Privacy notice

INFORMATION
ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679

Data Subjects: Users of e-commerce services

“POLLINI RETAIL S.P.A.”, in its capacity as Data Controller of your personal data, pursuant to and for the purposes of Regulation (EU) 2016/679, hereinafter the “GDPR”, hereby informs you that the aforementioned legislation provides for the protection of data subjects with regard to the processing of personal data, and that such processing will be carried out in accordance with the principles of fairness, lawfulness, transparency and the protection of your privacy and your rights.

Your personal data will be processed in accordance with the legislative provisions of the aforementioned regulation and the confidentiality obligations set out therein.

Source of the data: Your data are collected directly from you when you register on the website, when you purchase a product without registering, or as part of online promotional campaigns (e.g. campaigns on social networks).

Purposes and legal basis of processing: Your data will be processed to provide the available features, including management of the shopping cart (Shopping Bag), selection of one or more items, storage of the contents of the cart from your previous visit, commercial transactions using the payment methods you have chosen, and other ancillary and functional services designed to make it easier for you to select items. They will also be processed, where requested, for invoicing in accordance with applicable law, transport logistics, delivery and collection, and, where applicable, after-sales activities and verification of service efficiency. The Data Controller hereby informs you that the authentication process for your account with the provider of the payment service selected to purchase one or more products from the Store (including Satispay, PayPal, Scalapay, Amazon, etc.) is managed by that provider in its capacity as an independent data controller.

1) Registration on the website: Registration on the website is intended to ensure your proper identification in connection with a potential or actual purchase. Registration will allow you to create a user profile without having to enter your data again for subsequent purchases. Your profile will store your details relating to your residential address, any delivery address (if different from your residential address), your tax identification number where required by law, and your purchase history. You may request deletion of your user profile at any time.

2) Purchase without registration: You may make an online purchase without registering on the website. In this case, your data will be processed solely to identify you correctly, enable you to make the purchase and arrange shipment in accordance with the general terms and conditions of the contract, and issue invoices as required by law.

3) Customer care / Online Shop customer service: Handling and responding to any reports, after-sales information requests (including order status and tracking), purchase assistance, returns, refunds, order cancellations and complaints submitted by the Customer, in compliance with the general terms and conditions of sale, through the online forms and paper forms made available by the Data Controller on the website. This purpose also includes the processing of product photographs/images where necessary to handle the request, in compliance with the general terms and conditions of sale.

The legal basis for processing for purposes 1, 2 and 3 is the performance of pre-contractual measures and the contract, insofar as data processing is required for steps taken prior to purchase and for the purchase itself. The legal basis for issuing purchase invoices is compliance with a legal obligation.

Consequences of failure to provide data: Processing of the data is necessary in order to fulfil the Customer’s request for the purposes indicated. Failure to provide, or the incorrect provision of, any mandatory information may make it impossible for the Data Controller to guarantee the purchase of products and the provision of any additional services requested.

Optional purposes: The purposes described below in points 4 and 5 are optional and not mandatory; they will be pursued solely on the basis of your consent. In particular, two separate consents are requested: the first (point 4) for sending promotional communications by Pollini Retail S.p.A., as Data Controller; the second (point 5) for profiling (creating your profile and analysing your habits or consumption choices in order to suggest, through various channels, offers based on your preferences). You may withdraw your consent at any time by accessing your personal area, if registered, by using the automatic mechanisms provided at the bottom of each email received, or by sending a request to the Data Controller using the contact details below: privacy@pollini.com.

4) Direct marketing and use of tracking pixels: Subject to your freely given consent, the Data Controller, Pollini Retail S.p.A., may process your data, where applicable, for market research, customer satisfaction surveys, statistical analyses, invitations to events and promotional activities, including the sending of advertising and promotional material by email, post and/or SMS and/or telephone calls, other than those necessary to perform the contractual relationship. These communications may also be sent through the WhatsApp channel, where expressly indicated by the customer in the data collection form. In connection with the sending of promotional material to your email inbox, including emails and newsletters, interactions with the communications sent may also be processed (e.g. email open rates and any clicks on links, banners and/or buttons).

