Impact, Risk and Opportunity Management

S4-1 – Policies related to consumers and end-users

To prevent or mitigate any form of risks or negative impacts on consumers and end-users concerning privacy, health and safety, and responsible marketing practices, we have several policies in place. We have established mechanisms to ensure all our policies are regularly revisited and updated as necessary.

Policies related to privacy risk

adidas has policies, standards and blueprints (like processes, procedures, guidelines, and manuals) in place which apply to all adidas entities around the globe. In these documents, adidas has defined an information security management system (ISMS) for the development, introduction, operation, and further enhancements of adidas information security capabilities. This risk-based approach ensures that relevant security objectives are met. The ISMS is built on the principles of Govern, Identify, Protect, Detect, Respond and Recover (in accordance with the NIST SP 800-53 Rev. 5 framework) to ensure performance measurement and continual improvement.

Policies related to our health and safety risk

Policies to tackle our responsible marketing practices impacts

adidas is committed to respecting and promoting the fulfillment of human rights throughout the entire value chain and for its consumers. Human rights are fundamental rights and freedoms for everyone based on dignity, fairness, equality, and respect. Our policy addresses our commitment to due diligence in our own operations, products and services, business relationships and toward our consumers globally.

Since its inception in 1997, our human rights program has been built on extensive stakeholder outreach and dialogue, aiming to understand and address the most relevant issues to address. Our active engagement includes participating in specialist forums to share lessons learned and develop best practices for our industry.

Our Human Rights Policy aligns with international instruments such as the UN Guiding Principles on Business and Human Rights, the ILO Declaration on Fundamental Principles and Rights at Work, and the OECD Guidelines for Multinational Enterprises. No cases of non-respect with these principles, involving consumers and/or end-users, have been reported in the adidas downstream value chain during the reporting year.

Please refer to chapters S1 Own workforce and S2 Workers in the value chain for further descriptions on adidas’ Human Rights Policy. SEE ESRS S1 OWN WORKFORCE SEE ESRS S2 WORKERS IN THE VALUE CHAIN

S4-2 – Processes for engaging with consumers and end-users about impacts

The adidas Brand Insights department plays a crucial role in streamlining insights across markets, categories, consumers, and competitors by monitoring, surveying, and tracking consumer behavior. This department comprises the following teams:

• Marketing & Consumer Insights, which focuses on understanding broad consumer behavior, perception of our brand, and brand health,
• Category Insights, which formulates insights based on the specific needs of our product categories, e.g., Football, Running, etc., and
• Brand Insights, responsible for conducting regular market studies to gather comprehensive consumer data, such as brand funnel surveys or bespoke consumer research with leading agencies in the respective fields.

To gain consumer insights, we mostly use three types of data sources:

• Quantitative (structured) consumer survey data gathered for us from third-party providers (agencies, software-as-a-service (SaaS) providers). We work with agencies in the field who execute a brand perception and brand health survey in various countries annually – this type of data is collected continuously throughout the year (based on a rigid sampling plan).
• Behavioral data from digital data sources from social media platforms and search engines that are used by our target consumer such as Instagram, Tik Tok, Google – this data is sourced via SaaS partners who provide platform access and raw data (dashboards, files, API access). This type of data is always accessible.
• Qualitative consumer feedback on products, concepts, ideas, looks, and styles from focus groups, workshops and in-depth interviews. This data is gathered on an ad-hoc basis, pending requirements.

We gather data from consumers who buy into technical sports products, branded sportswear and streetwear, with a focus on

• The GenZ demographic
• Avid athletes and key opinion leaders in their area of expertise – e.g., outdoor athletes for discussions on trail running shoes , fitness instructors to discuss gym wear, etc.

This multifaceted approach to insights helps us gain diverse and credible perspectives that inform our decisions and activities aimed at managing the impact of our responsible marketing practices on our consumers. These activities are being managed by our Brand Insights & Planning team reporting into the SVP Brand Development.

Furthermore, our Brand Partnership Insights department leverages insights through online platforms and panel questionnaires to understand how our partners, such as clubs, athletes, and celebrities are perceived by consumers. We use digital tools and collaborate with agencies that conduct consumer surveys and collect specific data. This allows us to measure various aspects of our partners, including social media performance and brand fit. Additionally, we generate ad hoc reports for specific or special occasions. This comprehensive approach helps us understand the broader impact of our brand partnerships on consumer perception.

All insights related to our partners are being managed by the Brand Partnerships Operations, Insights and History Management team reporting into the SVP Brand Partnership.

