MOSS Privacy Notice

Key terms

It would be helpful to start by explaining some key terms used in this notice:

Data controller

An entity which, alone or jointly with others, determines the purposes and means of the processing of Personal Data.

Data processor

An entity which processes Personal Data on behalf of the data controller.

Data protection laws

The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and the Data (Use and Access) Act 2025, any successor legislation and any other applicable data protection laws.

Direct marketing

The communication (by whatever means) of advertising or marketing material which is directed to particular individuals.

ICO

Information Commissioner’s Office (the UK data protection regulator), or any successor, replacement, or equivalent supervisory authority from time to time.

Personal data

Any information relating to an identified or identifiable individual.

Processing, processes or processed

Any operation or set of operations which is performed on personal data or on sets of personal data.

Special category data

Personal data that is provided with extra protection under data protection laws, including data that reveals racial or ethnic origin, political opinions, religious beliefs, philosophical beliefs or trade union membership, genetic data, biometric data (where used for identification purposes), data concerning health, sex life, or sexual orientation, as updated from time-to-time by data protection laws.

Website

Means this website: www.moss.co.uk

What this privacy notice applies to

This privacy notice relates to your:

• Use of this Website;

• Interacting with our customer support team;

• Visiting our stores to purchase or hire our menswear; and

• Attending appointments for our Custom Made or Mens Suit Hire service.

Our Website may contain links to websites operated by third parties to make additional products and services available to you. These third-party websites have their own privacy notices. We are not responsible for the privacy practices of other websites and encourage you to read their privacy notices upon leaving our Website.

Personal data we collect about you

The personal data we collect about you depends on the particular activities carried out through our Website, interacting with our customer support team or in our stores.

We may collect and process personal data about you in the following circumstances:

On our Website, our social media platforms and interacting with our customer support team:

• Your name, address and contact information (email and telephone);

• Any delivery addresses specified for your order;

• Information to check and verify your identity;

• Your gender, if you choose to give this to us;

• Location data if you choose to give this to us;

• Your billing information, transaction and payment card or other payment method information;

• Bank account and payment details;

• Details of any information, feedback or other matters you give to us by phone, email, post or via social media to our customer support team;

• Your account details, such as username and login details;

• Your activities on, and use of, our Website;

• Personal data you choose to share with our customer support team;

• Call recordings; and

• Your social media account names

In our stores:

• Name, address and contact information, including email address and telephone number;

• Any delivery addresses specified for your order;

• Information to check and verify your identity;

• Bank account and payment details

• Your billing information, transaction and payment card or other payment method information;

• Details, such as username and login details

• CCTV footage; and

• When you book an appointment for MOSS Hire Service or Custom Made Suits in one of our stores, we may take your body measurements.

Special category data

As a retailer, we do not generally process special category data. However, in limited circumstances, we may need to. In such cases, we must have a lawful basis for processing under both Article 6 and Article 9 of the UK GDPR. This may occur, for example, if you notify us of accessibility requirements for an in-store appointment, which may reveal information about a disability, or if you voluntarily disclose health-related information during your interactions with us.

If you fail to provide personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide the data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example to provide you with our goods or services). In this case, we may have to cancel a product or service you have with us but we will notify you if this is the case at the time.

How your personal data is collected

We collect personal data from you:

• Directly, when you enter or send us information, such as when you create an account, contact our customer support team, (including via email), send us feedback, purchase products via our Website, complete customer surveys or participate in competitions via our Website or social media accounts; and

• Indirectly, such as your browsing activity while on our Website; we will usually collect information indirectly using the technologies explained in our cookie policy.

How and why we use your personal data

We will only use your personal data where data protection laws allows us to. Most commonly, we will use your personal data in the following circumstances:

• For performance of a contract we enter into with you;

• Where necessary for compliance with a legal or regulatory obligation we are subject to;

• With your consent;

• For our legitimate interests (as described within this notice) and your interests and fundamental rights do not override these interests; and/or

• Where it is in your vital interests.

A legitimate interest is when we have a business or commercial reason to use your personal data, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see ‘How to contact us’ below).

The information below explains what we use your personal data for and why in more detail.

What we use your personal data for and why

1. Creating and managing your account with us

• To perform our contract with you or to take steps at your request before entering into a contract

2. Providing you with an e-receipt

• To perform our contract with you.

• It is our policy to issue e-receipts to your email address. If you do not want to share your email address with us, please let us know and we will issue you with a paper receipt.

