PRIVACY POLICY

Welcome to the website of Golden Goose S.p.A., located at the URL www.goldengoose.com (the “Website”).

Please read carefully this Privacy Policy, which applies regardless of the purchase of products marketed on the Site.

Please recall that this Privacy Policy is governed by European Regulation no. 2016/679 (the “Regulation”). The Regulation guarantees that the processing of personal data is carried out in consideration of the Data Subject’s fundamental rights, freedoms, and dignity, with a particular emphasis on confidentiality and personal identity.

1. DATA CONTROLLER

Golden Goose S.p.A., with registered office at Via Privata Ercole Marelli 10, Milan, Italy (hereinafter “GGDB”), is the autonomous data controller of the personal data of the Data Subjects, including browsing data, marketing and profiling data, data related to sales and the relevant pre- and post-sales activities, as well as data related to further experiential and customisation services offered by GGDB.

Please note that you can always exercise your rights (including requesting the complete list of appointed Data Processors) by sending an e-mail to the following address: privacy@goldengoose.com

2. TYPE AND PURPOSE OF PROCESSING CARRIED OUT BY THE SITE – LEGAL BASIS OF PROCESSING

GGDB collects and processes different types of personal data for several purposes and in different ways. More specifically:


(a) personal data on browsing, processed to enable the proper functioning of the Site and for marketing purposes. In this regard, please read the Cookie Policy present on the Website;


(b) personal data voluntarily provided by the Data Subject (e-mail address, telephone number, personal details, password provided by filling in the registration form) or, otherwise, provided during the interaction with the Website and/or through the interaction with the customer care made available by GGDB and/or with the shop staff and processed to fulfil the Data Subject's requests and provide the services, the assistance, and the information requested. It should also be noted that registration and access to the Website or customer account through social media implies the transmission of specific data (First name, Last name, E-mail, and any other data concerning the Data Subject appearing on the social network; such data will, in any case, be displayed to the Data Subject before they confirm their intention to proceed with logging in through their social network). However, such a provision will only occur after the Data Subject has explicitly confirmed their willingness to proceed before logging in. In some cases, social networks ask for some feedback and information about the use of the log-in. For further information, please refer to the relevant social network privacy statement;


(c) personal data provided by the Data Subject as part of the purchasing of products, for the execution of transactions, for functional and instrumental activities related to the sale as well as for any necessary pre- and post-sales assistance;


(d) personal data - including image and/or voice data - provided by the Data Subject for the realisation of experiential and customisation services - including video making services - offered by GGDB;


(e) personal data, personal details and contact information, processed by GGDB - upon express consent - for marketing purposes, i.e. to send to the Data Subject (through traditional and data transmission means such as newsletters, e-mails, SMS, MMS and smart messages) information and updates about products, sales, promotional campaigns, events and other initiatives promoted by GGDB or by its commercial partners;

(f) personal data concerning purchases and any preferences expressed, processed by GGDB - upon express consent - to analyse consumer behaviour and decisions, to make products, initiatives, and individual commercial proposals more responsive to customers’ tastes and needs;

(g) personal details and contact information transmitted by GGDB - upon express consent - to third parties belonging to the Lifestyle and Fashion industries for their relevant marketing activities.

Except for browsing data, governed by the Cookie Policy, the processing of personal data is based on:

  1. the legitimate interest of GGDB in providing the services of the Website and in responding to any requests from customers, with reference to points (a) and (b);
  2. Performance of the sales agreement and the fulfilment of pre and post-contractual obligations, with reference to all the activities under points (c) and (d);
  3. Any consent given by the Data Subject for the purposes referred to in point (b) - with exclusive reference to social network login - and points (d), (e), and (f);

3. SOURCE OF PERSONAL DATA

The personal data collected by GGDB are provided directly by the Data Subject (by registering on the Website, as part of the sales process or related services, and for the development of experiential and customised product services) except for the browsing data referred to in point 2 (a) above, the data collected in the event of registration and access via social network profile as referred to in point 2 (b) above, and the sales data referred to in point 2 (e) above.

