:

• that we are obliged to verify the credentials of any data subject who exercises these rights. This is to prevent unlawful disclosure of personal data to the wrong recipient;
• we may reach out to you to understand exactly what data you need and why. This enables you to more promptly receive your data and our analysis of why we are processing it;
• there are circumstances where we can reject the exercise of these rights or demand that you pay a reasonable fee.

Who we are and how you can get in touch

Varley Clothing Limited is a company incorporated under the laws of England and Wales, whose registered address is at 101 New Cavendish Road, 1st Floor South, London, United Kingdom.

Varley Clothing B.V is a company incorporated under the laws of the Netherlands, whose registered address is at Herengracht 420, 1017BZ Amsterdam, the Netherlands.

Varley Clothing Inc. is a corporation incorporated under the laws of Delware, whose registered address is at 860 S. Los Angeles Street, Suite 513, Los Angeles California 90014, United States.

If you have any questions about this privacy notice, including any requests to exercise your legal rights outlined above, please contact us at support@varley.com.

Individuals in the UK and the EEA have the right to make a complaint at any time to the local data protection supervisory authority. For details of supervisory authorities in the EEA see here. For the UK’s data protection authority, contact the Information Commissioner’s Office (ICO) here. We would appreciate the chance to deal with your concerns before you approach the relevant supervisory authority. So please contact us support@varley.com in the first instance.

Last Update 6 February 2025