PREAMBLE

Thank you for visiting and using our website: mbandf.com (hereinafter: the “Site”), including its e-commerce section (the “E-shop”), as well as our social media pages on Facebook, YouTube, Instagram, LinkedIn, and X (hereinafter: “Social Media Pages”).
MB & F SA (hereinafter: “MB&F”), located at Route de Drize 2, 1227 Carouge, Switzerland respects your right to privacy in both the online and the offline world, when you use our Site and when you visit our boutiques, such as the M.A.D.Gallery. This Privacy and Cookies Policy (hereinafter: “Policy”) explains how and for what purposes information relating to an identified or identifiable person (hereinafter: “Personal Data”) is collected, used and protected, and sets out policies and procedures relating to the collection and processing of Personal Data that you may provide us with when visiting our Site, Social Media Pages, our boutiques, or when participating in offline programs or events (hereinafter: "Offline Services").
The present Policy forms integral part of our General Terms and Conditions of Sale, as well as of our Terms of Use pertaining to the use of the Site.

1.    Scope of the privacy and cookies policy and amendments

1.    By using our Site and/or Social Media Pages or by providing us with your Personal Data in the context of our Offline Services, you accept the practices described in this Policy. If you do not agree with our use of your Personal Data as described in this Policy, please refrain from using or visiting our Site, Social Media Pages, or using our Offline Services requiring the processing of your Personal Data.
2.    MB&F reserves the right to make changes to this Policy at any time by posting a new version of this Policy on the Site, without any prior notification. If you do not accept the new terms of the Policy, please do not use our Site, Social Media Pages, nor our Offline Services.
3.    We will always handle your Personal Data in accordance with the Policy that was in effect at the time of collection.
4.    The new version of the Policy will become effective on the date it is posted, which will be listed at the top of the page as the new effective date.

2.    What Personal Data we collect about you

1.    The Personal Data that we collect through our Site, Social Media Pages and our Offline Services can be divided into two categories: (i) cookies and (ii) Personal Data you provide us with.
A.    Cookies
(I) WHAT ARE COOKIES AND WHAT INFORMATION DO THEY COLLECT?
1.    Cookies are files containing a small amount of data that are sent from a website to your browser and stored on your mobile or computer device. Other tracking technologies, such as beacons, tags and scripts (hereinafter: “Similar Technologies”), may also be used to collect and track information and to improve and analyze our Site.
2.    Through the use of cookies and Similar Technologies we may collect Personal Data when you interact with our Site, Social Media Pages or open emails that we send to you. In particular, we may identify certain usage data when you browse or click on content.
3.    The following information and Personal Data are collected through the use of cookies and Similar Technologies:

•    your device ID;
• the IP address of the device that can connect to the Internet and request the connection;
• the location, if enabled on the device;
• the resources you accessed on the Site;
• name and URL of the linking page;
• the browser you are using and, if necessary, the operating system of your Internet-enabled device, s well as the name of your service provider.

4.    In order to control or limit the collection of this information, you can:

•     set up your browser to refuse all cookies or to indicate when a cookie is being sent;
• delete cookies and clear your browsing data directly from your browser’s settings.

5.    Please note that if you do not accept certain cookies or Similar Technologies, you may not be able to access certain features of our Site.

6.    List of cookies and Similar Technologies that we use:

(II) FOR WHAT PURPOSE DO WE COLLECT INFORMATION USING COOKIES AND OTHER SIMILAR TECHNOLOGIES?

1.    We use cookies and Similar Technologies that we collect in order to:

• enable access to our Site;
• make certain features of our Site accessible, and to provide you with additional functionality;
• improve our Site and Social Media Pages;
• store information regarding your preferences, enabling us to customize our Site in accordance with your personal preferences;
• ensure the security of our Site;
• collect statistical information about the use of our Site, Social Media Pages and regarding the opening of our promotional e-mails and newsletters.  

(III) LEGAL BASIS FOR PROCESSING

1.    With regards to cookies and Similar Technologies used for the operation, maintenance and security of our Site, the legal basis we rely on to process your Personal Data is our overriding private interest.
2.    In addition, cookies and Similar Technologies which would go beyond the purposes justified by our overriding private interests (for example, analytics and targeting cookies used for marketing purposes), are implemented upon your consent, collected through the means of our cookie banner.

B.    Personal data provided by you

(I) WHAT PERSONAL DATA DO YOU PROVIDE US WITH?

