PRIVACY NOTICE PURSUANT TO ARTICLE 14 OF REGULATION (EU) 679/2016
Etro S.p.A. (hereinafter, “Etro” or “Data Controller”), is an Italian company located at Via Spartaco, 3, 20135 - Milan, VAT Code 11905330962, as Data Controller will process your personal data in compliance with the Regulation (EU) 679/2016 (“GDPR”) and Legislative Decree No. 196/2003 as subsequently amended (“Italian Data Protection Code”) (together referred to as “Data Protection Law”).
Source of the data and categories of personal data
Etro collects personal data from third parties, such as other companies having a contractual relationship with Etro (“Partners”). Etro will process personal data you have provided to its Partners in compliance with the applicable data protection laws in your Country and only to the extent you consented to the transfer of your personal data to third parties and/or such transfer is allowed under the applicable law.
Etro may collect and process the following categories of personal data:
· Identification data (e.g. name, surname, gender, birthdate) and contact details (e.g. telephone number, e-mail address, address);
· ID and/or passport;
· Data related to preferences (e.g. kind of products, number of purchased products).
Purposes of the processing and legal basis
Etro will process your personal data only for specific purposes and to the extent that a proper legal basis exists, according to the Data Protection Law. In particular, the Controller will process your personal data as described in the table below.
In case the legal basis is the compliance with the law or the execution of a contract between you and the Controller, providing your personal data is necessary. In case of denial proving your personal data, you cannot access Etro’s services, nor purchase Etro’s products.
In the other cases, providing your personal data is not mandatory and your denial to provide such data will not affect the possibility to access Etro’s services or purchase Etro’s products.
Modalities of the processing
Your personal data will be processed by means of manual, computerized, telematic as well as paper-based tools and according to adequate security measures in order to ensure the protection of your personal data. Your personal data will be processed through the Etro’s Customer Relationship Management (“CRM Etro”) and the servers are located both within the EU and outside the EU.
Data communications
The Controller may share your personal data with the following categories of recipients:
· the employees and collaborators of the Controller, duly authorized and instructed to process personal data;
· third-parties services providers, which have been appointed as data processors;
· banks and external consultants;
· the competent authorities.
Data retention
Your personal data will be retained for a reasonable period of time as long as this is necessary for the purposes aforementioned or to comply with a legal obligation provided by the applicable law, and specifically for 10 years from the termination of the contractual relationship.
In any case, personal data processed for marketing purposes will be retained until you withdraw your consent, while personal data processed for profiling will be retained for 2 years since the last interaction between you and Etro.
After the data retention period expires, your personal data will be permanently anonymized and will be processed only in an aggregate manner.
Data transfers
Your Personal Data will be transferred outside the European Union. Etro will ensure that your personal data will be transferred in compliance with the Data Protection Law and, specifically, to the extent that the European Commission considered that there adequate the safeguards for personal data applicable in the receiving country or one of the other measures listed under Articles 46 ff. GDPR has been implemented. In any case, you are entitled to contact Etro, by sending an e-mail to the address below, in order to have further information about such transfer as well as obtain copy of the safeguards enforced to protect your personal data.
Your rights
At any point while we are in possession of or processing your personal data, you have the right to:
· Access and request a copy;
· Request the rectification;
· Request the erasure;
· Obtain restriction of processing;
· Object to the processing (including for soft spam based on the legitimate interest;
· Receive it in a structured, commonly used and machine-readable format and to transmit such data without hindrance to another data controller, where technically feasible and where the processing is based on consent;
You have also the right to withdraw your consent at any time, without prejudice to the processing of personal data carried our prior the withdrawal.
Contact
For the exercise of your rights, to withdraw your consent and to get further information on your personal data, you may contact Etro by sending a written communication via mail to Etro S.p.A. (C.F. N. e P.IVA 11905330962), to the address in Via Spartaco 3 – 20135 Milan, or by sending an e-mail to privacy@etro.com or via fax to: + 39 02550208363.
You also have the right to lodge a complaint to a supervisory authority, namely the Garante per la Protezione dei Dati Personali located in Piazza Venezia n. 11 00187 ROME, Fax: (+39) 06.69677.3785, Phone: (+39) 06.696771, Email: garante@gpdp.it.