Privacy Policy

Information on the processing of personal data pursuant to Article 13 of EU Regulation 2016/679

Data Subjects: users who visit the website www.pollini.com of POLLINI RETAIL S.P.A.

Why this information?

Pursuant to EU Regulation 2016/679 ("GDPR"), this page describes how personal data of users who visit the POLLINI RETAIL S.P.A. website (www.pollini.com) is processed.

This information does not apply to other websites, pages or online services reached through hyperlinks published on this Website but referring to resources outside the domain www.pollini.com.

Data Controller

The Data Controller is POLLINI RETAIL S.P.A.
Address: Strada Erbosa Uno, 92 - 47043 Gatteo (FC), Italy
VAT: 03527510154
Email: privacy@pollini.com
Tel: +39 0541 816311

Data Protection Officer (DPO)

Studio Paci & C. Srl – Contact person: Luca Di Leo
Email: dpo.pollini@studiopaciecsrl.it
Phone: (+39) 0541 1795431
PEC: studiopaciecsrl@pec.it

Types of data processed, purpose and legal basis

1) Browsing data

Legal basis: contractual necessity – GDPR Art. 6(1)(b)

The browsing systems of this website acquire certain technical data (IP address, URLs, timestamps, response codes, device info). These are necessary for:

• website navigation and functionality;
• statistical analysis (aggregated and anonymous);
• security, fraud prevention, and detection of anomalies.

Retention: only for the time strictly necessary for technical purposes unless required for judicial investigation.

2) Data provided by the user

Legal basis: contractual necessity – GDPR Art. 6(1)(b)

When users voluntarily send emails, messages, or fill out forms, the data provided is used solely to reply to their requests.

Retention: for the time needed to manage the request. For statistics, only in anonymous form.

3) Registration and purchase data

Legal basis: contractual and legal obligation – GDPR Art. 6(1)(b)(c)

Data collected for creating accounts, processing orders, invoicing, shipping and customer management.

4) Cookies and tracking tools

Types used:

• Technical cookies (necessary, no consent)
• Analytical cookies (with consent)
• Profiling cookies (with consent)

See the detailed Cookie Policy for full management options.

5) Direct Marketing

Legal basis: consent – GDPR Art. 6(1)(a)

Used to send newsletters, promotions, product updates via email or WhatsApp. Interactions with emails may be tracked.

6) Profiling

Legal basis: consent – GDPR Art. 6(1)(a)

With consent, profiling is performed to tailor marketing content based on user behaviour, preferences, navigation data, purchases, and interactions.

7) Additional data collected by the Controller

Includes data collected through newsletters, landing pages, and email interactions for personalized communications.

8) Social Media Policy

Data shared through Pollini-managed social media pages is processed according to platform policies. Personal or sensitive data in comments may be removed.

9) Customer Care

Legal basis: contractual necessity – GDPR Art. 6(1)(b)

Used to handle orders, refunds, assistance, tracking, complaints.

Voluntary data provision and consent withdrawal

Providing data (except browsing data) is voluntary but necessary to receive replies or services.

Consent for marketing/profiling can be withdrawn at any time via:

• personal account settings
• unsubscribe link in emails
• emailing privacy@pollini.com
• sending “STOP WHATSAPP” for WhatsApp messages

Data about third parties

If the user provides data of third parties (e.g., shipping to someone else), they take full responsibility.

Data retention

• Registered accounts: until deletion or 5 years of inactivity
• Marketing/profiling data: until consent withdrawal (renewal request every 2 years)
• Contractual data: retained for legal obligations (e.g., tax: minimum 10 years)

Data recipients

Data may be shared with:

• data processors (agencies, tech providers, digital partners)
• companies of the Aeffe Group
• independent controllers like payment service providers

A full list is available on request.

Security measures

Data is protected in accordance with GDPR Art. 32 through technical and organizational measures (SSL, firewalls, anti-intrusion systems, ReCAPTCHA).

Data transfer outside the EU

The hosting provider (Amazon.com Inc.) is certified under the EU–US Data Privacy Framework.

Rights of Data Subjects

• Access
• Rectification
• Erasure
• Restriction
• Portability
• Objection
• Withdraw consent

Requests may be sent to the Data Controller’s contact details.

Right to lodge a complaint

Users may file a complaint with the Italian Data Protection Authority (Garante Privacy) if they believe data processing violates GDPR.

Form available at: Garante – Complaint Form