R&C CAMBODIA PRIVACY POLICY Version 1.1. 18 05 2018

CAMBODIA RESERVE & COLLECT

Privacy Policy

1.- Introduction

The website under the domain “www.shopdutyfree.com” (hereinafter the "Website" or "Reserve & Collect") is owned and operated by Dufry (Cambodia) Ltd a Dufry group company (hereinafter "Dufry", "we", "our", and "us"), with registered address at Phnom Penh International Airport, Russian Federation Boulevard, Khan Posenchey, Phnom Penh, Sangkat Kakap 12406, Cambodia with contact email address: legal@dufry.com., and is the data controller for the personal data processed in accordance with this privacy policy (the “Privacy Policy”).

This Privacy Policy governs the way we treat all the personal information you provide or that we have obtained from you, including through the Website. This data will be processed in accordance with the privacy, data protection and e-commerce laws and regulations applicable at the relevant time.

This Privacy Policy explains what information we collect and how we use it, and under what circumstances we may disclose the information to third parties. This Privacy Policy applies to all visitors to our Website. WHEN YOU ACCESS OUR WEBSITE, YOU AGREE TO THIS PRIVACY POLICY. IF YOU DO NOT AGREE TO THIS PRIVACY POLICY, OR TO ANY CHANGES WE MAY SUBSEQUENTLY MAKE, YOU MUST IMMEDIATELY REFRAIN FROM REGISTRATION, ACCESSING OUR WEBSITE AND OUR SERVICES.

When giving consent during any aspect of the registration process by selecting the confirmation box, a user expressly consents to their data being processed by Dufry for the purposes of pre booking items, sending sale information (including the electronic newsletter) on products sold by Dufry, and on the activities and services provided by Dufry, other companies in the Dufry group and third party companies with which Dufry has trade agreements (and which offer their products and services through the Website), by post, email, SMS, or any other equivalent means of electronic communication, and so that their data are processed in order to create categories and/or set up profiles for similar promotional or advertising purposes, although adapted to your profile as a user of the Dufry group’s services.

2. Use of Your Personal Information

When you choose to use the Website, we may ask you to provide some personal information, for example, when you register on the Website, when you subscribe to one of the services offered on the Website or when you place a pre-order. The personal information requested and processed includes, but is not limited to, your name, address, email address, telephone number, date of birth, etc.

Your personal information allows us to give you access to all parts of the Website and to provide all the services that you have requested. This also allows us to contact you should it be necessary after you have used the Website. We will also use and analyze the information that we receive so that we can administer, support, enhance and further our services and/or our Website.

We may also use your personal information to send you newsletters, to inform you of special offers or promotions or to ask you to participate in customer polls or to provide information regarding our services and/or our Website, unless you have expressly forbidden the use of your personal information. We strive to customize all marketing materials that we send to you, however, if you do not wish to receive this information, please let us know by sending an email to privacy@dufry.com or follow the instructions provided in each Communication (for example by clicking on the unsubscribe link).

3. Disclosure of Personal Information

Your personal information may be disclosed, shared or transferred within the Dufry group of companies. We will not transfer or disclose any of your personal information outside of the Dufry group of companies, unless it is part of a joint venture or a proposed or actual sale of all or part of the company's assets. Unless otherwise required by law, we will not share, transfer or disseminate any personal information provided by you, unless we have your consent.

4. Where Do We Store Your Personal Information?

Your personal information you have provided to Dufry will be located in a Dufry cloud based customer management database software tool located within data centres maintained in the territories of the European Economic Area (“EEA”), the purpose of which is to manage the business relationship with you, in accordance with the provisions of the local data protection laws. However, the customer relationship can be accessed or communicated to group or affiliated companies of Dufry AG.

Dufry will manage the customer relationship with you and any marketing materials can be provided, in accordance with your preferences, by Dufry as Controller.

You will be responsible for providing accurate information to ensure the authenticity of the data entered when completing a form.

5. Security and Safekeeping of Personal Information

We make use of the appropriate technical and organizational measures to protect the information you provide to us, to prevent access by unauthorized persons and illegal processing, accidental loss, destruction or damage. Such security measures may include, as the case may be, the use of firewalls and other anti-virus protection measures, encrypting, training of DUFRY staff and using access rights management systems. If we provide a password, or when you choose a password to gain access to some of the benefits offered by the Website, the safekeeping and confidentiality of the password is your responsibility, and you agree not to allow any third parties to use it. Where the Website allows online transactions, we make use of adequate security measures such as “Security Sockets Layers” (SSL) to guarantee the safety of these online transactions.

Unfortunately, transferring information over the Internet is not completely secure. Even though we do everything we possibly can to protect your personal information, we cannot guarantee the security of personal information that you disclose online. You acknowledge and accept the inherent safety implications related to the use of the Internet and cannot hold us liable for any security breaches unless we were negligent and only within the limitations set under the terms and conditions of this Website.

We only store your personal information for as long as it is necessary for the purposes described here or for as long as required by current legislation. As soon as we no longer need to retain your personal information, it will be deleted or permanently anonymized.

6. Rights to your personal information

You may exercise your right of access, rectification, cancellation and opposition as well as withdraw your consent for commercial processing of your data. We cannot, however, delete any personal information that we are required to retain under current legislation. You also have the right to withdraw your consent or to prohibit the use and processing of your personal information for direct marketing and other similar marketing purposes.

If you wish to exercise the above-mentioned rights or any other right granted to you under the relevant data protection laws, you can write to the Global Data Protection Co-Ordinator, enclosing a photocopy of your identity card or official document proving your identity, or alternatively send an email stating your name, telephone number and attaching a scan of your identity card or official document proving your identity.

Lastly, please note that DUFRY will keep your personal information strictly confidential at all times and will comply with the compulsory obligation of privacy, and to this end implements the necessary technical and organizational measures ensuring the security of your personal information, preventing its alteration, loss or unauthorized access or processing, taking into account the state of the art of technology, the nature of the information being stored and the risks to which it is exposed.

7. Who is Responsible for Your Personal Information?

DUFRY is responsible for the processing of your personal information and this responsibility is in accordance with the relevant data protection legislation. You may contact Global Data Protection Co-Ordinator, Dufry AG, Brunngaesslein 12, Basel, Basel-Stadt, CH-4052, Switzerlandper email at privacy@dufry.com.

We will review and respond to questions, requests and complaints within a reasonable time.

8. Amendments to Our Privacy Policy

Any future changes which we might make to our Privacy Policy will be published on this Website. Please read the Privacy Policy whenever you log into our Website. Should you not agree to any changes or amendments, then you should cease or stop using our Website or services.

9. Links to Third Party Websites and/or Websites

This Privacy Policy only applies to this Website and does not apply to other third party websites and/or websites that may be accessed via this Website.

Our Website may contain links to and from websites and/or the websites of our network of partners, advertisers and affiliates. These are only provided for information purposes. If you follow a link to any of these websites, please remember that they have their own privacy policies and that we do not accept any responsibility arising under their policies.

You should therefore carefully read the privacy policies of each of these third parties.

Dufry (Cambodia) Ltd 2018