Privacy Policy

  1. Privacy Policy

    INFORMATION ON PERSONAL DATA PROCESSING

    Data controllers:

    In accordance with art. 13 of European Regulation no. 2016/679 “General Data Protection Regulation” (hereinafter “GDPR”)

    Blufin S.p.A.based in Viale Della Chimica, 21 - 41012 - Carpi (MO), Italia dpo@blufin.it (hereinafter “Blumarine”)

    e

    Digital Boite S.r.l. based in Via Cusani 5, 20122, Milano, Italia, dpo@digitalboite.com (hereinafter “DB”)

    (hereinafter jointly the "Data Controllers") provide you with the following information on the collection, usage, sharing and processing of your personal data carried out via the website https://www.blumarine.com/ (hereinafter "Website") or any other point of sale forming part of the network of Blumarine stores.

    In detail:

    • Blumarine is the owner of the Website and is the autonomous controller of the personal data processed for the purpose of marketing and profiling;
    • DB is an autonomous controller of personal data processed for the purposes of the sale, invoicing, payment and shipment of products purchased via the Website;
    • DB is the data processor for IT services management and maintenance.

    Blumarine and DB are joint controllers of the personal data processed for the purposes of:

    • Website registration;
    • operation of customer service and post-purchase services through the Online B2C Store;
    • operation of multi-channel services.

    The main content of the joint agreement between Blumarine and DB is stated in the following table. You may request further information relating to the content of the joint controller agreement below by writing to Blumarine or DB at the addresses stated above, or by contacting the DPO by writing to the email indicated in the following section.

    Parties involved Purpose Data processing under joint controllership regimen Type of data
    Customers Registration on the website and the provision of services reserved for registered users (e.g., wishlist, order management, etc.) Operation of the services reserved for registered customers (e.g., wishlist, order management, etc.) Operation of the e-commerce platform and other technology
    Common personal data (e.g., name, surname, email, password, sex, date of birth, browsing data)
    Customers Operation of customer service and post-purchase services through the Online B2C Store Processing of queries relating to:
    Information on products; Purchases in store; Anti-counterfeiting; Size guide; Website registration; Payments; Shipping; Return and Refunds; Technical assistance; Operation of the e-commerce platform and other technology.    		 Common personal data (e.g., name, surname, email)
    Customers Operation of multi-channel services Management of requests relating to the use of multi-channel services offered, which require the direct involvement of the stores Common personal data (e.g., name, surname, email)

    For further information on the personal data processed while using the Website, please see paragraph I below.

    For further information on the personal data processed by the use of cookies and other similar tracking technologies, please see our Cookie Policy.

    Date protection officer (DPO)

    Blumarine and DB have both nominated a data protection officer (DPO):

    The data protection officer (DPO) for Blumarine can be contacted at the following email address dpo@blufin.it;

    • The data protection officer (DPO) for DB can be contacted at the following email address dpo@digitalboite.com.

    Categories of data processed

    According to the intended purposes, we will process the following personal data (for example and not limited to):

    • Personal data: name, surname, date of birth, sex;
    • Contact data: telephone number, email address;
    • Autenthication: email address, password;
    • Shipping Data: delivery address, telephone number, email address;
    • Information on purchases made: items, size and colour, price, date of purchase;
    • Data relating to the customer's profile and preferences: data on behaviour and purchases;
    • Browsing data: data collected during the visit and usage of the Website, including via cookies or other tracking technologies (for further information on the processing of your data via such technologies, please see our Cookie Policy
    • Possible further data transmitted in order to make use of specific services offered by Blumarine.

    Purpose, legal basis for the processing and retention periods of the data

    Controllership Purpose Legal Basis Period of retention
    Blumarine Provision of retail services and of any further service requested by the customer in store Execution of a contract in which the party is involved or for pre-contractual steps requested by that party, in accordance with art. 6.1, letter b) of the GDPR The data relating to purchases will be stored for the duration necessary for the execution of the contract relating to the services offered to you, and therefore not longer than 10 years from the completion of the contract, save for other data retention periods
    Blumarine Execution of assistance and post-sales support services for in-store customers, such as carrying out the administrative, fiscal and accounting activities required by law, as well as support services relating to payment, shipping, returns and refunds, as well as other services offered, such as registration for the Blumarine newsletter at your request Execution of a contract in which the party is involved or for pre-contractual steps requested by that party, in accordance with art. 6.1, letter b) of the GDPR

    Compliance with a legal obligation to which the data controller is subject to, in accordance with art. 6.1, letter c) of the GDPR    		 Data processed for the purpose of providing a service requested by you will be retained for the period necessary to carry out the service, or until you request the revocation of your registration for the service.

