Privacy Policy

Our commitment to protect dignity and human privacy

"Privacy is a kindness of the soul that we ought to show both to those we know and to those we come across. It is also a right we are entitled to, and it’s never pleasant to be forced to demand it, since that spoils the charm of its pure sincerity.

Brunello Cucinelli,
“Consulentia 2018” conference,
Rome, February 6, 2018

PRIVACY POLICY REGARDING THE PERSONAL DATA PROCESSING

Brunello Cucinelli - considers the privacy and protection of personal data to be one of our company's main objectives. Consequently, we invite you to carefully read this Privacy Policy before communicating any personal data to us, because it contains important information regarding the protection of your personal data when you interact with us, and provide personal data, using this website (e.g., purchase of products, filling out online forms to request information or subscription to the Newsletter service).
This Privacy Policy:

• is provided in relation to this websites https://shop.brunellocucinelli.cn (hereinafter referred to as the "Website");

is an integral part of the Website and the services we offer. When we use the wording "personal data" in this Privacy Policy we refer to any information enabling us to identify you (or a third party whose personal data you provide us) directly or indirectly including any information incidental to the purchase of goods or services; or that you chose to communicate to us or share with us, or third parties, while using the Website. We process the personal data in accordance with the principles of correctness, lawfulness, transparency, purpose and retention limitation, minimisation, accuracy, integrity and confidentiality, set out under the applicable data protection laws, e.g. the laws applicable in China where we collect the data and the General Data Protection Regulation (EU) 2016/679 (hereinafter the “GDPR”) for the purposes of marketing and the supporting services to the sales transactions offered by Brunello Cucinelli and its suppliers.

INDEX

Below is the index of this Privacy Policy so that you can easily find the information pertinent to the processing of your personal data that concerns you.

1. DATA CONTROLLER AND DATA PROTECTION OFFICER
2. PERSONAL DATA SUBJECT TO PROCESSING
a. Web browsing data
b. Data provided voluntarily by the user
c. Third party data voluntarily provided by the user
d. Cookie
3. PURPOSE OF DATA PROCESSING AND LEGAL BASIS
4. PERSONAL DATA RECIPIENTS
5. TRANSFERS OF PERSONAL DATA
6. RETENTION OF PERSONAL DATA
7. DATA SUBJECT'S RIGHTS
8. MODIFICATIONS
9. CONTACT US

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

1.1. In relation to the processing carried out on personal data related to online sales and management of any related activities (e.g. place the order, pay the products, managing any tax, accounting and commercial issues related to the online transaction, including managing your consumer protection rights as described in the Terms and Conditions), the entity who determines the purposes of the processing of the personal data and is responsible for them (i.e. the data controller) is Brunello Cucinelli (Sichuan) Fashion Co. Ltd., with registered office in [25/F Chengdu IFS Tower 1, no.1 Hongxing Road, Section 3, Jinjiang District, Chengdu, Sichuan, China] (hereinafter "Brunello Cucinelli China").
You can contact Brunello Cucinelli China at any time at the address above, or by sending an email to Customer Care.
1.2. When you register with us (e.g. registering your Website account, subscribing to our Newsletter), or ask for information or specific services in relation to our brand and products, or agree to us to analyse your profile to offer you better and tailored services the data controller is Brunello Cucinelli S.p.A. with registered office in Corciano (PG, Italy), hamlet of Solomeo, Viale Parco dell'Industria no. 5, tax code and registration number of the Perugia Register of Companies 0188612054 (hereinafter "Brunello Cucinelli SpA"). You can contact Brunello Cucinelli SpA and its Data Protection Officer at its headquarters at the address indicated above and by email at: dpo@brunellocucinelli.it.

2. PERSONAL DATA SUBJECT TO PROCESSING

We collect and use different types of personal data, depending on the specific purpose we have.
The following personal data is processed through the Website:

a. Web browsing data

During their normal course of operation, the computer systems and software procedures used to operate this Website acquire certain personal data, the transmission of which is implicit in the use of internet communication protocols. This information is not collected with the intent of associating it with identified users but, by its nature, it could lead to the identification of users through processing and association with data held by third parties.
This category of data includes:
IP addresses or domain names of computers used by users who connect to the Website, the URI (Uniform Resource Identifier) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in reply, the numerical code indicating the status of the reply given by the server (successful, error, etc.) and other parameters regarding the user's operating system and computer environment.
This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Website to check its correct functioning, to identify anomalies and/or misuses; in any event, they are deleted immediately after processing. The data could be used to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the Website or third parties.

b. Data provided during registration and use of services

When using the services offered by the Website, you voluntarily insert personal data when filling out the various forms. This happens e.g. when you register your account with the Website, you contact us or you place an order.
For Brunello Cucinelli China this data includes, where appropriate:

1) Identification information: personal details, such as name, surname, gender, age/date of birth, country of origin, and other personal details as allowed by applicable laws;
2) Contact information: contact details, such as address, email address, phone number (if any);
3) Payment information: payment details, such as payment instrument (credit card, debit card);
4) Sales information: sales related information, such as date, products provided, place of purchase, product codes, amount, total of sales, VAT number if applicable, complaints, returns, refunds and other sales related information as allowed by applicable law.

