1. Data Processed, Purpose of Processing and Legal Basis for Processing
SHIRT FACTORY processes common data (identification, personal, contact, financial, location and browsing data) for:
a) performance of contractual obligations or execution of pre-contractual measures with respect to the data subject, namely:
• to manage the sale of Shirt Factory products and services and related after-sales services (for example, exchanges, returns, product delivery, etc.);
• to manage e-commerce and related registration services;
b) compliance with legal or regulatory obligations: namely to manage legal obligations relating to sales activities (such as, for example, the issuance and retention of invoices), the management of requests to exercise rights regarding the processing of personal data, the communication of any data breaches;
c) legitimate interest of the data controllers:
• for the prevention and suppression of fraud and abusive behavior (including by third parties) contrary to applicable laws (for example, intellectual property), contractual provisions, rules of fairness and good faith, as well as for the management of any complaints and legal defense;
• to carry out aggregate statistical analyses on an individual basis aimed at measuring the number of conversions of a given advertisement, for organizational purposes, using the email address you provided only if you have given your consent to profiling cookies.
Shirt Factory also processes common data for:
d) upon obtaining your consent:
• for marketing purposes: namely to send you informational communications about Shirt Factory products, services, events and promotions. Marketing activities are carried out using the contact methods you have selected from those listed below, which you may change at any time;
• for profiling purposes: namely to analyze, including in an automated manner, your preferences, your habits and your lifestyle, as well as the details of purchases made. The data is used to create group and/or individual profiles (“profiling”), market research and statistical analysis, including with anonymous data, organized in aggregate form. If you also give consent for marketing purposes, we will send you personalized communications based on the analysis of your preferences and interests;
• for location purposes: namely to allow you to share your geographical location and purchase a product online at the website www.shirtfactory.it as well as discover the nearest Shirt Factory retailer.
2. Processing Methods
Data is processed with and without the use of electronic tools, based on logic and procedures consistent with the purposes indicated above and in compliance with Privacy Laws, including confidentiality and security profiles. Processing takes place through the operations of collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, communication, deletion and destruction of data. More specifically, with regard to profiling purposes, we inform you that data is organized into group profiles in aggregate and/or individual form based on the preferences and interests you have communicated.
3. Data Retention
Data is retained for the time strictly necessary to pursue the purposes for which it is collected and to comply with applicable legal and regulatory obligations. The retention period varies depending on the purpose of processing, in particular:
- for activities necessary for the performance of the contract relating to the provision or sale of our goods and services referred to in point 1, letter a) of this notice, data is retained for administrative and accounting purposes for ten years from the conclusion thereof, except for registration on the Site (“My Account”) and use of services reserved for registered users, in relation to which your personal data will be retained until you request deletion of your account and in any case no longer than seven years. Retention for longer periods occurs if authorized by law and in case of defense of rights in legal proceedings;
- for marketing and profiling purposes referred to in point 1, letter d) of this notice, data is retained for a period of seven years;
- for location purposes referred to in point 1, letter d), data is retained for the time necessary to use the service;
- for activities necessary to comply with legal obligations referred to in point 1, letter b) of this notice, data is retained for the time necessary to pursue the purposes and in any case no longer than ten years;
- for activities necessary for the prevention and suppression of fraud and abusive behavior referred to in point 1, letter c) of this notice, data is retained for the time necessary to pursue the legitimate interest of the data controller and in any case no longer than ten years;
- for activities necessary to carry out aggregate statistical analyses on an individual basis aimed at measuring the number of conversions of a given advertisement, referred to in point 1, letter c) of this notice, data is retained for the time necessary to pursue the purposes described above, unless objection is exercised, and in any case by Google for a maximum period of 140 days.
4. Nature of Data Provision and Consequences in Case of Failure to Provide
For the purposes referred to in point 1, letters a), b), c) above, the provision of data is necessary and any refusal to provide it would prevent the performance of the indicated activities. The provision of data for the purposes referred to in point 1, letter d) above is optional and any refusal will have no consequence on the ability to purchase Shirt Factory products and services.
5. Categories of Recipients to Whom Data May Be Disclosed
Data is accessible to Shirt Factory where necessary, and to our personnel. Data is also shared with our service providers, for example for technical and organizational services functional to the purposes indicated above, including in associated form, shipping companies, marketing and payment management companies, who act as our Data Processors based on our instructions.
Data is disclosed to third parties in the following cases: (i) when disclosure is required by applicable laws and regulations with respect to third parties who are legitimate recipients of communications, such as authorities and public bodies, who act as independent data controllers for their respective institutional purposes; (ii) disclosure to third parties (such as current or proposed assignees, transferees, participants or sub-participants in rights or in our business), independent data controllers, in case of extraordinary transactions (for example, acquisitions, business transfers, etc.). Data is not disseminated, except in the case of particular initiatives (for example, online) for which we will provide you with specific information on the occasion of those initiatives.
6. Data Protection Officer
The Data Protection Officer is Shirt Factory, located at via Guido D’Arezzo 19, 20145 Milan.
7. Changes to the Notice
Shirt Factory reserves the right to modify this privacy notice at any time. The modified notice will be published on our website.