1.    We collect Personal Data from you when you (i) create an account on our E-Shop, (ii) create an account to become a member of The Tribe, (iii) subscribe to a newsletter, (iv) when you contact us by email, (v) when you use our E-Shop ChatBot, (vi) when you purchase items from our E-Shop and (vii) when you register for the possibility to purchase some exclusive watches or take part in exclusive promotions.
2.    With regards to our Offline Services, we collect Personal Data from you when you visit our boutiques, and make in-store purchases. We also collect Personal Data from you when you register to participate in our Offline Services.
3.    The Personal Data collected includes:

• Personal contact information such as name, email, phone number, address, company, picture and demographic information, including birth date, age, gender or location;
• Information about your watch, such as series number, date and location of purchase;
• Account login information or membership details, such as name and address;
• Payment information, such as credit card and bank information;
• Your comments and user-generated content, including any photos, videos and personal stories that you share with us.
• Video images when you visit one of our boutiques such as the M.A.D.Gallery in Geneva or the M.A.D.House.

4.    Please note that when you purchase a product through our Site using a credit card, you will be automatically redirected to the payment service providers’ website, whose general terms and conditions and privacy policy are the only ones applicable to such credit card payments. No information concerning your credit card will thus be requested or recorded on our Site.

(II) FOR WHAT PURPOSE DO WE COLLECT PERSONAL DATA?

1.    We collect and use your Personal Data for the following purposes:

• to allow you to create and access your client account or manage your Tribe membership;
• to fulfil your orders and purchases, including after sales services and any required upgrade of your watch;
• to respond to your queries;
• to contact you for marketing purposes, including sending you information about new accessories and exclusive rewards, as well as entering you into exclusive promotional activities reserved for members of the Tribe, through which you may receive free gifts or other benefits. You will always have the option to opt out of such promotional communications and activities at any time by contacting us;
• to send you newsletters;
• for safekeeping and maintenance of our Site; for reporting; and for risk, dispute and record management;
• for the security of our boutique and employees via CCTV monitoring.

(III) LEGAL BASIS FOR PROCESSING

1.    We process your Personal Data in accordance with the Swiss Federal Act on Data Protection (FADP). The legal bases for processing your Personal Data include:
1.    Performance of a Contract 

• We process your Personal Data to fulfill our contractual obligations to you, including processing your orders, handling payments, delivering products or services, and providing customer support.

2.    Legal Obligation 

•  We may process Personal Data where necessary to comply with legal obligations, such as record-keeping, tax, or consumer protection laws.

3.    Legitimate Interests 

• We process Personal Data to pursue our legitimate interests, such as improving our website and services, preventing fraud, and ensuring the security of our systems. Where we rely on this basis, we ensure that your rights and interests do not override our legitimate interests.

4.    Consent 

•  Where required, we process your Personal Data based on your explicit consent – for example, for sending marketing emails, newsletters, or using certain cookies. You may withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

3.      Where we store your Personal Data and cross-border disclosures of your Personal Data

1.    We take data protection issues seriously and we have chosen to store your Personal Data on servers provided by Infomaniak in Switzerland, Shopify in Canada, MailChimp in the US and Saiesforce in the US.
We use the services of some third parties, some of which operate outside Switzerland or the European Economic Area, notably in the United States of America and Canada. We may thus transfer your data to third parties and processors, including to countries which may not have an adequate level of protection of your Personal Data compared with that provided in Switzerland or the European Economic Area. In such an event, and unless provided otherwise in this Policy, we undertake to enter into agreements with such third parties and processors to ensure an adequate level of protection of your Personal Data. By providing us with your Personal Data, you acknowledge that we may transfer, store and process your Personal Data outside Switzerland or the European Economic Area – in particular in the United States of America and Canada. For more details on cross-border disclosures, please refer to Section 4 below.