Certain types of personal data that Brunello Cucinelli China collects from you are classified as sensitive personal data under applicable Chinese laws, regulations and guidance, including your address, email address, phone number and payment information.
Except for the payment information (point 3) above) and any information related to the management of the accounting and tax purposes, Brunello Cucinelli SpA may access or collect the same personal data listed above for its purposes of processing activities, and it will process also profiling information, e.g. habits and profiles, such as data regarding your purchases (purchase history including type, quantity and price of the products purchased by you), information related to customer relationship management activities and initiatives (date and categories of said actions as performed or to be performed and results of said actions), shopping habits and preferences (e.g. preferred categories of product, colour, style, how you knows our brand, sizes, notes regarding purchase habits or special needs stated by you – i.e. preferred materials).
We do not intentionally collect special categories of personal data, such as personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data relative to a person's health, sex life or sexual orientation, and we invite you not to include any of this when you fill the appropriate forms.

c. Third party data voluntarily provided by the user

When using the services offered by the Website, the personal data you communicate to Brunello Cucinelli China for the online sales may be related to third parties, such as in the case of purchasing products to be sent to third parties. With respect to these hypotheses, you represent and warrant that you have obtained all necessary consents from such third parties prior to providing us with personal data relating to such third parties for the relevant processing purposes. We will process such personal data in order to fulfil the obligation arising from the purchase you made or to take steps at your request prior to entering into a contact.

d. Cookies and other tracking technologies

Information on cookies used by the Website is available here。

3. PURPOSE OF DATA PROCESSING, LEGAL BASIS AND NATURE OF PROVIDING DATA

Personal data may be used for the following purposes, depending on the specific circumstances in which you interact with us.

3.1. For online sales (by Brunello Cucinelli China)
由Your personal data, provided by you or collected when you make any purchase - regardless as a guest or registered user - i.e. identification information, contact information, sales information and payment information, and any other data strictly necessary for the delivery of products, will be used:
a) to manage, administer and process your purchase of our products, sale and after-sale services, e.g. administrative activities, accounting, returns, warranties, tax free refunds if applicable, communicating with you, including by e-mail, for any problem relating to the handling of the order or to subsequent requests relating to the order. Providing personal data for this purpose is necessary, and failure to provide it would make it impossible to purchase or to obtain the related service.
b) for online fraud prevention. We will not request your specific data for this purpose, but we will process the payment and purchase related data for assessing fraud risks, with the support or our payment service intermediaries.
c) to inspect specific requests addressed to Brunello Cucinelli China, including any requests for Customer Assistance sent using the "Contact Us" form. The provision of the personal data is optional but failing to receive all or part of the information essential to manage your request may cause us to be unable to manage your expectations.
d) to fulfil any obligations stipulated by applicable laws, regulations or legislation, or to satisfy requests from authorities. Providing the data, if any, is necessary.
By providing personal data to us for purposes of online sales, you consent to the collection and use (including any sharing or transfer) of personal data by Brunello Cucinelli China as set out in this Privacy Policy. Further, we would first obtain your express consent prior to any processing (including sharing or disclosure) of your sensitive personal data under applicable Chinese laws, regulations and guidance.

3.2. For specific purposes for which it was volunteered (by Brunello Cucinelli SpA)
Your personal data provided by you or collected when you ask for a specific service (e.g., registering your account on our Websites, handling complains, asking for information) i.e. personal details, contact details, data strictly necessary for follow-up your request, will be used
a) to provide the services you requested (e.g., operating the processes of registering your account, managing authentication on the Website, allow navigation of the Website, including the management of the Website's security operating your accounts, assisting you, and handling any complaints, handling wish lists, follow up to any question or contact request you may submit to us, also through our customer care service);
b) to manage newsletter subscription if you are not also registered with us.

3.3. For targeting, if you register with us (by Brunello Cucinelli SpA)
The personal data that you provide filling in our forms or collected when you visit our Website and interact with us, also in the boutiques, i.e. personal details, contact details, data regarding your habits and profile, family details, will be entered in our centralized marketing data base:
a) to send you promotional and marketing communications, which includes sending you newsletters and market research, through automated tools (SMS, MMS, email, push notifications, fax) and other means (paper mail, telephone with operator). We collect a single consent for all the channels above, but if you wish to object to the processing of your data for marketing purposes carried out with the means specified here, you may contact us at any time, at the addresses indicated in the "Contact" section of this Privacy Policy, without prejudice to the lawfulness of the processing based on the consent given before the revocation;
b) to analyse your preferences, habits and choices as a consumer, to send you personalised commercial communications and proposals as well as to carry out general analyses for strategic orientation and commercial intelligence purposes;
c) to communicate your personal data to other companies belonging to the Brunello Cucinelli Group for the purposes of sending you their promotional and marketing communications, including newsletters and market research, using both automated tools (SMS, MMS, email, push notifications, fax) and other means (paper mail, telephone).
For all the purposes above under this point 2.3 we can use your personal data only based on your consent. Therefore, the provision of your personal data for these purposes is entirely optional and does not affect the use of the services. If you wish to object to the processing of your data for marketing, profiling or communication purposes, you may contact the Data Controller, at any time, using the contact details provided in the "Contact Us" section of this Privacy Policy or, where available, via the "privacy settings" found within your personal area.
d) In addition, each of the data controllers can use personal data to establish or defend a legal claim based on their legitimate interest to protect their interests and rights. Providing the data, if any, is necessary.
Both Brunello Cucinelli China and Brunello Cucinelli SpA may also carry out processing for statistical purposes, using anonymous data without it being possible to trace your identity.
Specific security measures have been implemented to prevent data loss, illicit or incorrect use of data and unauthorised access. We will let you know in accordance with applicable laws if a breach occurs that may have compromised the privacy or security of your personal data. If it is determined that a breach of personal data has occurred, we will in accordance with law notify you of the data involved, steps you may take, and a summary of actions being taken to investigate the breach, reduce harm to you, and protect against future breaches. We will also comply with any obligations to notify as required in accordance with applicable laws.

