Privacy Policy

 

Boglioli S.p.A., acting as Data Controller, provides users with the following information regarding the processing of their personal data when using the website www.bogliolimilano.com (hereinafter, the “Website”), pursuant to the General Data Protection Regulation (EU) 2016/679 (hereinafter, the “GDPR”).

 

Data Controller

The Data Controller (hereinafter, the “Data Controller”), i.e. the entity that determines the purposes and means of processing personal data, is Boglioli S.p.A., with registered office at Via Brescia No. 47, Gambara (BS), Italy, VAT No. 00564580983; contact: privacy@boglioli.it.

 

Personal Data

“Personal data” means “any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person” (hereinafter, “Personal Data”).

The Website collects the following Personal Data from users:

• Browsing data: The IT systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects but, by its very nature, may, through processing and association with data held by third parties, make it possible to identify users. This category includes the IP addresses or domain names of the computers used by users connecting to the Website, URI (Uniform Resource Identifier) addresses, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the server response (successful, error, etc.), the country of origin, the characteristics of the browser and operating system used by users, the various time-related details of the visit (e.g. the time spent on each page) and details of the browsing path followed within the Website, with particular reference to the sequence of pages visited, as well as parameters relating to users’ operating systems and IT environments.

• Personal and contact details (in the event of registration on the Website and subscription to the newsletter): first name, surname, date of birth and gender (optional), e-mail address, telephone number, delivery address for purchased goods and geographical location.
• Technical data collected through tracking pixels or equivalent tools contained in newsletter emails, such as information relating to the date and time of opening and viewing and, more generally, any interaction with such communications, the device used, IP address and clicks.
• Payment data (processed through the Shopify platform): payment information (payment method).
• Purchase-related data: the user’s purchase history, billing details and address, and any other data necessary to ensure the management of purchase orders.

Data collection

Personal Data are provided directly by the user.

 

Purpose of processing, legal basis and whether the provision of data is mandatory

 

The Personal Data provided by the user will be processed for the following purposes:

 

1. Management of Website Browsing

Data are collected by automated means in order to enable and improve users’ browsing experience on the Website. Processing such Personal Data allows users to access the Website and make full use of its features and services. Browsing data may also be used to verify that the Website is functioning correctly. Personal Data may also be used to display content from external platforms through the Website.

The legal basis for processing Personal Data is the legitimate interest of the Data Controller (Article 6(1)(f) GDPR).

Providing such data is necessary to enable browsing of the Website.

 

2. Sale of products through the Website, management of orders  and shopping charts, and handling of support and contact requests

The Data Controller may verify the validity of the payment instruments used by users to make purchases on the Website (e.g. credit or debit cards) primarily to prevent fraudulent activities or to comply with anti-money laundering legislation. As this activity is delegated to duly authorised third parties, the Data Controller does not process or store financial information relating to users or their payment instruments.

The legal basis for processing Personal Data is the performance of a contract to which the data subject is a party or the implementation of pre-contractual measures taken at the data subject’s request (Article 6(1)(b) GDPR).

Providing Personal Data is necessary for the sale of products, the management of orders and the handling of support requests. Failure to provide the requested Personal Data will prevent users from completing an order on the Website.

 

3. Registration on the Website

Users may also access their account through social media. Users who choose to create or access their Website account in this way should be aware that, when they link their Website account to a social media account, the Website collects certain Personal Data that the user has already provided to that social media platform (e.g. email address and public Facebook profile).

The Data Controller does not supervise or manage these social media services or users’ profiles on such services. Nor does it determine the Personal Data protection settings or the rules governing the use of Personal Data on those social media platforms (Facebook, Twitter or others). Users are strongly encouraged to read the privacy policies published by the operators of those services to obtain further information about how Personal Data are processed through these channels.

The legal basis for processing Personal Data is the data subject’s consent given at the time of registration (Article 6(1)(a) GDPR). Consent may be given by selecting the relevant checkbox.

Providing Personal Data is necessary to register on the Website. Without such data, users will not be able to access the services provided by the Website.

 

4. Newsletter and marketing communications

By accessing the Website, users may choose to receive newsletters and commercial communications by email and SMS.

The Data Controller obtains the user’s explicit, freely given, specific and informed consent before sending commercial and promotional communications through automated systems, except in cases where Article 130(4) of Legislative Decree No. 196/2003 applies in relation to products or services similar to those already purchased by the user.

Commercial communications, including communications relating to order status, and newsletters may contain tracking pixels or similar tools designed to detect whether a message has been opened or viewed, the user’s interaction with its content and the technical information required to measure campaign performance. The use of such tools for individual-level measurement, performance analysis, personalisation, remarketing, retargeting or profiling purposes will take place only with the user’s prior consent.

