Privacy policy

1

DATA CONTROLLER AND CONTACT INFORMATION

The data controller is Forall Confezioni S.p.A. (hereinafter “Forall” and/or “Controller”) with registered office at Via Fabio Filzi, 34 - 36050 Quinto Vicentino (VI). Requests for clarification regarding this policy and requests to exercise the rights prescribed by law and/or described herein may be submitted to the following contact: privacy@forall.com.

2

CATEGORIES OF DATA PROCESSED, PURPOSES, AND LEGAL BASIS FOR PROCESSING

CATEGORIES OF DATA PROCESSED

PURPOSES

LEGAL BASIS

2.a

First name(s), last name, email address, phone number, and any personal data included in messages sent via the contact methods available on the Website.

To respond to user requests sent via the interaction methods available on the Website, or to the email addresses listed on the Website (e.g., contact form).

Performance of a contract to which the data subject is a party/implementation of pre-contractual measures taken at the data subject’s request - Art. 6.1.(b) GDPR.

2.b

Browsing data (personal data whose transmission is implicit in the use of Internet communication protocols, such as IP addresses or domain names of the computers used by users, the time of the request, and other parameters relating to the user’s operating system and IT environment).

To enable the user to browse the Website.

2.c

First name(s), last name, gender, date of birth, age group, nationality, phone number, email address, password.

(The provision of some of the data listed above is optional. This is indicated in the form—or other collection tool).

To allow the creation of a personal user account on the Site.

2.d

First name(s), last name, email address, phone number, physical address, credit card information, or other payment method details.

To finalize and fulfill the sale of products through the Site, as well as to provide after-sales services and other support related to the transaction concluded by the data subject.

2.e

First name(s), last name, title, date of birth, age group, email address, data regarding previous purchases of the Data Controller’s products (products purchased, purchase channel, purchase frequency, value of previous purchases, and general spending habits), hobbies and interests, history of previous communications and interactions, preferred method of contact, preferred language.

(The provision of some of the data listed above is optional. This is indicated in the form—or other data collection tool).

General marketing activities through the sending of communications and materials (e.g., via text messages, email).

Consent of the data subject – Art. 6.1.(a) GDPR.

Consent may be revoked by the data subject at any time.

2.f

First name(s), last name, email address, data regarding previous purchases of the Data Controller’s products (products purchased, purchase channel, purchase frequency, value of previous purchases, and general spending habits).

(The provision of some of the data listed above is optional. This is indicated in the form—or other collection tool).

Direct marketing activities through the sending of communications or materials (e.g., via email, newsletters) regarding products similar to those already purchased by the data subject, or in any case news of interest regarding the activities carried out by the Data Controller.

Processing is permitted as it is necessary for the pursuit of a legitimate interest of the data controller – Article 6.1.(f) of the Regulation. The data controller’s legitimate interest lies in promoting its business through direct marketing as well as in the proper and complete conduct of its activities toward customers – see Recital No. 47 of the Regulation.

2.g

First name(s), last name, gender, date of birth, age group, nationality, physical address, email address, data regarding previous purchases of the Data Controller’s products (products purchased, purchase channel, purchase frequency, value of previous purchases, and general spending habits), hobbies and interests, history of previous communications and interactions, preferred method of contact, preferred language.

(The provision of some of the data listed above is optional. This is indicated in the form—or other collection tool).

Strategic and predictive analysis activities (for example, to optimize product assortments, campaigns, and loyalty strategies).

Processing is permitted as it is necessary for the pursuit of a legitimate interest of the data controller – Article 6.1.(f) of the Regulation. The data controller’s legitimate interest lies in the ability to improve and streamline its commercial offering to better align it with customer requests and preferences.

2.h

Gender, nationality, age group, data regarding previous purchases of the Data Controller’s products (products purchased and related categories and sizes, purchase channel, purchase frequency, values of previous purchases, and general spending habits), hobbies and interests, history of previous communications and interactions, preferred method of contact, preferred language. Data collected via cookies while browsing the Site.

(The provision of some of the data listed above is optional. This is indicated in the form—or other collection tool).

Customer analysis and segmentation, profiling, and predictive assessments aimed at personalizing the offer, one-to-one clienteling activities.

Consent of the data subject – Art. 6.1.(a) GDPR.

Consent may be revoked by the data subject at any time.

3

The personal data referred to in the categories listed above may be supplemented and completed by the Data Controller with personal data relating to the same data subject that may have been collected through other sales channels attributable to the Data Controller (e.g., at physical points of sale) in order to manage the data subject’s profile in a unified and efficient manner.