Our organization employs a comprehensive approach to assess the effectiveness of our engagement with consumers and end-users. This process includes evaluating brand heat, consumer demand, and other relevant metrics to ensure that our strategies are aligned with consumer expectations and preferences.

In brand partnership marketing, we follow a structured yearly planning process to determine our portfolio strategies with all our partners. This process involves making informed decisions about continuing or initiating partnerships based on a potential partner’s alignment with our brand values and objectives. Furthermore, we assess the brand association between athletes and consumers with our brand.

The outcomes of our assessments and engagements are documented and reviewed to guide future strategies and decisions. This iterative process helps ensure that our engagement with consumers and end-users remains effective and aligned with our organizational goals.

S4-3 – Processes to remediate negative impacts and channels for consumers and end-users to raise concerns

In general, consumers can lodge complaints about any issues they want to address through various accessible and responsive channels. These channels include:

• Contacts provided by national adidas websites, as also detailed by the EU’s General Product Safety Regulation (GPSR)
• Direct communication with our Customer Service team
• Specific adidas websites that are open for questions of any kind
• adidas complaint system (the customer complaint system adiComp tracks all consumer complaints at point of sales)
• adidas Key Account Management (potential consumer complaints on adidas products addressed to our wholesalers are channeled back via the respective account management)
• Whistleblowing system SEE ESRS G1 BUSINESS CONDUCT

Our customer service provider is contractually obligated to handle consumer complaints and requests, with an internal due diligence process overseen by business stakeholders to ensure compliance and effectiveness.

Our Policy and Stakeholder Engagement team is responsible for handling cases brought forward by NGOs, such as local or federal consumer organizations (German ‘Verbraucherzentralen’). The team aims to ensure that we engage with stakeholders effectively and address their concerns promptly.

As for our business relationships, we support and require the availability of complaint and feedback channels by focusing on relationship management and accessibility, specifically for key accounts and online communities. This ensures that our partners are equipped to handle consumer complaints and feedback effectively.

By maintaining open channels of communication and continuously improving our processes, we strive to provide effective remedies and uphold our commitment to responsible marketing practices as well as consumer satisfaction and safety. For further details, please refer to the section on taking action on responsible marketing practices. SEE S4-4

We track and monitor issues raised and addressed through various systems to ensure the effectiveness of our channels. This includes our customer service and the adidas complaint system (adiComp), which tracks, captures, and handles 100% of incoming consumer complaints and resolutions. For privacy cases, we use an automated individual rights request tool with KPIs and periodic reporting to monitor and assess its effectiveness. Customer service is tracked by customer service systems and processes, while emails to Global Privacy are handled manually by the Global Privacy team. Our customer service provider is contractually obligated to handle consumer complaints and requests, with an internal due diligence process overseen by business stakeholders to ensure compliance and effectiveness.

We have established various channels to ensure that our consumers can easily reach us and are aware of our various channels. They can approach our store staff anytime, consult our online and social media channels or use the Fair Play hotline (see S1 Own workforce for further information on the Fair Play hotline) for any type of inquiries. The fact that our consumers actively use these channels and reach out to us for support directly, demonstrates their trust in our services. For information on how we protect individuals from retaliation when they use our processes, please refer to G1 Business Conduct. The information provided about employees who filed a complaint also applies to consumers and end-users. SEE ESRS S1 OWN WORKFORCE SEE ESRS G1 BUSINESS CONDUCT

S4-4 – Taking action on material impacts on consumers and end-users, and approaches to managing material risks and pursuing material opportunities related to consumers and end-users, and effectiveness of those actions

Approaches to manage the privacy risk

To mitigate the risk, we have integrated robust privacy management systems into our business practices. This includes regular audits, employee training, and the adoption of security technologies to protect consumer data. By prioritizing privacy, we not only comply with legal standards, but also build consumer trust, which is essential for our long-term success.

Furthermore, privacy-related risks are fully considered in the adidas enterprise risk and opportunity assessment, which sets a standardized approach to identify, evaluate, and handle all relevant risks. To manage such risks, we identify the needed actions by carrying out dedicated impact assessments on all projects processing consumer data – in addition to our data protection impact assessment as required by Art. 35 EU GDPR. We furthermore consult applicable local legal requirements and authority guidance in case such requirements deviate from the General Data Protection Regulation (GDPR). More details can be found in the risk and opportunity report. SEE RISK AND OPPORTUNITY REPORT

Based on the outcome of our assessments, we implement necessary measures to ensure risk mitigation. If we determine that the risks remain high and cannot be mitigated, we do not proceed with the processing to ensure minimal risk exposure. To mitigate our risk, we conduct the above-mentioned data protection impact assessments and aim to ensure that necessary compliance measures are implemented.