    The data processed in order to respond to your requests will be retained until the matter is resolved and for a further period of 6 months.

    Data processed in order to comply with legal obligations will be stored according to the period provided for in the applicable regulation.
    Digital Boite Operational management of browsing and security of the Website Legitimate interest of the data controller, in accordance with art. 6.1, letter f) of the GDPR 7 days from the date on which the Website was visited and consulted. For data relating to cookies, please refer to the specific cookie policy
    Digital Boite Execution of the contract of sale and online post-sales activities, such as carrying out the administrative, fiscal and accounting activities required by law, as well as support services relating to payment, shipping, returns and refunds Execution of a contract in which the party is involved or for pre-contractual steps requested by that party, in accordance with art. 6.1, letter b) of the GDPR

    The need to fulfil the obligations provided for in national or international regulations to which the data controllers are subject, in accordance with art. 6.1, letter c) of the GDPR, for example, the fulfilment of fiscal and accounting obligations    		 The data will be stored for the duration necessary for the execution of the contract, and in accordance with the legal or conventional requirements, and following the completion of the contract, not longer than 10 years save for other data retention periods provided for in the applicable regulations
    Blumarine Registration on the website and the provision of services for registered users. This registration can be made by completing the data collection form found on the Website. Execution of a contract in which the party is involved or for pre-contractual steps requested by that party, in accordance with art. 6.1, letter b) of the GDPR Personal data collected for the purpose of registering on the Website will be retained until you decide to withdraw your registration
    Digital Boite Provision of online customer services, including technical support to recover login data for your personal account Execution of a contract in which the party is involved or for pre-contractual steps requested by that party, in accordance with art. 6.1, letter b) of the GDPR Data processed for the purpose of providing a service requested by the user will be retained for the period necessary to carry out the service, or until you request the revocation of your registration for the service.

    The data processed in order to respond to customer requests will be retained until the matter is resolved and for a further period of 6 months
    Blumarine / Digital Boite Prevention of crime and fraud Legitimate interest of the data controller, in accordance with art. 6.1, letter f) of the GDPR Data collected via the Website will be retained for not more than 180 days
    Blumarine / Digital Boite Inspection, exercise or defence of rights in court and extra-judicial credit recovery Legitimate interest of the data controller, in accordance with art. 6.1, letter f) of the GDPR The data will be retained for the full duration of the credit recovery process and in the case of a legal disagreement, for the duration of the same, until the expiry of the period in which complaints may be lodged
    Blumarine Sending of "soft spam" communications via email, namely commercial communications regarding products and services similar to those you have purchased Legitimate interest of the data controller, in accordance with art. 6.1, letter f) of the GDPR Personal data will be retained until a request to stop receiving such emails is received, which may be requested via the link available at the bottom of each of these communications
    Blumarine Marketing activities: such as the sending of communications of a commercial nature about products and services (news, new arrivals, exclusives, offers and promotions) and for the carrying out of market research and surveys to record the level of customer satisfaction with the aim of improving our services and customer relations Free, specific, informed, unambiguous and revocable consent of the data subject, in accordance with art. 6.1, letter a) of the GDPR Personal data collected for marketing purposes will be retained until you decide to withdraw your registration on the Website, or until you revoke your consent to the processing of personal data.

    Personal data relating to the details of purchases, which is processed for marketing purposes, will be retained for 24 months from the date of recording.

    On expiry of the retention periods indicated above, the data will automatically be deleted or made permanently and irreversibly anonymous
    Blumarine Profiling activities using the browsing and shopping habits of registered users via the use of the data provided by the users, data provided via the use of the Website, and from data relating to the details of purchases made on the Website in order to send personalised commercial communications according to the user's interests Free, specific, informed, unambiguous and revocable consent of the data subject, in accordance with art. 6.1, letter a) of the GDPR Personal data collected for profiling purposes will be retained until you decide to withdraw your registration on the Website, or until you revoke your consent to the processing of personal data.

