INFORMATION
ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679 Data Subjects: Users of e-commerce services
“AEFFE S.P.A.”, and “Drop Srl,” acting as Data Controllers of your personal data, pursuant to and for the purposes of EU Regulation 2016/679 (hereinafter the “GDPR”), hereby inform you that the aforementioned regulation provides for the protection of data subjects with regard to the processing of personal data and that such processing will be based on the principles of fairness, lawfulness, transparency, and the protection of your privacy and rights. Your personal data will be processed in accordance with the legal provisions of the aforementioned regulation and the confidentiality obligations set forth therein.
Roles and Responsibilities: This section describes the roles of the companies that process your personal data following your registration on the website www.moschino.com or following a purchase from the online store on that same website.
- AEFFE S.P.A.
Aeffe S.P.A. is the data controller for your personal data relating to registration on the online portal, orders placed, and responding to customer service requests received (sections 1, 2, and 3 of this policy), and generally to ensure the functionality available on the website; as well as, subject to your free consent, for the optional marketing and profiling purposes described in sections 4 and 5 of this policy.
Drop Srl
Drop Srl is the data controller of your personal data solely for the purposes necessary to comply with regulatory obligations regarding tax and accounting matters arising from purchases made through the website’s online store.
• Legal basis: legal obligation and contractual obligation.
Source of data: The data is collected by Aeffe S.p.A. directly from the data subject during registration on the website, during the purchase of a product without registration, or as part of online promotional campaigns (e.g., social media campaigns). Drop Srl collects the data subject’s data, in its capacity as data controller, through the Aeffe S.p.A. website following a purchase.
Aeffe S.p.A. may also collect the data subject’s personal data if the data subject conducts searches related to Aeffe S.p.A.’s products or brands, receives recommendations, or interacts with artificial intelligence systems, platforms, or tools, or other similar digital channels that make the online store’s products available or allow access to the online store, in their capacity as independent data controllers.
Aeffe S.p.A. may also collect the data subject’s personal data if a purchase is initiated or completed directly through such artificial intelligence systems or platforms, where this functionality is available, limited to the data necessary for managing the request, concluding and executing the sales contract, shipping the products, providing after-sales support, managing returns, refunds, and complaints, as well as to comply with tax, accounting, and legal obligations.
Purpose and legal basis of the processing: Your data will be processed to ensure the availability of the following features, including the management of your shopping cart (Shopping Bag), selecting one or more items, retaining the contents of your shopping cart from your last login, processing commercial transactions using your chosen payment methods, and providing other ancillary and functional services to assist you in selecting items, as well as—when required—invoicing in accordance with applicable laws, logistics for shipping, delivery, and pickup, and, where applicable, after-sales activities and service performance evaluations. The Data Controllers hereby inform you that the authentication process for your account with the payment service provider you have chosen to purchase one or more products from the Store (including PayPal, Scalapay, Klarna, etc.) is managed by that provider in its capacity as an independent data controller.
1) Registration on the portal: Registration on the portal is required to ensure your proper identification in preparation for and during a purchase. Registration will allow you to create your own user profile so you won’t have to re-enter your information for future purchases. Your user profile will store your residential address, shipping address (if different from your residential address), tax ID number (if required by law), and your purchase history. You may request the deletion of your user profile at any time.
Data Controller: Aeffe S.p.A.
2) Purchase (even without registration): You can make an online purchase even without registering on the portal. Your data will be processed solely for the purpose of correctly identifying you, enabling you to make the purchase and arrange for shipping in accordance with the general terms and conditions of sale, and to facilitate invoicing as required by law.
Data Controller: Aeffe S.p.A. and Drop srl for invoicing.
3) Online Store Customer Care: managing and responding to any reports, after-sales inquiries (including order status and tracking), purchase assistance, returns, refunds, order cancellations, and complaints submitted by the Customer, in accordance with the General Terms and Conditions of Sale, via the online forms and paper forms made available by Aeffe S.p.A. on its website. This purpose also includes the processing of photos/images of products where necessary to fulfill the request, in accordance with the General Terms and Conditions of Sale.
Data Controller: Aeffe S.p.A. The legal basis for processing for purposes 1, 2, and 3 is pre-contractual and contractual, insofar as data processing is required in connection with activities prior to the purchase and the purchase itself. To enable the invoicing of purchases, the legal basis is a legal obligation.
Consequences of Failure to Provide Information: Data processing is necessary to fulfill the customer’s request for the purposes indicated; failure to provide, or the provision of incorrect, mandatory information may make it impossible for the Data Controllers to guarantee the purchase of the products and any additional services requested.