4. PERSONAL DATA RECIPIENTS

4.1.Your personal data may be shared, for the purposes set out in section 2 of this Privacy Policy, with third parties that provide us with their services and process your personal data on our behalf as data processors. In particular,
a) for the purposes under point 2.1, Brunello Cucinelli China will share your personal data with Brunello Cucinelli SpA, and its sub processors, for the management of the ecommerce platform, and the hosting of the personal data, as well as with logistic and express couriers, and its providers of IT services;
b) for the purposes under point 2.2 Brunello Cucinelli SpA will share your data with its email service providers for delivery of its marketing campaigns, its suppliers of the CRM and analysis tool system, hosting providers, its mailing services providers.
We will only provide those companies and organisations the personal data required to deliver the services and prohibit them for using that personal data for any other purpose.

4.2.We can also share your personal data with third parties that receive your data for their delivery of services, as data controllers, for us to properly manage our business, namely: (i) persons, companies or professional firms that provide assistance and advice to Brunello Cucinelli on accounting, administrative, legal, tax and financial matters; (ii) credit institutions and insurance companies and brokers; the payment service providers; (iii) persons, entities or authorities who require the communication of your personal information as mandated by law or by order of the authorities.

4.3.We may also share the data with other companies of the Brunello Cucinelli Group
a) when this is necessary to the pursuit of internal administrative purposes or to comply with a legal or contractual obligation. The Brunello Cucinelli companies will receive the data as data controllers;
b) when they offer marketing and profiling related services to Brunello Cucinelli SpA to support its marketing and profiling activities locally in their countries to pursuit the one vision service for the Brunello Cucinelli customers. The Brunello Cucinelli companies will receive and process the data as data processors;
c) If you opt-in, when they wish to send you their promotional and marketing communications, including newsletter and market research.

Our staff, both at Brunello Cucinelli China and Brunello Cucinelli SpA, is authorized to access and process your personal data to the extent that this is necessary to carry out activities strictly related to the provision of services. Each of them is committed to respecting your confidentiality or have an appropriate legal confidentiality obligation.
These subjects are collectively defined as "Recipients".
A complete list of data processing recipients is available by sending a written request to the Data Controller at the addresses indicated in the "Contact Us" section of this Privacy Policy.

5. TRANSFERS OF PERSONAL DATA

Generally, Brunello Cucinelli China collects, processes and stores your personal data in China. Subject to obtaining your express consent, Brunello Cucinelli China may share your personal data with Brunello Cucinelli SpA in Italy and the European Union, when it uses their services, on Brunello Cucinelli China's behalf, for offering you the online sales services. To the extent we transfer your personal data to another country (which may have data protection laws that are different to the laws in China), we will ensure that your personal data will be protected in a similar manner as it is in China.
Some of your personal data is also shared by Brunello Cucinelli SpA with Recipients that may be situated inside and outside the European Economic Area. Whenever we need to transfer the personal data abroad for achieving the purposes of this Privacy Policy, we take steps to ensure that these communications happen in compliance with the applicable data protection standard set out by the law, including entering into data protection safeguard agreement so that your data remain secure and confidential.
Indeed, transfers by Brunello Cucinelli SpA outside the European Economic Area can be based on an adequacy decision or on the Standard Contractual Clauses approved by the European Commission.
More information is available by sending a written request to the relevant data controller at the addresses indicated in the "Contact Us" section of this Privacy Policy.

