This notice describes which of your personal data is collected by Zerogrey S.r.l. and by Blufin S.p.A (hereinafter referred to as "us"), the purposes for this and how it is processed. You will also find the information necessary to exercise your rights under GDPR. In general, we collect your data when you create an account on our online store www.blumarine.com and www.blugirl.it (hereinafter "Store"), when you visit
www.blufin.it and www.annamolinari, when you purchase products offered for sale in the Store, when you send us emails or when you call us for assistance.

You are hereby informed that the personal data collected during said procedures will be processed in order to respond to your requests, allow you to use the services offered by the Store through the private areas (for example, to process your orders and perform the tasks necessary to do this, including the transactions required for administrative and tax compliance and, at your request, and information) and to provide better services, marketing and support for you and other customers, as set out above.

1. Who processes your data: data controllers

Zerogrey S.r.l., a sole shareholder company, with registered offices at Via L. Colli, 15 10128 Turin, fiscal code and tax code no. 08003340018 (hereinafter “Zerogrey”) and Blufin S.p.A. at Via G. Ferraris 13-15-15/A 41012 Carpi (Modena), fiscal code and tax code no. 01801930361 (hereinafter “Blufin”) are the joint controllers of your data. In accordance with Art. 26 GDPR, you are hereby informed that Zerogrey is the controller of your personal data for the purposes of: processing and managing your orders, shipping the products you have bought, providing you with the necessary after-sales support, managing the return of purchased products, complying with taxation law and, subject to your prior consent, carrying out marketing activities, in accordance with the purposes and methods set out below. In accordance with Art. 26 GDPR, you are hereby informed that Blufin is the controller of your personal data for the purposes of: managing Store accounts when transitioning to new operators or internalising the services currently entrusted to Zerogrey; helping Zerogrey identify your location in order to abide by the legal or contractual warranties, including managing product return procedures; managing and maintaining the Store; and, subject to your consent, marketing.
To get in touch with Blufin’s Data Protection Officer please contact: dpo@blufin.it

2. Which data we process - Type of data processed

Your contact and account data. We will retain the contact information you provide (for example, your first name, surname, address, telephone number, email, country of residence, ) when you create an account on the Store, purchase a product and/or take part in our competitions or promotions.

Your payment and invoicing data. We will retain the payment and invoicing data that you provide (for example, credit card number, post code and address) when you purchase a product, for the purpose of managing your order and shipping the products. At your request, we can also retain the payment and invoicing data in order to make future purchases easier.

Website use data. By using our website, you agree for us to process the data from your browser and the device you are using, as well as your IP address (this is the number that identifies a specific device on the internet and that is needed for your device to communicate with websites). We can analyse which site you have come from, what you have done and what you have not done on our website.

3. Where we get your data - Data collection method:

Directly from you. For example, if you register to make a purchase from the Store, create an account, take part in a competition, ask us a question or contact with our call centre. If you do not send us your data, you will not be able to register at the Store and will therefore be unable to purchase any products offered for sale.

Through the use of the Store's features. We use cookies and other technology, such as pixel tags, on our websites and in our emails in order to collect your usage data and to make better targetted promotions. To find out more, please view our Cookie Policy.

4. Why and how long we process your data for - Purpose and legal basis for data processing; retention period

To supply the products and services you have purchased and send you information about your order or your payment. For example, we will use your data to manage your order, confirm your purchase and manage any related services, such as shipping your purchased products. We cannot manage and process your order without your data.

The legal basis for this processing is the performance of the purchase agreement to which you are party from the moment you accept the Store's terms and conditions of sale.

The retention period for your data is equal to the period required to process the order. Wherever you have created a Store account, the period will be 24 months from the date on which the data was collected.

To provide you with the necessary after-sales support in accordance with the applicable product warranty laws. For example, we will use your data to provide you with support and to manage the return and/or repair of the products you have purchased from the Store, in accordance with the applicable laws.

The legal basis for this processing is compliance with the legal requirements. The retention period is equal to the period required by law (in particular, by the Italian Consumer Code).

