On Group Privacy Notice

We are On AG with our registered office at Förrlibuckstrasse 190, 8005 Zurich. This Privacy Notice sets out how On AG or any of our affiliates ("On", "we", "us", "our") process your personal data. This Privacy Notice applies whenever we process any personal information about you as a customer or individual with whom we have a business relationship whether this is via our website or mobile application (our "App"). We collect your personal data as provided by you to us directly, or where it is collected via our website, App or a third party including when you sign in to our App using a third-party account. In the event we process your personal data under any other circumstances we will ensure that a privacy notice is provided to you prior to processing your personal data. In this Privacy Notice the term "Data Protection Legislation" means all applicable legislation relating to privacy or data protection in force from time to time, including (i) the EU General Data Protection Regulation ("GDPR") and the GDPR as it forms part of the domestic law of the United Kingdom; (ii) the Swiss Federal Data Protection Act and Ordinance ("FDPA"); (iii) the California Consumer Privacy Act ("CCPA"); and (iv) China's Personal Information Protection Law ("PIPL"). Please note that some privacy rights and obligations may differ in certain locations based on applicable Data Protection Legislation. We have included supplemental information for certain jurisdictions at the end of this Privacy Notice. CHANGES TO THIS PRIVACY NOTICE Any changes we make to this Privacy Notice in the future will be posted on this page of our website. We strongly encourage users to check our Privacy Notice each time they use our website or our App. However, any material changes to this Privacy Notice will be notified to you through an appropriate method. WHAT PERSONAL DATA DO WE PROCESS, WHY AND FOR WHAT PURPOSES Website Visitors and App Users - Personal data that you provide to us when you contact us, for example your name, contact details (home address, email address and telephone number), details of your query and any extra information that you choose to tell or provide to us ("Communication Data"); and - Online identifiers (including IP address), device information and information about your visit to our website or App (including the full Uniform Resource Locators (URL)), clickstream to, through and from our website or App (including date and time), length of visits to certain pages, page interaction information (such as scrolling, clicks, and mouse-overs) and methods used to browse away from the page) ("Device and Web Data") To provide you with a safe, smooth, efficient, and customised experience on our website or App As necessary for our legitimate interests in providing, running and administering our website or App When legally disclosed to us When required under Data Protection Legislation, we will obtain your consent for processing such data. - Device and Web Data To ensure that the content on our website or App is presented in the most effective manner for you and your device As necessary for our legitimate interests in providing you with content relevant to you in the most optimum format When required under Data Protection Legislation, we will obtain your consent for processing such data. - Device and Web Data To administer our website and App and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes As necessary for our legitimate interests in evaluating, developing and improving our services When required under Data Protection Legislation, we will obtain your consent for processing such data. - Device and Web Data As part of our efforts to keep our website and App safe and secure As necessary for our legitimate interests in maintaining the security of our website and App When required under Data Protection Legislation, we will obtain your consent for processing such data - Device and Web Data By using third-party tags to analyse how you have interacted with the links contained in our newsletter Where you have provided us with your consent to do so. For further information, please refer to our Cookies Notice - Communication Data To provide you with the information and services that you request from us, including when you sign up to our events As necessary for our legitimate interests in running and administering our business, providing you with information you have requested or responding to queries from you When legally disclosed to us When required under Data Protection Legislation, we will obtain your consent for processing such data. - Your name, shipping and billing address, telephone number, date of birth, gender, social media username or handles (where you contact us via social media), imagery and email address ("Customer Data") To process your order As necessary to fulfil our obligations under our contract with you. As necessary for our legitimate interests in providing our services to you - Customer Data To register and maintain your account As necessary for our legitimate interests in providing our services to you When legally disclosed to us When required under Data Protection Legislation, we will obtain your consent for processing such data. - Customer Data as well as products viewed or purchased on our website or App (if applicable) ("Commercial Data") To communicate with you about your account or order or our website or App and to handle your customer service requests As necessary to fulfil our obligations under our contract with you. As