Privacy information

OPTIONAL NATURE OF DATA PROVISION AND WITHDRAWAL OF CONSENT

Except for browsing data collected automatically, the provision of personal data is always voluntary and optional, although failure to provide such data may prevent the sending of messages, requests for information or assistance, as well as the submission of complaints, reports and support requests in general.

Where required, consent to data processing is also optional, but necessary if the data subject wishes to subscribe to the newsletter and/or receive personalized commercial communications. Full information on data processing is available in the privacy notices attached to the relevant forms.

The data subject may withdraw consent at any time, both for marketing and profiling purposes, by accessing their personal area after registration, by using the unsubscribe function available at the

bottom of the commercial communications received, or by sending a request to privacy@aeffe.com.

PERSONAL DATA OTHER THAN THOSE REQUESTED IN CONTACT FORMS

As contact forms on the Website contain free-text fields and may in some cases allow file uploads, Users are invited to verify the personal data they intend to share, avoiding the disclosure of special categories of personal data, such as data revealing political opinions, religious or philosophical beliefs, health status, sex life or sexual orientation.

If Aeffe S.p.A. considers that such data have been communicated by mistake or are not necessary to process the request received, it will disregard them and/or delete them immediately.

PERSONAL DATA RELATING TO OTHER INDIVIDUALS

For the same reasons outlined above, contact forms and attached files may contain personal data relating to other individuals (for example, where an order is to be delivered to a person other than the purchaser).

Should the User decide to communicate such data, they assume full responsibility for doing so, including where they act under authorization from the data subject concerned.

Data Controller: Aeffe S.p.A.



  1. Purchase (including without registration)

It is possible to make an online purchase without registering on the portal. Your data will be processed solely for the purpose of correctly identifying you, enabling the purchase and shipment of products in accordance with the General Terms and Conditions of Sale, and ensuring invoicing as required by law.

Data Controllers: Aeffe S.p.A. and Drop Srl for invoicing purposes.

  1. Customer Care / Online Shop Customer Service

Management of and responses to reports, requests for after-sales information (including order status and tracking), purchase assistance, returns, refunds, order cancellations and complaints submitted by customers, in accordance with the General Terms and Conditions of Sale, through online forms and paper forms made available by Aeffe S.p.A. on its website.

This purpose also includes the processing of product photos/images where necessary to handle the request in compliance with the General Terms and Conditions of Sale.

Data Controller: Aeffe S.p.A.

Legal basis for purposes 1, 2 and 3: processing is based on pre-contractual and contractual measures where data processing is necessary for activities preceding a purchase and for the

performance of the purchase itself. For invoicing purposes, the legal basis is compliance with a legal obligation.

Consequences of failure to provide data: processing is necessary to fulfil the customer's request for the purposes indicated. Failure to provide, or the incorrect provision of, mandatory information may make it impossible for the Data Controllers to complete the purchase of products and provide the requested services.

Optional Purposes

The purposes described below under points 4 and 5 are optional and entirely based on your consent. Two separate consents are required:

  • the first (point 4) for receiving promotional communications from Aeffe S.p.A.;

  • the second (point 5) for profiling activities, including the creation of your profile, analysis of habits and consumption preferences, and the provision of offers tailored to your interests.

You may withdraw your consent at any time by accessing your personal account area or by contacting Aeffe S.p.A. at privacy@aeffe.com.

  1. Direct Marketing

Subject to your freely given consent, Aeffe S.p.A. may process your data for market research,

customer satisfaction surveys, statistics, invitations to events and promotional activities, including the sending of advertising and promotional material by e-mail, postal mail, SMS and/or telephone calls.

Such communications may also be sent via WhatsApp where specifically requested by the customer.

Interactions with promotional communications may also be processed, including email open rates and clicks on links, banners and buttons.

  1. Profiling

To improve the identification of products that may be of interest to you, Aeffe S.p.A. may use your data to create a profile, analyse consumption habits and preferences, and send tailored offers through e-mails, newsletters and dedicated messages.

Your data may also be used to personalise online advertising displayed while browsing search engines or social media platforms (e.g. Google, Pinterest, etc.).

Legal basis: the data subject's consent.

Consequences of refusing consent: refusal to consent to Direct Marketing and Profiling activities will not affect your ability to purchase products or receive services.

Withdrawal of consent: consent may be withdrawn at any time, including with regard to WhatsApp communications. To stop receiving WhatsApp promotional messages, send a message containing the text "STOP WHATSAPP".

Processing Methods

Data are processed using manual, electronic and telematic tools designed to ensure data security, integrity and confidentiality, in compliance with Articles 5 and 32 GDPR.