For this purpose, we use tracking technologies (tracking pixels) in our promotional communications and newsletters. These technologies allow us to detect email opens and collect technical information, such as the date and time of opening, IP address and data relating to the device used, in order to monitor the effectiveness of promotional campaigns and improve our communications.
You may withdraw your consent to tracking at any time by using the relevant link at the bottom of each newsletter, without having to stop receiving promotional communications; those communications will no longer be monitored using these tools. Tracking pixels may nevertheless be used in specific service communications or communications relating to the contractual relationship, for example those concerning contractual changes, deadlines or security notices, exclusively where the conditions laid down by applicable law for their use without consent are met.

5) Profiling: In order to improve your search for products that may meet your needs, we would like to use your data to create your profile and analyse your habits or consumption choices, so as to suggest, through various channels, offers based on your preferences, including by means of emails, newsletters or messages addressed specifically to you. Your data will also be used to personalise online advertisements, for example while you browse search engines or social media platforms (e.g. Google, Pinterest, etc.).

The legal basis for processing for purposes 4 and 5 is the data subject’s consent.

Consequences of not giving consent for optional purposes: Failure to give consent for the optional purposes referred to in points 4 and 5 (Direct Marketing and Profiling) will not affect your ability to purchase products or receive the service.

How to withdraw consent: You may withdraw your consent at any time by accessing your personal area, by using the automatic mechanisms provided at the bottom of each email received, or by sending a request to the Data Controller using the contact details below: privacy@pollini.com. To stop receiving promotional communications via WhatsApp, you may send a message containing the words “STOP WHATSAPP”.

Methods of processing: Processing is carried out using manual and/or computer and electronic tools in such a way as to ensure the security, integrity and confidentiality of the data, in compliance with the physical and logical organisational measures required by applicable provisions, and to minimise the risks of destruction or loss, unauthorised access, alteration and unauthorised disclosure, in accordance with Articles 5 and 32 of the GDPR.

Recipients: In order to carry out certain activities or provide support for the operation and organisation of the business, some data may be made known or disclosed to recipients. These recipients are divided into the following categories:

Third parties: (disclosure to: natural or legal persons, public authorities, services or other bodies other than the data subject, the data controller, the data processor and persons authorised to process personal data), including:

• Companies belonging to the Aeffe Group, within the scope of legitimate intra-group communications for internal administrative purposes;
• Banks for the management of collections and payments and third-party companies performing the same activities, such as providers of the payment methods selected by the data subject (including Satispay, PayPal, Scalapay, Amazon, etc.);
• Companies responsible for managing regulatory, tax and accounting obligations connected with the purchase (e.g. Tax Free requirements);
• Companies providing traditional or electronic postal services;
• Consultants and self-employed professionals, including professional firms, in the legal field, etc., acting as independent data controllers;
• Bodies/entities which, by virtue of a legal obligation, are entitled to access your data;
• Any other parties to whom the data must be disclosed in order to achieve the purposes indicated above.

Data Processors: (the natural or legal person, public authority, service or other body that processes personal data on behalf of the Data Controller), including:

• Companies and other entities, consultants and self-employed professionals appointed to manage mandatory tax, administrative and accounting requirements, legal consultancy and similar matters;
• Any providers of IT, web or other services necessary to achieve the purposes required for managing the relationship.

Within the company: Your data will be processed solely by personnel expressly authorised by the relevant Data Controllers, who are required to comply with confidentiality agreements.

Transfers of data to third countries: The Data Controller uses the hosting provider Amazon.com, Inc., located in the United States, a country outside the EU. The Data Controller has verified the existence of an adequacy decision for the recipient country adopted by the Commission, with particular reference to the provider’s participation in the Data Privacy Framework (adequacy decision of 10/07/2023, pursuant to Article 45 of the GDPR, “EU-US Data Privacy Framework”). Depending on the circumstances, other safeguards for transfers to recipients may include the execution of standard contractual clauses and verification of the adoption of any supplementary measures in accordance with EDPB Recommendation 01/2020. By way of derogation from these safeguards, for data processing activities (with reference to Article 49 of the GDPR), where applicable, the existence of a contract or pre-contractual measures in favour of the data subject, or consent to the transfer, is verified.