To correctly manage your billing status. We process your data for the accounting, administrative and tax purposes directly related to the joint controllers' business activities and required by the applicable laws. The legal basis for this processing is compliance with the legal requirements. The retention period is equal to the period required by law (in particular, fiscal, money laundering, banking and public security laws).

So that you can interact with our customer support staff. We may use your email address or phone number, as well as your name and/or postal address, to help you if you need support when using the products you purchased from the Store.

The legal basis for this processing is the performance of the purchase agreement that you entered into with Zerogrey when you accepted the Store's terms and conditions of sale and compliance with the legal obligations regarding warranties and customer support.

It is also possible that information regarding the support or a service problem may be captured. To improve its customer support service, which is subject to the applicable laws, Zerogrey may also record and relisten to your conversations with its customer support staff.

The legal basis for this processing is Zerogrey's legitimate interest in improving the quality of the customer services it provides. In addition, Zerogrey may analyse any feedback provided voluntarily through customer surveys.

The legal basis for this processing is the consent of the interested party.

In all of the aforementioned cases, the data retention period is equal to the period during which your account is active.

To monitor and improve our products and the Store. With your consent, we analyse your usage data, preferences and consumption of our products in order to improve our approach for both you and our customers in general. We do so through automated processing that includes profiling. This is done in order to make better decisions regarding services, advertising, products and content based on a greater understanding of how our customers use our services, and to provide a more personalised user experience.

For this reason, we may also collect your IDFA (Identifier for Advertising) for iOS devices and your AAID (Google Advertising ID) for Android devices so that we can provide you with targeted, relevant adverts based on your preferences and interests. The legal basis for this processing is your explicit consent. The retention period for your data is equal to 12 months from the date on which the data was collected.

To prevent or investigate illegal behaviour or to protect and assert rights. For example, we may use your data to prevent the breach of our intellectual property rights (for example, counterfeiting of our and/or our partners' trademarks) or theft (including credit card cloning and thefts that we believe to have occurred during a competition, activity or event) or other illegal activities, as permitted by the applicable law. The legal basis for this processing is the legitimate interest of the joint data controllers. The data retention period is equal to the time that is reasonably necessary to assert our rights from the point at which we become aware of the illegal behaviour or the potential to commit illegal behaviour.

To send commercial proposals and offer products in line with your preferences. With your consent, we analyze your personal data and the use of the Shop site, your purchase and consumption preferences of our products to improve our approach to you and our customers in general, through automated treatments that include profiling . We do this in order to be able to send personalized commercial communications so that we can make better decisions in relation to services, advertising, products and content that are based on a greater awareness of how our customers use our services and to guarantee a more personalized experience. To this end we could also collect the identifier for the advertising of your mobile device (IDFA - Identifier for Advertising - for iOS and AAID devices - Google Advertising ID - for Android devices, Adabra) to allow us to always provide you with announcements targeted and relevant based on your preferences and interests.
The legal basis for this processing is your explicit consent. Your data retention period is 12 months from the collection of your data.

For direct marketing purposes. Upon release of your consent, you may be contacted by email or other means of electronic communication with information or offers of products and services offered by us.
The legal basis for this processing is your explicit consent. Your data retention period is 24 months from the collection of your data.

Other purposes permitted by the law. In certain circumstances, we may process your data if there is a legitimate interest for Zerogrey and Blufin, in accordance with Art. 6, paragraph 1 (f) of GDPR. For the aforementioned purposes, personal data is processed using manual, digital and online tools with software that is closely related to said purposes and, in any case, is processed in such a way that the data is kept secure and confidential in accordance with the law.

5. Cookies

What are cookies? Cookies are small text files that are sent to your computer when you visit a website. Your computer saves the cookies and sends them back to the website when you visit the website again.