4.    Communication and processing of your Personal Data 

A.    Communication to third parties in general
1.    We may disclose your Personal Data to third parties. This includes in particular our contractors and affiliates, in particular our boutiques and our franchises, as well as third-party service providers. 
2.    With your consent, through the use of cookies, the Site may use third parties such as network advertisers and ad exchanges to serve you ads on third-party websites after you leave our Site, and we may use third-party analytics and other such service providers to evaluate and provide us and/or third parties with statistical information about the use of the Site. Such statistical information is however, anonymized.
3.    We do not actively sell or seek your Personal Data to or from other third-party sources, nor do we actively cross-reference your Personal Data with information from other third-party sources.
4.    The disclosure of your Personal Data as described above is carried out in strict compliance with the provisions of the FADP.
B.    Processors
1.    We may grant certain contractual partners and third-party service providers who process Personal Data on behalf of us (hereinafter: "Processors") access to your Personal Data made available to us through our Site, Social Media Pages and Offline Services. 
2.    The disclosure of your Personal Data to Processors is carried out in strict compliance with the provisions of the FADP, specifically under the following conditions: (i) the processing is based on a legal basis or a contract, (ii) we are authorized to process your Personal Data ourselves, and (iii) no legal or contractual confidentiality obligation prohibits it.
3.    We may in particular grant access to your Personal Data to Processors providing the following services: operation of our Site (including its E-Shop) and Offline Services, data management and marketing activities.
4.    We notably use the following Processors:
1.    Idéative SA, based in Switzerland (hosting provider);
2.    Infomaniak, based in Switzerland;
3.    E-commerce facilities providers :
1.    E-shop service provider Shopify Inc., based in Canada;
2.    Mailing service provider Mailchimp, based in the US;
3.    Customer relationship management (CRM) provider Salesforce, based in the US;
5.    If a Processor is located outside Switzerland, the relevant provisions on cross-border data transfers outlined in this Policy and under the FADP will be complied with.

6.    Processors process your Personal Data on our behalf and solely under our instructions. They are contractually obliged to protect your Personal Data using procedures similar to ours as set out in this Policy, and to provide sufficient guarantees in this regard.

C.    Social media and third-party websites
1.    Where we provide links to websites of third parties, this Policy does not cover how such third parties process your Personal Data. We thus encourage you to read the privacy policies of the other websites you visit.
2.    Our Site and Social Media Pages contain links that direct you to social networks, such as Facebook, YouTube, Instagram, Pinterest, LinkedIn, Twitter, WhatsApp and WeChat, in order to connect you with the content displayed on these social media platforms. In particular, our Site utilize YouTube API Services to provide enhanced functionality and access to YouTube contents. When you access social media or another website via our Site or our Social Media Pages, responsibility for compliance with data protection laws is to be guaranteed by the providers of the respective social media platforms.
3.    When you establish a connection to a social media platform or another website, your browser connects directly to the server of the relevant service provider. Through this connection, the social media platform or website receives the information that your browser has accessed the relevant page of our Site or our Social Media Page(s), even if you do not have an account with such social media platform or if you are not logged into the relevant social media account. This information (including your IP address) is transmitted from your browser directly to the service provider’s server and stored there. If you are logged in to your account with the relevant social media platform, such platform may immediately link your visit to our Site(s) or Social Media Page(s) to your account. If you interact with our Site or Social Media Pages, for example by clicking on the “Like” or “Share” icon, this information will also be transmitted directly to the social media service provider’s server and be stored there.
4.    Please refer to the privacy policy of the relevant social media platform or website for information regarding the purpose and scope of the collection of Personal Data by the relevant service provider, the further processing and use of such Personal Data by the relevant service provider, as well as the related rights and settings to enable the protection of your Personal Data.
D.    Change in control or sale
1.    We may share your Personal Data, subject to a confidentiality agreement, as part of a sale, merger or change in control, or in preparation for any of these events. 
2.    Your Personal Data may be transferred to a successor in the event of a merger, divestiture, restructuring, reorganization, dissolution or other transfer of some or all of our assets, whether as a growing concern or as part of bankruptcy, liquidation or similar proceeding, in which the Personal Data we hold is amongst the assets transferred.
E.    Legal disclosures
1.    We may use your Personal Data (including your communications) if we think it is necessary for security purposes, to investigate possible fraud or other violations of this Privacy Policy and/or attempts to harm other users of our Site, Social Media Pages, and/or Offline Services. Hence, we may use your Personal Data to investigate, respond to and resolve complaints and issues relating to our Site, Social Media Pages and/or Offline Services.
2.    It is possible that we will need to disclose your Personal Data when required by law or if we have a good faith belief that disclosure is necessary to (i) investigate, prevent, or take action regarding suspected or actual illegal activities or to assist government enforcement agencies; (ii) enforce our contract(s) with you, (iii) investigate and defend ourselves against any third-party claims or allegations, (iv) protect the security or integrity of our Site or Social Media Pages; (v) exercise or protect the rights and safety of our clients, users of our Site, Social Media Pages and Offline Services, personnel, and others.
3.    We attempt to notify you of legal requests for your Personal Data when appropriate in our judgment and technically feasible, unless prohibited by law or court order, or when the request is an emergency. We may dispute such requests when we believe, in our discretion, that the requests are too broad, vague, or lack proper authority. However, we do not promise to challenge every request.

