PRIVACY POLICY
INFORMATION NOTICE ON THE PROCESSING OF CUSTOMERS’ PERSONAL DATA PURSUANT TO ARTICLE 13 OF (EU) REGULATION 2016/679 (“GDPR”)
DATA CONTROLLER: Autonomous Data Controller:
Percassi Retail S.r.l., Via Giorgio e Guido Paglia n. 1/D, 24122 Bergamo (Italy), tax code and VAT Number 04307790164, e-mail: privacy.pr@percassi.com, and its subsidiaries, licensees of each trademark
Hereinafter, jointly or individually as the case may be, referred to also as the “Company” and/or the “Data Controller(s)”.
DATA PROTECTION OFFICER (“DPO”): You can reach the DPO at the following e-mail address: dpo.percassiretail@percassi.com
PERSONAL DATA PROCESSED
For online customers:
Browsing data (collected via pixels and/or cookies – with reference to the latter, see the Cookie Policy, which can be accessed at the link in the sidebar, at the bottom of the page), and data obtained through the use of widgets/social buttons.
The computer systems and software procedures employed to operate this Website acquire, in the course of their normal operation, certain personal data, whose transmission is implicit in the use of Internet communication protocols.
Such data are not collected to be linked to any data subjects further identified; however, by their very nature, they may allow user identification, through processing and association with data held by third parties.
This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), and other parameters relating to the user’s operating system and computer environment.
This data is used solely for the purpose of obtaining anonymous statistical information on website usage and to assess its proper operation, and is deleted immediately after processing, without prejudice to it being used for ascertaining liability in the event of cybercrimes to the detriment of the site.
The Company also processes the data you provide directly by creating a personal account and completing further website sections (such as, without limitations: personal data, contact data, any consent provided), and details of purchases you made.
If you have consented to marketing activities, the company also processes data on sending, receiving and opening promotional e-mails and newsletters and the related times.
If you login through social media, the Company, always in compliance with the principle of necessity and proportionality, may process your personal data, following your consent to their transfer provided to the social media network through which you may log in.
For customers in physical shops:
The Company processes the data provided directly by you during in-store purchases, and any completion by you or the shop staff of the form on a tablet or similar device at checkout (including, but not limited to: personal details, contact details, any consent provided), and any details of purchases you made.
If you have consented to marketing activities, the company also processes data on sending, receiving and opening promotional e-mails and newsletters and the related times.
PURPOSES OF PROCESSING
For online customers:
- Provision of e-commerce services for the online purchase and sale of products (including any ancillary services required, such as personal wishlists), shipping of purchased products and order tracking.
LEGAL BASIS OF PROCESSING: Performance of a contract to which you are a party.
DATA RETENTION TIME: Contractual term and, after its termination, for the ordinary retention period of 10 years.
- Registration and creation of a personal account on the Website and/or the apps (where available).
LEGAL BASIS OF PROCESSING: Performance of a contract to which you are a party.
DATA RETENTION TIME: Contractual term and, after its termination, for the ordinary retention period of 10 years.
- Standard operation of the website, operating system and IT environment
LEGAL BASIS OF PROCESSING: Performance of a contract to which you are a party.
DATA RETENTION TIME: For the time of navigation.
For all kinds of customers:
- Subscription to any loyalty programmes and/or initiatives organised by the Company, including through its social media pages.
LEGAL BASIS OF PROCESSING: Performance of a contract to which you are a party.
DATA RETENTION TIME: Contractual term and, after its termination, for the ordinary retention period of 10 years.
- Management of reports, complaints, and customer care activities, also by verifying your identity.
LEGAL BASIS OF PROCESSING: Performance of a contract to which you are a party.
DATA RETENTION TIME: Contractual term and, after its termination, for the ordinary retention period of 10 years.
- Fulfilment of obligations provided for by regulations and by applicable national and supranational legislation.
LEGAL BASIS OF PROCESSING: Need to fulfil legal obligations.
DATA RETENTION TIME: Statutory duration (10 years for administrative-accounting purposes).
- If necessary, to ascertain, exercise or defend rights (e.g. for debt collection).
LEGAL BASIS OF PROCESSING: Legitimate interest (judicial protection).
DATA RETENTION TIME: In the event of judicial litigation, for the entire duration thereof, until the deadline for appeals has been exhausted.
- Direct marketing (by both Data Controllers): including, but not limited to: sending – by automated contact methods (such as SMS, MMS, e-mail, social networks, instant messaging apps, push notifications) and traditional methods (such as manned phone calls and traditional mail) – newsletters, promotional and commercial communications relating to services/products offered by the Company, notification of company events, and customer satisfaction surveys, market research and statistical analyses.
LEGAL BASIS OF PROCESSING: Data subject’s consent (optional and revocable at any time).
DATA RETENTION TIME: Personal data (identification and contact data) shall be processed for this purpose until you withdraw your consent. Purchase data shall be processed for this purpose for 24 months.