4. STUDY OF USER CONSUMER BEHAVIOUR AND DECISIONS

As specified in point 2 (e) above, upon the express consent of the Data subject, GGDB may process the provided personal data to study consumer behaviour and decisions to ensure that GGDB products and initiatives are better attuned with the tastes and needs of its customers.


GGDB will process data pertaining to the value and frequency of purchases and the type of products purchased through automated instruments. Data concerning consumption and preferences may be collected not only by tracking the purchases made on the Website and in GGDB stores but also through the Data Subject’s interaction with GGDB and any other information that may be voluntarily provided thereby. The sole objective of this research is to provide customers and users with products, services, and initiatives that best suit their tastes and needs. It should be noted that the research on user and customer behaviour will be carried out in a non-privacy-intrusive manner. You may always request clarification on the logic applied to this processing and the modification of the results obtained by contacting GGDB at the contact details indicated.


As indicated in point 2 (a) above, and upon express consent of the Data Subject, GGDB may also process the personal data thereof, using automated tools to analyse cookies and check the navigation on the Website to suggest products and services in line with the browsing activity.

5. METHODS USED BY GGDB TO PROCESS PERSONAL DATA

The personal data collected through the GGDB Website, as part of the interaction between the Data Subject and GGDB Customer Care and the Experiential and Customisation Services, are processed mainly through IT and data transmission methods and tools. Such tools implement the necessary security measures to minimise any risks of data destruction or loss, even accidental, unauthorised access, or any processing that might be unlawful or non-compliant with the purposes indicated in this Privacy Policy.


However, such measures cannot completely restrict or eliminate any risk of unauthorised access or loss of data due to the inherent nature of the online transmission medium. To this end, you should periodically check that your computer is equipped with software devices to protect incoming and outgoing data transmission on the internet (such as up-to-date antivirus systems) and that your ISP adopts the appropriate measures to safeguard the transmission of data online (such as firewall and spam filter).

6. MANDATORY OR VOLUNTARY NATURE OF PROVIDING DATA

Except for browsing data (the provision and collection of which is governed by the “Cookie Policy”), the transmission to GGDB of personal data collected through the Website to respond to user requests and queries as well as for marketing purposes, to study consumer habits and preferences and for communication to third parties is free, optional and facultative. Failure to provide such information does not restrict the use of the Website; however, it may prevent GGDB from responding to requests for information and queries or sending information material, updates, newsletters, and invitations to GGDB events.
The provision of personal data, more specifically of personal details, e-mail addresses, mailing addresses, telephone numbers and bank details (in the case of payments with credit cards) is necessary to conclude the product purchase contract through the Website. Therefore, failing to provide such data may make it impossible to complete your purchase via the Website.


Some of those data may also be essential for the provision of other services offered by GGDB, including product experiential and customisation services and services related to the sale (pre- and post-sales services, such as, for example, the customisation service, etc.) or to fulfil obligations deriving from laws or regulations (tax compliance and anti-money laundering legislation). Failure to provide such data may therefore constitute, depending on the case, a legitimate and justified reason for not performing the contract for the purchase of products from the Online Store and/or the provision of related services.

If necessary, the mandatory or voluntary nature of the provision of data will be indicated, from time to time, by adding the appropriate symbol (*) to the information required to provide a service and purchase a product through the Website. Failure to provide any personal data indicated as voluntary or optional will not result in any restriction or disadvantage to the Data Subject.

7. CATEGORIES OF RECIPIENTS OF PERSONAL DATA

GGDB discloses the personal data of Website users only within the limit permitted by law and in line with what is specified below. In addition to the provisions set out in point 2 b. above. (i. e. Social network login), personal data may be disclosed to:

  • GGDB employees and consultants, who shall act as authorised data processors for the internal organisation of the company’s activities;
  • companies of the same Group, operating as appointed data processors, to carry out contractual activities and services as well as perform specific marketing activities (such as inviting the user to events, sending discounts, promotions, etc.); and
  • companies that act as data processors for GGDB, carrying out specific technical and organisational services connected to the Website (logistics services, IT services, customer care services and marketing services).

