UK/EU PRIVACY POLICY ADDENDUM



This Privacy Policy was last updated on November 7th, 2025.

This UK/EU Privacy Policy applies where UK and/or EU data protection laws apply to our processing of your personal information and supplements the main (global) Groupe Dynamite Inc. Privacy Policy. We suggest reading our global Privacy Policy in conjunction with this UK/EU Privacy Policy. Terms defined in the global Privacy Policy shall also apply in this UK/EU Privacy Policy unless specified otherwise. If there is any inconsistency in wording between this UK/EU Privacy Policy and the global Privacy Policy, the wording in this UK/EU Privacy Policy takes precedence.

Garage International (UK) Ltd (“Garage UK”), an entity wholly owned by Groupe Dynamite Inc., is the data controller responsible for your personal information under this Privacy Policy.

If you have any questions on how we handle your personal information or if you want to exercise your privacy rights, you can reach out to our Data Protection Officer at any time:

Data Protection Officer
Garage International (UK) Ltd
5592 Ferrier St, Mount Royal, Quebec H4P 1M2
Email: privacy@garageclothing.com

1. Purpose and Lawful Basis of Processing

We collect various types of personal information from and about you to provide and improve our Services, as outlined in our global Privacy Policy. Each collection and processing activity is based on a lawful ground as required by applicable data protection laws, including the General Data Protection Regulation (the UK or EU GDPR, whichever is applicable). Below, we explain what information we collect, the purposes for which we use it, and the lawful basis we rely on for that use.

Information You Provide to Us

  • Contact Data
    • Purpose:To register you as a new customer, assist you in creating, registering and managing your account, fulfill orders, provide customer service and administer and manage our contractual relationship with you. We may also enable you to partake in contests.
    • Lawful Basis:
      • Contractual for the fulfillment of orders and management of your account; or
      • Legitimate Interest for anything not necessary to perform the contract, including customer service enquiries, to manage our relationship with you, to study how our customers use our services and to grow and market our business
  • Profile Data
    • Purpose: To manage your online account, personalize your experience based on your interests, enable participation in promotions, marketing events as well as to track behaviour surrounding our events and promos
    • Lawful Basis:
      • Contract for any data collection to do with your account;
      • (Where required) consent for the personalization (including promos and events) based on interests (for further detail, see Automatic Data Collection below); or
      • Legitimate interest for understanding customer behaviour
  • Communications
    • Purpose: To manage pre- and after-sale service, to address enquiries or complaints, send administrative (and related) messages and to improve customer service for our customers
    • Lawful Basis:
      • Contract for any after-sale service enquiries or enquiries relating to your account; or
      • Legitimate interest for customer service improvement, providing requested information, address complaints, customer sentiment analysis and analysing published reviews and feedback or suggestions provided by you
  • Call recordings
    • Purpose: To record telephone calls when you contact our customer services team by phone.
    • Lawful Basis:Legitimate interests to establish the existence of facts relevant to the business (e.g. to keep a record of instructions given over the phone) and to monitor that our training and quality standards are being maintained
  • Research Data
    • Purpose: To improve products/services and understand consumer behaviour
    • Lawful Basis:Consent as it is voluntary and consent is obtained to participate in research activities, including for screen recordings and captures
  • Payments and Transactional Data
    • Purpose: To process payments, fulfill orders and maintain transaction records
    • Lawful Basis:Contract and Legal Obligation
  • Marketing Data
    • Purpose: To send you marketing communications (including sending you offers, discounts, newsletters and similar marketing) in accordance with your preferences and to measure the effectiveness of our marketing
    • Lawful Basis:
      • Consent (if required by law); or
      • Legitimate interests to study how customers (and potential customers) engage with us and to grow and market our business, when consent is not required by law.
  • Surveillance of Website
    • Purpose: To monitor use for security and fraud prevention
    • Lawful Basis:Legitimate interests to protect the business
  • Loyalty Programme Data
    • Purpose: To administer your membership, manage your account, track your points and benefits and facilitate the redemption of benefits.
    • Lawful Basis:
      • Contractual for the purposes of fulfilling your and our contractual commitments; or
      • Legitimate interests for the purposes of managing the customer relationship and growing and marketing our business.
  • All Data
    • Purpose: TTo enable us to comply with any legal or regulatory requirements and otherwise to meet applicable requirements of any relevant regulator or competent authority. To enforce legal rights or defend or undertake legal proceedings
    • Lawful Basis:
      • Legal Obligation; or
      • Legitimate interests for the purpose of protecting our business and establishing, exercising or defending our legal rights.