necessary for our legitimate interests in responding quickly and effectively to your requests - Customer Data Where we communicated with you via our website chatbot which may, in some circumstances, be powered by AI As necessary for our legitimate interests in responding quickly and effectively to your requests When legally disclosed to us When required under Data Protection Legislation, we will obtain your consent for processing such data. - Commercial Data as well as details that you provide to us about your interests and your communication preferences as well as inferences drawn in order to create a profile about you to reflect your preferences, characteristics, behaviour and attitude ("Inferences and Preferences") Inferences and Preferences data we collect may include language preference and category of products interested in (for example, male or female styles) se note that we do not use special category data to form the basis of the Inferences and Preferences data referred to above. In addition, the Inferences and Preferences data referred to above shall not constitute special category personal data To analyse preferences, trends or statistics As necessary for our legitimate interests in providing you with information relevant to you and your requirements When required under Data Protection Legislation, we will obtain your consent for processing such data. - Customer Data; Commercial Data; and Inferences and Preferences. To send you marketing communications in line with your specified preferences including where you are a Member. You can unsubscribe at any time by clicking on the “unsubscribe” link at the bottom of any newsletter that you receive. You may also contact our customer service via https://customer-servi ce.on-running.com/dech/contact_us. If you decide not to receive our newsletters, we may still send you service related communications Where you have provided us with your consent to do so - Customer Data; and Commercial Data. To allow you to leave a review of our products and to display your review and any other associated content on our website, App and our social media platforms Where you have provided us with your consent to do so - Images of you that are captured on CCTV systems ("Security and Monitoring Data") Security and monitoring access to our retail stores As necessary for our legitimate interests in ensuring the security of our shops and other premises As allowed by applicable Data Protection Legislation. - Your name and work contact details and any other details that you may choose to provide to us ("Business Contact Data"); and Financial Data To maintain our relationship with you or your employer As necessary for our legitimate interests in administering our relationship with individuals with whom we have a business relationship and for the operation of our business When legally disclosed to us When required under Data Protection Legislation, we will obtain your consent for processing such data. - Business Contact Data To issue or pay invoices As necessary to fulfil our obligations under our contract with you

AUTOMATED DECISION MAKING AND PROFILING If you are a customer, website visitor or App user we use automated decision making and profiling in limited circumstances for the purposes set out above. However, such automated decision-making or profiling will never be used in circumstances where it may have a legal or similarly significant impact on you. SHARING YOUR PERSONAL DATA - Communication Data On Affiliates To ensure your request is processed by the appropriate party in accordance with your reasonable expectations As necessary for our legitimate interests in processing your request and ensuring the appropriate party responds appropriately to you Third party service providers To ensure your request is processed by the appropriate party in accordance with your reasonable expectations As necessary for our legitimate interests in processing your request and ensuring the appropriate party responds appropriately to you Regulators or other authorities Where we are required to do so to comply with our legal obligations Where we share personal data in order to comply with our legal obligations or to defend legal claims made against us Third party advertising providers To provide you with personalised advertisements from specific third party providers Where we have obtained your consent to do so. For further information please refer to our Cookies Notice - Device and Web Data On affiliates To administer our website and App and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes As necessary for our legitimate interests in: ● providing, running and administering our website and App; providing you with content relevant to you in the most optimum format; ● evaluating, developing and improving our services; and ● maintaining the security of our website and App Third party service providers To administer our website and App and for internal operations, including troubleshooting, data analysis, testing, research, statistical and survey purposes We do this as necessary under our legitimate interest to: ● providing, running and administering our website and App; ● providing you with content relevant to you in the most optimum format; ● evaluating, developing and improving our services; and ● maintaining the security of our website and App Regulators or other authorities Where we are required to do so to comply with our legal obligations Where we share personal data in order to comply with our legal obligations or to defend legal claims made against us - Customer Data; Commercial Data; and Inferences and Preferences. On Affiliates ● To provide joint content and services ● As necessary for our legitimate interests in providing our services to you ● To improve our products and services ● As necessary for our legitimate interests in providing our services to you ● To send you marketing communications in line with your specified preferences including where you are a Member ● Where you have provided us with your consent to do so ● As necessary for our legitimate interests in providing our services to you (where you are a business customer) ● Third party service providers (including, without limitation, postal service providers) ● To provide our services ● As necessary for our legitimate interests in providing our services to you