The cookies used by the Store and their purpose. The site uses cookies whose purpose is to allow some sections to function correctly, for example when accessing the private area of the Store ("technical cookies"), to provide certain personalised features ("functional cookies"), to improve the browsing experience ("analytical cookies") and to help us offer you personalised recommendations for products you may like ("profiling cookies"). The first time you visit the website, a banner will ask you to accept (or not accept) cookies. You can refuse to accept all or some cookies or you can change your computer's settings, including at a later date, so that you know when you receive cookies or so that you can stop your computer automatically accepting cookies.

The Store uses the following types of cookies:

• Technical (or browsing) cookies, which help the site to function, for example by allowing you to browse between pages and access the site's private area; the legal basis for processing data using these cookies is the joint controllers' interest in providing efficient, well-functioning services to their customers; the retention period of these cookies runs from the date of first access to the site until the end of the session or a maximum of one month.
• Functional cookies, which allow certain Store features to be activated and preferences (such as language) to be saved in order to improve your browsing experience; the legal basis for processing data using these cookies is the joint controllers' interest in providing efficient, well-functioning services to their customers; the retention period for these cookies runs from the date on which the site was first accessed until the date on which the cookies are disabled. Users may accept and disable these cookies whenever they like using the cookie management tool.
• Analytical cookies, which allow us to acquire aggregated, anonymous statistical information concerning browsing habits; the legal basis for processing data using these cookies is the joint controllers' interest in providing efficient, well-functioning services to their customers; the retention period for these cookies runs from the date on which the site was first accessed until the date on which the cookies are disabled. Users may accept and disable these cookies whenever they like using the cookie management tool.
• Profiling cookies, which allow us to personalise advertising messages based on your interests and preferences so that we can send you only the adverts that you will find relevant or interesting; the legal basis for processing data using these cookies is the consent of the interested party; the retention period for these cookies runs from the date on which the site was first accessed until the date on which the cookies are disabled and, in any case, will be no longer than 12 months. Users may accept and disable these cookies whenever they like using the cookie management tool.

The cookies currently used are:

Partner	Category	Optout
Facebook	Advertising	https://www.facebook.com/help/568137493302217	1
Tumblr	Advertising	https://www.tumblr.com/policy/en/privacy	1
Google+ Platform	Social	https://plus.google.com/settings	1
Twitter	Advertising	https://support.twitter.com/articles/20170405-your-privacy-controls-for-tailored-ads	1
DoubleClick	Advertising	http://www.google.com/ads/preferences/html/opt-out.html	1
Google Adwords	Advertising	https://support.google.com/ads/answer/2662922?hl=en	1
AdRoll	Advertising	https://www.adroll.com/about/privacy	1
Pinterest	Social	https://about.pinterest.com/en/privacy-policy	1
Google Analytics	analytics	https://tools.google.com/dlpage/gaoptout	1

To analyse how the site is used, we use Google Analytics, a web analysis service provided by Google Inc. ("Google") which leaves cookies on your computer so that we can perform our statistical analyses. The data collected is aggregated and does not allow us to identify you in any way. To read Google's privacy notice for the Google Analytics service, please visit this website http://www.google.com/analytics/learn/privacy.html. To read Google's privacy policy, please visit this website https://policies.google.com/privacy. You can refuse to accept Google Analytics cookies by following this procedure (https://tools.google.com/dlpage/gaoptout?hl=). As such, if you continue to use the Blumarine site without refusing Google Analytics cookies, you agree to your data being processed by Google strictly in the ways and for the purposes outlined above.

How to disable technical cookies. You can change your browser's settings to disable cookies. Some of the site's features may not work correctly if you do so. Below you will find links explaining how to disable cookies on a range of browsers (for any other browser you may be using, we suggest searching for this option in the software's help section, which you can normally access by pressing the F1 key):

Internet Explorer: Click the tools button and then 'internet options'. Click the privacy tab and in 'settings' move the slider up to block all cookies.

Google Chrome: Click the menu in the browser's toolbar. Select 'settings'. Click 'advanced'. In the privacy section, click the 'content settings' button. Select 'allow sites to save and read cookie data'.