3. Providing products and services to you

• To perform our contract with you or to take steps at your request before entering into a contract.

• When you shop with us online, we will need certain information to fulfil your order, such as your name, contact details, and delivery address.

• When you shop with us in-store, we will provide your receipt by email for sustainability purposes, but you can request a paper copy instead.

• If you use our Custom Made service or Hire Service, we will ask for your postcode to find your nearest store. We will then require your first name, last name, email address, phone number, and certain online identifiers to allow you to interact with this service.

• At your appointment, we will take your measurements for the purposes of providing a custom-made suit or hire wear, and we will add this information to your account with us to allow us to perform our services.

4. Enforcing legal rights or defend or undertake legal proceedings

• Depending on the circumstances:

(a) to comply with our legal and regulatory obligations —in other cases

(b) in other cases, for our legitimate interests, i.e. to protect our business, interests and rights

5. Customising our Website and its content to your particular preferences based on a record of your selected non essential cookies preferences or on your use of our Website.

• This helps us to provide you with a good experience when you browse our Website and also allows us to improve our Website. For detailed information on the cookies we use and the purposes for which we use them see our Cookie Policy.

• We may use your personal data with your consent to:

(a) provide you with information, or services that you requested from us;

(b) allow you to participate in interactive features of our Website, when you choose to do so;

(c) ensure that content from our Website is presented in the most effective manner for you and for your device; and

(d) improve our Website and services.

• We may use AI systems to facilitate this, for more information, please visit the ‘Automated Processing and Use of AI’ section below for more details.

6. Direct Marketing our services to existing and former customers (by email)

• Depending on the circumstances:

(a) your consent as obtained by our staff when you place an order with us in store; or

(b) where we are not required to obtain your consent and do not do so, for our legitimate interests (i.e. soft opt in), to provide you with information about our goods and services.

• Please see our ‘Marketing’ section below for more details.

7. Communications with you not related to marketing, including about changes to our terms or policies or changes to the products and services or other important notices

• Depending on the circumstances:

(a) to comply with our legal and regulatory obligations; and

(b) in other cases, for our legitimate interests, ie to be as efficient as we can so we can deliver the best service to you at the best price.

8. Protecting the security of systems and data used to provide the services

• To comply with our legal and regulatory obligations We may also use your personal data to ensure the security of systems and data to a standard that goes beyond our legal obligations, and in those cases our reasons are for our legitimate interests, i.e. to protect systems and data and to prevent and detect criminal activity that could be damaging for you and/or us.

9. Statistical analysis to help us understand our customer base

• For our legitimate interests, i.e. to be as efficient as we can so we can deliver the best service to you at the best price.

10. Updating and enhancing customer records

• Depending on the circumstances:

(a) to perform our contract with you or to take steps at your request before entering into a contract

(b) to comply with our legal and regulatory obligations

(c) where neither of the above apply, for our legitimate interests, e.g. making sure that we can keep in touch with our customers about existing orders and new products.

11. Disclosures and other activities necessary to comply with legal and regulatory obligations that apply to our business, e.g. to record and demonstrate evidence of your consents where relevant

• To comply with our legal and regulatory obligations.

12. To share your personal data with members of our group and third parties that will or may take control or ownership of some or all of our business (and professional advisors acting on our or their behalf) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency In such cases information will be anonymised where possible and only shared where necessary

• Depending on the circumstances:

(a) to comply with our legal and regulatory obligations

(b) in other cases, for our legitimate interests, ie to protect, realise or grow the value in our business and assets.

13. To collect and collate market research from your experiences

• For our legitimate interests, to improve our products and services.

Marketing

Where you have provided your consent or you have indicated that you would like to receive marketing correspondence from us, for example when you’ve purchased a product or service, subscribed to our mailing lists or newsletters, enter into any of our competitions or provided us with your details we may use your personal data for our legitimate interests in order to provide you with details about our goods, services, business updates and events which we think may be of interest.

We run online advertising to keep you aware of what we’re up to and to help you see and find our products. Like many companies, we target banners and ads to you when you are on other websites and apps. We do this using a variety of digital marketing networks and ad exchanges. We use a range of advertising technologies such as web beacons, pixels, ad tags, cookies and mobile identifiers, as well as specific services offered by some sites and social networks, such as Facebook’s Custom Audience service. The banners and ads you see are based on information we hold about you, or your previous engagement with MOSS (for example, items you search for and the content you read while on our website) or MOSS. banners or ads you have previously clicked on.