● To improve our products and services ● As necessary for our legitimate interests in providing our services to you ● To send you performance surveys and questionnaires ● As necessary for our legitimate interests in improving your customer experience ● Where you have indicated that you wish for us to receive communications from third party service providers ● Where we have obtained your consent to do so - Customer Data; Commercial Data; and Security and Monitoring Data. ● Professional advisors, such as accountants, lawyers or auditors ● Where we are required to do so to comply with our legal obligations or to defend or protect our rights ● Where we are required to do so to comply with our legal obligations or to defend or protect our rights - Customer Data; Commercial Data; and Security and Monitoring Data. ● Regulators or other authorities ● Where we are required to do so to comply with our legal obligations or to defend or protect our rights ● Where we share personal data in order to comply with our legal obligations or to defend legal claims made against us - Customer Data; Commercial Data ● Third parties as part of a corporate transaction ● As part of a corporate transaction, for example if it is proposed that we are to merge with or be acquired by another business in the future ● As necessary for our legitimate interests in the context of a corporate transaction - Business Contact Data. On Affiliates ● To maintain our relationship with you ● As necessary for our legitimate interests in maintaining our relationship with you Third party service providers ● To maintain our relationship with you ● As necessary for our legitimate interests in maintaining our relationship with you Professional advisors, such as accountants, lawyers or auditors ● Where we are required to do so to comply with our legal obligations or to defend or protect our rights ● Where we share personal data in order to comply with our legal obligations or to defend legal claims made against us Regulators or other authorities ● Where we are required to do so to comply with our legal obligations or to defend or protect our rights ● Where we are required to do so to comply with our legal obligations or to defend or protect our rights Third parties as part of a corporate transaction ● As part of a corporate transaction, for example if it is proposed that we are to merge with or be acquired by another business in the future ● As necessary for our legitimate interests in the context of a corporate transaction

Separate consent: When required by Data Protection Legislation, we will obtain your separate consent prior to sharing your personal data. LINKS TO OTHER SITES Our website and App may contain links to other websites. On is not responsible for the privacy policies of third-party websites to which links are provided. You should check the privacy policies on these sites before providing any personal data. HOW WE PROTECT YOUR PERSONAL DATA On takes all reasonable steps to keep your personal data secure and confidential. In particular, we maintain appropriate physical, organisational and technical measures so as to prevent any loss, misuse, unauthorised access, disclosure, or modification of your personal data. For more information, please contact us at: dpo@on-running.com. HOW LONG WE KEEP YOUR PERSONAL DATA We will only keep your personal data for as long as it is required for the purposes for which it was collected, or as required to comply with applicable law or to defend or enforce our legal rights. WHERE DO WE STORE YOUR PERSONAL DATA Your personal data is stored in the European Economic Area (Ireland). We may transfer your personal data to a recipient based in a country outside of the UK, China, and/or European Economic Area ("EEA"). Where we do so, we will ensure that such transfer is in accordance with our obligations under Data Protection Legislation. If you would like more details about the safeguards we rely on, please contact us using the contact details set out below. YOUR RIGHTS IN RELATION TO YOUR PERSONAL DATA Under Data Protection Legislation you may have a certain rights available, namely the right to: - access your personal data; - correct incomplete/ inaccurate data; - erase the personal data we hold about you; - restrict how we handle your personal data; - ask us to transfer your personal data to a third party; - object to how we process your personal data; and - withdraw your consent at any time. However, please note that some of these rights may not always apply, as there are sometimes requirements and exemptions which may mean we need to keep processing the personal data or not disclose it, or other times when the rights may not apply at all. You also