Optional Purposes: The purposes described below in points 4 and 5 are optional and not mandatory; their implementation is based solely on your consent. Specifically, two separate consents are required: the first (point 4) for Aeffe S.p.A., as the data controller, to send promotional communications; the second (point 5) for profiling (to define your profile, analyze your habits or consumption choices, and thereby suggest, through various means, offers tailored to your preferences). You may revoke your consent at any time by accessing your personal account (after registering), using the automated options at the bottom of every email you receive,
or by sending a request to the contact information of the data controller, Aeffe S.p.A., at privacy@aeffe.com.
4) Direct marketing: Subject to your free consent, the Data Controller, Aeffe S.P.A., may process your data for market research, customer satisfaction surveys, statistics, invitations to events, and promotional activities—including the sending of advertising and promotional material via email, regular mail, and/or text messages and/or phone calls—other than those necessary to ensure the performance of the contractual relationship. Such communications will also be sent via WhatsApp upon the customer’s express indication on the data collection form. With regard to the sending of promotional material to your email inbox, interactions with the communications sent (e.g., email open rates, any clicks on links and/or banners and/or buttons) may also be subject to processing.
5) Profiling: In order to improve the search for products that may meet your needs, Aeffe S.p.A. would like to use your data to create your profile and analyze your consumption habits or choices, so as to suggest, in various ways, offers based on your preferences—whether via email, newsletters, or personalized messages. Your data will also be used to personalize online ads, for example, while you are browsing search engines or social media platforms (e.g., Google, Pinterest, etc.).
The legal basis for processing for purposes 4 and 5 is the data subject’s consent.
Consequences of withholding consent for optional purposes: Withholding consent for the optional purposes referred to in purposes 4 and 5 (Direct Marketing and Profiling) does not affect the purchase of products or the provision of services.
How to withdraw consent: You may withdraw your consent at any time—including regarding the use of WhatsApp—by accessing your personal account, using the opt-out options at the bottom of every email you receive, or by sending a request to the contact information of the Data Controller, Aeffe S.p.A., at privacy@aeffe.com. To stop receiving promotional messages via WhatsApp, you can send a message with the text “STOP WHATSAPP.”
Methods of Processing: Data processing is carried out using manual and/or computerized and telematic tools, in a manner that ensures the security, integrity, and confidentiality of the data in compliance with the physical and logical organizational measures required by applicable regulations, so as to minimize the risks of destruction or loss, unauthorized access, alteration, and unauthorized disclosure, in accordance with the procedures set forth in Articles 5 and 32 of the GDPR.
Recipients: In order to carry out certain activities, or to support the operation and organization of the business, certain data may be disclosed to or communicated with recipients. These recipients are categorized as follows:
Third parties: (disclosure to: natural or legal persons, public authorities, services, or other entities other than the data subject, the data controller, the data processor, and authorized persons responsible for processing), including:
Aeffe Group companies, as part of legitimate intra-group communications for internal administrative purposes;
• Drop Srl, solely for the purposes necessary to comply with tax and accounting regulatory obligations arising from purchases made through the website’s online store.
• Banks for the processing of collections and payments, and third-party companies, for the same purposes, such as providers of the payment methods chosen by the data subject (including PayPal, Scalapay, Klarna, etc.);
• Companies responsible for managing tax and accounting compliance obligations related to the purchase (e.g., TaxFree compliance…);
• Companies that provide traditional or digital postal services;
• Consultants and independent professionals, including those operating as a group in legal matters, etc., acting as independent data controllers;
• Individuals or entities required to do so by law, whose right to access your data may be established by legal obligations;
• Companies that manage artificial intelligence systems, platforms, or tools, if the purchase is initiated or completed directly through such systems or platforms;
• Any other parties to whom the disclosure of data is necessary to achieve the purposes indicated above.
Data processors: (the natural or legal person, public authority, agency, or other body that processes personal data on behalf of the data controller)
Companies and other entities, consultants, and independent professionals who have been entrusted with managing mandatory tax, administrative, and accounting obligations, as well as legal consulting, etc.;
Providers of marketing services and services to improve online product search capabilities;
Providers of IT, web, or other services necessary to achieve the purposes required for managing the relationship.
Within the company: Your data will be processed solely by personnel expressly authorized by the individual Data Controllers, who are required to sign a confidentiality agreement.
Data transfer to third countries: Aeffe S.p.A. uses the hosting provider Cloudflare, Inc., located in the United States, a country outside the EU. The Data Controller has verified the existence of adequacy decisions for the recipient country issued by the Commission, with particular reference to the provider’s enrollment in the Data Privacy Framework (adequacy decision dated July 10, 2023, pursuant to Article 45 of the GDPR, “EU-US Data Privacy Framework”). Other safeguards for the transfer to recipients, depending on the specific circumstances, may include: the signing of standard contractual clauses, and verification of the adoption of any supplementary measures in accordance with EDPB Recommendation 01/2020. Notwithstanding these safeguards, for data processing (pursuant to Article 49 of the GDPR), where applicable, the existence of a contract or pre-contractual measures in favor of the data subject or consent to the transfer is verified.