Personal data may also be disclosed to:

  • third parties, for the sole purpose of executing the product purchase contract on the Website (such as credit institutions in charge of remote electronic payment services by credit/debit card);
  • law enforcement or the judicial authority, in compliance with the law and at the formal request of such parties, or if there are justified reasons to believe that the disclosure of such data is reasonably necessary to investigate, prevent or take initiatives relating to suspected unlawful activities or support the state control and supervisory authorities; defend against any complaint or accusation from third parties, or protect the security of the website itself and the company; or exercise or protect the rights, property or security of GGDB, the companies of the same group, its affiliates, customers, employees or any other party.

Your data will not be disseminated and will be transferred abroad only while guaranteeing adequate levels of security and safeguards for the protection of such data, in compliance with the regulations in force. The data centres used by GGDB to process the data collected are located within the territory of the European Union. To enable companies of the same Group to process the data for contractual and marketing purposes, your data will be transferred to the relevant countries (including non-EU countries). In this regard, GGDB has stipulated Standard Contractual Clauses with subsidiaries based in countries outside the EU, in compliance with national and supranational data protection regulations. Personal data may be transferred to IT service providers with registered offices and data centres located in countries outside the EU. Please note that, also in this regard, GGDB has entered into the necessary Standard Contractual Clauses with its providers to protect the personal data transferred (after first verifying the security of the measures used by the providers as duly appointed data processors).

8. DATA RETENTION PERIOD

The personal data collected for sale purposes are stored for a period not exceeding 10 years from the purchase, in compliance with tax and civil regulations and without prejudice to particular requirements of defence in court that may require storage for a longer period of time. The data provided by the Data Subject to request support, information and feedback are stored for the time required to provide the responses requested and for any additional interaction with the customer necessary to fully manage the request and/or issue.


Personal data - including image and/or voice data processed to provide experiential services and product customisation - will be stored for a period strictly necessary to carry out the services offered to the Data Subject, except in case the Data Subject, duly informed, gives their consent to the processing of their image and voice to be used in GGDB promotional and institutional activities.

The personal data provided for marketing and profiling purposes are stored for the necessary period based on the specific processing and for up to a maximum of 7 years, also based on the particular business sector (luxury products) and considering the interest displayed by the customer in receiving updates on products and events organised by GGDB.

For further information on cookie storage and persistence, please refer to the Cookie Policy

9. RIGHTS GRANTED TO THE DATA SUBJECT BY THE PRIVACY LAW

The Data Subject is always entitled to obtain from GGDB:

(i) confirmation whether or not personal data concerning them are being processed even if not yet recorded, and their communication in an intelligible form;

(ii) information concerning the origin of their personal data, the purposes and methods of processing the logic applied in the case of processing performed with the support of electronic instruments, the details of the data controller and data processors, an indication of the subjects and categories of subjects to whom the personal data may be disclosed or who may be informed thereof in their capacity as data processors or, in any event, parties authorised to process the data;

(iii) the updating, rectification or, if interested, the completion of the personal data;

(iv) the erasure, anonymisation or blocking of unlawfully processed personal data, including data whose retention is not necessary for the purposes for which they were collected or subsequently processed, as well as certification that the operations referred to above have been brought to the attention of those to whom the data were disclosed, except where this proves impossible or involves the use of means disproportionate to the protected right;

(v) the portability of their personal data;

(vi) the restriction of the processing of their personal data.

The Data Subjects also have the right to object, in whole or in part, on legitimate grounds, to the processing of their personal data, even if it is relevant to the purpose of the collection, and to revoke the consent provided previously. The right to object and withdraw consent may also be exercised specifically in relation to one or more methods of sending marketing communications.

The rights listed above may be exercised by contacting GGDB at the following address: privacy@goldengoose.com

Finally, please note that you are always entitled to lodge a complaint with the competent supervisory authority (Autorità Garante per la Protezione dei Dati Personali [Italian Data Protection Authority]).