PRIVACY POLICY
INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF REGULATION (EU) 2016/679
Data Subjects: users and customers of the website www.moschino.com operated by AEFFE S.P.A. WHY THIS NOTICE
Pursuant to Regulation (EU) 2016/679 (hereinafter the "Regulation" or "GDPR"), this page describes the methods used to process the personal data of users and customers of the website of AEFFE S.P.A., accessible electronically at the following address: www.moschino.com.
This notice does not apply to other websites, pages, or online services that may be accessed through hyperlinks published on this website and referring to resources outside the www.moschino.com domain.
DATA CONTROLLERS
Following consultation of the website or the purchase of products through the website, personal data relating to identified or identifiable natural persons may be processed.
AEFFE S.P.A. Registered office: Via delle Querce 51, 47842 San Giovanni in Marignano (RN), Italy VAT No.: 01928480407 Email: privacy@aeffe.com Tel.: +39 0541 965211 Aeffe S.p.A. acts as Data Controller for the processing of your personal data relating to website browsing, registration on the online portal, orders placed, responses to customer care requests and, more generally, to ensure the functionality of the website. Subject to your freely given consent, Aeffe S.p.A. may also process your data for optional marketing and profiling purposes.
Drop Srl Registered office: Via Sandro Pertini 1, 63812 Montegranaro (FM), Italy Tax Code, Companies Register Number and VAT No.: 01383870431 Email: privacy@drop.it Drop Srl acts as Data Controller for your personal data solely for the purposes necessary to comply with tax and accounting obligations arising from purchases made through the website's online store.
Legal basis: compliance with legal obligations and contractual obligations. DATA PROTECTION OFFICER
The Data Protection Officer ("DPO") for Aeffe S.p.A. is Studio Paci & C. Srl (Contact Person: Dr. Gloriamaria Paci), reachable at: dpo.aeffe@studiopaciecsrl.it, telephone +39 0541 1795431, certified email (PEC): studiopaciecsrl@pec.it.
The Data Protection Officer ("DPO") for Drop Srl can be contacted at: dpo@drop.it. TYPES OF DATA PROCESSED, PURPOSES OF PROCESSING AND LEGAL BASIS
For the purposes of this notice, personal data means any information relating to an identified or identifiable natural person (Art. 4(1) GDPR); data subject means the natural person (user and/or
customer of the website) to whom the data relate; processing means any operation performed on personal data, whether or not by automated means (Art. 4(2) GDPR).
The personal data processed by Aeffe S.p.A. as a result of browsing the website include:
1) Browsing Data
Legal basis: data processing necessary for website navigation – performance of a contract – Art. 6(1)(b) GDPR.
The information systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
This category includes IP addresses or domain names of users' devices, URI/URL addresses of requested resources, time of requests, method used to submit requests to the server, size of files received in response, numerical status codes returned by the server (successful operation, error, etc.), and other parameters relating to the user's operating system and IT environment.
These data, necessary for browsing the website and accessing its contents, are also processed by Aeffe S.p.A. for the following purposes:
• obtaining aggregated and anonymous statistical information regarding website usage (most
visited pages, number of visitors by time slot or day, geographical areas of origin of visitors,
etc.);
• verifying the correct functioning and accessibility of website content;
• preventing or combating any form of cybercrime and fraudulent use of website functionalities,
including the reconstruction and traceability of security incidents.
Retention Period
In compliance with the principles of lawfulness, purpose limitation and data minimisation pursuant to Article 5 of the GDPR, browsing data will be retained for no longer than necessary to achieve the technical purposes described above for which the data are collected and processed, without prejudice to any need for investigations by judicial authorities.
2) Data Provided by the User
Legal basis: data processing necessary to respond to users' enquiries – performance of a contract – Article 6(1)(b) GDPR.
The optional, explicit and voluntary sending of messages to Aeffe S.p.A. contact addresses, private messages sent by users to institutional profiles/pages and social media accounts, as well as the completion and submission of forms available on the Controller's website, entail the collection of the sender's contact details, which are necessary to provide a response, together with any personal data included in such communications.
Specific privacy notices are published on website pages dedicated to particular services. Where required, user consent is collected, providing information from time to time regarding the purposes and voluntary nature of the data provision.
Retention period: Data provided by the user are retained for the time necessary to manage individual requests. Any
subsequent retention for statistical purposes requires the anonymisation of such data (without prejudice to possible requirements of judicial authorities).
3) Registration and Purchase Data
Legal basis:
• User registration and purchases - performance of a contract - Article 6(1)(b) GDPR;
• Invoicing and tax/accounting obligations - legal obligation - Article 6(1)(c) GDPR.
Registration on the portal is necessary to correctly identify the user before and in connection with a purchase. Registration enables the creation of a user profile without the need to re-enter data for future purchases. The user profile will store residence address, delivery address (if different), tax identification number where required by law, and purchase history. Users may request deletion of their user profile at any time.
Online purchases may also be completed without registration. In such cases, personal data will be processed solely for identification purposes, to enable the purchase and shipment of products in accordance with the General Terms and Conditions of Sale and to comply with legal invoicing requirements.