Your personal data, for which Drop Srl is the data controller, is processed by Drop Srl within the European Union and is not transferred to countries outside the EU.
Disclosure: Your personal data will not be disclosed in any way.
Retention Period: Please note that, in accordance with the principles of lawfulness, purpose limitation, and data minimization, pursuant to Article 5 of the GDPR, the retention period for your personal data necessary to perform the requested services is set for a period not exceeding the time required to achieve the purposes for which it was collected.
- If you register on the portal, your data will be retained until you delete your account or following a 5- year period of inactivity.
- Data related to optional purposes (4. Direct Marketing - 5. Profiling) will be retained until you revoke your consent, which you may do by accessing your personal account, using the automated options provided in emails, or by sending a request to the Data Controller’s contact information. Two years after your consent is obtained, you will receive a notification via the contact channels you provided, allowing you to revoke your consent or confirm its continuation.
- Under the same terms and data protection safeguards, if you have made a purchase, your data may be retained for a period of time in compliance with the obligations prescribed by applicable laws—for example, in accordance with tax regulations, for at least 10 years.
Data Controller: The data controller, as defined by law, is “AEFFE S.P.A.”, with registered office at Via delle Querce 51 - 47842 San Giovanni in Marignano (RN), VAT No.: 01928480407, Phone: 0541 965211, in the person of its current legal representative. You may request further information regarding the data provided by sending an email to the following address: privacy@aeffe.com.
The Data Protection Officer (“DPO”) for Aeffe S.p.A. is Studio Paci & C. Srl (Contact: Dr. Gloriamaria Paci), who can be reached at the following address: dpo.aeffe@studiopaciecsrl.it, phone: 0541 - 1795431 and certified email (PEC): studiopaciecsrl@pec.it.
Data Controller solely for purposes related to compliance with regulatory obligations regarding tax and accounting matters arising from purchases made through the website’s online store: the Data Controller for personal data is Drop Srl, with registered office in Montegranaro (FM), Via Sandro Pertini No. 1, ZIP code 63812, Tax ID, Marche Regional Business Registry number, and VAT number 01383870431. Email: privacy@drop.it.
The Data Protection Officer (“DPO”) for Drop Srl can be contacted at the following email address: dpo@drop.it.
EU Regulation 2016/679: Articles 15, 16, 17, 18, 19, 20, 21, 22 – Rights of the Data Subject
1. The data subject has the right to obtain confirmation as to whether or not personal data concerning him or her are being processed and, if so, to obtain access to the personal data and to the following information (Right of access by the data subject):
a) the purposes of the processing;
b) the categories of personal data involved;
c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organizations;
d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
e) the existence of the data subject’s right to request from the controller the rectification or erasure of personal data concerning him or her, or the restriction of processing of such data, or to object to their processing;
f) the right to lodge a complaint with a supervisory authority;
g) where the data are not collected from the data subject, all available information regarding their origin;
h) the existence of automated decision-making, including profiling as referred to in Article 22, paragraphs 1 and 4 of the GDPR, and, at least in such cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
2. The data subject has the right to:
a. obtain the rectification of inaccurate personal data concerning him or her without undue delay (Right to Rectification);
b. obtain the erasure of personal data concerning him or her without undue delay if one of the grounds set forth in Article 17 of the GDPR applies (Right to Erasure);
c. have the processing of their personal data restricted when one of the following circumstances set forth in Article 18 of the GDPR applies (Right to Restriction of Processing);
d. receive their personal data in a structured, commonly used, and machine-readable format, provided the conditions set forth in Article 20 of the GDPR are met (Right to Data Portability);
e. to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them pursuant to Article 6(1)(e) or (f), including profiling based on those provisions (Right to Object);
f. not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning the data subject or similarly significantly affects the data subject, subject to the exceptions provided for in Article 22 of the GDPR (Automated decision-making regarding natural persons, including profiling)
Complaint: Data subjects, where the conditions are met, also have the right to file a complaint with the Data Protection Authority as the supervisory authority, in accordance with the established procedures. For any further information, and to exercise your rights, you may contact the data controller using the contact information provided above.
Consent
Form for Obtaining the Data Subject’s Consent
Once you have reviewed the information provided by the data controller in the privacy notice, your registration on the website will be recorded, including the IP address associated with your data, as well as the date and time of registration. Any consent you provide for processing for the purposes of direct marketing and profiling (points (4) and (5), respectively) will be recorded (IP address, email address, date, and time) by checking/clicking the relevant box, immediately after pressing the “Submit” / “OK” / “Register” button.
These consents will be archived to verify that they were given and to allow you to revoke them at any time, in addition to exercising all other rights set forth above.