have the right to complain to the regulator about On's information rights procedures. Where you are in the EU, you may contact your local Supervisory Authority - a full list of Supervisory Authorities in the EU can be found here. In the UK, the relevant regulator is the ICO and you can make your complaint via the ICO's website here. In Switzerland, the relevant regulator is the FDPIC and you can make your complaint via the FDPIC's website here. If you are a resident of California, please see Additional Information for Individuals Whose Personal Information is Subject to the CCPA below. COOKIES On set and access cookies and similar technology on your device to obtain information about how you access and use our website and App. We use the word "cookie" in this Privacy Notice to refer to all technologies that collect information in this way including our use of tags in the newsletters we send to you in line with your preferences. For full information about On's use of cookies, please refer to our Cookie Notice. Your browser settings may allow you to automatically transmit a “Do Not Track” signal to online services you visit. Note, however, there is no industry consensus as to what site and app operators should do with regard to these signals. Accordingly, unless and until the law is interpreted to require us to do so, we do not monitor or take action with respect to “Do Not Track” signals. For more information on “Do Not Track,” visit http://www.allaboutdnt.com. CONTACT US Should you have any questions or concerns relating to this Privacy Notice or the processing of personal information we hold about you, please contact us: ▪ By post: On AG, DPO, Förrlibuckstrasse 190, 8005 Zurich, Switzerland ▪ By email: DPO@on-running.com

Additional Information for Individuals Whose Personal Data is Subject to Swiss Data Protection Legislation This Privacy Notice has been drawn up with a view to the Data Protection Legislation, including the GDPR and the Swiss FDPA. While both legislations are fairly similar, there are some notable differences that we want to explain to help you navigate and understand this Privacy Notice more easily. For instance, the Privacy Notice includes references to the "lawful basis" for our processing. A lawful basis is a requirement under the GDPR, but not under the FDPA. As such, when reading through the Privacy Notice you may disregard the lawful bases explained, or take it as further information about the reasons for us to process your personal data. Another difference is that the FDPA requires controllers to state the countries where your personal data may be transferred. As noted above, in the Section "WHERE DO WE STORE YOUR PERSONAL DATA", your personal data may be transferred to recipients outside Switzerland, including in the UK and in the European Economic Area ("EEA", which includes the EU member states and Iceland, Norway and Liechtenstein). However, recipients may be located elsewhere, for example in all locations where On is present (see https://culture.on.com/where-we-are), but also in other countries, for example where we have third party service providers, or where these use other providers. As such, and as with other global brands, your personal data may be transferred globally, but always in accordance with our obligations under the applicable Data Protection Legislation. Additional Information for Individuals Whose Personal Data is Subject to US Data Protection Legislation For customers residing in the USA: Further to On's rights as outlined in the Privacy Notice, On reserves the right to send you marketing communications by direct mail. In addition, we might share, sell or exchange your personal information with other marketers for their own marketing or commercial purposes or we might receive your personal information from other marketers for our own marketing or commercial purposes. As a part of our commitment to your privacy, On supports and adheres to the guidelines and practices adopted by the Direct Marketing Association's "Privacy Promise to American Consumers." We have agreed to (1) provide customers with notice of their ability to opt out of information rental, sale, or exchange with other marketers; (2) honor customers' requests not to share their contact information with other marketers; and (3) honor customers' requests not to receive mail, telephone, or other solicitations from On. You have privacy rights for the information we process about you. You can choose to opt-out of third party sharing or selling and object to our use of your personal information for online behavioral marketing and advertising purposes, delete your personal information, or access your personal information. To do so contact us using the details set forth at the end of this Privacy Notice. Additional Information for Individuals Whose Personal Information is Subject to the CCPA Residents of the state of California have certain rights with respect to their personal information pursuant to the CCPA as further described in this section. Please note that the rights under the CCPA do not apply to (i) On personnel or job applicants seeking opportunities at On or (ii) personnel working on behalf of business partners with whom we are conducting business. Definitions. The following definitions under the CCPA apply to this section: ● Personal information. means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to you or your household. ● Sensitive personal Information. This is information such as your social security number, driver’s