6. RETENTION OF PERSONAL DATA

Personal data that is processed for the purposes set out in sections 2.1 and 2.2 will be kept for the time strictly necessary to achieve those same purposes.
With regard to information processed for the provision of services (2.1 a) c) and 2.2 a), the relevant data controller will keep this personal data for the minimum period of time envisaged by the applicable commercial, civil and tax laws, as applicable, to protect its own interests. Brunello Cucinelli SpA will delete your personal data related to the registration of your account when you withdraw from such a service.
Personal data processed for the purposes set out in section 2.1 d) and 2.3 d) will be kept up until the time stipulated by the specific obligation or applicable law.
For the purposes set out in section 2.2 b) and 2.3 a)-c), your personal data will be processed until you present an objection to its processing.
For the profiling purposes, and the related tailored marketing set out in section 2.3 b), your personal data will be processed for a maximum period of seven years, starting from its registration, in accordance with the principles applied by the Italian data protection authority. Further information regarding the data retention period and the criteria used to determine this period may be requested via a written request sent to Brunello Cucinelli SpA at the addresses indicated in the "Contact Us" section of this Privacy Policy.
However, whenever we process your personal data based on your consent, we will stop retaining the data relevant for that purpose once you opt-out.
In any case, the data controller is granted the possibility to keep your personal data for the period of time provided and allowed for by Italian law to protect their interests (article 2947 ( 1 )( 3 ) of the Italian civil code).
Further information regarding the data retention period and the criteria used to determine this period may be requested via a written request sent to the Data Controller at the addresses indicated in the "Contact Us" section of Privacy Policy.
In any case, the Data Controller is granted the possibility to keep your personal data for the period of time provided and allowed for by Italian law to protect their interests (Article 2947 (1)(3) of the Italian Civil Code).

7. DATA SUBJECT'S RIGHTS

According to the applicable data protection law, you can control how the personal data is processed, and restrict its use if applicable. In particular, in respect of personal provided to, or collected by, Brunello Cucinelli SpA for purposes other than online sales, you are entitled to:
a) receive confirmation of the existence of your personal data, access your data and obtain a copy (right to access);
b) update, amend and/or correct your personal data (right to rectification);
c) request the erasure or restriction of the processing of your personal data in the cases specified by the GDPR, including where data has been processed unlawfully or if its storage is not necessary in relation to the purposes for which the data were collected or otherwise processed (right to erasure);
d) request that we restrict any processing of your personal data pending any claim or when any rights to defence is pending (right to restriction); withdraw your consent, where given, at any time, without prejudice to the lawfulness of processing based on the consent given prior to the withdrawal (right to withdraw consent);
e) except for the personal data that we process for complying with the legal obligation and to defend our rights, to receive a copy of the data provided by you in a structured, commonly used format readable by automatic devices, and request the transmission of such data to another data controller if technically feasible (right to data portability);
f) object to the processing of your data in the cases specified by the GDPR (right to object). In particular, at any time, you can opt-out from our Brunello Cucinelli SpA marketing communications or to its profiling (point 2.2 above) and to unsubscribe from Brunello Cucinelli SpA newsletter.

In respect of personal provided to, or collected by, Brunello Cucinelli China for purposes of online sales, you are entitled to:
a) request us to provide to you: (i) a description of the type of personal data we hold about you, including a general account of its use, its source and (ii) what personal data has been made available to other organisations, e.g. affiliated companies. You may also request a copy of your basic personal data, we have about you (right to access);
b) request us to correct any personal data we hold about you if you think they are incorrect or incomplete (right to rectification);
c) request the erasure of your personal data if: (i) your personal data has been given to or collected and processed by us in violation of any applicable law; (ii) our use and collection of your personal data is contrary to what we have agreed with you; (iii) we collect and use your personal data without obtaining any consent from you; (iv) you no longer wish to receive information from us or continue with any online sales transactions with us (right to erasure);
d) even if you have given us consent to collect, use, share or disclose some or all of your personal data, you can opt-out any time by requesting us cease or limit any data processing. However, if you do so, you may not be able to continue with your online purchases which depend on having any such personal data (right to withdraw consent); and
e) delete or cancel any account you set up with us in relation to the online sales (right to delete or cancel account).

You can exercise the above rights at any time by contacting the relevant data controller (as identified in point 1 and 2 above). We may request you to verify your identity before responding to your requests. To the extent required by applicable law, we will respond to your requests as soon as possible and in any event within 30 days of receiving your request. In general, we will not charge a fee for responding to your request. However, in cases of repeated requests beyond reasonable expectations, as permitted by applicable laws, we reserve the right to charge a fee to cover our administrative costs. In certain circumstances, we may reject your requests as may be permitted by applicable laws.
Requests for erasure of data are subject to the applicable legislative and regulatory document retention obligations.
You may exercise your rights at any time by writing to the relevant data controller (as identified under point 1 and 2 above) at the addresses indicated in the "Contact Us" section of this Privacy Policy. To unsubscribe, you can also use the specific tool available on each of our newsletter and marketing communication.
If you believe that your personal data have not been processed in accordance with the law or wish to complain about their use, you can lodge a complaint with the supervisory authority of the country where you live or work, or where you believe the alleged unlawful conduct occurred.
If you disagree with a decision of Brunello Cucinelli China, you may submit your complaint to [the China International Economic and Trade Arbitration Commission for arbitration. The seat of arbitration will be Sichuan. The arbitral award will be final and binding upon you and us. The arbitration will be conducted in accordance with the CIETAC Arbitration Rules in effect at the date of the Request for Arbitration, subject to the following: (1) the arbitration shall be conducted in Italian and Chinese. All documents filed, and all oral submission must be in Italian and Chinese. Any party wishing to rely on documentary or witness evidence which is not in both languages shall be responsible for providing an accurate translation or interpretation of the same to the other party and to the arbitrators, at the same time as the original language version is provided. In the absence of such translation or interpretation, such evidence shall be disregarded. (2) There shall be one arbitrator. (3) You agree to the appointment of arbitrators from outside of CIETAC's Panel of Arbitrators.]

