Privacy policy

PRIVACY POLICY

INFORMATION ON THE PROCESSING OF PERSONAL DATA

PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679

Data Subjects: users and customers of the website www.albertaferretti.com operated by AEFFE S.P.A.

WHY THIS NOTICE

Pursuant to Regulation (EU) 2016/679 (hereinafter the "Regulation" or "GDPR"), this page describes the methods used to process the personal data of users and customers of the website of AEFFE S.P.A., accessible electronically at the following address: www.albertaferretti.com.

This notice does not apply to other websites, pages, or online services that may be accessed through hyperlinks published on this website and referring to resources outside the www.albertaferretti.com domain.

DATA CONTROLLERS

Following consultation of the website or the purchase of products through the website, personal data relating to identified or identifiable natural persons may be processed.

AEFFE S.P.A.

Registered office: Via delle Querce 51, 47842 San Giovanni in Marignano (RN), Italy VAT No.: 01928480407

Email: privacy@aeffe.com Tel.: +39 0541 965211

Aeffe S.p.A. acts as Data Controller for the processing of your personal data relating to website browsing, registration on the online portal, orders placed, responses to customer care requests and, more generally, to ensure the functionality of the website. Subject to your freely given consent, Aeffe S.p.A. may also process your data for optional marketing and profiling purposes.

Drop Srl

Registered office: Via Sandro Pertini 1, 63812 Montegranaro (FM), Italy Tax Code, Companies Register Number and VAT No. 01383870431 Email: privacy@drop.it

Drop Srl acts as Data Controller for your personal data solely for the purposes necessary to comply with tax and accounting obligations arising from purchases made through the website's online store.

Legal basis: compliance with legal obligations and contractual obligations.

DATA PROTECTION OFFICER

The Data Protection Officer ("DPO") for Aeffe S.p.A. is Studio Paci & C. Srl (Contact Person: Dr. Gloriamaria Paci), who can be contacted at: dpo.aeffe@studiopaciecsrl.it, telephone +39 0541 1795431, certified e-mail (PEC): studiopaciecsrl@pec.it.

The Data Protection Officer ("DPO") of Drop Srl can be contacted at: dpo@drop.it. TYPES OF DATA PROCESSED, PURPOSES OF PROCESSING AND LEGAL BASIS

For the purposes of this notice, "personal data" means any information relating to an identified or identifiable natural person, directly or indirectly (Art. 4(1) GDPR); "data subject" means the natural person (user and/or customer of the Website) to whom the data relate; and "processing" means any operation or set of operations performed on personal data, whether or not by automated means (Art. 4(2) GDPR).



The personal data processed by Aeffe S.p.A. as a result of browsing the Website include:

  1. Browsing Data

Legal basis: processing necessary for website navigation – performance of a contract – Article 6(1)(b) GDPR.

The IT systems and software procedures used to operate this Website acquire, during their normal functioning, certain personal data whose transmission is implicit in the use of Internet communication protocols.

These data include IP addresses or domain names of users' computers and devices, URI/URL addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, numerical status codes returned by the server (success, error, etc.), and other parameters relating to the user's operating system and IT environment. These data are also processed in order to:

  • obtain aggregated and anonymous statistical information regarding Website usage (most visited pages, number of visitors by time period, geographical origin of visitors, etc.);

  • verify the proper functioning and accessibility of Website content;

  • prevent or combat cybercrime and fraudulent use of Website functionalities, including the reconstruction and traceability of security incidents.

Retention Period

Browsing data, in compliance with the principles of lawfulness, purpose limitation and data minimisation set out in Article 5 GDPR, will be retained for no longer than necessary to achieve the technical purposes described above, without prejudice to any requirements of judicial authorities for the investigation of criminal offences.

  1. Registration and Purchase Data Legal basis:

    • User registration and purchase – performance of a contract – Article 6(1)(b) GDPR

    • Invoicing and tax/accounting compliance – legal obligation – Article 6(1)(c) GDPR

Registration on the portal is necessary to properly identify the user in connection with a purchase.

Registration allows you to create a user profile without having to re-enter your data for future purchases. Your user profile will store your residential address, any delivery address (if different), tax identification number where required by law, and your purchase history. You may request deletion of your user profile at any time.

It is also possible to make online purchases without registering on the portal. In this case, your data will be processed exclusively for your identification, to allow the purchase and shipment of products in accordance with the General Terms and Conditions of Sale, and to enable legally required invoicing.

Information regarding first-level data processing is available in the specific privacy notices provided within the registration and purchase forms.

  1. Data Collected Through Cookies and Other Tracking Technologies

The Website uses:

  1. Technical cookies necessary for website navigation and functionality.

Legal basis: performance of a contract, as they are necessary for the service.