4

No sensitive data (i.e., data concerning religious beliefs, trade union membership, sexual preferences, and others specified in Article 9 of the GDPR) is processed through the Website, and we ask all users not to include such data when submitting a contact request via the Website or in other forms of interaction provided by the Website.

5

MANDATORY NATURE OF DATA PROVISION

The provision of data for marketing and/or profiling purposes is optional, and failure to provide such data and/or failure to consent and/or a request not to use it for marketing and/or profiling purposes will not affect the ability to browse the Site and/or make purchases through the Site. The provision of other data is necessary for browsing and/or making purchases through the Site. Failure to provide such data may result in the inability to browse the Site and/or the inability to respond to messages from the data subject.

6

POSSIBLE RECIPIENTS OF PERSONAL DATA

The data may be disclosed to and/or made available to (i) employees and contractors of the Data Controller, whether based in Italy or abroad; (ii) third parties operating, including on behalf of and for the account of the Data Controller, to perform services related to the purposes indicated in this privacy policy, and in particular the management and maintenance of the Website and the fulfillment of sales contracts concluded through the Website (e.g., couriers); (iii) consultants and third-party suppliers of the Data Controller, such as tax and/or communications consultants; (iv) other companies belonging to the same group as the Data Controller, which carry out activities on behalf of the latter; (v) public authorities and entities to whom disclosure is mandatory.

In managing personal data, the Data Controller uses tools that may involve the transfer of data to countries outside the EEA, in particular to the United Kingdom. The Data Controller undertakes to select and use first-rate, reputable suppliers who guarantee the lawful processing and transfer of personal data.

7

RETENTION PERIOD

Technical browsing data will be retained for the time technically necessary to fulfill the purposes for which they were collected.

In the case of exchanges and/or purchases and/or any interaction via the Website with the Data Controller’s customers, or with users who subsequently become customers of the Data Controller, the data is retained for a maximum of 10 (ten) years from the date of termination of the commercial relationship with the customer in question, in consideration of the statute of limitations for any claims arising from the relationship between the Data Controller and the data subject, as provided by law.

In the case of exchanges and/or any interaction via the Site with users who are not, and subsequently do not become, customers or suppliers of the Data Controller, personal data is retained for a maximum of 2 (two) years from the date of the last interaction with the user.

In the case of data processed with the data subject’s consent (e.g., for marketing or profiling purposes), such data will be retained until such consent is revoked by the data subject, and in any case for a maximum of 7 years. With regard to the sending of direct marketing communications, processing will continue until the User requests to no longer receive communications (“opt-out”), and in any case for a maximum of 7 years. These timeframes have been determined based on the characteristics of the Data Controller’s products and the typical frequency of related purchases, which usually occur with a significant interval between one purchase and the next and are also influenced by seasonality and/or special occasions (e.g., formal wear).

8

RIGHTS OF THE DATA SUBJECT

At any time, each user may exercise against the Data Controller the rights provided for in Articles 15 through 22 of the GDPR, namely the right to request:

1. access to personal data, namely to know their personal data held by the Data Controller, the purposes for which it is processed, its origin, and other information provided for in Article 15 of the GDPR;

2. the rectification of personal data in the event of inaccuracy, or their completion in the event of incompleteness;

3. the erasure of personal data (the so-called “right to be forgotten”);

4. restriction of the processing of personal data, i.e., the right to have the processing of personal data suspended for the period necessary to verify the request for correction of personal data, or in the other cases provided for in Article 18 of the GDPR;

5. data portability, i.e., the right to receive personal data in a structured, commonly used, and machine-readable format—including by requesting the direct transfer of such data to another controller (with respect to data processed by automated means);

6. the right to request that the data controller refrain from processing data pursuant to Article 6(1)(e) or (f) of the GDPR (right to object);

7. the right to lodge a complaint pursuant to Articles 77 et seq. of the GDPR with a supervisory authority, which for Italy is the Italian Data Protection Authority. The procedures for lodging a complaint are available at this link: https://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524.

9

MINORS

The processing of a minor’s personal data is lawful if the minor is at least 16 years old. If the minor is under 16 years of age, consent to the processing of data pursuant to Article 6.1.(a) of the GDPR must be provided or authorized by the parents or their legal guardians. The Data Controller does not intend to collect personal data from minors or to deliberately communicate with them. For this reason, we urge parents to actively monitor the online activities of their children under the age of sixteen.

10

CHANGES TO THIS POLICY

This Privacy Policy may be amended over time—including in connection with the entry into force of new industry regulations, the updating or provision of new services , or technological innovations. Changes to this policy become effective upon their publication on the Website, provided that the Data Controller may not use data collected prior to such changes for processing purposes other than those described herein without informing the user.