You have the right to opt-out of receiving any marketing communications at any time. To opt-out of receiving such information you can:

• click the unsubscribe button contained in any such communication received; or

• email us at [email protected] providing us with your name and contact details; or

• visit one of our stores

Where you have indicated you would like to receive marketing material from us we will use your personal data for three years from when you last engaged with us, such as opening one of our marketing emails. You can always unsubscribe from receiving marketing if you no longer want to hear about offers from us.

We may ask you to confirm or update your marketing preferences if you ask us to provide further products or services in the future, or if there are changes in the law, regulation, or the structure of our business.

We will always treat your personal data with the utmost respect and never share it with other organisations outside the Moss Bros group for marketing purposes.

Monitoring and Recording

We may monitor and record communications with you (such as telephone communications and emails) for the purpose of quality assurance, training, fraud prevention and compliance.

In our stores we also have CCTV cameras installed in our premises for the purpose of crime prevention and for health and safety reasons. We retain such information for up to 30 days subject to store location. We may also use technology to monitor customer flows in our stores.

We use Artificial Intelligence (AI) solutions to record calls with the primary purpose of improving our customer service interactions. The AI technology helps us analyse and enhance the quality of our communications, ensuring that we provide the best possible service to our customers.

We care about everyone’s privacy rights and safety in our stores, including that of our staff. We reserve the right to remove individuals overtly or covertly recording through any device if recording is done in a way which threatens, harasses or intimidates our staff.

Automated processing and use of AI

We use AI to assist with customer service and provide information to you. When you interact with our chatbot, or contact us by email or by webforms, we may collect and process personal data such as your name, contact details, order details, and any other information you provide during the conversation and use AI to make the customer service process more efficient. The purpose of this processing is to enhance your experience and provide you with accurate and timely responses to frequently asked questions and to automate certain responses. This may constitute automated decision-making without a significant legal effect on you. The legal basis for this processing is our legitimate interest in improving our services and ensuring effective communication with our customers. We use artificial intelligence to generate responses from our defined knowledge bank. If you would like to speak to one of our customer service agents at any point, you can ask to speak to a human at any point if you are using live chat, our chatbot or web forms.

We are committed to protecting your personal data. The information collected through AI call recording and our chatbot is stored securely and access is limited to authorised personnel only. We have implemented appropriate physical, technical, and organisational measures to safeguard your data against accidental loss, unauthorised access, use, alteration, or disclosure.

If further to undertaking a credit check you receive a low credit score, we reserve the right not to supply you with goods or services on credit and/or require upfront payment for the goods or services you wish to purchase.

If you have any questions or concerns about how we use AI solutions, or if you wish to exercise any of your rights, please contact our Data Protection Officer at [email protected].

Who we share personal data with

We routinely share personal data with:

• third party companies in order to facilitate the provision of goods or services to you such as delivery providers, our market research and payment providers;

• our affiliated entities to support internal administration;

• IT software providers that host our Website and store data on our behalf;

• professional advisers including consultants, lawyers, bankers and insurers who provide us with consultancy, banking, legal, insurance and accounting services;

• HM Revenue and Customs, regulators and other authorities who require reporting of processing activities in certain circumstances;

• third parties who we may choose to sell, transfer or merge parts of our business or assets. Alternatively, we may seek to acquire other business or merge with them. If a change happens to our business then the new owners may use your personal data in the same way as set out in this privacy notice; and

• Where you use our garment hire service, we will share your personal data with our trusted third parties who are involved in facilitating and delivering those services.

We only allow those organisations to handle your personal data if we are satisfied they take appropriate measures to protect your personal data. We also impose contractual obligations on them to ensure they can only use your personal data to provide services to us and to you.

We or the third parties mentioned above occasionally also share personal data with:

• our and their professional advisors (such as lawyers and other advisors), in which case the recipient of the information will be bound by confidentiality obligations;

• our and their external auditors, e.g. in relation to the audit of our or their accounts, in which case the recipient of the information will be bound by confidentiality obligations;

• law enforcement agencies, courts, tribunals and regulatory bodies to comply with our legal and regulatory obligations; and

• other parties that have or may acquire control or ownership of our business (and our or their professional advisers) in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale, initial public offering or in the event of our insolvency—usually, information will be anonymised but this may not always be possible.

The recipient of any of your personal data will be bound by confidentiality obligations.

Cross-Border data transfers

To deliver our services to you, it is sometimes necessary for us to share your personal data with our service providers and other third parties who are based outside the UK and the European Economic Area (‘EEA’).