5.     Management of your Personal Data

A.    Your rights
1.    To the extent possible, you may exercise your rights as described below, by sending us an email at info(at)mbandf.com. Please note that we will ask you to prove your identity before responding to requests based on the rights below, or otherwise related to your Personal Data.
2.    Right to access and update your Personal Data: whenever we process your Personal Data, we take reasonable steps to ensure that your Personal Data is kept accurate and up-to date for the purposes for which it was collected.
3.    Right to delete your Personal Data: you may request the deletion of your Personal Data at any time, subject to any retention obligations imposed on us or to our overriding private interest of retention to be assessed on a case-by-case basis. We may retain de-personalized (anonymous) information after the deletion of your Personal Data.
4.    Right of rectification: you have the right to obtain the rectification of your Personal Data, if it is inaccurate or incomplete.
5.    Right to object to processing: within the limits of the law, you have the right to object to our processing of your Personal Data.
6.    Right to restriction: within the limits of the law and subject to obligations imposed on us or to our overriding private interest to be assessed on a case-by-case basis, you have the right to request that we restrict the processing of your Personal Data.
7.    Right to data portability: you have the right to be provided with a copy of the Personal Data we have on you in a structured, machine-readable and commonly used format.
8.    Right to withdraw consent: you have the right to withdraw your consent at any time where we relied on your consent to process your Personal Data. Please note that such withdrawal will not affect the lawfulness of processing based on your consent before its withdrawal. Such withdrawal may furthermore result in you no longer being able to make use of certain features of the Site or our Offline Services. With regards to marketing communications, you may opt-out at any time by following the ‘opt-out’ options provided, or by contacting us at info(at)mbandf.com.
9.    Right to complain to an authority: you have the right to complain to any competent authority with regards to our collection and use of your Personal Data, including to a data protection supervisory authority.

B.    Protection of your Personal Data and data breach
1.    We take all reasonable technical and organizational measures to protect your Personal Data against loss, unauthorized access or disclosure and against other misuse.
2.    The security of your Personal Data is important to us, but no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use appropriate technical and organizational commercially acceptable measures to protect your Personal Data against manipulation, partial or complete loss and unauthorized access by a third party, we cannot guarantee its absolute security.
3.    In the event of a data breach that compromises the security, confidentiality, or integrity of your Personal Data, we will take immediate steps to investigate and mitigate the impact. 
4.    In the event of a data breach, we will:

• Assess the nature and scope of the breach, including the categories and approximate number of individuals and data records involved;
• Take necessary measures to contain and limit the breach;
• Notify the relevant data protection authority without undue delay if required by applicable data protection laws;
• Where legally required, inform affected individuals without undue delay;
• Provide clear information on the nature of the breach, its potential consequences, the measures taken or proposed to address it, and how individuals can protect themselves;
• Maintain records of all data breaches, regardless of whether notification is required.
   

5.    If you believe your personal data may have been compromised, please contact us immediately at info(at)mbandf.com.

C.   Retention of your Personal Data 
1.    We retain the Personal Data you provide us with to the extent necessary to: (i) provide you access to and use of our Site (and their functionalities, e.g. to receive newsletters), Social Media Pages and Offline Services, (ii) comply with our internal regulations, (iii) comply with our legal obligations, and (iv) to resolve a dispute or to enforce agreements we have entered into.
2.    The length of time we retain cookies and Similar Technologies depends on their purpose and is always the same, regardless of who the Personal Data relates to.
3.    When the Personal Data that we collect is no longer required for the given purpose, or in accordance with legal requirements, we destroy or delete it in a secure manner. However, we reserve the right to store the data in a depersonalized (i.e. anonymous) form following the deletion of your Personal Data.

6.    Automated-decision making 

1.    Your Personal Data is not subject to automated individual decision-making and we do not engage in profiling activities.

7.    How to contact us

1.    Should you have any questions or complaints regarding this Policy, please contact us by phone at +41 22 786 36 18 or +41 22 508 10 38; email at info(at)mbandf.com; regular mail at MB&F S.A., Route de Drize 2, 1227 Carouge, Switzerland.
_______
MB&F SA 2025