8. MODIFICATIONS

Subject to obtaining your consent as may be required by applicable laws, Brunello Cucinelli China and Brunello Cucinelli SpA reserve the right to modify or simply update its content, wholly or partially, as a result of a change in the processing activities or as a result of variations in the applicable legislation. Therefore, we invite you to regularly visit this section to keep you up-to-date with the most recent and updated version of the Privacy Policy to always be informed on the data collected and how we use it.

9. CONTACT US

To exercise the above rights or for any other requests, depending on the processing activities you are interested to know about, please write to the relevant data controller (as identified under point 1 and 2 above) at the physical address indicated above, or using the privacy contact details under point 1. Please, preferably insert the wording "request for exercise of privacy rights" in the subject matter.

Data Policy Disclosure on the processing of personal data pursuant to Articles 13 and 14 of EU Regulation 2016/679

Brunello Cucinelli S.p.A., as Data Controller (hereinafter: “Brunello Cucinelli” or “Data Controller”) pursuant to Regulation (EU) 2016/679 (so-called The General Data Protection Regulation, hereinafter referred to as the "Regulation") and Italian Legislative Decree no. 196/2003 (so-called Data Privacy Code, hereinafter the "Code") – considers privacy and the protection of personal data as one of its primary business purposes. Consequently, we request you to carefully read this Privacy Policy before disclosing any personal data to the Data Controller, because it contains important information regarding the protection of your personal data.
This Privacy Policy:

• refers to the websites https://shop.brunellocucinelli.com and https://shop.brunellocucinelli.cn (hereinafter referred to as the "Website");
• it is an integral part of the Website and the services we offer;
• pursuant to Articles 13 and 14 of the Regulation, it applies to those who interact with the Website services, both during simple consultation and the use of specific services made available through the Website (by way of example, the purchase of products, the compilation of online information request forms or newsletter subscriptions), as well as the use of other services provided through the Website (telephone assistance and assistance via WhatsApp and Live Chat).

***
The processing of personal data shall be governed by the principles of lawfulness, fairness and transparency, purpose and retention limitation, accuracy, integrity and confidentiality, as well as the principle of accountability, pursuant to Article 5 of the Regulation. Your personal data will therefore be processed in compliance with personal data protection legislation and the envisaged confidentiality obligations.
"Personal data processing" means any operation or set of operations which is carried out on personal data or sets of personal data, by automated means or otherwise, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

CONTENTS

Below is the contents preview of this Privacy Policy so that you can easily find the information on the processing of your personal data that concerns you.

1. DATA CONTROLLER AND DATA PROTECTION OFFICER
2. PERSONAL DATA PROCESSED
a. Browsing data
b. Data voluntarily provided by the user
c. Data processed to fulfil services rendered online
d. Third-party data voluntarily provided by the user
e. Specific data categories f. Cookies 3. PURPOSES OF DATA PROCESSING
4. LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING
5. RECIPIENTS OF PERSONAL DATA
6. TRANSFER OF PERSONAL DATA
7. RETENTION OF PERSONAL DATA
8. RIGHTS OF DATA SUBJECTS
9. COMPLAINT TO THE DATA PRIVACY GUARANTOR AUTHORITY
10. AMENDMENTS
11. CONTACT US

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is Brunello Cucinelli S.p.A. with registered office in Corciano (Perugia, Italy), hamlet of Solomeo, Viale Parco dell'Industria no. 5, tax code and Perugia Register of Companies enrolment number 0188612054.
The Brunello Cucinelli S.p.A. Data Protection Officer can be contacted at the headquarters of the Data Controller at the address indicated above and by email at the address dpo@brunellocucinelli.it.

2. PERSONAL DATA PROCESSED

We inform you that the personal data we process may consist of an identifier such as a name, an identification number, location data, an online ID or one or more characteristic elements of physical, physiological, physical, financial, cultural or social identity, capable of identifying a data subject or making him/her identifiable, according to the type of services requested (hereinafter simply "personal data"). The following personal data is processed through the Website:

a. Browsing data

During their normal course of operations, the computer systems and software procedures used to operate this Website acquire certain personal data, the transmission of which is implicit in the use of internet communication protocols. This information is not collected with the intent of associating it with identified users but, by its nature, it could lead to the identification of users through processing and association with data held by third parties. This category of data includes IP addresses or domain names of computers used by users who connect to the Website, URI addresses (Uniform Resource Identifiers) of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in reply, the numerical code indicating the status of the reply given by the server (successful, error, etc.) and other parameters regarding the user's operating system and computer environment. This data is used for the sole purpose of obtaining anonymous statistical information on the use of the Website to check its correct functionality, to identify anomalies and/or abuses; in any case, they are deleted immediately after processing. The data may be used to ascertain responsibility in the event of computer crimes against the Website.

b. Data voluntarily provided by the user

Except for references to specific information that may be available in the various sections of the Website, this Privacy Policy also addresses the processing of data voluntarily entered by you in the various forms envisaged within the Website itself, such as:

- the information request form in the "Contact Us" section, in which you will be asked to enter your name, your surname and your contact details – email address and telephone number – as well as to submit your specific request, which itself may contain further personal data;
- the chat and instant messaging service, through which you may connect with an operator who will be able to assist you by responding in real time to your requests for information.