Under data protection laws, we can only transfer your personal data to a country outside of the UK and EEA where:

• the UK government has decided the particular country ensures an adequate level of protection of personal data (known as an ‘adequacy regulation’ or ‘adequacy decision’) further to Article 45 of the UK GDPR,

• there are appropriate safeguards in place, together with enforceable rights and effective legal remedies for you (such as the UK's International Data Transfer Agreement or the UK Addendum to the EU's Standard Contractual Clauses), or

• a specific exception applies under relevant data protection laws

Where we transfer your personal data outside the UK and EEA, we do so on the basis of an adequacy regulation where available. Where an adequacy regulation is not available, we will put in place appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, to ensure your personal data is protected to the same standard as in the UK. You can contact our Data Protection Officer for more information about the safeguards we use.

How long your personal data will be kept

We will not keep your personal data for longer than we need it for the purpose for which it is used. Different retention periods apply for different types of personal data. For most personal data that we collect to provide our goods and services to you, we will retain it for the duration you use our products and services plus a 6-7 year period in line with statutory limitation periods.

Where you have indicated you would like to receive marketing material from us we will use your personal data for three years from when you last engaged with us, such as opening one of our marketing emails. If you no longer want to hear about offers from us, you can always unsubscribe from receiving marketing from us by:

• the unsubscribe button contained in any such communication received; or

• email us at [email protected] providing us with your name and contact details.

If you provide false or inaccurate information and we suspect fraud, we will keep a record of this.

Data security

Where we have given you (or where you have chosen) a password which enables you to access certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share a password with anyone.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your information transmitted to our Website; any transmission is at your own risk.

Information you provide to us is shared on our secure servers. We have implemented appropriate physical, technical and organisational measures designed to secure your information against accidental loss and unauthorised access, use, alteration or disclosure. In addition, we limit access to personal data to those employees, agents, contractors and other third parties that have a legitimate business need for such access.

Your rights

You have the following rights, which you can exercise free of charge:

• Access

The right to be provided with a copy of your personal data (where it is proportionate and reasonable for us to do so)

• Rectification

The right to require us to correct any mistakes in your personal data

• Erasure (also known as the right to be forgotten)

The right to require us to delete your personal data—in certain situations

• Restriction of processing

The right to require us to restrict processing of your personal data in certain circumstances, e.g. if you contest the accuracy of the data

• Data portability

The right to receive the personal data you provided to us, in a structured, commonly used and machine-readable format and/or transmit that data to a third party—in certain situations

• To object

1.1. at any time to your personal data being processed for direct marketing (including profiling);

1. The right to object:

1.2. in certain other situations to our continued processing of your personal data, e.g. processing carried out for the purpose of our legitimate interests unless there are compelling legitimate grounds for the processing to continue or the processing is required for the establishment, exercise or defence of legal claims

• Not to be subject to automated individual decision making

The right not to be subject to a decision based solely on automated processing (including profiling) that produces legal effects concerning you or similarly significantly affects you

• The right to withdraw consent

If you have provided us with a consent to use your personal data you have a right to withdraw that consent easily at any time You may withdraw consent by contacting us at [email protected] Withdrawing consent will not affect the lawfulness of our use of your personal data in reliance on that consent before it was withdrawn

How to contact us and right to complain

You can contact us by post, email or telephone if you have any questions about this privacy notice or the information we hold about you, to exercise a right under data protection law or to make a complaint.

Our contact details are shown below:

• Moss Bros Group, 128 Albert Street, London, England, NW1 7NE

• [email protected]

Please give us the opportunity to make any issue or complaint right by contacting us. However, if you are not satisfied with the way we have dealt with any complaint you have, we would like to remind you of your right to complain to the UK data protection regulator, the Information Commissioner’s Office. You may contact the ICO at:

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or at www.ico.org.uk.

Whilst we acknowledge that we cannot prevent individuals from recording their experiences in stores, we reserve the right to remove any individuals from our stores, where such recording constitutes harassment.

Changes to our privacy notice

We reserve the right to update this privacy notice at any time, and any changes we make to our privacy notice will be posted on this page, please check this privacy notice for any updates. We will notify you if there are any changes to this notice that materially affect how we collect, store or process your personal data. If we would like to use your previously collected personal data for different purposes than those we notified you about at the time of collection, we will provide you with notice and, where required by law, seek your consent, before using your personal data for a new or unrelated purpose. We may process your personal without your knowledge or consent where required by applicable law or regulation.

This privacy notice was published in February 2026 and last updated February 2026.