A. Data controllers:

In accordance with art. 13 of European Regulation no. 2016/679 “General Data Protection Regulation” (hereinafter “GDPR”)

Exelite S.p.A. (formerly Liu Jo S.p.A) based in Via Tortona, 37 - 20144 - Milan (MI), Italyprivacyconsumer@liujo.it (hereinafter “Blumarine”)

e

Digital Boite S.r.l. based in Via Cusani 5, 20122, Milan, Italy, dpo@digitalboite.com (hereinafter “DB”)

(hereinafter jointly the "Data Controllers") provide you with the following information on the collection, usage, sharing and processing of your personal data carried out via the website https://www.blumarine.com/ and any Blumarine apps for mobile devices (hereinafter, jointly, "Website") or any other point of sale forming part of the network of Blumarine stores.

In detail:

• Blumarine is the owner of the Website and is the autonomous controller of the personal data processed for the purpose of marketing and profiling;
• DB is an autonomous controller of personal data processed for the purposes of the sale, invoicing, payment and shipment of products purchased via the Website;

Blumarine and DB are joint controllers of the personal data processed for the purposes of:

• registration on the Website and the provision of services for registered users;
• store planning, sales analysis;
• management of after-sales assistance requests (online and in physical stores) and returns management;
• management of requests related to the use of multi-channel services;
• prevention of crime and fraud.

The main content of the joint agreement between Blumarine and DB is stated in the following table. You may request further information relating to the content of the joint controller agreement below by writing to Blumarine or DB at the addresses stated above, or by contacting the DPO by writing to the email indicated in the following section.

For more information on the personal data processed by the use of cookies and other similar tracking technologies, please see our Cookie Policy.

B. Date protection officer (DPO)

Blumarine and DB have both nominated a data protection officer (DPO):

The Data Protection Officer (DPO) for Blumarine can be contacted at the following email address dpo@liujo.it;

The data protection officer (DPO) for DB can be contacted at the following email address dpo@digitalboite.com.

C. Categories of data processed

According to the intended purposes, we will process the following personal data (for example and not limited to):

• Personal data: name, surname, date of birth, gender;
• Contact data: telephone number, email address;
• Authentication data: username, password;
• Shipping information: home address, residential address, any additional addresses needed to deliver the order;
• Invoicing and tax free data: billing address, name and surname, company name, fiscal code, VAT number, nationality, passport number;
• Information on purchases made: items, size and colour, price, date of purchase, price paid;
• Data relating to the customer's profile and preferences: data on behaviour and purchases;
• Browsing data: data collected during the visit and usage of the Website, including via cookies or other tracking technologies (for further information on the processing of your data via such technologies, please see our Cookie Policy);
• Location data (store locator service): IP address;
• Loyalty program data: points, clusters, discounts, vouchers.

Any additional data transmitted in order to make use of specific services offered by Blumarine.

D. Purpose, legal basis for the processing and retention periods of the personal data

E. Sharing of Data

The disclosure of data to fulfil these purposes based on the conditions of lawfulness as per art. 6.1, letter b), c) and f) of the GDPR are necessary to be able to pursue the purposes mentioned above.
The disclosure of data for the purposes for which a legal basis of consent is provided, as per art. 6.1, letter a) of the GDPR, is purely voluntary and the lack of disclosure of data or the lack of consent provided precludes the pursuance of the purposes related to profiling, marketing and enhancement of the data, but without prejudice to your possibility to register on the Website, or to make use of services provided on a contractual basis.

During their normal operation, the IT systems and software procedures used to operate this website acquire some personal data, the transmission of which is implicit in using Internet communication protocols.

This information is not collected to be associated with identified interested parties, but by their very nature could allow users to be identified through processing and associations with data held by third parties.

The information that may be collected includes IP addresses, the type of browser or operating system used, addresses in URI form (Uniform Resource Identifier), the domain name and the website address from which the Website was accessed or left for (referring/exit pages), the time in which the server request was carried out, the method used and information on the response received, other information on the user's browsing (please see also the section on cookies) and other parameters relevant to the operating system and computer environment of the user.

This same data may also be used to identify and verify responsibility in the case of possible cyber crimes against the Website.

F. Recipients of the Personal Data

The data will be processed by:

• a. employees and associates of the Data Controllers (including staff at physical stores) who are authorised to collect, use, share or process your personal data;
• b. demployees and associates of DB, who are responsible for data processing regarding the management of marketing and profiling activities on behalf of Blumarine;
• c. third parties located within the European Union, which are responsible for processing and are employed by the Data Controllers, in particular, for services for the acquisition of and integration of personal data, shipping services, mailing of promotional materials, for the services made available on the website (e.g., chatbot), market research, customer satisfaction surveys, and the management and maintenance of IT systems;
• d. third parties, autonomous data controllers, in particular freelancers or consulting firms, legal or financial assistance companies, and debit or credit card payment processing services;
• e. third parties, autonomous data controllers such as supervisory and control authorities or other public or private entities that are entitled to request the data.

The complete list of recipients of personal data can be requested by writing to the addresses indicated above in paragraph A.

G. Transfer of Data outside of the European Union

Your personal data may be transmitted outside of the European Economic Area (for example to Albania, for the purpose of customer assistance provided by the call center). Blumarine undertakes to guarantee that this transfer occurs in accordance with CHAPTER V of the GDPR. In particular, adequate security measures and appropriate methods of transmission (for example, the standard contractual clauses approved by the European Commission) will be implemented to guarantee a standard of protection equivalent to that which is expected within the EEA.

H. Rights of the Interested Parties

By contacting the email addresses given above in paragraph A, you may request from the data controllers access to the data relating to you, deletion of said data, correction of errors in the data, additions to incomplete data, and the limitation of processing of the data in the cases provided for by art. 18 of the GDPR. You may also oppose the processing of your data in the data controller's legitimate interest for reasons relating to your particular situation.

Where the processing is based on consent or on the contract and is performed by automated tools, you also have the right to receive your data in a structured, commonly used and machine-readable format, as well as, if technically possible, you may request that this data is transmitted to another data controller without prejudice.

You have the right to revoke your consent at any moment for the purposes of marketing and/or profiling, as well as to oppose data processing for marketing purposes, including profiling connected to direct marketing.

If you prefer, you can request to be contacted for the purposes mentioned above exclusively in traditional ways, and you may register your opposition only to receiving automated communications.

Furthermore, you have the right to file a complaint with the competent oversight authority in the member state in which you usually reside or work, or in the state in which the alleged violation took place.

Lastly, you may modify or update your personal data and your consent to the processing of personal data at any time by accessing your personal account or by sending an email to dpo@liujo.it or alternatively, to privacyconsumer@liujo.it.