Regarding such data, we request you to enter in the aforementioned forms and in chat and instant messaging exchanges, only the personal data strictly necessary for the purposes of managing your request, thus excluding irrelevant information and/or details that may fall within the special categories of personal data pursuant to Article 9 of the Regulation ([...] personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data intended to uniquely identify a natural person, data relating to the person's health, sexual behaviour or sexual orientation).

c. Data processed to fulfil services rendered online

With the exception of references to specific information that may be available in the various sections of the Website, this Privacy Policy also addresses the processing of data voluntarily provided by you for the purpose of performing the services rendered online, with particular reference to the following:

- registration and access to your personal area which stores your personal and contact details, enabling processing (according to the data you have saved) of your shipping addresses, your credit card information and your product preferences. Details of any credit cards saved in your personal area will be handled through an external service provider, in compliance with PCI Regulations;
- conclusion and execution of purchase contracts (including the order status verification service), in the context of which your personal data, contact details and information related to the delivery address of purchased products will be processed as well as any information concerning the Your shopping experience. The latter includes confirmation of payment through Apple Pay or PayPal. In regard to the latter, please note that, should you choose the Apple and PayPal payment methods, as independent data controllers, these entities notify the payment parameters to Brunello Cucinelli together with information necessary for the shipment of the order;
- handling any returns, in the context of which we shall process your personal data, contact details and information regarding the returned products collection address, as well as any information related to your purchase and return experience;
- the "Book an appointment" function, in which you may provide your personal details to arrange appointments in our boutiques;
- customer-specific assistance to meet requests for guidance on sizes, product categories in the women's and man's collections, body fit, new arrivals or other information;
- the 'wishlist' service, through which you can add items to your list of desired items to purchase.

Furthermore and in general, the Data Controller will process any information relating to your purchases (type of product, date of purchase, amount spent as well as, in general, your purchase choices, your preferences and your browsing behaviour on the Website) and, for profiling purposes, data obtained from your Website online activities, with and without personalised consequences, as better specified below. The Data Controller will also process information deriving from your choices for personalising newsletter content.

d. Third-party data voluntarily provided by the user

Third parties may process personal data you disclose to Brunello Cucinelli when you use Website services, (such as information provided for the purchase of products to be sent to third parties; data related to payments concluded referencing the bank details of third parties; billing information; details you may provide when requesting information in the Website's "Contact Us" section). In such cases, you become the independent data controller, assuming all the applicable legal obligations and responsibilities. To this effect, you fully indemnify us against any dispute, claim, request for compensation for processing-related damages etc. the Data Controller may receive from third parties whose personal data has been processed, through your use of the Website's services, in violation of the applicable the personal data protection rules. In any event, if you provide or otherwise process personal data of third parties when using the Website, you hereby and henceforth guarantee that such possible data processing scenario shall be based, where necessary, on the prior acquisition – by yourself – of the third parties' consent to the processing of their information and you accept all related liability.

e. Cookies and other tracking technologies

Information about cookies used on the Website is available here.

3. PURPOSES OF DATA PROCESSING

Your personal data will be processed, with your consent where necessary, for the following purposes, where applicable:

3.1. to enable navigation of the Website, registration in private areas, the deactivation of your account – following your request – for a maximum of 12 months and the provision of all other associated services provided by the Data Controller (such as, by way of example but not limited to, online sales, product returns and the service assuring product warranty management, the 'wishlist' service, the "Book an appointment" function, the "Contact us" section in relation to your customer care requests, the verification of order status, the saving of the preferred delivery addresses of the goods purchased on the Website as well as of favourite boutiques etc.). The above includes the management of Website security, as well as contractual, administrative, accounting and after-sales services. Please note that, with respect to the boutique locator service, the data controller for data relating to your geographical location and other information provided by you as part of this service is represented by Google and, for China, by Baidu (whose privacy policies are available here and here respectively). Please also note that the Website provides additional assistance services to the Customer, including, in particular, the telephone, WhatsApp and LiveChat assistance services through which you can submit specific requests and receive assistance from Brunello Cucinelli's customer service; with reference to telephone assistance, we remind you that, subject to your consent, calls may be recorded to check the quality of service and for internal training purposes.
3.2. to follow up specific requests addressed to the Data Controller, also in relation to after-sales situations, including requests for Customer Service and information (for example in relation to product warranty handling) sent by completing the relevant contact forms on the Website as well as through the chat and instant messaging services;
3.3. to fulfil any obligations under applicable laws, regulations or EU legislation, or to satisfy requests from authorities;
3.4. to provide for direct sending via post and email of advertising and promotional material in relation to products or services similar to those purchased by you, pursuant to Article 130, paragraph 4 of the Code and the Provision of the Data Privacy Guarantor Authority of 19 June 2008, unless you deny your consent to receive such material, which you can express during registration on the Website or on subsequent occasions;
3.5. to send you announcements and commercial proposals, including newsletters (the contents of which you can customise), through automated tools (SMS, MMS, email, instant messaging and chat) and otherwise (post, telephone). Please note that the Data Controller collects a single consent declaration for the marketing purposes described here, pursuant to the General Provision of the Data Privacy Guarantor "Guidelines on promotional activities and counteracting spam" of 4 July 2013. If, in any case, you wish to oppose the processing of your data for marketing purposes carried out with the means indicated here, you can do so at any time by contacting the Data Controller at the addresses indicated in the "Contacts" section of this disclosure, without prejudice to the lawfulness of the processing undertaken prior to your opposition;
3.6. to analyse your personal data, your purchasing choices, preferences, Website browsing behaviour to enable us to send you personalised announcements and commercial proposals as well as, in general, for profiling activities;
3.7. or general profiling purposes, without personal implications, by means of generalised analyses (including predictive or strategic orientation) aimed at creating statistical processing and calculation models representative of the entire customer base. This purpose implies the processing of your data on an aggregate basis, in pseudonymised form, as a direct prerequisite and instrumental means for the pursuit of the purposes referenced in sections 3.5 and 3.6 of this disclosure albeit distinct from them;
3.8. to meet any defensive needs;
3.9. for statistical assessment and monitoring purposes. This purpose implies an analysis of aggregate information not referable to identified or identifiable natural persons and which, therefore, does not constitute personal data and does not in any way enable the Data Controller to trace your identity.

