Privacy Policy

1.1 Who We Are

Arenas is a Spain-based luxury resort and beachwear brand that designs and sells swimwear, cover-ups, kaftans, sarongs, and accessories through its online store at arenasresortwear.eu. The current Gems of the Season collection is sold ready-made, in fixed designs and standard sizing. Arenas is also developing an AI-personalised, made-to-order product model, which will be offered once the underlying configuration tool is launched. Every product is designed by Camila Arenas and produced in Italy. Arenas sells exclusively to consumers (B2C) and does not operate a wholesale or B2B channel.

The entity responsible for the processing of your personal data is:

Trading name: Arenas Legal entity: [ ] Registered address: [ ], Valencia, Spain Mercantile Registry (Registro Mercantil): [ ] VAT number: [ ] Email: hello@arenasresortwear.eu Telephone: [ ] Website: arenasresortwear.eu

1.2 Purpose of This Privacy Policy

This Privacy Policy explains what personal data Arenas collects from you when you visit arenasresortwear.eu, create an account, place an order, or otherwise interact with Arenas — including, once launched, your use of the AI configuration tool. It sets out why we collect that data, on what legal basis, how long we retain it, with whom we share it, and what rights you have as a data subject.

We are committed to handling your personal data with care, transparency, and in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and any applicable national implementation legislation.

1.3 Scope

This Privacy Policy applies to all personal data processed by Arenas in connection with: visits to arenasresortwear.eu; use of the AI configuration tool; the creation and management of a customer account; the placing and fulfilment of orders; customer service and complaints handling; email and marketing communications; and participation in any promotion, survey, or event organised by Arenas.

This Privacy Policy does not apply to third-party websites that may be linked to or from arenasresortwear.eu. Arenas is not responsible for the privacy practices of such third parties.

2.1 Data You Provide Directly

When you interact with Arenas, you may provide us with the following categories of personal data:

Identity and contact data: first name, last name, email address, telephone number, and date of birth (where provided voluntarily).

Delivery and billing data: delivery address, billing address, and any special delivery instructions.

Account credentials: username and password (stored in encrypted form) where you create an account.

Configuration data: the choices you make within the AI configuration tool, including the silhouette, fabric print, colour scheme, and any further product characteristics you select. These choices are linked to your order and account.

Payment data: payment method and transaction reference. Payment card details are processed directly by our payment service provider and are not stored by Arenas.

Communications data: the content of any correspondence you send to us, including emails, contact form submissions, complaint records, and any attachments.

User-generated content: images or other content you share publicly featuring Arenas products, where you have tagged Arenas or otherwise consented to their use (see Section 7).

2.2 Data Collected Automatically

When you visit arenasresortwear.eu, we automatically collect certain technical and behavioural data through cookies and similar technologies:

Technical data: IP address, browser type and version, operating system, device type (desktop, mobile, tablet), screen resolution, and time zone.

Usage data: pages visited, time spent on pages, links clicked, search queries entered on the website, and the URL from which you arrived.

Session data: session identifiers and cookie identifiers used to maintain the continuity of your browsing session and shopping basket.

Configuration session data: the steps taken in the AI configuration tool during a visit, including intermediate selections, even where no order is completed. This data is used solely to improve the configuration experience and is not linked to your identity unless you are logged in or place an order.

For a full explanation of the cookies we use, their purpose, and how to manage your preferences, please refer to our Cookie Policy at arenasresortwear.eu/cookies.

2.3 Data Received from Third Parties

In certain cases, Arenas may receive personal data about you from third parties:

Payment service providers: we receive transaction status confirmations (success, failure, refund processed) from our payment service provider. We do not receive your full payment card details.

Shipping carriers: we receive delivery status updates (dispatched, in transit, delivered, failed delivery attempt) from our shipping partner(s).

Social media platforms: where you interact with Arenas content on social media or use social login functionality, we may receive your public profile data to the extent permitted by the platform and your privacy settings.

Analytics providers: we receive aggregated and, where applicable, pseudonymised data from analytics tools to understand website usage patterns.

2.4 Special Categories of Personal Data

Arenas does not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, health data, biometric data, or data concerning sexual orientation) through its website or ordering process.