Third- Party Sources

  • Public Sources
    • Purpose:To understand market trends and personalize marketing efforts
    • Lawful Basis:Legitimate Interest to study market trends, how customers (and potential customers) engage with us and to grow and market our business
  • Business and Marketing Partners
    • Purpose: To fulfill orders made through third-party marketplaces, to conduct joint marketing efforts and campaigns and analyze the effectiveness of said joint campaigns
    • Lawful Basis:
      • Contract for fulfilling of orders;
      • Legitimate interest for joint marketing efforts and campaigns with partners (who have themselves confirmed their lawful basis for collection); or
      • Consent, if necessary
  • Data Providers
    • Purpose:For market segmentation, targeted advertising and market research
    • Lawful Basis:Legitimate interest for understanding our market better to provide better services
  • Users of the Service
    • Purpose: To fulfill orders for gift recipients, send product links or process friend referrals
    • Lawful Basis:
      • Contract for fulfilling of orders for gift recipients; or
      • Legitimate interest of us and our users for sending of product links and friend referrals and our legitimate interest to ensure it occurs (including to grow and market our business)
  • Third-Party Platforms
    • Purpose: To facilitate account creation and/or login, to personalize your experience and conduct market analysis
    • Lawful Basis:
      • Consent (to agree to connect to us through a third-party platform account and where required); or
      • Legitimate interest for market insight so that we can improve our services

Automatic Data Collection

  • Device Data and Online Activity Data
    • Purpose:To improve and optimize the user experience, analyze website traffic and usage, marketing and advertising, ascertain your preferences, ensure the proper security of the website and/or app and also to prevent fraud
    • Lawful Basis:
      • Consent (where required by law); or
      • Legitimate interest to ensure the website is operating efficiently, providing a proper user experience, analytics, to study how customers (and visitors) use our website(s), to grow and market our business, fraud prevention and for the website’s security
  • Security Camera Footage and Photos
    • Purpose:For security, crime and loss prevention purposes
    • Lawful Basis:Legitimate interest to protect our customers, staff and assets from theft, damage and other security incidents. Footage is retained for a limited period unless it is required for investigation or to meet legal obligations.
  • Information about Others
    • Purpose:
      • To fulfill a contract with the purchase by delivering the goods or gift card to the intended recipient
      • To facilitate the sharing of information requested by our customer
    • Lawful Basis:
      • Legitimate interest for our customers to share products they find interesting with their network and for us to grow and market our business.
      • Contract for fulfilling orders (e.g. of gift cards)

2. Cookies and Similar Technologies

Our website uses cookies and similar technologies to distinguish you from other users. Please refer to the Cookie and Similar Technologies section in our global Privacy Policy for more information as to the way in which we use cookies, and similar technologies, on our website.

3. Sharing Your Personal Information

As outlined in section How Does Groupe Dynamite Inc. Share Personal Information with Third Parties? of our global Privacy Policy, we share your personal information with certain third parties for the purposes and lawful bases specified in section 1 above.

4. What Are Your Data Rights?

Where UK or EU data protection laws apply, you have the following rights in respect of your personal information that we hold:

Right to Information and Access: You have the right to be informed about whether we process your personal information and how we collect, use, and disclose your personal information. You also have the right to access the personal information we hold about you.

Right to Rectification: If you believe that any personal information we hold about you is incorrect or incomplete, you have the right to request its correction.

Right to Erasure: You can request the deletion of your personal information under certain circumstances. Please note that this right is not absolute and may be subject to specific exceptions under the law (e.g. compliance with a legal obligation, to defend legal claims, etc.).

Right to Data Portability: You may have the right, in some circumstances, to receive your personal information in a structured, commonly used, and machine-readable format, and you may have the right to transmit that data to another entity without hindrance from us, if it concerns personal information you provided to us based on your consent or is necessary for the performance of a contract and is carried out by automated means.

Right to Restriction of Processing: You have the right to request that processing of your personal information be restricted in certain circumstances such as: (i) your contesting of the accuracy of your personal information; or (ii) we no longer need your personal information for the purpose but require it for legal claims.

Right to Withdraw Consent: You have the right to withdraw your consent to the processing of your personal information at any time for processing that is based solely on your consent (without affecting the lawfulness of our processing prior to you having withdrawn your consent).

Right to Object: You also have a right, in certain circumstances, to object to processing of your personal information based on our legitimate interests. You have an absolute right to object to direct marketing (by clicking unsubscribe or using any of the other methods specified in our global Privacy Policy).