Information regarding first-level processing activities is available in the specific privacy notices included within the registration and purchase forms.
4) Data Collected through Cookies and Other Tracking Systems
The website uses:
a) Technical cookies necessary for navigation and proper use of the website. Legal basis: performance of a contract, as they are functional and necessary.
b) Analytical cookies used to generate aggregated statistical analyses regarding users' interaction with and use of the website. Legal basis: user consent.
c) Profiling cookies used to collect information about users' preferences and generate reports intended for targeted advertising and marketing campaigns. Legal basis: user consent.
For analytical and profiling cookies, consent under Article 6(1)(a) GDPR is provided by clicking the button to accept all cookies or by setting preferences through the customisation options made available, in accordance with the "Guidelines on Cookies and Other Tracking Tools" issued by the Italian Data Protection Authority.
Information concerning cookie processing, purposes, duration and management, including consent and withdrawal thereof, is available in the Cookie Policy, accessible from the website footer.
5) Direct Marketing
Legal basis: consent of the data subject – Article 6(1)(a) GDPR.
By entering the personal data (identification and contact details) requested in forms requiring consent for direct marketing activities (including newsletter subscription), the User declares that they have read this Privacy Notice and freely provides consent to the processing of personal data for marketing purposes.
In addition to the data provided by the User, Aeffe S.p.A. also collects the date and time of form submission, the referring page and the IP address of the device used to register the consent.
The data provided and collected by Aeffe S.p.A. are used to send periodic e-mail communications containing information about new products available through the e-commerce platform, events and promotional initiatives organised by Aeffe S.p.A.
Interactions with promotional e-mails may also be processed, including e-mail opening rates and clicks on links, banners and buttons.
6) Profiling
Legal basis: consent of the data subject – Article 6(1)(a) GDPR.
By providing the personal data (identification and contact details) requested in forms requiring consent for profiling activities, the User declares that they have read this Privacy Notice, are over 16 years of age and voluntarily consent to the processing of their personal data for profiling purposes.
In addition to the data provided by the User, Aeffe S.p.A. also collects the date and time of form submission, the referring page and the IP address of the device used to register the consent.
As a result of the specific consent granted for profiling activities, Aeffe S.p.A. acquires data and information capable of revealing consumption habits and lifestyles based on the preferences shown by the User through interaction with Website pages, purchased products and the content of communications received from Aeffe S.p.A.
Such data, combined and organised into clusters, namely groups of Users classified according to their demonstrated preferences, contribute to defining the User's profile and enable the delivery of personalised communications based on the relevant profile category.
Interactions with promotional communications sent to the User's email address may also be processed (for example, email open rates and clicks on links, banners and/or buttons).
7) Additional Data Collected by the Data Controller
Subscription to the newsletter, requests to receive personalised commercial communications, and interaction with Website pages that Users may access through social media as a result of marketing campaigns promoted by Aeffe S.p.A., which redirect users to specific landing pages, allow Aeffe S.p.A. to collect additional data beyond those directly provided by Users.
Examples include the date and time of opening newsletters and commercial emails, the content viewed and the preferences shown by recipients.
Such data are used to establish and maintain customer relationships and to send news and information selected on the basis of demonstrated preferences.
For the purposes described above, the legal basis for processing is the data subject's consent pursuant to Article 6(1)(a) GDPR, provided by selecting the relevant boxes within the newsletter subscription and personalised communications request forms.
Further details regarding the processing of user data, legal bases and processing methods are available in the full privacy notices accompanying marketing campaign data collection forms.
8) Social Media Policy
For information regarding personal data processing carried out by Social Media platform providers, users should refer to the privacy policies published by the respective platform operators.
Aeffe S.p.A. processes personal data provided through its dedicated Social Media pages for corporate promotion and communication purposes and to manage interactions with users (comments, public posts, messages, shares, etc.), in compliance with applicable data protection legislation and this Privacy Notice.
Where necessary, user consent is collected after providing information concerning the purposes of processing and the voluntary nature of data provision.
Personal or sensitive data included in public comments or posts on social media channels may be removed.
9) Customer Care
Legal basis: performance of a contract – Article 6(1)(b) GDPR.
Management of and responses to reports, after-sales information requests (including order status and tracking), purchasing assistance, returns, refunds, order cancellations and customer complaints in accordance with the General Terms and Conditions of Sale.
Source of the Data
Data are collected directly by Aeffe S.p.A. from the data subject during registration on the website, during purchases made without registration or through online promotional campaigns (for example, social media campaigns).
Following a purchase, Drop Srl acquires the data subject's data through the Aeffe S.p.A. website in its capacity as an independent Data Controller.
Aeffe S.p.A. may also collect personal data when users search for products or brands of Aeffe S.p.A., receive suggestions or interact with artificial intelligence systems, platforms or tools, or with other digital channels that make products available through the online store or enable access to it, acting as independent Data Controllers.
Aeffe S.p.A. may also acquire personal data where purchases are initiated or completed directly through such artificial intelligence systems or platforms, where available, limited to the data necessary to manage requests, conclude and perform the sales contract, ship products, provide aftersales assistance, manage returns, refunds and complaints, and comply with legal, tax and accounting obligations.