Where you voluntarily share content (for example, photographs) on social media featuring Arenas products, such content may incidentally contain personal data in one of the above categories. In that case, your explicit consent to the use of that content (by tagging Arenas or otherwise) constitutes the legal basis for any processing of such data by Arenas.

3.1 Performance of a Contract (Art. 6(1)(b) GDPR)

We process personal data to the extent necessary to conclude and perform the contract with you. This includes:

Processing and confirming your order, including the saving of your configuration choices and the assignment of a uniqueness code (Unica).

Arranging and tracking the production and delivery of your product.

Managing returns, refunds, and exchanges in accordance with our Terms and Conditions.

Sending you order status notifications and transactional emails (order confirmation, production started, dispatched, delivered).

Handling customer service enquiries directly related to an order.

Without this processing, we cannot fulfil your order. You are not required by law to provide this data, but we cannot enter into a contract without it.

3.2 Compliance with a Legal Obligation (Art. 6(1)(c) GDPR)

Arenas processes certain personal data to comply with applicable legal obligations, including:

Retention of order and financial records for a period of six (6) years to comply with Spanish commercial and tax law (Article 30 of the Código de Comercio and the Ley 58/2003 General Tributaria).

Compliance with consumer protection legislation, including the provision of required pre-contractual information and the handling of withdrawal or complaint requests.

Compliance with anti-money laundering obligations where applicable.

Responding to lawful requests from supervisory authorities, law enforcement, or courts.

3.3 Legitimate Interests (Art. 6(1)(f) GDPR)

Where processing is not required for the performance of a contract or compliance with a legal obligation, Arenas may process personal data on the basis of its legitimate interests, provided those interests are not overridden by your interests or fundamental rights. Arenas' legitimate interests include:

Improvement of the AI configuration tool and product offer: Arenas uses anonymised and aggregated configuration data (which silhouettes, prints, and colours are selected, by Individual choices are anonymised before use for this purpose.

Website analytics and performance: Arenas uses pseudonymised usage data to understand how visitors use arenasresortwear.eu, identify technical issues, and improve the website experience. We use [ ] as our analytics provider. Where applicable, we apply IP anonymisation.

Fraud prevention and security: Arenas monitors transactions and account activity to detect and prevent fraudulent orders, account takeovers, and payment fraud.

Debt collection: where an invoice remains unpaid, Arenas may process relevant personal data in the context of recovery proceedings.

Defence of legal claims: Arenas may retain and use personal data to defend itself in the event of a legal claim or dispute.

You have the right to object to processing based on legitimate interests at any time. See Section 8 for details.

3.4 Consent (Art. 6(1)(a) GDPR)

Where Arenas processes personal data on the basis of consent, you have the right to withdraw that consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal. Processing activities based on consent include:

Email marketing and newsletters: where you have subscribed to receive news, new collection announcements, editorial content, or promotional offers from Arenas by email. You may unsubscribe at any time via the unsubscribe link in any marketing email or by contacting us at hello@arenasresortwear.eu.

Non-essential cookies: cookies that are not strictly necessary for the operation of the website, including analytical cookies (beyond basic, non-identifying visit counts) and personalisation cookies. You manage these via the cookie consent banner on arenasresortwear.eu.

Use of user-generated content for marketing purposes: where you tag Arenas in a post featuring an Arenas product or otherwise grant us permission to use your image. See Section 7.

3.5 Summary Table of Processing Activities

The table below summarises the main processing activities, the personal data involved, the legal basis, and the retention period. Rows referring to configuration data or the AI configuration tool describe processing that will apply once that tool is launched; they do not currently apply to the Gems of the Season collection.