Specific security measures have been implemented to prevent data loss, illicit or incorrect use of data and unauthorised access.

4. LEGAL BASIS AND OBLIGATORY OR OPTIONAL NATURE OF PROCESSING

The legal basis for the processing of personal data for the purposes referenced in sections 3.1 and 3.2 is Article 6, par. 1, point b of the Regulation ([...] processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract), since the processing is necessary for the provision of services. With specific reference to the telephone assistance service referenced in section 3.1, please note that the recording of calls to check the quality of the service can be disabled upon your request. The provision of personal data for these purposes is optional, but failure to provide it would make it impossible to activate the requested services themselves.
The purpose referenced in section 3.3 represents a legitimate processing of personal data pursuant to Article 6, par. 1, point c) of the Regulation ([…]processing is necessary for compliance with a legal obligation to which the controller is subject). In fact, once the personal data has been submitted, the processing must comply with the legal obligations incumbent on the Data Controller.
The processing performed for the purposes referenced in sections 3.5 and 3.6 is based on your consent pursuant to Article 6, par. 1, point a ([…] the data subject has given consent to the processing of his or her personal data for one or more specific purposes) and to Article 22, par. 2, point c of the Regulation. This consent can be revoked at any time without prejudice to the lawfulness of the processing carried out prior to the revocation in accordance with the provisions of Article 7 of the Regulation.
Therefore, the provision of your personal data for these purposes is entirely optional and does not affect the use of the services. If you wish to object to the processing of your data for marketing, profiling or communication purposes, you may contact the Data Controller, at any time, using the contact details provided in the "Contact Us" section of this Privacy Policy disclosure or, where available, via the Privacy Settings found within your Personal Area. With reference to the purpose referenced in point 3.4, please note that if the Data Controller uses details provided by the data subject via post or email for the purposes of direct sales of its products or services. In doing so, it may, pursuant to Article 130, paragraph 4 of the Code, refrain from requesting the consent of the data subject, provided that the products or services are similar to those purchased by the data subject who is properly informed and does not refuse such use, initially or on the occasion of subsequent communications.
The processing referenced in section 3.7 is carried out in order to pursue the legitimate interest of the Data Controller pursuant to Article 6, par. 1, point f of the Regulation.
It is also specified that the processing referenced in section 3.8 is carried out to meet any defensive needs of the Data Controller pursuant to Article 6.1.f of the Regulation.
It should be noted that the processing referenced in section 3.9, since it does not address personal data, does not fall under the scope of personal data protection regulations and can therefore be freely undertaken by the Data Controller.

5. RECIPIENTS OF PERSONAL DATA

Your personal data may be shared, for the purposes set out in section 3 of this Privacy Policy disclosure, by:

5.1. persons authorised by the Data Controller to process personal data pursuant to Articles 29 and 2-quaterdecies of the Code (e.g. staff operating in sales, administration and accounting, after-sales assistance, CRM and IT systems management);
5.2. third parties who, in the provision of services (by way of example: technological services, assistance and consultancy services in accounting, administrative, legal, tax and financial matters, technical maintenance, transport services, banking and insurance services), typically act as data processors pursuant to Article 28 of the Regulation. The Data Controller keeps an up-to-date list of the appointed data processors and guarantees that the same may be viewed by the data subject at the aforementioned office or upon request to the addresses indicated above.
5.3. Brunello Cucinelli Group companies based both in the EU and outside the EU http://investor.brunellocucinelli.com/it/governo-societario/struttura-del-gruppo as independent data controllers for administrative-accounting purposes on the basis of legitimate interest pursuant to Article 6.1.f and Recitals 47 and 48 of the Regulation;
5.4. third parties responsible for carrying out the activities referenced in this Privacy Policy Disclosure with which BC has entered into commercial agreements;
5.5. individuals, entities or authorities who require the disclosure of your personal information as mandated by law or by order of the authorities.