Disclosure: Your personal data will not be disclosed to the public in any way.

Retention period: In compliance with the principles of lawfulness, purpose limitation and data minimisation set out in Article 5 of the GDPR, we inform you that your personal data necessary to perform the requested services will be retained for no longer than is necessary to achieve the purposes for which they were collected.
- In the case of registration on the website, your data will be retained until you request deletion of your account or following a period of inactivity of 5 years.
- Data relating to the optional purposes (4. Direct Marketing - 5. Profiling) will be retained until consent is withdrawn. Consent may be withdrawn by accessing your personal area, using the automatic mechanisms provided in emails, or sending a request to the Data Controller using the contact details provided. Two years after consent is obtained, a communication will be sent to the contact channels provided, allowing you to withdraw your consent or confirm that it should remain in place.
- Subject to the same data protection methods and safeguards, if you have made a purchase, your data may be retained for the period required by applicable law, for example, for at least 10 years under tax legislation.

Data Controller: The Data Controller of the personal data, pursuant to applicable law, is “POLLINI RETAIL S.P.A.”, with registered office at Strada Erbosa Uno, 92 - 47043 Gatteo (FC), Italy, VAT No. 03527510154, represented by its legal representative pro tempore. You may request further information regarding the data you have provided by sending an email to privacy@pollini.com.

The Data Protection Officer (“DPO”) is Studio Paci & C. Srl (Contact person: Luca Di Leo), who can be contacted at dpo.pollini@studiopaciecsrl.it or by telephone on 0541-1795431.

Regulation (EU) 2016/679: Articles 15, 16, 17, 18, 19, 20, 21 and 22 - Rights of the Data Subject
1. The data subject has the right to obtain confirmation as to whether or not personal data concerning them are being processed and, where that is the case, to obtain access to the personal data and the following information (Right of access):

a) the purposes of the processing;
b) the categories of personal data concerned;
c) the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
d) where possible, the envisaged period for which the personal data will be stored or, if that is not possible, the criteria used to determine that period;
e) the existence of the right to request from the Data Controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject, or to object to such processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the personal data are not collected from the data subject, any available information as to their source;
h) the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) of the GDPR and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

2. The data subject has the right to:

a. obtain the rectification of inaccurate personal data concerning them without undue delay (Right to rectification);
b. obtain the erasure of personal data concerning them without undue delay where one of the grounds set out in Article 17 of the GDPR applies (Right to erasure);
c. obtain restriction of processing where one of the cases set out in Article 18 of the GDPR applies (Right to restriction of processing);
d. receive the personal data concerning them in a structured, commonly used and machine-readable format, where the conditions set out in Article 20 of the GDPR are met (Right to data portability);
e. object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6(1)(e) or (f), including profiling based on those provisions (Right to object);
f. not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them, subject to the exceptions set out in Article 22 of the GDPR (Automated individual decision-making, including profiling).

Complaints: Where the relevant conditions are met, data subjects also have the right to lodge a complaint with the Italian Data Protection Authority (Garante) as the supervisory authority, in accordance with the applicable procedures. For any further information, and to exercise the rights granted to you, you may contact the Data Controller using the contact details provided above.

CONSENT
Consent collection statement

Having received the information provided by the Data Controller in this privacy notice, your registration on the website will be recorded, identifying the IP address associated with your data, as well as the time and date of registration. Any consent you give to the processing of your data for the purposes of direct marketing and profiling, respectively points (4) and (5), will be recorded (IP address, email address, date and time) when you tick/click the relevant box and immediately after you press the “submit” / “OK” / “register” button.
Such consents will be stored as evidence that they were given and to enable you to withdraw them at any time, as well as to exercise all the other rights set out above.