Order processing and fulfilment | Identity, contact, delivery, payment, configuration data | Contract (Art. 6(1)(b)) | 6 years (tax/accounting obligation)

Customer account management | Identity, contact, account credentials, order history, saved configurations | Contract (Art. 6(1)(b)) | Duration of account + 2 years after last activity

Order status communications | Email address, order reference | Contract (Art. 6(1)(b)) | Duration of order cycle

Customer service and complaints | Identity, contact, correspondence | Contract / Legal obligation | 3 years from closure of case

Accounting and tax compliance | Order data, financial records | Legal obligation (Art. 6(1)(c)) | 6 years

AI configuration tool improvement | Anonymised configuration data | Legitimate interest (Art. 6(1)(f)) | Anonymised; no personal retention limit

Website analytics | Pseudonymised usage and technical data | Legitimate interest (Art. 6(1)(f)) | [ ] months

Fraud prevention | Transaction data, IP address | Legitimate interest (Art. 6(1)(f)) | [ ] months

Email marketing | Email address, name, purchase history | Consent (Art. 6(1)(a)) | Until withdrawal of consent + 3 months

Non-essential cookies | Cookie identifiers, browsing behaviour | Consent (Art. 6(1)(a)) | Per cookie; see Cookie Policy

User-generated content (marketing) | Images, social media handle | Consent (Art. 6(1)(a)) | Until withdrawal of consent

Note: the table above presents the data in plain text for readability. The full structured table is available on the website at arenasresortwear.eu/privacy.

4.1 What the Configuration Tool Does

The AI configuration tool is a proprietary web application, currently in development, that will enable you to compose a unique product by selecting a silhouette from the current Arenas collection and personalising it by choosing a fabric print, colour scheme, and any further available characteristics. Once launched, the tool will render a three-dimensional simulation of your configuration in real time. This Privacy Policy describes the configuration tool and its data processing in advance of its launch; until it is activated on arenasresortwear.eu, no configuration data of the kind described in this Section is collected.

The configuration tool will become central to part of the Arenas product model once launched. Products composed via the configuration tool are made to your individual specifications, and your configuration choices form an essential part of that order and the contract between you and Arenas. The Gems of the Season collection, Arenas' current standing collection of ready-made products in fixed designs and standard sizing, is not affected by this Section and does not involve any configuration data.

4.2 What Configuration Data We Collect and Why

When you use the configuration tool, Arenas collects the following data:

Your configuration choices: the silhouette, fabric print, colour, and any other product characteristics you select. These are linked to your order upon checkout and form the basis for production.

Session interaction data: intermediate steps and selections made during your configuration session, including where you do not complete an order. This data is collected in pseudonymous form (linked to a session identifier, not to your name or email address unless you are logged in) and is used solely to improve the configuration experience.

The uniqueness code (Unica): upon order confirmation, your configuration is assigned a unique code that is registered in the Arenas database and printed on your certificate of uniqueness. This code links your identity (as the orderer) to the specific configuration produced for you.

4.3 How Configuration Data Is Used

Your individual configuration data (linked to your order) is used to: produce your product in accordance with your specifications; validate the finished product against your order at dispatch; generate and issue your certificate of uniqueness; and maintain a record of your order for customer service and warranty purposes.

Anonymised and aggregated configuration data (not linked to you as an individual) is used to: identify which silhouettes, prints, and colour combinations are most popular across markets and seasons; improve the configuration algorithm; and inform product development and collection design decisions.

We do not use your individual configuration data for automated decision-making that produces legal or similarly significant effects on you, within the meaning of Article 22 GDPR.

4.4 Configuration Data and Third Parties

Your individual configuration data is not sold, licensed, or otherwise transferred to third parties for commercial purposes. Configuration data may be shared with our production partner in Italy solely for the purpose of manufacturing your product, and with our logistics partner for delivery. Both are bound by confidentiality obligations and data processing agreements.

5.1 Categories of Recipients

Arenas shares personal data only where necessary for the purposes described in this Privacy Policy, and only with parties that provide adequate guarantees of data protection. The categories of recipients are:

Production partner: our manufacturing atelier in Italy (EU), which receives your configuration data and order details for the sole purpose of producing your product. Italy is an EU Member State; no special transfer mechanism is required.

Logistics and shipping partners: the carrier(s) responsible for delivering your order receive your name, delivery address, and contact details necessary for delivery. Our current primary carrier is [ ].

Payment service provider: [ ] processes your payment. Arenas does not receive or store your full payment card details. The payment service provider acts as an independent data controller for the processing of your payment transaction data.

E-commerce platform provider: our webshop runs on [ ] (e.g. Shopify Plus), which processes order and customer data as a data processor on our behalf, under a data processing agreement.