Mozilla Firefox: Click the menu button and selection 'options'. Select the privacy tab. In the history drop-down menu, select 'use custom settings for history'. To activate cookies, tick 'accept cookies from web sites'; to disable them, untick the box.

Safari: Click the 'Safari' button on the menu bar, then 'preferences'. Now click on 'privacy', then 'details' to select the site, then click 'remove'. Alternatively you can disable Google Analytics cookies only by using the opt-out add-on provided by Google for major browsers https://tools.google.com/dlpage/gaoptout?hl=

6. Where your data is processed – data transfer

Data will be processed and stored at the Zerogrey offices at Via L. Colli no. 15, Turin, and at the Blufin offices at Via G. Ferraris 13-15-15/A, Carpi (Modena). For internal administrative and organisational reasons, we may pass your data on to companies in the Zerogrey group operating within the European Union.

7. Who we share your data with – personal data recipients

On the understanding that, where required by law, we will obtain your prior consent and carry out any formalities required by the law, we will share your data with the following third parties (acting as external data processors):

Our service providers We may share your data with third parties so that they can provide us with services (for example, couriers, call centre companies, warehousing and logistics companies) but in this case we will enter into an agreement in compliance with Art. 28 GDPR for the purpose of protecting your data. These parties will only have possession of the data required to perform their functions and may use this data only for the purpose of providing services on our behalf or complying with the law. You can find out details of such data processors pursuant to Art. 28 GDPR by emailing privacy@zerogrey.com.

Where we deem it necessary for complying with our legal obligations or to legally protect ourselves or third parties. Where permitted or required by the law, we may also share the data requested by a government body or by another authorised third party or organisation for the purpose of protecting or exercising our rights or those of third parties, or for the purpose of limiting or preventing fraud (including credit card fraud or other fraud that we believe may have occurred during a lottery, promotion or event) and other illegal activities.

8. Minors

Our Store is not aimed at under-16s, but rather at an adult audience. If you are a parent or guardian and you think your child may have transmitted data, you can contact us.

9. Security measures

We adopt the security measures required by the law. We adopt security measures to protect your data. The standard security measures that we use depend on the type of data that we process and meet the legal requirements and the standards of European government agencies.

10. Your rights

You can contact Zerogrey and Blufin to request access to your personal data, modify it, delete it or limit its processing, to oppose its processing, and to request the portability of your data; you can also withdraw your consent at any time (this will not prejudice the lawfulness of the processing on the basis of the consent granted prior to the withdrawal).

When you exercise your right of access, you have the right to know whether your data is currently being processed, what the purpose of the processing is, what categories of data are being processed, who the recipients of your data or categories of recipients are (and, if they reside in a third country, what guarantees this transfer is based on), the retention period for your data (or the criteria for determining the retention period), whether automated processing is being carried out (for example through profiling), what the reason for the processing is, and the origin of the data (when not initially collected by us). You have the right to submit a complaint to the National Data Protection Authority and, at any time, to ask the joint controllers for information about the data processors and parties that are authorised by the data controllers to process your data and the contents of the agreement between the joint controllers under Art. 26 GDPR. You can exercise your rights by contacting either Zerogrey (at the address stated above or by emailing privacy@zerogrey.com) or Blufin at the address indicated above or by emailing info@blufin.it. In any case, you can modify or withdraw your consent using the Store's settings. You can withdraw your consent to receiving marketing communications, including newsletters. To stop receiving marketing communications, you can access your account and change your choice or follow the instructions in the promotional message you receive. Alternatively you can withdraw your consent by emailing one of the addresses stated above. You can control and disable cookies and other profiling tools. To find out how we use cookies and other profiling tools, click here. You can change your preferences regarding marketing emails and data processing through profiling by using the privacy settings in your account or by writing to one of the email addresses given above.

11. What happens if we change this policy

We may make changes to our privacy policy. We will inform you of any changes, in accordance with the law. We will also publish an updated version on our website. It will have a different date and version number to the one given below. Please visit the site regularly to check for updates.

May 25, 2018

privacy@zerogrey.com

info@blufin.it