Right Related to Automated Decision-Making and Profiling: You have the right not to be subject to a decision based solely on automated processing, which produces legal (or similarly significant) effects concerning you, unless otherwise authorized by law. In these cases, you have the right to request human intervention to express your point of view and/or contest the decision.

Right to Lodge a Complaint: If you believe that we have processed your personal information in violation of applicable law, you have the right to lodge a complaint with your national data protection authority. If you are in the UK, information on how to contact the the Information Commissioner’s Office (ICO) is available at www.ico.org.uk. If you are located in the EU, further information about how to contact your local data protection authority is available at http://ec.europa.eu/justice/data-protection/bodies/authorities/index_en.htm.

To exercise these rights, please contact our Data Protection Officer (using the contact details provided above). Please note that we may ask you to verify your identity before responding to such requests and that a fee may be applicable for manifestly unfounded or excessive requests. We will aim to respond to your request within one month. If we require an extension, however, we will communicate this with you.

Please note also that the above rights are not absolute, and we may be entitled to refuse requests, wholly or partly, where exceptions under the applicable law apply. Note that we may refuse to comply with a request (or charge a fee as mentioned above) if it is deemed to be manifestly unfounded or excessive.

5. International Data Transfer

Garage International (UK) Ltd, a UK company, is the data controller in respect of your personal information. However, your personal information will also need to be process by our parent company, Groupe Dynamite Inc., a Canadian-based company, which manages our systems. Personal information collected through our Services, including our websites, will therefore be processed and maintained in Canada. However, it may also need to be processed in other countries (such as the United States) where our service providers operate.

By using our Services, you understand and acknowledge that your personal information may be transferred to and processed in countries outside of the jurisdiction you are in. While the laws of other countries regarding the collection, use, disclosure and retention of personal information may differ from those in the country you are in, we are committed to upholding the standards of protection outlined in the Privacy Policy through the application of appropriate safeguards.

If you are located in the UK or European Economic Area (“EEA”), your personal information may be transferred outside of the UK and EEA respectively to a country which is not recognized by the UK or European Commission as ensuring an adequate level of protection for personal data (note that, as at the date this privacy policy was updated, Canada is deemed adequate by the UK and European Commission). These international transfers of your personal information will be made pursuant to appropriate safeguards, such as standard contractual clauses adopted by the European Commission and UK government (as applicable). If you wish to enquire further about the safeguards used, please contact us using the details set out at the end of this privacy policy.

6. Marketing Communications

From time to time, we may contact you with information about our products, including sending you marketing messages (by email or text). For some marketing messages, we may use personal information we collect about you to help us determine the most relevant marketing information to share with you.

We will only send you marketing messages if we have your consent or, if consent is not required under applicable law, you have not opted out of receiving messages from us. You can withdraw your consent, or opt out of receiving further communications at a later date, by clicking on the unsubscribe link contained in our marketing emails or following any of the alternative methods set out in our global Privacy Policy.

Unsubscribing from marketing emails will not unsubscribe you from system, order processing, service update, legal or similarly related notifications which we may need to send you.

7. Data Retention

We will only retain your personal information for as long as reasonably necessary to fulfil the purposes for which it was collected. To determine the appropriate retention period for personal information, we consider the amount, nature and sensitivity of the personal information, the potential risk of harm from unauthorized use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, as well as the applicable legal, regulatory, tax, accounting or other requirements.

8. Children

Garage UK’s Services are not directed to children under the age of 16. We do not knowingly collect personal information from children who are under 16 years of age without the consent of their legal guardian. If you are a parent or legal guardian and believe that we have collected personal information from a child under 16 years old without your consent, please immediately contact Garage UK's Data Protection Officer using the contact details provided in this addendum. If Garage UK learns that it has inadvertently collected personal information from a child under 16 years of age without the consent of their legal guardian, Garage UK will use reasonable efforts to promptly delete that information from its systems (except to the extent that the retention of the personal information is required or permitted by applicable law).

9. Job Applications

If you apply for a job with us, we will use and disclose your personal information to administer and process your application (and keep you updated as necessary), evaluate your qualifications, conduct background checks where permitted, and for related recruitment matters.

If you are hired, your personal information will then be used, disclosed, and retained in accordance with our separate Employee Data Use Notice.

10. Contacting Garage International (UK) Ltd’s Data Protection Officer

Please let us know if you have any concerns or complaints about this Privacy Policy and how we process personal information by emailing our Data Protection Officer at privacy@garageclothing.com. We take your concerns seriously and will take the necessary actions to resolve them.