Email service provider: [ ] sends transactional and marketing emails on our behalf, under a data processing agreement.

Analytics provider: [ ] provides website analytics. Data is processed in pseudonymised form; see Section 3.3 and our Cookie Policy.

Legal and professional advisers: our lawyers, accountants, and other professional advisers may access personal data where strictly necessary for the provision of their services, subject to professional confidentiality obligations.

Supervisory authorities and law enforcement: where required by law or a binding court order.

5.2 International Transfers Outside the EEA

Some of the third-party service providers listed above may process personal data outside the European Economic Area (EEA). Where this is the case, Arenas ensures that appropriate safeguards are in place in accordance with Chapter V of the GDPR, including:

Adequacy decisions: transfers to countries that the European Commission has deemed to provide an adequate level of data protection (e.g. the United Kingdom, Canada for commercial organisations).

Standard Contractual Clauses (SCCs): where no adequacy decision exists, Arenas uses the European Commission's approved Standard Contractual Clauses as the transfer mechanism.

Binding Corporate Rules or other appropriate safeguards: where applicable.

You may request a copy of the applicable transfer safeguards by contacting us at hello@arenasresortwear.eu.

5.3 No Sale of Personal Data

Arenas does not sell, rent, or otherwise commercially transfer your personal data to third parties. We do not share your personal data with advertisers, data brokers, or other commercial third parties for their own marketing purposes.

6.1 General Principle

Arenas does not retain personal data for longer than is necessary for the purposes for which it was collected, or longer than required by a statutory retention obligation. The retention periods set out below apply from the date on which the relevant processing activity ends (e.g. the date of delivery, the date an account is closed, or the date of the last email interaction).

6.2 Order and Financial Data

Order records, invoices, payment confirmations, and related financial data are retained for six (6) years from the date of the transaction, in compliance with Spanish statutory commercial and tax retention requirements (Article 30 of the Código de Comercio and Article 66 of the Ley 58/2003 General Tributaria).

6.3 Customer Account Data

Data held in your customer account (name, email, address, saved configurations, order history) is retained for as long as your account is active. If your account has been inactive for a continuous period of two (2) years, Arenas will notify you by email and, in the absence of a response, delete or anonymise your account data, subject to any overriding statutory retention obligation.

You may request deletion of your account at any time. See Section 8 for the exercise of your rights.

6.4 Customer Service and Complaints

Records of customer service interactions and formal complaints are retained for three (3) years from the closure of the case, to enable us to respond to any follow-up queries and to defend potential legal claims within the applicable limitation period.

6.5 Marketing Data

Email marketing data (your email address and marketing preferences) is retained until you withdraw your consent, plus a period of three (3) months to allow for processing of the withdrawal. Anonymised statistical data on email campaign performance is retained indefinitely.

6.6 Configuration Session Data (Anonymised)

Anonymised and aggregated configuration data — from which no individual can be identified — is retained indefinitely for the purpose of algorithmic improvement and trend analysis.

6.7 Technical and Log Data

Server logs, IP addresses, and technical data collected for security and fraud prevention purposes are retained for a maximum of [ ] months, unless a specific incident requires longer retention for investigative purposes.

7.1 What Cookies We Use

Arenas uses cookies and similar tracking technologies on arenasresortwear.eu. A cookie is a small text file stored on your device by your browser. We use the following categories of cookies:

Strictly necessary cookies: essential for the operation of the website, including core functionality such as session management, shopping basket persistence, and secure checkout. Once launched, these cookies will also support the configuration tool. They do not require your consent and cannot be disabled without impairing the functioning of the website.

Functional cookies: remember your preferences (e.g. language, currency) to improve your experience. These require your consent.

Analytical cookies: collect pseudonymised data on how you use arenasresortwear.eu (pages visited, time on site, errors encountered) to help us improve the website. These require your consent.

Configuration experience cookies: track your progress within the AI configuration tool during a session to maintain the continuity of your design choices. Strictly necessary cookies cover session continuity; any beyond-session retention requires your consent.

7.2 Third-Party Cookies

Some cookies are placed by third-party providers on our behalf, including our analytics provider ([ ]) and our payment service provider ([ ]). These third parties have their own privacy policies, which we encourage you to review.