license number, state identification card, passport number, account log-in and password, financial account and password, debit or credit card number and access code, precise geolocation information, race, ethnic origin, religious or philosophical beliefs, union membership, the content of your mail, email or texts other than those communications you have with us, genetic data, biometric information, health information, or information that concerns your sex life or sexual orientation. ● Sell, sale, or sold. This means the selling, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or other means, your personal information to a third party for money or other valuable consideration. ● Share, shared, or sharing. This means the sharing, renting, releasing, disclosing, disseminating, making available, transferring, or otherwise communicating orally, in writing, or other means, your personal information to a third party for cross-context behavioral advertising, whether or not for monetary or other valuable consideration. Your Legal Rights. Under the CCPA you may have the right to: ● Right to Know. You have the right to request that we disclose, subject to certain exceptions, free of charge, information concerning (1) the categories and specific pieces of personal information we collect about you (and, if applicable, sell or otherwise disclose to a third party), (2) the categories of third parties with whom we have shared, sold, or disclosed your personal information, including the business or commercial purpose for said sharing, selling, or disclosure, and (3) the categories of sources from which such personal information was collected, and the business purpose for collecting, selling or disclosing such personal information; ● Right to Opt-Out of the Sale or Sharing of Personal Information. Certain of our online tracking technologies may be considered a “sale” or a “share” of your information to third parties under the CCPA. You may choose to opt out of being tracked by these technologies by sending an e-mail to [INSERT]. We have no actual knowledge that we sell the personal information of California residents who are under 16 years of age. You may also opt-out by using an opt-out preference signal, such as the Global Privacy Control (GPC) on your browser. To download and use a browser supporting the GPC, you may click here. If you choose the GPC signal, you will need to turn it on for each supported browser or browser extension you use; ● Right to Delete. You have the right to request that we delete the personal information we have collected about you, subject to certain exceptions; ● Right to Correct. You have a right to request that we correct your personal information, subject to certain exceptions; and ● Right to Non-Discrimination. You have a right to exercise the above rights without being discriminated against under the CCPA. We will not discriminate against any California resident who exercises the rights set forth in this section. These rights are not absolute and each is subject to certain exceptions or qualifications. For example, if you are currently an investor in one of our funds and you request that we delete the personal information we have collected about you, the CCPA permits us to deny such request and retain your personal information to the extent necessary to manage the applicable fund and our business relationship with you in connection with that fund. Notice of Collection. ● To learn more about the categories of personal information we collect about California residents, please see What Personal Data Do We Process, Why and for What Purposes above. ● For more information about how we use those categories of personal information, please see What Personal Data Do We Process, Why and for What Purposes above. ● For more information about how we collect categories of personal information, please see How Do We Collect Your Information? and Cookies And Related Online Tracking Technologies above. ● To learn more about how we disclose categories of personal information, and the categories of third parties with whom we disclose such information, please see How Do We Disclose Your Information? above. ● To learn more about how long we keep your information, please see How Long Do We Keep Your Information? above. Notice of Disclosure for a Business Purpose. To learn more about the categories personal information we have disclosed for a business purpose, and the categories of third parties with whom we’ve disclosed such information, please see Sharing Your Personal Data above. Notice of Sale or Sharing Personal Information. We may share your personal information with third party data cooperatives that assist us with direct mailing to customers and potential customers and, in exchange for this data, these co-op databases provide us with lookalike data from other consumers, which we use for marketing, advertising, and audience measurement purposes. The categories of personal information we may share in these circumstances includes your IP address, persistent online identifiers, ad identifiers, similar information about your devices and browsers, and information about your engagement with our App. We have no actual knowledge that we sell the personal information of California residents who are under 16 years of age. To opt out of these "sales", please click Do Not Sell My Personal Information. Notice of Sensitive Information. We do not use California resident sensitive personal information for any purpose other than is permissible under the CCPA. Specifically, we do not use sensitive personal information of California residents to derive characteristics about California residents. Exercising Legal Rights Requests. If you are a resident of California, you may exercise your respective legal rights In accordance with the below considerations: 1. Verification Requirements: For certain requests, we may require specific information from you to help us verify your identity and process your request. Depending on your request, we will ask for information such as your name, or an e-mail address that you have used with us. For certain requests, we may also ask you to provide details about the most recent purchase you. If we are unable to verify your identity, we may deny your requests to know or delete. 