Recipients of the Data

The following parties may receive or access personal data:

Third Parties

  • Companies belonging to the Aeffe Group for legitimate internal administrative purposes;

  • Drop Srl for tax and accounting compliance purposes;

  • Banks and third-party payment providers (e.g. PayPal, Scalapay, Klarna);

  • Companies managing tax and accounting compliance services (e.g. Tax Free services);

  • Traditional and electronic postal service providers;

  • Legal consultants and independent professionals acting as independent Data Controllers;

  • Public authorities and bodies authorised by law;

  • Companies managing artificial intelligence systems and platforms used for purchases;

  • Other entities where data disclosure is necessary to achieve the above purposes.

Data Processors

  • Companies, consultants and professionals appointed to manage legal, tax, accounting and administrative compliance obligations;

  • Marketing service providers and providers of online product search optimisation services;

  • IT, web and other service providers necessary for managing the relationship.

Within the Company Structure

Your personal data will be processed exclusively by personnel expressly authorized by the respective Data Controllers and bound by confidentiality obligations.

Transfer of Data to Third Countries

Aeffe S.p.A. uses the hosting provider Cloudflare, Inc., located in the United States, a country outside the European Union. The Data Controller has verified the existence of adequacy decisions issued by the European Commission for the recipient country, particularly in relation to the provider's

participation in the EU-US Data Privacy Framework (adequacy decision of 10 July 2023 pursuant to Article 45 GDPR).

Depending on the circumstances, additional safeguards may include the execution of Standard Contractual Clauses (SCCs) and verification of supplementary measures adopted in accordance with EDPB Recommendation 01/2020.

By way of derogation, where applicable under Article 49 GDPR, the existence of a contract, pre-contractual measures in favour of the data subject or the data subject's consent to the transfer may constitute a lawful basis for the transfer.

The personal data for which Drop Srl acts as Data Controller are processed within the European Union and are not transferred outside the EU.

Disclosure

Your personal data will not be disclosed to the public in any form.

Retention Period

In accordance with the principles of lawfulness, purpose limitation and data minimisation set out in Article 5 GDPR, personal data necessary for the requested services will be retained only for as long as necessary to achieve the purposes for which they were collected.

  • Registration data will be retained until the user account is deleted or after five years of inactivity.

  • Data processed for optional purposes (Direct Marketing and Profiling) will be retained until consent is withdrawn. Two years after consent has been obtained, a communication will be sent allowing the data subject to confirm or withdraw such consent.

  • Purchase-related data may be retained for longer periods in compliance with legal obligations, for example at least ten years for tax purposes.

Data Controller

The Data Controller is AEFFE S.P.A., Via delle Querce 51, 47842 San Giovanni in Marignano (RN), Italy, VAT No. 01928480407, Tel. +39 0541 965211.

Further information may be requested by writing to privacy@aeffe.com. Data Protection Officer (DPO):

Studio Paci C C. Srl (Contact Person: Dr. Gloriamaria Paci) E-mail: dpo.aeffe@studiopaciecsrl.it

Telephone: +39 0541 1795431 PEC: studiopaciecsrl@pec.it

Data Controller (Tax and Accounting Purposes Only)

For purposes related exclusively to tax and accounting obligations arising from online purchases, the Data Controller is:

Drop Srl

Via Sandro Pertini 1, 63812 Montegranaro (FM), Italy VAT and Tax Code No. 01383870431

E-mail: privacy@drop.it

DPO: dpo@drop.it

Rights of the Data Subject

Data subjects have the right to obtain:

  • confirmation as to whether personal data concerning them are being processed;

  • information regarding:

    • the origin of the data;

    • the purposes and methods of processing;

    • the logic applied where processing is carried out electronically;

    • identification details of the Controller and Processors;

    • categories of recipients to whom the data may be disclosed. Data subjects also have the right to:

  • update, rectify or supplement data;

  • request erasure, anonymisation or restriction of unlawfully processed data;

  • receive confirmation that rectification or erasure has been notified to recipients;

  • obtain data portability;

  • object to processing for legitimate reasons;

  • object to processing for direct marketing purposes. Complaints may be lodged with the competent Supervisory Authority. Consent

By acknowledging this Privacy Notice, registration on the website will be recorded together with the IP address associated with the user, as well as the date and time of registration.

Any consent granted for Direct Marketing and Profiling purposes (points 4 and 5) will be recorded together with the IP address, e-mail address, date and time by selecting the relevant checkbox and subsequently clicking the "Submit", "OK" or "Register" button.

Such consents will be archived as evidence of consent and to enable withdrawal at any time as well as the exercise of all the rights described above.