 

5. Profiling

Profiling and Personalisation of Communications

Subject to the user’s specific consent, the Data Controller may process Personal Data, including purchase data, stated preferences, and data relating to the viewing of and interaction with communications, for commercial profiling and communication personalisation purposes.

In particular, the Data Controller may use data relating to email openings, content views, repeated non-opening of emails as an indication of lack of interest, and interactions with communications to understand users’ interests, improve the content sent, adjust the frequency of communications and suggest products considered more relevant to them.

These activities may also be carried out through email service providers, marketing automation platforms, digital agencies and advertising platforms, within the scope of their respective functions and in accordance with the applicable data protection roles.

The legal basis is the data subject’s consent, pursuant to Article 6(1)(a) GDPR and Article 122 of Legislative Decree No. 196/2003. Providing data for these purposes is optional, and refusal to consent does not affect the user’s ability to purchase products or use the Website’s services.

 

6. Compliance of legal obligations

If users make purchases, request an invoice, exercise their statutory warranty rights or if other legal obligations apply, the Data Controller will process users’ Personal Data to comply with legal obligations relating to taxation and consumer protection.

The legal basis for processing is compliance with a legal obligation to which the Data Controller is subject (Article 6(1)(c) GDPR).

Providing Personal Data is necessary. In their absence, the Data Controller will be unable to fulfil its obligations towards users.

 

7. Legal defence

The Data Controller may process Personal Data to defend its rights in legal proceedings or in the event of misuse of the Website.

The legal basis for processing is the Data Controller’s legitimate interest (Article 6(1)(f) GDPR).

Providing Personal Data is necessary to protect the Data Controller’s rights.

 

8. Determination of geographical location

The Data Controller may determine users’ geographical location by tracking their IP addresses in order to apply the appropriate language.

The legal basis for processing is the Data Controller’s legitimate interest (Article 6(1)(f) GDPR).

Providing Personal Data is optional. Without such data, the Data Controller cannot guarantee location-based interactions.

 

9. Statistical purposes

The Data Controller may process aggregated and, where possible, anonymised statistical data relating to the use of the Website and the effectiveness of communications sent.

Email statistics will be generated without consent only where the data are processed in a genuinely aggregated or anonymised form, or where the tool used is strictly necessary for the transmission, security or technical management of the communication.

Individual tracking of email openings, opening times, devices used or user interactions through tracking pixels, where used to measure the behaviour of individual recipients, improve promotional campaigns, personalise content or create commercial profiles, will be carried out only with the user’s prior consent.

 

10. Website Security

The Data Controller may process Personal Data to ensure the security of the Website, monitor its proper functioning and establish liability in the event of suspected cybercrime against the Website.

The legal basis for processing is the Data Controller’s legitimate interest (Article 6(1)(f) GDPR).

Providing Personal Data is optional. Without such data, the Data Controller may be unable to fulfil users’ orders and/or requests.

 

Recipients of personal data

Personal Data may be processed by employees and collaborators of the Data Controller responsible for customer service, marketing/profiling or administrative activities.

The following categories of recipients may have access to Personal Data in their capacity as data processors, insofar as they process Personal Data on behalf of the Data Controller pursuant to Article 28 GDPR:

• Providers of services for sending, managing and analysing email and SMS communications, including marketing automation platforms and technical tools for managing tracking pixels, user preferences, withdrawals of consent and communication statistics;
• Providers of customer support services for users who have purchased products;
• Providers of consultancy and support services for marketing activities (e.g. advertising, digital and social media agencies, newsletter distribution agencies) and logistics (e.g. couriers or postal operators, fulfilment centres and warehouses);
• Professional advisers (e.g. external professionals, including lawyers responsible for protecting the Data Controller’s rights, accountants responsible for the administrative management of purchases, and consultants involved in creating the Website);
• Providers enabling payment for orders, including banks, payment institutions, other payment intermediaries and, generally, payment service providers.

Personal Data may also be disclosed to judicial authorities.

Users’ Personal Data will not be disseminated or made publicly available.

 

Transfer of personal data to countries outside the EU

For the purposes of managing the Website, users’ Personal Data are transferred outside the European Economic Area (“EEA”). Some service providers are located in the United States, a country outside the EEA, or may in turn entrust the processing of users’ Personal Data to sub-processors located in that country. Transfers to that country or, where necessary for the provision of the relevant service, to other countries outside the EEA take place in compliance with the appropriate safeguards provided for by the Regulation.

 

Data retention periods

Personal Data are retained for the period strictly necessary to fulfil the purposes for which they were collected and to comply with applicable legal and regulatory obligations.

