Effective date: 30.07.2026

Last updated: 30.07.2026

1. Data controller and contact

This Privacy Policy explains how personal data is collected, processed, disclosed, and protected when you use the decathlon.az online store (“Site”), related services, and customer-support channels.

Data controller: “Pross Sport Retail” Limited Liability Company, TIN: 1507072131, legal address: Ashig Ali street 3C, Baku, Azerbaijan, AZ1072 (“Decathlon Azerbaijan,” “we”).

Privacy inquiries: decathlon@prosretail.az, Baku city, Azadliq avenue 15A/4, AZ1014; phone: +994 10 230 62 62; website: www.decathlon.az.

Shopify, as well as payment, hosting, analytics, communication, and logistics providers acting on our behalf in the processing of data, may act as processors or as separate data controllers depending on their respective functions.

2. Key concepts and scope

“Personal data” means any information that allows a natural person to be identified, directly or indirectly. The “data subject” is the natural person about whom personal data is collected and processed. This Policy applies to Site visitors, account holders, buyers, persons making inquiries, and marketing subscribers.

This Policy does not apply to sites and services separately operated by third parties. Please review their privacy notices before proceeding to such services.

3. Data we collect

• Identity and contact data: first and last name, phone number, email, delivery and billing address.

• Account data: login credentials, account preferences, and loyalty program data (where applicable). Passwords are stored in protected form; we do not have visibility of your plain-text password.

• Order and payment data: order contents, amount, delivery, return, warranty, and payment status. Full card details are, as a rule, processed by the payment provider; this section should be updated if the actual integration differs.

• Communication data: inquiries, complaints, calls and correspondence, product reviews, and photos/videos you voluntarily submit.

• Technical and usage data: IP address, device and browser information, log records, pages viewed on the Site, searches, clicks, and cookie identifiers.

• Marketing preferences: consent, opt-out, and preference records for commercial communications.

• Data required by law: information necessary for tax, accounting, fraud prevention, and the fulfilment of legal requirements.

We do not intentionally request special-category or biometric data for ordinary sales activity. Where processing such data becomes necessary, the separate written consent required by law and additional safeguards will apply.

4. Sources of data

• directly from you — through order, registration, inquiry, review, subscription, and campaign forms;

• from the Site and your device — through strictly necessary cookies, log records, and analytics/advertising technologies to which you have consented;

• from service providers — payment, delivery, Shopify apps, customer support, and fraud-prevention services;

• from public sources permitted by law and from competent state authorities.

5. Purposes of processing and legal basis

We process data only for predetermined, lawful, and declared purposes, and only to the extent proportionate to those purposes:

• accepting orders, confirming payment, delivery, returns, warranty, and providing customer service — based on the information you provide in writing and on the necessity of performing the transaction;

• managing your account, loyalty program, and inquiries — based on the information you provide and, where required, your consent;

• accounting, tax, consumer-inquiry handling, and other legal obligations — on the basis of legislation;

• information security, fraud prevention, and protection of rights — in cases provided by law and, where necessary, on the basis of consent;

• Site analytics and improvement of functionality — based on your separate choice/consent for strictly necessary cookies and non-essential technologies;

• email, SMS, and other direct marketing — based on your separate, voluntary, and revocable consent.

Important: Failure to provide the data necessary for order fulfilment may make it impossible to place the order or provide the relevant service. Consent to marketing and non-essential cookies is not a condition for receiving service.

6. Consent and its withdrawal

Where consent is required, we obtain it by providing information on the specific purpose, categories of data, operations, validity period, and the conditions for withdrawal and retention/destruction, and we keep evidence of it. Consent must be obtained separately from other terms, through a clear choice.

You may withdraw your consent via email to decathlon@prosretail.az, through your account settings, or via the cookie panel on the Site. Withdrawal does not affect the lawfulness of processing carried out before that point; however, we stop future consent-based processing and disclosure of data as required by law.

7. Cookies and similar technologies

Cookies strictly necessary for the operation of the Site enable functions such as security, the shopping cart, sessions, and the checkout flow. Analytics, personalization, and advertising cookies are activated only in accordance with your choice in the cookie panel. The cookie panel must offer equally accessible options to give consent, decline, and change your choice later.

The category, purpose, and validity period of the cookies used are shown in the cookie preference panel on the Site. Through that panel and your browser settings, you can decline non-essential cookies, change your preferences, and delete or block cookies; this may affect some functions of the Site.

8. Disclosure of data to third parties

We may disclose personal data, only to the extent necessary for the purpose, to the following recipients:

• Shopify and the app/hosting providers that operate the Site;

• banks and payment service providers;

• courier, warehouse, logistics, returns, and customer-support partners;

• analytics, advertising, and communication partners, where you have given consent;

• professional advisors, auditors, insurers, and parties involved in a corporate transaction;

• courts, law-enforcement, and other state authorities, where there is lawful authority and a request.

Except for the exceptions provided by law, the written consent required for disclosing confidential personal data to a third party is obtained. Contracts with service providers set out confidentiality, purpose limitation, security, and data return/destruction terms.