  1. Analytical cookies used to generate aggregated statistical analyses regarding the use of and interaction with the Website.

Legal basis: consent.

  1. Profiling cookies used to collect information regarding user preferences and generate reports for targeted advertising and marketing campaigns.

Legal basis: consent.

For analytical and profiling cookies, consent pursuant to Article 6(1)(a) GDPR is expressed by clicking the button accepting all cookies or by managing preferences through the customization options available, in accordance with the applicable Cookie Guidelines.

Complete information regarding cookie processing, purposes, retention periods, consent and withdrawal of consent is available in the Cookie Policy, accessible from the website footer.

  1. Direct Marketing

Legal basis: consent of the data subject – Article 6(1)(a) GDPR

By entering the personal data (identification and contact details) required in forms intended for direct marketing activities (including newsletter subscription), the User declares that they have read this Privacy Notice and voluntarily consent to the processing of their personal data for marketing purposes.

In addition to the information provided by the User, Aeffe S.p.A. also records the date and time the form was submitted, the referring page and the IP address of the device used for consent registration.

The collected data are used to send periodic e-mail communications containing information about new products available through the e-commerce platform, events and promotional initiatives of Aeffe S.p.A.

Interactions with promotional communications may also be processed, including email open rates and clicks on links, banners and buttons.

  1. Profiling

Legal basis: consent of the data subject – Article 6(1)(a) GDPR

By entering the personal data required in forms dedicated to profiling activities, the User declares that they have read this Privacy Notice, are over 16 years of age and voluntarily consent to profiling activities.

In addition to the data provided by the User, Aeffe S.p.A. acquires the date and time of submission, the referring page and the IP address of the device used to register consent.

Based on the specific profiling consent, Aeffe S.p.A. collects data capable of revealing consumer habits and lifestyle preferences based on the User's interactions with Website pages, purchased products and communications received.

Such data are combined and organized into clusters of Users with similar preferences in order to create profiles and provide personalized communications.

Interactions with promotional e-mails may also be processed.

  1. Additional Data Collected by the Data Controller

Subscription to the newsletter, requests to receive personalized commercial communications, and interaction with Website pages reached through social media marketing campaigns and landing pages allow Aeffe S.p.A. to collect additional information beyond that directly provided by Users.

Such information may include the date and time promotional emails are opened, content viewed and preferences demonstrated by recipients.

These data are used to establish customer relationships and to send news and information selected according to demonstrated preferences.

The legal basis for this processing is the data subject's consent pursuant to Article 6(1)(a) GDPR.

Further details are available in the full privacy notices associated with marketing campaign data collection forms.

  1. Social Media Policy

For information regarding the processing of personal data carried out by Social Media platform operators, please refer to the privacy policies published by the respective providers.

Aeffe S.p.A. processes personal data provided by users through its dedicated Social Media pages for the purposes of corporate promotion and advertising, in order to manage interactions with users (comments, public posts, messages, shares, etc.) in compliance with applicable data protection legislation and this Privacy Notice. Where required, user consent is collected after informing the user of the purposes of processing and the voluntary nature of providing data.

Personal or sensitive data contained in comments or public posts on social media channels may be removed.

  1. Customer Care

Legal basis: performance of a contract – Article 6(1)(b) GDPR.

Management of and responses to reports, after-sales information requests (including order status and tracking), purchase assistance, returns, refunds, order cancellations and customer complaints submitted in accordance with the General Terms and Conditions of Sale.

SOURCE OF THE DATA

Data are collected directly by Aeffe S.p.A. from data subjects during website registration, product purchases made without registration, or within online promotional campaigns (e.g. social media campaigns).

Following a purchase, Drop Srl acquires the data subject's information through the Aeffe S.p.A. website in its capacity as Data Controller.

Aeffe S.p.A. may also collect personal data where data subjects search for Aeffe S.p.A. products or brands, receive recommendations, or interact with artificial intelligence systems, platforms or tools, or similar digital channels that provide access to the online store.

Aeffe S.p.A. may also collect personal data where purchases are initiated or completed directly through such AI systems or platforms, where available, limited to the data necessary to manage requests, conclude and perform the sales contract, ship products, provide after-sales assistance, manage returns, refunds and complaints, and comply with legal, tax and accounting obligations.



VOLUNTARY PROVISION OF DATA AND WITHDRAWAL OF CONSENT

Except for browsing data collected automatically, the provision of personal data is always voluntary and optional. However, failure to provide data may prevent the sending of messages, requests for information or assistance, complaints, reports and support requests.

Consent to processing, where required, is optional but necessary if the data subject wishes to subscribe to the newsletter and/or receive personalized commercial communications.