2. Right to Know, Access, and Deletion Requests: You may exercise your right to know, access or delete information by sending us an email to dpo@on-running.com. In the request, please specify which right you are seeking to exercise and the scope of the request. There are certain circumstances where applicable law allows us to retain certain information and we will not be able to delete such information. In such instances, we will inform you of what information cannot be deleted. 3. Correction Requests: You can correct information related to your account by logging into your account or sending an email to usa_happinessdelivery@on.com 4. Opt-Out of Sale Profiling, and Context-Based Behavioral Advertising: To opt out of these "sales", please click Do Not Sell My Personal Information. 5. Authorized Agents: You may appoint an authorized agent to exercise these rights on your behalf. To exercise any of these rights through an authorized agent, you must: (1) provide that authorized agent written and signed permission to submit such request; and (2) verify your own identity directly with us. Please note, we may deny a request from an authorized agent that does not submit proof that they have been authorized by you to act on your behalf. Responding to Requests. Requests properly submitted will be responded to within the required period under the CCPA. If a request is deficient, we may deny the request but will use reasonable efforts to explain the deficiency in the request so that you may correct the request. Please note that we may charge a reasonable fee for multiple requests in the same 12-month period, as permitted by applicable law. Accessibility. To print a copy of this Privacy Policy, please select “File” > “Print” on the website here. For consumers with disabilities who need to access this Privacy Notice in an alternative format, please contact us using the details set forth at the end of this Privacy Notice. Additional Information for Individuals Whose Personal Data is Subject to Chinese Data Protection Legislation If you are located within the People's Republic of China ("PRC"), further rules may apply to the processing of your personal data and your rights under PRC personal data protection laws and regulations, including but not limited to the PIPL. If you are located within the PRC, the following terms apply to the processing of your personal data: Definitions and Interpretation Under this privacy notice, "personal data" means any information relating to an identified or identifiable natural person that is electronically or otherwise recorded, excluding information that has been anonymized, as defined by the PIPL. Under this privacy policy, "sensitive personal data" means personal information of which the leakage or illegal use could easily lead to the violation of the personal dignity of a natural person or harm to personal or property safety. In China, the relevant supervisory authority is the Cyberspace Administration of China ("CAC") and its local branches, and you can find the general contact information of the CAC here. Notice Requirements Under the PIPL, we are required to provide you with certain information about our data processing activities, such as how we collect your data, for which purposes, and what are our legal basis for processing your personal data. Such information is available in this privacy notice, as indicated below: Information about how we process your personal data, for what purposes and under which legal basis is available above at What Personal Data Do We Process, Why and for What Purposes above. Information about the processing of your sensitive personal data is available at Processing Sensitive Personal Data above. Information about the third parties we share your personal data with is available at Sharing Your Personal Data above. Information about your rights and how you can exercise them is available at Your Rights In Relation To Your Personal Data above. Information about automated decision making conducted by using your personal data is available at Automated Decision Making And Profiling above. Information about for how long we keep your personal data is available at Retention Period above. Additional information about the processing of your personal data is provided in this section, and if you need to contact us about any point of this privacy notice, please see our contact information at Contact Us above. Transfer of personal data outside of the PRC We transfer your personal data to recipients based in jurisdictions outside the PRC, including to store your personal data. We take all the appropriate security measures and perform such transfers under valid cross-border mechanisms and rules provided by the PIPL and other relevant laws and regulations.