9. Cross-border transfer

Use of Shopify, Decathlon group systems, and other service providers may require data to be processed outside the Republic of Azerbaijan. Where such a transfer is intended, the data subject is given the information required by law regarding the recipient, destination country, purpose, and safeguards applied, and the necessary consent is obtained.

Cross-border transfer is carried out only in accordance with Article 14 of the Law of the Republic of Azerbaijan “On Personal Data.” Where the recipient country does not provide an equivalent level of legal protection, transfer is not carried out unless the cases provided by law and the data subject’s required consent are secured. Transfers that pose a threat to national security are not permitted.

10. Retention and destruction

We do not retain data for longer than necessary for the purpose and for the fulfilment of legal obligations. Once the purpose has been achieved and the need for retention has ceased, data is destroyed or irreversibly anonymized in accordance with the law.

• order, payment, and accounting records: for the period provided by tax, accounting, consumer-rights, and limitation-period legislation;

• account data: for as long as the account is active, and after account closure only for the period necessary to fulfil legal obligations and defend legal claims;

• customer inquiries and complaints: until the inquiry is fully resolved, and thereafter for the period necessary for legal accountability and possible legal claims;

• marketing consent and opt-out records: until consent is withdrawn, and thereafter for the period necessary to prove the opt-out and prevent future communications;

• cookies and technical logs: limited to the function of the cookie, its security purpose, and the validity period shown in the cookie preference panel on the Site.

11. Security

We apply organizational and technical measures appropriate to the nature of the data and the risk involved: access restrictions, authentication, encryption, backups, logging and monitoring, employee and contractor confidentiality, incident management, and periodic reviews. As no transmission over the internet is completely secure, we take reasonable measures required by law to mitigate the relevant risks.

12. Statutory limitation of liability

This section applies only to the maximum extent permitted by the legislation of the Republic of Azerbaijan. No provision of this Policy removes liability whose exclusion or limitation is prohibited by law, the data subject’s mandatory rights, or the powers of competent state authorities.

Unless the legislation provides otherwise, “Pross Sport Retail” LLC is liable only for actual, direct damage that has a direct causal link to its culpable act or omission and whose amount is substantiated by credible evidence. Liability for lost profit and for indirect, incidental, special, and consequential damages is excluded to the maximum extent permitted by law.

To the extent permitted by law, we are not liable for consequences arising from:

• the user providing incorrect, incomplete, or outdated information;

• the user’s failure to properly protect their account credentials, password, device, or means of communication, or enabling a third party to use them;

• malfunction or outage in internet, telecommunications, electricity, banking, payment, Shopify, courier, or other independent third-party systems beyond our reasonable control;

• lawful actions carried out on the basis of the user’s separate consent, instruction, or voluntary disclosure;

• disclosure of data pursuant to a lawful request, court act, or mandatory instruction of a competent state authority;

• force majeure, cyberattacks, and other events that could not reasonably have been prevented in advance — to the extent the company has taken the security measures required by law;

• the content, security, and privacy practices of third-party sites accessed via links on the Site that we do not control.

The data subject must take reasonable measures to prevent the increase of possible damage and must promptly notify decathlon@prosretail.az of any suspicious circumstance relating to account or data security. This obligation does not limit the data subject’s statutory rights.

If any limitation of liability is held invalid in a particular case, this does not affect the remaining provisions of this section; the invalid provision is applied with the closest and broadest protective meaning permitted by law.

13. Your rights and how to exercise them

To the extent provided by law, you have the right to:

• find out whether data about you exists, and learn the purpose, methods, sources, users, and recipients of its processing;

• obtain free access to your data and request a copy of it;

• request correction of inaccurate or incomplete data, and the deletion/destruction of unlawfully processed data;

• object to the collection and processing of your data and withdraw your consent;

• challenge, in the manner provided by law, a decision made through information technology that affects your interests;

• complain to a competent state authority or the courts, and claim compensation, where your rights have been violated.

To submit a request, write to decathlon@prosretail.az or send a request in the form required by law to Baku city, Azadliq avenue 15A/4, AZ1014. We may request information necessary and proportionate to verify your identity and authority. A response is provided no later than 7 business days from the date the request is received; where it is necessary to contact a third party, this period may be extended by a further 7 business days. Where a request is declined on lawful grounds, a reasoned response is provided within 5 business days.

14. Minors

The Site is not directed at children, and we do not intentionally collect data from minors. Where required by law, consent must be given by a parent or legal representative. If you believe that such data has been unlawfully collected, please contact us immediately.

15. Registration of the information system and compliance

Where required by legislation, the information system for personal data is registered with the competent state authority, and the collection and processing of data does not begin before registration is completed. Any exemption from registration must be confirmed by a separate legal assessment and documentation.

16. Changes to this Policy

This Policy may be updated to reflect legal, technical, or operational changes. We will provide a clear notice on the Site of any significant changes and will obtain any new consent required by law for a new purpose or transfer. The last-updated date is shown at the top of the page.

17. Applicable law

This Policy is interpreted in accordance with the legislation of the Republic of Azerbaijan, including the Laws “On Personal Data,” “On Electronic Commerce,” “On Information, Informatization, and Protection of Information,” and other applicable legal acts. Disputes are resolved by the competent authorities and courts of the Republic of Azerbaijan in accordance with the jurisdiction established by law.