We do not use third-party advertising cookies or retargeting cookies on arenasresortwear.eu. We do not share your browsing data with advertising networks.

7.3 Managing Your Cookie Preferences

Upon your first visit to arenasresortwear.eu, you will be presented with a cookie consent banner that allows you to accept or decline non-essential cookies. You may change your preferences at any time via the cookie settings link in the website footer.

You may also manage cookies through your browser settings. Note that disabling strictly necessary cookies will impair the functioning of the website. For instructions on managing cookies in your browser, refer to your browser's help documentation.

For a complete and up-to-date list of all cookies used by Arenas, their purpose, provider, and duration, please refer to our Cookie Policy at arenasresortwear.eu/cookies.

8.1 Overview of Your Rights

Under the GDPR, you have the following rights with respect to your personal data processed by Arenas. These rights are not absolute and may be subject to limitations and conditions under applicable law. Arenas will respond to all requests within one (1) month. Where a request is complex or numerous, we may extend this period by a further two (2) months, in which case we will notify you within the first month.

8.2 Right of Access (Art. 15 GDPR)

You have the right to obtain confirmation from Arenas as to whether or not we process personal data concerning you, and, where we do, to receive a copy of that data together with information about the purposes of processing, the categories of data, the recipients, the retention periods, and your rights.

8.3 Right to Rectification (Art. 16 GDPR)

You have the right to request that Arenas correct any inaccurate personal data concerning you without undue delay, and to have incomplete data completed, including by means of a supplementary statement.

8.4 Right to Erasure / Right to Be Forgotten (Art. 17 GDPR)

You have the right to request that Arenas erase your personal data without undue delay where one of the following grounds applies: the data is no longer necessary for the purposes for which it was collected; you withdraw your consent and there is no other legal basis for processing; you object to processing based on legitimate interests and there are no overriding legitimate grounds; the data has been unlawfully processed; or erasure is required to comply with a legal obligation.

The right to erasure does not apply where processing is necessary for compliance with a legal obligation (e.g. the seven-year accounting retention requirement) or for the establishment, exercise, or defence of legal claims.

8.5 Right to Restriction of Processing (Art. 18 GDPR)

You have the right to request that Arenas restrict the processing of your personal data in the following circumstances: you contest the accuracy of the data (for the period required to verify accuracy); the processing is unlawful but you object to erasure; Arenas no longer needs the data but you require it for legal claims; or you have objected to processing pending verification of whether Arenas' legitimate grounds override yours.

8.6 Right to Data Portability (Art. 20 GDPR)

Where processing is based on your consent or on the performance of a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit that data to another controller. Where technically feasible, you may request that we transmit the data directly to another controller.

8.7 Right to Object (Art. 21 GDPR)

You have the right to object at any time to processing of your personal data that is based on Arenas' legitimate interests (Art. 6(1)(f) GDPR), on grounds relating to your particular situation. Arenas will cease processing unless it can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time, without giving reasons. Upon receipt of your objection, Arenas will immediately cease processing for marketing purposes.

8.8 Rights Related to Automated Decision-Making (Art. 22 GDPR)

Arenas does not subject you to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you. The AI configuration tool generates product renderings based on your inputs but does not make any automated decisions that affect your legal rights or other similarly significant interests.

8.9 How to Exercise Your Rights

To exercise any of the above rights, please submit a request to Arenas at:

Email: hello@arenasresortwear.eu Post: [ ], Valencia, Spain

To protect your data, we may ask you to verify your identity before processing your request. We will not charge a fee for processing your request unless it is manifestly unfounded or excessive.

8.10 Right to Lodge a Complaint with a Supervisory Authority

If you believe that Arenas has processed your personal data in breach of the GDPR, you have the right to lodge a complaint with the competent data protection supervisory authority. In Spain, the supervisory authority is:

Agencia Española de Protección de Datos (AEPD — Spanish Data Protection Agency) Website: aepd.es Postal address: Calle Jorge Juan 6, 28001 Madrid, Spain

If you are resident in another EU Member State, you may also lodge a complaint with the supervisory authority of your country of habitual residence or place of work. We do, however, invite you to contact us first so that we may attempt to resolve your concern directly.