Consent may be withdrawn at any time by accessing the personal account area, using the unsubscribe function available in communications received, or sending a request to privacy@aeffe.com.

PERSONAL DATA OTHER THAN THOSE REQUESTED IN CONTACT FORMS

Since contact forms contain free-text fields and may allow file uploads, Users are requested not to provide special categories of personal data, such as data revealing political opinions, religious or philosophical beliefs, health conditions, sex life or sexual orientation.

Where such data are provided by mistake or are not required to process a request, Aeffe S.p.A. will disregard and/or immediately delete them.

PERSONAL DATA RELATING TO OTHER INDIVIDUALS

Contact forms and attachments may contain personal data relating to other individuals (for example where goods are to be shipped to someone other than the purchaser).

Should Users decide to provide such data, they assume full responsibility for doing so, including where they act under authorization from the relevant data subject.

DATA RETENTION PERIOD

Personal data are retained only for the period strictly necessary to achieve the purposes described above.

In particular:

  • registration data are retained until account deletion or after five years of inactivity;

  • data processed for Direct Marketing and Profiling purposes are retained until consent is withdrawn; after two years, a communication will be sent requesting confirmation or withdrawal of consent;

  • data processed for contractual purposes are retained throughout the duration of the contract; purchase-related data may be retained for at least ten years in accordance with tax regulations.

The Data Controllers reserve the right to retain data for a longer period where necessary to establish, exercise or defend legal claims.

DATA RECIPIENTS

Recipients of the data collected in connection with the use of the services described above include entities appointed by the Data Controllers pursuant to Article 28 GDPR as Data Processors, as well as service providers operating in the fields of web agency services, digital communications, IT support, social media management for marketing campaigns, and other digital services. A complete list of such recipients may be requested by contacting privacy@aeffe.com or privacy@drop.it.



Certain data and information may also be transmitted to or collected by entities acting as independent Data Controllers, including third-party payment service providers selected by the data subject (e.g. PayPal, Scalapay, Klarna), cookie-related data generally anonymized before transmission for statistical purposes, and companies operating artificial intelligence systems, platforms or tools when purchases are initiated or completed through such systems.

Collected personal data are also processed by authorized personnel of the Data Controllers acting under specific instructions regarding the purposes and methods of processing.

SECURITY OF PROCESSING

Personal data transmitted and retained for the purposes described above are protected through specific technical and organizational security measures pursuant to Article 32 GDPR. These measures are intended to ensure, on an ongoing basis, the confidentiality, integrity and availability of personal data, as well as the ability to promptly restore access to and availability of data in the event of a physical or technical incident.

This protection also addresses risks of destruction, loss, alteration, unauthorized disclosure or unauthorized access to personal data.

Data transmitted through the Website are protected by SSL encryption. Contact forms are protected by Google's reCAPTCHA system, which distinguishes human access from automated access in order to prevent robotic systems from generating fraudulent submissions and compromising Website functionalities.

TRANSFER OF PERSONAL DATA TO NON-EU COUNTRIES

Aeffe S.p.A. uses the hosting provider Amazon.com, Inc., located in the United States, a country outside the European Union.

Aeffe S.p.A. has verified the existence of an adequacy decision adopted by the European Commission, particularly with reference to the provider's participation in the EU-US Data Privacy Framework (Adequacy Decision of 10 July 2023 pursuant to Article 45 GDPR).

Depending on the circumstances, additional safeguards may include the execution of Standard Contractual Clauses (SCCs) and the implementation of supplementary measures in accordance with EDPB Recommendation 01/2020.

Where applicable under Article 49 GDPR, transfers may also be based on the existence of a contract, pre-contractual measures in favor of the data subject, or the data subject's consent.

Personal data processed by Drop Srl remain within the European Union and are not transferred outside the EU.

DATA SUBJECT RIGHTS

Both Data Controllers guarantee the exercise of data subject rights with respect to the processing activities falling within their respective areas of responsibility. Requests may be submitted using the contact details provided above.

Data subjects have the right to:

  • access their personal data;

  • rectify inaccurate data;

  • obtain erasure of personal data;

  • obtain restriction of processing;

  • receive their data in a portable format;

  • object to processing;

  • withdraw consent where consent is the legal basis for processing. These rights may be exercised in accordance with Articles 15 to 22 GDPR.

A standard request form is also available from the Italian Data Protection Authority: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9038275

RIGHT TO LODGE A COMPLAINT

Data subjects who believe that the processing of their personal data through this Website infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority pursuant to Article 77 GDPR or to seek judicial remedies pursuant to Article 79 GDPR.

The complaint form is available at: https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/4535524