    Personal data relating to browsing and details of purchases, which are processed for profiling purposes, will be retained for 24 months.

    On expiry of the retention periods indicated above, the data will automatically be deleted or made permanently and irreversibly anonymous.

    Sharing of data

    The disclosure of data to fulfil these purposes based on the conditions of lawfulness as per art. 6.1, letter b), c) and f) of the GDPR are necessary to be able to pursue the purposes mentioned above.

    The disclosure of data for the purposes for which a legal basis of consent is provided, as per art. 6.1, letter a) of the GDPR, is purely voluntary and the lack of disclosure of data or the lack of consent provided precludes the pursuance of the purposes related to profiling, marketing and enhancement of the data, but without prejudice to your possibility to register on the Website, or to make use of services provided on a contractual basis.

    During their normal operation, the IT systems and software procedures used to operate this website acquire some personal data, the transmission of which is implicit in using Internet communication protocols.

    This information is not collected to be associated with identified interested parties, but by their very nature could allow users to be identified through processing and associations with data held by third parties.

    The information that may be collected includes IP addresses, the type of browser or operating system used, addresses in URI form (Uniform Resource Identifier), the domain name and the website address from which the Website was accessed or left for (referring/exit pages), the time in which the server request was carried out, the method used and information on the response received, other information on the user's browsing (please see also the section on cookies) and other parameters relevant to the operating system and computer environment of the user.

    This same data may also be used to identify and verify responsibility in the case of possible cybercrimes against the Website.

    F. Recipients of the personal data

    The data will be processed by:

    • a. employees and associates of the data controllers (including staff at physical stores) who are authorised to collect, use, share or process your personal data;
    • b. employees and associates of DB, who are responsible for data processing regarding the management of marketing and profiling activities on behalf of Blumarine;
    • c. third parties located within the European Union, which are responsible for processing and are employed by the data controllers, in particular, for services for the acquisition of and integration of personal data, shipping services, mailing of promotional materials, market research, surveys on customer satisfaction, and the management and maintenance of informatics systems.

    Your data may also be transmitted to third parties, autonomous data controllers, in particular freelancers or consulting firms, legal or financial assistance companies, and debit or credit card payment processing services.

    Your data may also be transmitted to autonomous data controllers whose supervisory authority, or other public or private interests, justifies their request for the data.

    The complete list of recipients of personal data can be requested by writing to the addresses indicated above in paragraph A.

    Transfer of data outside of the European Union

    Your personal data will not be transferred outside of the European Economic Area.

    Should transmission of your personal data to non-EU countries become necessary, Blumarine will undertake to guarantee that this transmission happens in accordance with CHAPTER V of the GDPR. In particular, adequate security measures and appropriate methods of transmission (for example, the standard contractual clauses approved by the European Commission) will be implemented to guarantee a standard of protection equivalent to that which is expected within the EEA.

    Rights of the data subjects

    By contacting the email addresses given above in paragraph A, you may request from the data controllers access to the data relating to you, deletion of said data, correction of errors in the data, additions to incomplete data, and the limitation of processing of the data in the cases provided for by art. 18 of the GDPR. You may also oppose the processing of your data in the data controller's legitimate interest for reasons relating to your particular situation.

    Where the processing is based on consent or on the contract and is performed by automated tools, you also have the right to receive your data in a structured, commonly used and machine-readable format, as well as, if technically possible, you may request that this data is transmitted to another data controller without prejudice.

    You have the right to revoke your consent at any moment for the purposes of marketing and/or profiling, as well as to oppose data processing for marketing purposes, including profiling connected to direct marketing.

    If you prefer, you can request to be contacted for the purposes mentioned above exclusively in traditional ways, and you may register your opposition only to receiving automated communications.

    Furthermore, you have the right to file a complaint with the competent oversight authority in the member state in which you usually reside or work, or in the state in which the alleged violation took place.

    Lastly, at any time you may modify or update your personal data and your consent to the processing of personal data by accessing your personal account or by sending an email to dpo@blufin.it or alternatively, a info@blufin.it.