OPTIONAL NATURE OF DATA PROVISION AND WITHDRAWAL OF CONSENT
Except for browsing data collected automatically, the provision of personal data is always voluntary and optional. However, failure to provide such data may prevent the sending of messages, requests for information or assistance, as well as the submission of complaints, reports, or support requests in general.
Where required, consent to the processing of personal data is also optional; however, it is necessary if the data subject wishes to subscribe to the newsletter and/or receive personalised commercial communications. Complete information regarding data processing is available in the privacy notices attached to the relevant forms.
The data subject may withdraw consent at any time, both for marketing and profiling activities, by accessing their personal account area (following registration), by using the unsubscribe function
available at the bottom of commercial communications and/or profiling communications, or by sending a request to privacy@aeffe.com.
PERSONAL DATA OTHER THAN THOSE REQUESTED IN CONTACT FORMS
As the contact forms available on the Website contain free-text fields and may, in some cases, allow the uploading of files, Users are invited to carefully evaluate the personal data they choose to share and to avoid disclosing special categories of personal data, such as data revealing political opinions, religious or philosophical beliefs, health conditions, sex life, or sexual orientation.
Where Aeffe S.p.A. considers that such data have been communicated by mistake or are not necessary for handling the request received, it will disregard and/or immediately delete such data.
PERSONAL DATA RELATING TO OTHER INDIVIDUALS (OTHER THAN THE DATA SUBJECT)
For the same reasons described above, contact forms and attached files may contain personal data relating to other individuals (for example, where delivery of an order is requested to a person other than the purchaser).
Should the User choose to provide such data, they assume full responsibility for doing so, including where they act under an authorisation granted by the relevant data subject.
DATA RETENTION PERIOD
In accordance with the storage limitation principle set out in Article 5 GDPR, personal data are retained only for the period strictly necessary to achieve the purposes described above.
In particular:
• where a user has registered on the portal, personal data will be retained until the account is
deleted or after a period of five years of inactivity;
• data processed for optional purposes (Direct Marketing and Profiling) are retained until
consent is withdrawn. Two years after obtaining consent, the user will receive a
communication allowing them either to withdraw or renew such consent;
• for processing activities carried out in the performance of a contract or pre-contractual measures pursuant to Article 6(1)(b) GDPR, data are retained for the duration of the contractual relationship. Data relating to purchases may be retained for longer periods where required by law, for example for tax purposes for at least ten years.
The Data Controllers reserve the right to retain data for longer periods where necessary to establish, exercise or defend legal claims.
DATA RECIPIENTS
Recipients of the data may include processors appointed pursuant to Article 28 GDPR and service providers operating in the areas of web development, digital communication, IT support, social media services used for marketing campaigns and other digital service providers.
A complete list can be requested by writing to privacy@aeffe.com or privacy@drop.it.
Certain data and information may also be communicated to independent data controllers, including:
• third-party payment service providers chosen by the user (e.g. PayPal, Scalapay, Klarna);
• providers receiving anonymised cookie-related information for statistical purposes;
• operators of artificial intelligence systems, platforms or tools where purchases are initiated or
completed through such systems.
Personal data are also processed by authorised personnel acting under specific instructions from the Data Controllers.
PROCESSING SECURITY
Personal data are protected through appropriate technical and organisational security measures in accordance with Article 32 GDPR, ensuring confidentiality, integrity, availability and timely recovery of data in the event of physical or technical incidents.
Data transmitted through the Website are protected by SSL encryption. Contact forms are protected by Google's reCAPTCHA system, which distinguishes between human and automated access in order to prevent robotic systems from submitting fraudulent data.
TRANSFER OF PERSONAL DATA TO NON-EU COUNTRIES
Aeffe S.p.A. uses Amazon.com, Inc. as its hosting provider, located in the United States.
Aeffe S.p.A. has verified the existence of an adequacy decision by the European Commission, particularly with regard to the provider's participation in the EU-US Data Privacy Framework.
Depending on the circumstances, additional safeguards may include the execution of Standard Contractual Clauses (SCCs) and supplementary measures in accordance with EDPB Recommendation 01/2020.
The personal data processed by Drop Srl remain within the European Union and are not transferred to non-EU countries.
RIGHTS OF DATA SUBJECTS
Data subjects may exercise their rights by contacting the respective Data Controllers using the contact details provided above.
Data subjects have the right to obtain:
• access to personal data;
• rectification;
• erasure;
• restriction of processing;
• data portability;
• objection to processing;
• withdrawal of consent where consent constitutes the legal basis. Requests may be submitted directly to the Data Controllers.
Data subjects may also use the form made available by the Italian Data Protection Authority: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/9038275
RIGHT TO LODGE A COMPLAINT
Data subjects who believe that the processing of their personal data through this Website infringes the GDPR have the right to lodge a complaint with the Italian Data Protection Authority pursuant to Article 77 GDPR or to seek judicial remedies pursuant to Article 79 GDPR.
The complaint form is available at: https://www.garanteprivacy.it/home/docweb/-/docwebdisplay/docweb/4535524