We have restrictive system and data access controls in place to ensure that our employees and suppliers access our systems and data strictly on a need-to-know basis. In addition, we have internal supplier due diligence processes in place to mitigate any negative consumer experiences that may result from our data processing supply chains. We conduct periodic spot checks to determine whether the measures in place remain sufficient, especially if there are changes in the level of risk that could increase the impact on individuals.

Our information security (InfoSec) measures include the so-called InfoSec initiative as well as further projects as described below. Some of these actions are already in place or in progress, while others are still planned.

InfoSec initiatives:

• Tighten security controls around the central secure file transfer services (File Transfer Protocol Secure – FTPS) – planned
• Security configuration management for critical technical components – planned
• Security assessment for consumer centers – in place
• Security assessment for local e-commerce providers – in place

Further projects:

• Container vulnerability scanning and level 1 compliance 2023 – in progress
• Office data retention rollout for managing data in SharePoint – in place
• Cloud security program – in progress
• Security architecture – in place
• Controls implementation for 23 blueprints – in progress

When a personal data breach is reported to the Cyber Security Incident Response team, it is categorized as either a confidentiality breach (unauthorized access, use, or disclosure of confidential information), an integrity breach (unauthorized modification – intentional or unintentional – of information), or an availability breach (accidental loss of access to, or destruction of, information). An analysis is then conducted to determine if the breach is likely to adversely affect individuals, such as consumers. If a potential adverse effect is identified, we take appropriate steps to involve relevant stakeholders and report the breach to authorities. We identify corrective actions to address significant compromises or vulnerabilities. These actions are executed by respective stakeholders, such as business or tech teams, to remediate the issues. Follow-up actions are conducted for successful closure and validation, and a lessons learned activity is organized to incorporate learnings to prevent such incidents in the future.

While human error cannot be entirely avoided, we take measures to prevent personal data breaches caused by such errors. We strictly enforce our Fair Play Code of Conduct and provide continuous training of our employees. Additionally, we conduct quality control of our suppliers to ensure that all adidas employees and representatives process consumers’ personal data appropriately. Furthermore, we continuously improve our data collection and storage processes to ensure data quality and prevent the fraudulent use of personal data. To minimize technical errors, we monitor and control our systems through global and local tests of our information security controls by our Information Security team. These tests validate the effectiveness of our security controls. Moreover, vulnerability assessments, penetration testing, log monitoring, threat intelligence, and security architecture consulting are regularly performed.

Our organizational Data Protection Officer (DPO) reports findings to the Executive Board and necessary stakeholders on a periodic basis. The Privacy team also provides input to Internal Audit, which verifies and audits the privacy implementation and its corresponding effects on consumers.

In the reporting year, no severe human rights issues or incidents in relation to consumers’ and/or end-users’ privacy rights were reported.

Approaches to manage the health and safety risk

We have company-wide product safety policies in place to mitigate our health and safety risk. They help ensure that we consistently apply physical and chemical product safety and conformity standards. We created the respective standards and policies following a collaborative, cross-functional approach involving experts from both our Legal and Sourcing departments to ensure all aspects of a specific product are covered. This includes subsequent updates and training activities. Compliance with our policies is monitored and enforced by our Sourcing organization.

One of these policies is the adidas Policy for the control and monitoring of hazardous substances we introduced in 1998. It encompasses the strictest applicable local requirements and includes best practice standards as recommended by consumer organizations. The policy is updated and published both internally and externally at least once a year, informed by our ongoing dialogue with scientific organizations, and is mandatory for all business partners. Both our own quality laboratories and external institutes are used to constantly monitoring material samples for compliance with our requirements. Materials that fail to meet our standards and specifications are rejected. As a result of our ongoing efforts, we did not record any health and safety-related product recalls in 2024 (excluding licensed products).

Over the past few years, we have made significant contributions to the industry network AFIRM’s (Apparel and Footwear International RSL Management) ‘Restricted Substances List.’ As the adoption of this list as an industry best practice has matured, and AFIRM membership continues to grow, various tools were developed further in 2024. These include a harmonized test request form, a third-party lab evaluation questionnaire, and the offer of additional languages for the supplier online training videos. In addition, a PFAS phase-out guidance supported by an online webinar for suppliers was published. All these tools will be issued to the public and made available to other companies from the textile and sporting goods industry and their suppliers. We have also participated in several major public stakeholder consultation processes initiated by the European Commission (e.g., European Chemicals Agency) and US state legislative initiatives. The aim is to inform governmental entities on implications and opportunities of drafted legislation. To respond to the increasing legislation from US states, such as the recently enacted Federal US Environmental Protection Agency (EPA) law for PFAS, we have strengthened our status sharing for US retailers and enhanced our outreach to strategic suppliers, also improving our tracking functionality retroactively.