9.1 Technical and Organisational Measures

Arenas implements appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include:

Encryption: arenasresortwear.eu uses TLS (Transport Layer Security) encryption for all data transmitted between your browser and our servers. Sensitive data (including account passwords) is stored in encrypted or hashed form.

Access controls: access to personal data is restricted on a need-to-know basis. Employees and service providers with access to personal data are bound by confidentiality obligations.

Payment security: payment transactions are processed by our payment service provider in a PCI-DSS-compliant environment. Arenas does not store payment card data.

Data minimisation: Arenas collects only the personal data that is necessary for the purposes described in this Privacy Policy.

Supplier due diligence: we select third-party processors carefully and require them to implement appropriate security measures through contractual data processing agreements.

9.2 Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, Arenas will notify the affected individuals without undue delay, in accordance with Article 34 GDPR. Where required by law, Arenas will also notify the competent supervisory authority within 72 hours of becoming aware of the breach, in accordance with Article 33 GDPR.

10.1 Age Restriction

Arenas' products and services are intended for consumers who are at least sixteen (16) years of age. We do not knowingly collect personal data from children under the age of sixteen (16). If you are under sixteen (16), please do not use arenasresortwear.eu or provide any personal data to us.

If Arenas becomes aware that it has inadvertently collected personal data from a child under the age of sixteen (16) without verified parental or guardian consent, we will take steps to delete such data as promptly as possible. If you believe that a child under sixteen (16) has provided us with personal data, please contact us at hello@arenasresortwear.eu.

11.1 Third-Party Links

arenasresortwear.eu may contain links to third-party websites, including the websites of our shipping carrier, payment provider, and social media platforms. These links are provided for your convenience only. Arenas has no control over the content or privacy practices of those websites and accepts no responsibility for them. We encourage you to read the privacy policies of any third-party website you visit.

11.2 Social Media Platforms

Arenas maintains a presence on Instagram, Pinterest, TikTok, and other social media platforms. When you interact with Arenas on those platforms, the relevant platform acts as a data controller for the data processed through its platform. Arenas' use of social media platforms is governed by each platform's terms of service and privacy policy.

Where you tag Arenas in a post or otherwise share content featuring an Arenas product, you grant Arenas a non-exclusive licence to use that content for marketing purposes, as described in Article 8.5 of the Arenas Terms and Conditions. Arenas processes only the content and public profile data you make available; Arenas does not access private messages or non-public profile data via social media platforms.

12.1 Right to Amend

Arenas reserves the right to amend this Privacy Policy at any time to reflect changes in applicable law, our data processing activities, or our business operations. The most current version of this Privacy Policy is available at all times at arenasresortwear.eu/privacy.

12.2 Notification of Material Changes

Where we make a material change to this Privacy Policy that affects how we process your personal data, we will notify you by email (where we hold your email address) or by means of a prominent notice on arenasresortwear.eu, at least fourteen (14) days before the change takes effect.

Where a material change requires your consent (e.g. a new processing purpose for which we rely on consent), we will seek your consent before the change takes effect. Your continued use of arenasresortwear.eu following notification of a non-material change constitutes your acknowledgement of the updated Privacy Policy.

12.3 Version History

Version 1.0 — Effective date: [ ] — Initial version.

13.1 How to Reach Us

For any questions, concerns, or requests relating to this Privacy Policy or the processing of your personal data by Arenas, please contact us at:

Email: hello@arenasresortwear.eu Post: Arenas · [ ], Valencia, Spain Website: arenasresortwear.eu/privacy

13.2 Data Protection Officer

Arenas is a small-scale consumer brand that does not meet the thresholds requiring the mandatory appointment of a Data Protection Officer (DPO) under Article 37 GDPR. Data protection matters are handled directly by Camila Arenas, who can be reached at hello@arenasresortwear.eu.

Where Arenas appoints a DPO in the future, the contact details will be updated in this Privacy Policy and communicated to the supervisory authority as required.

13.3 Response Times

Arenas will acknowledge receipt of any privacy-related enquiry or data subject request within two (2) business days and will provide a substantive response within one (1) calendar month of receipt. Where a request is complex or numerous, we may extend this period by a further two (2) months, in which case we will inform you of the extension and the reasons for it within the first month.