- Data communication/transfer to third parties: your personal data and contact details shall be disclosed to our parent company, Odissea S.r.l., as well as to its subsidiaries or affiliates, even indirectly, belonging to the retail sector (both physical and digital), the food sector, the real estate sector and the sports sector (Womo S.r.l., Bullfrog S.r.l., Percassi Management S.r.l., Hexagon S.p.A. and its foreign subsidiaries for the brands: Victoria’s Secret; Bath and Body Works; L’Innominato S.p.A. and its foreign subsidiaries for the brands: Nike; Lego; Armani Exchange AX; Yves Saint Laurent; Garmin; Siren Coffee Srl for the brand: Starbucks; Food Management Srl for the brand: 30 Polenta; New Oak S.r.l. for the brand: Oakley), to our franchisors, joint-venture partners and/or to third parties indicated by the latter, to allow these companies to carry out marketing activities (by way of example, sending – by automated contact methods (such as SMS, MMS, e-mail, social networks, instant messaging apps) and traditional methods (such as manned phone calls and traditional mail) – newsletters, promotional and commercial communications relating to services/products offered by the companies, notification of company events, and for carrying out market studies and statistical analyses) concerning their products.
LEGAL BASIS OF PROCESSING: Data subject’s consent (optional and revocable at any time).
DATA RETENTION TIME: Until consent is revoked.
- Profiling: Analysis of your preferences, habits, behaviours, and interests, also by installing cookies (e.g. navigation analysis, monitoring of the products selected and the virtual shopping cart… see the Cookie Policy, which can be accessed at the link in the sidebar at the bottom of the page) in order to send you personalised commercial communications/targeted promotions/offers and services tailored to your needs/preferences.
LEGAL BASIS OF PROCESSING: Data subject’s consent (optional and revocable at any time).
DATA RETENTION TIME: Personal data (identification and contact data) shall be processed for this purpose until you withdraw your consent.
Purchase data shall be processed for this purpose for 12 months.
After the end of the aforementioned retention times, based on each purpose, the Data will be erased, cancelled or made anonymous, in accordance with the technical procedures for erasure and backup and the accountability requirements of the Data Controller.
Please note that the Data Controllers, in order to pursue the purposes set out in points 8, 9, and 10, will create a personal profile for you internally, within their centralised management system (CRM). Should you wish to request the deletion of such a personal profile from the CRM, you may exercise your right of deletion in the manner provided for in the “Data Subject’s Rights” section of this policy.
Furthermore, following your possible withdrawal of consent for any purpose requiring it, the Company shall continue to process your Data for the sole purpose of holding evidence that such activities must no longer be carried out in relation to you.
MANDATORY DATA TRANSFER
Personal and contact data are required for the conclusion of contractual relationships, such as, for example, to register your personal account or provide the services you have requested. Browsing data are required to carry out computer and digital protocols, and failure to provide them would prevent this website from functioning.
The provision of data for direct marketing, profiling, and third-party data disclosure purposes is entirely optional. These processing activities will be carried out only with your express and unequivocal consent, without prejudice to your right to withdraw your consent at any time. It should be noted that the withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal.
DATA RECIPIENTS
Data may be processed by external parties, in their capacity as Independent Data Controllers, such as, but not limited to, our franchisors, joint-venture partners and the companies in their respective groups, authorities and supervisory and control bodies, parties providing electronic payment services on their own circuits, social networks present or referred to on our websites, and any parties offering necessary website operation services.
Data may also be processed on behalf of the Company by external parties designated as data processors who are given appropriate operating instructions. These entities essentially belong to the following categories:
- Companies that offer email services
- Companies that offer services instrumental to the pursuit of the purposes indicated in this policy (media agencies, IT suppliers, couriers, etc.)
- Companies that offer support in carrying out market studies
- Freelancers, professional firms or companies offering professional services in accounting, tax, and legal matters, as well as banks, payment service providers, anti-fraud service providers, etc.
PARTIES AUTHORISED TO PROCESS YOUR DATA
The data may be processed by the employees of the company departments responsible for pursuing the afore-mentioned purposes who have been expressly authorised to do so and have received adequate operating instructions.
TRANSFER OF PERSONAL DATA TO NON-EU COUNTRIES
Your personal data may be transferred outside the European Union to the subjects indicated in the section “Data Recipients”, if required for the purposes set out in this information notice. The Company guarantees that your personal data shall be processed by these recipients in accordance with the applicable Data Protection Regulation. Such transfers may be based on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission. For further information, please write to: privacy.pr@percassi.com
DATA SUBJECT’S RIGHTS – COMPLAINT TO THE CONTROL AUTHORITY
By contacting the Data Controller, by post at the address Percassi Retail S.r.l., Via Giorgio e Guido Paglia n. 1/D 24122 Bergamo (Italy), marked for the attention of the Privacy Manager, or by email to the address privacy.pr@percassi.com, Data Subjects may ask the Data Controller for access to data concerning them, the erasure thereof, the rectification of inaccurate data, the completion of incomplete data, the restriction of processing, the objection to processing, and to exercise any other right as and when provided for by the GDPR.
By choosing to exercise your right to erasure, you are aware that the Data Controller may adopt the procedures deemed fit for ascertaining your identity. Furthermore, where the processing is based on consent or contract and is carried out by automated means, data subjects have the right to receive the data in a structured, commonly used and machine-readable format and, if technically feasible, to have them sent to another data controller without hindrance.
Data subjects have the right to withdraw the consent provided for marketing and/or profiling purposes at any time, and to object to the processing of their data for such purposes, either in its entirety or also limited to automated methods.
Data subjects shall have the right to lodge a complaint with the competent supervisory authority in the Member State where they habitually reside or work or in the country where the alleged infringement occurred.
CHANGES TO THIS POLICY
The Company reserves the right to amend this Privacy Policy, in whole or in part, or simply update its contents, i.e. following any amendments in applicable law. The Company, therefore, prompts you to consult this Privacy Policy on a regular basis, for the most recent and up-to-date version thereof.