Compliance with product quality and safety standards

Ensuring compliance with legal requirements and standards for product quality and safety is imperative. As a company, we must manage the risk of selling defective products that may result in injury to consumers. Non-compliance can lead to voluntary or mandatory product recalls, returned stock, penalties, fines, personal injury claims, and reputational damage. The increasing regulatory requirements, particularly in regions like the EU, pose additional challenges. These include restrictions on the use of certain chemicals, import regulations, and stringent sustainability claims.

To address these challenges, we have implemented several initiatives. These include:

• Constant monitoring and lobbying efforts by our Legal, Social and Environmental Affairs and Government Affairs teams
• Strengthening of our Product Safety (PS) network to monitor and track regulatory PS compliance activities of business units
• Safety policies and procedures with a strong focus on business entities that market product safety-sensitive products
• An internal guidance portal on the intranet which shares insights and information on product safety recalls and on processes to efficiently manage recalls
• Creation of risk profiles for defined sourcing units/entities by the Product Safety and Compliance team

Furthermore, we updated our product compliance database, which houses mandatory product documentation such as Certificates of Compliance (COC). This proactive approach ensures that we can respond promptly to regulatory requests and maintain market access for our products.

Additional information can be found in our policies and actions section. By addressing these material risks, we ensure that our business model remains resilient and responsive to the evolving landscape of consumer expectations and regulatory requirements. Our commitment to product quality and safety is designed to mitigate these risks. SEE S4-4

Taking action on the responsible marketing practices impacts

As outlined in this chapter, our marketing practices are a crucial component of our commitment to responsible marketing. In our brand partnership marketing efforts, we strive to ensure that our collaborations and partnerships reflect our brand values and maintain consumer trust. To achieve this, we conduct thorough screenings of potential partners. We take appropriate and proactive measures to safeguard our brand, which may ultimately result in the termination of business relationships, if necessary.

We aim to prevent any negative impact on consumers from the outset through our marketing practices. However, if a negative impact occurs despite our preventive measures, we promptly seek to identify the actions needed to address the impact of our marketing practices, particularly in the areas of discriminative marketing and environmental claims (for the identification of actions needed in brand partnership marketing, please refer to section S4-2). To both prevent and respond to these impacts, we engage openly with our stakeholders. We provide multiple channels for consumers to lodge complaints or address issues, including our Customer Service team, dedicated adidas websites, or the adidas complaint system. SEE S4-2

In addition, through our Government Affairs team, we maintain relationships with legislative authorities and non-governmental organizations (NGOs) to ensure compliance with all relevant regulations and standards. Our diligent monitoring procedures allow us to integrate new requirements into our operations as soon as possible, often before they become legislated.

We are committed to addressing environmental claims responsibly. If, despite our measures and due diligence, an environmental claim does not meet our stringent standards or a product is perceived as ambiguous by our consumers, adidas will take corrective action by removing or adjusting the claim, such as revising product descriptions on e-commerce platforms to ensure accuracy and transparency.

In the context of taking action on discriminative marketing, we are employing several measures to prevent and mitigate our negative impacts concerning responsible marketing practices, and in particular brand partnership marketing. These measures include:

• Social media: We continuously monitor social media to track consumer sentiments and identify potential issues early.
• Sentiment analysis: By analyzing consumer sentiments, we gain insights into how our brand and partners are perceived, allowing us to address any negative perceptions promptly.
• Partner escalation process: We have established a partner escalation process to manage and resolve any issues that arise with our marketing partners, ensuring that any negative impacts are swiftly addressed.

If a negative impact occurs from brand partnership marketing despite our preventive measures, we tailor our approach to providing or enabling remedies to the specific circumstances of each case. We assess each situation individually to determine the most appropriate actions and measures. Our commitment is to act promptly and effectively as soon as a case arises, ensuring that we address our material negative impacts on consumers and end-users in a manner that is responsive to the unique circumstances of each situation. For example, in cases involving high-profile partnerships, we evaluate the specific impact and take swift action to address any issues that arise. This may involve direct engagement with the partners, issuing public statements, or implementing other remedial measures to mitigate the impact and uphold our brand integrity.

A detailed description of the allocated resources and the management of material impacts has been outlined in our sustainability report for many years and is also available on our corporate website. In addition, the involved departments and teams managing the material IROs in relation to consumers and end-users are mentioned in the section S4-2. SEE S4-2