The retention period varies according to the purpose of processing, as follows:

• Management of Website browsing: please refer to the Cookie Policy.
• Sale of products through the Website, management of orders and support and contact requests: 10 years from the date of purchase.
• Registration on the Website: 10 years from the date of registration, without prejudice to the right to request deletion of the account at any time.
• Newsletters, marketing communications and profiling: 10 years from the date of subscription or the last purchase, without prejudice to the right to withdraw consent at any time or to object to receiving newsletters where they are sent pursuant to Article 130(4) of Legislative Decree No. 196/2003. Data relating to interactions with electronic communications, including data collected through tracking pixels, will be retained for the period strictly necessary for the purposes for which they were collected and, in any event, no longer than the period specified in this Privacy Policy for marketing and profiling activities, unless the information must be retained to demonstrate that consent was given, manage a withdrawal of consent, or establish, exercise or defend a legal claim. If consent to tracking is withdrawn, the Data Controller will stop using tracking pixels in future communications and will no longer use the data collected for profiling or personalisation purposes, except where necessary to document the user’s choices or comply with legal obligations.

• Compliance with legal obligations: for activities necessary to fulfil the legal obligations referred to in point 1(b) of this Privacy Policy, data will be retained for the period necessary to fulfil those purposes and, in any event, for no longer than 10 years.
• Legal defence: for the period necessary to protect the Data Controller’s rights in legal proceedings.
• Determination of geographical location: for the period necessary to enable location-based interactions.
• Website security: for the period necessary to pursue the Data Controller’s legitimate interest and, in any event, for no longer than 10 years.

Longer retention periods may apply where permitted by law and where necessary to defend rights in legal proceedings.

At the end of the applicable retention period, Personal Data will be deleted or anonymised.

 

Processing methods

Personal Data are processed by the Data Controller using IT, automated and electronic tools and, in limited cases, documentary records. In accordance with the GDPR, specific security measures have been implemented to prevent data loss, unlawful or improper use, and unauthorised access.

Only persons authorised by the Data Controller or by the providers identified in the section “Recipients of Personal Data” may access Personal Data relating to activities carried out on the Website. Instructions and security measures have been established in agreements or formal appointments of data processors to ensure that the level of security required by the GDPR is maintained whenever Personal Data are processed in connection with activities on the Website.

Security measures have been adopted in the configurations and processing operations carried out through the Website to prevent the loss, destruction or disclosure of Personal Data. However, security risks associated with the online transmission of data cannot be entirely ruled out.

 

Links to third-party websites or platforms

The Website may display banners, advertisements and other links to third-party websites or platforms. The Data Controller cannot control or be held responsible for the conduct of such third-party websites or platforms with regard to data protection legislation. Users are invited to read the privacy policies of third-party websites to verify how those websites collect, store and process Personal Data.

 

Data subject rights

Users have the right, at any time and free of charge, without any formal requirements, to exercise the following rights under Articles 15 to 22 GDPR: the right to request access to, rectification and erasure of Personal Data, restriction of processing, the right to object to processing, and the right to data portability. Users also have the right to withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Requests to exercise these rights may be sent to the Data Controller at the following email address: privacy@boglioli.it.

Users may lodge a complaint at any time with the Italian Data Protection Authority (www.garanteprivacy.it) or with the competent supervisory authority of the EU Member State in which they reside or work.

 

Reference to the Cookie Policy

The Data Controller invites users of the Website to read the Cookie Policy published on the Website.

 

Additional information for users in Switzerland

This section applies to users in Switzerland and, for such users, replaces any other information contained in this Privacy Policy that differs from or conflicts with it.

Further details regarding the categories of Personal Data processed, the purposes of processing, the categories of recipients, where applicable, the retention period and other information concerning Personal Data are available in this Privacy Policy.

Users’ Rights under the Swiss Federal Act on Data Protection

Users may exercise certain rights relating to their data, within the limits of applicable law, including:

• The right to access Personal Data;
• The right to object to the processing of Personal Data, which also allows users to request restriction of processing, erasure or destruction of Personal Data, and a prohibition on disclosing Personal Data to third parties;
• The right to receive their Personal Data and transfer them to another data controller (data portability);
• The right to request the rectification of inaccurate Personal Data.

How to Exercise These Rights

Requests to exercise users’ rights may be sent to the Data Controller using the contact details provided in this document. Such requests are free of charge, and the Data Controller will respond as soon as possible, providing users with the information required by law.

 

Additional information for users in the United States of America

For users residing in certain US states, supplementary provisions apply concerning the categories of Personal Information collected, the purposes of processing, the rights available and how those rights may be exercised, in accordance with applicable law.

Such users may have, among other rights, the right to access, rectify, delete and transfer their data, the right to opt out of the sale or sharing of Personal Data, the right to limit the use of sensitive data, and the right to non-discrimination.

Requests may be submitted using the contact details provided in this Privacy Policy.