These subjects are collectively defined as "Recipients".

6. TRANSFERS OF PERSONAL DATA

Some of your personal data is shared with Recipients who may be situated outside the European Economic Area. The Data Controller ensures that these Recipients process your personal data in compliance with Articles 44–49 of the Regulation. With regard to the transfer of personal data to third countries, the Data Controller declares that the processing will be undertaken according to one of the methods permitted by current legislation, such as the consent of the concerned party, the adoption of Standard Clauses approved by the European Commission, the selection of subjects adhering to international programmes for the free dissemination of data or operating in countries considered as secure by the European Commission based on an adequacy decision. Further information is available by sending a written request to the Data Controller at the addresses indicated in the Contact Us section of this Privacy Policy Disclosure.

7. RETENTION OF PERSONAL DATA

Your personal data will be entered and stored, in accordance with the principles of minimisation and retention limitation pursuant to Article 5.1.c and e of the Regulation, in the information systems of the Data Controller, whose servers are located within the European Economic Area.
The personal data processed for the purposes referenced in sections 3.1 and 3.2 will be retained for the time strictly necessary to achieve those same purposes, i.e. for the time necessary for the execution of the contract, for the provision of legal or conventional guarantees, in accordance with the conservation required by law (see also, in particular, Article 2946 et seq. of the Italian Civil Code).

Personal data processed for the purposes set out in section 3.3 will be retained for the time stipulated by the specific obligation or applicable law.

For the purposes set out in section 3.4, your personal data will be processed until you present an objection to its processing.

Conversely, for the purposes referenced in sections 3.5 and 3.6, your personal data will be retained until the revocation of your consent and, in any case, limited to the purpose referenced in section 3.6 and the activities connected to it, for no more than seven years, starting from their registration, in accordance with the provisions of the provision of the Data Privacy Guarantor Authority for the protection of personal data in acceptance of the preliminary verification request presented by the Data Controller. Likewise, for the purposes referenced in Article 3.7, your data will be retained for no more than seven years from registration. Upon revocation of consent or expiry of the seven-year retention period (if preceding), the data processed for the purposes referenced above will be permanently deleted or anonymised.
In general and in any case, the Data Controller reserves the right to retain your data for the time necessary to fulfil any regulatory obligation to which it is subject or to meet any defensive needs. In any case, the Data Controller may retain your personal data for the time provided and allowed for by Italian law to protect their interests (Article 2947 of the Italian Civil Code).

It should be noted that, if your account is deactivated, your personal data will continue to be processed by BC in compliance with the criteria and principles highlighted above for the entire period coinciding with this deactivation (equal to 12 months). It should also be noted that, compatibly with the aforementioned criteria and principles, BC will retain such data also after the expiry of this term and in the event of total removal of your account. Therefore, please note that the expiry of the aforementioned term and the total removal of your account will not necessarily involve the deletion of your personal data or the revocation of the privacy consents legitimately provided by you. For more information regarding requests for data cancellation and withdrawal of consent, please refer to point 8 "Rights of data subjects" of this Data Privacy Disclosure.

Further information regarding the data retention period and the criteria used to determine this period may be requested via a written request sent to the Data Controller at the addresses indicated in the "Contact Us" section of this Privacy Policy.

8. RIGHTS OF DATA SUBJECTS

As a Data Subject, you can exercise the rights referenced in Articles 15–22 GDPR and revoke the consent given at any time without prejudice to the lawfulness of the processing undertaken before the revocation.
In particular, you may request access to your Personal Data pursuant to Article 15 GDPR, its rectification pursuant to Article 16 GDPR, cancellation of the same pursuant to Article 17 GDPR, restriction of processing in the cases envisaged by Article 18 of the GDPR as well as to obtain the portability of data related to you in the cases envisaged by Article 20 of the GDPR.
You may submit a request for opposition to the processing of your Personal Data pursuant to Article 21 of the GDPR, in which you may evidence the reasons justifying the opposition: the Data Controller reserves the right to assess your request, which may not be accepted if there are legitimate compelling reasons to proceed with the processing that prevail over your interests, rights and freedoms.
Requests should be sent in writing to the Data Controller at the addresses indicated in the "Contact Us" section of this Privacy Policy Disclosure.

9. COMPLAINT TO THE DATA PRIVACY GUARANTOR AUTHORITY

If you believe that the processing of your personal data by the Data Controller is undertaken in violation of the provisions of the Regulations, you have the right to lodge a complaint with the Data Privacy Guarantor Authority, as envisaged by Article 77 of said Regulation, or to seek redress through the appropriate legal channels (Article 79 of the GDPR).

10. AMENDMENTS

The Data Controller reserves the right to modify or simply update its content, wholly or partially, also as a result of variations in the applicable legislation. Therefore, the Data Controller invites you to regularly visit this section to keep up-to-date with the most recent and updated version of the Privacy Policy in order to always be informed on the data collected and how Brunello Cucinelli uses it.

11. CONTACT US

To exercise the above rights or for any other requests, please write to the Data Controller at the physical address indicated above, or via the dedicated contact details, preferably writing "request for the exercise of privacy rights" in the subject field.