With reference to the personal data collected for the use of the services available on the Website, and in the stores, the Data Controller is OVS S.p.A. with registered office in Via Terraglio, 17 – 30174 Venice Mestre Tax Code and VAT No. 04240010274 (hereinafter "OVS").

Below you will find the complete list of all the purposes for which we collect your personal data: you can click on each paragraph for more information.

WEBSITE NAVIGATION

Purposes of processing: to allow Website navigation; to carry out aggregated statistical analyses aimed at measuring the correct functioning of this Website.

The data could be used to ascertain responsibility in the event of hypothetical cyber crimes against the Website and users of the Website.

Processed data: the data relative to the user’s connection to and browsing on the Website (such as the URI-Uniform Resource Identifier addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relative to the user’s operating system and IT environment) are only collected for the purpose of gathering anonymous statistical information about the use of the Website and to check that it works correctly and these are erased immediately after processing.

Legal basis of the processing:

• provision of services aimed at allowing users to browse the Website (Article 6, 1, b of the Regulation);
• legitimate interest of OVS to ensure the proper functioning of its IT systems;
• legitimate interest to proceed with the investigation of possible crimes (also on the basis of the existence of a possible legal obligation).

Retention period: 

With the exception of the case in which the data is used to ascertain responsibility in cases of potential cyber crimes against the Website and its users, these data will be deleted after the useful time for the provision of the services specified on the Website.

30 (thirty) days following the date of collection, except for legal provisions or provisions of Public Authorities that impose a different retention period in relation to investigations related to any cyber crimes.

CUSTOMER CARE

Purposes of processing: the data you provide us (by telephone, email, online form, etc.) will be used in order to respond to your report, your request for information, complaints, issues related to the guarantee of products and the use of our services.

Personal data processed: data necessary to respond to the requests made to our Customer Care (for example, for the support service via online form, we will ask you to provide your name and email address). You are free to choose whether or not to provide us with your personal data; if you choose to provide us with your personal data, fill out the form by completing all the data requested, as they are necessary to reply to your message or request for information. If data is missing or your form is incomplete, we will not be able to reply to your message or provide the information you requested.

Legal basis of the processing:

• execution of the contract for the sale of products or pre-contractual measures adopted following your request (article 6, 1, b of the Regulation);
• for the help service via chat, execution of the requested service (article 6, 1, b of the Regulation)

Retention period: the data communicated to us will be kept for the period necessary to reply to you or provide you with the information requested. This is without prejudice to the different retention period necessary for judicial protection.

PURCHASE OF PRODUCTS ONLINE (E-COMMERCE)



Purpose of the processing:

• allow you to proceed with the purchase of the products, fulfil the obligations and exercise the rights deriving from the concluded contract (shipment of the goods, invoicing of the goods and management of payments, tracking of the shipment, delivery of the goods, any returns and refunds etc.); 
• comply with legal, regulatory, EU, tax or accounting obligations (invoicing, keeping records and accounting records).

Personal data processed: contact data (e.g. name, surname, email address, telephone number) and shipping address of the goods. OVS does not process the data relating to the means of payment indicated by the customer (e.g. credit card number, credit card security CVV code, etc.). These data are collected by the chosen payment service provider.

You are free to choose whether or not to provide us with your personal data; if you choose to provide us with your personal data, fill out the form by filling out all the mandatory fields (*) necessary to purchase the products. If your data is missing or your form incomplete, we will not be able to proceed with your purchase. However, failure to fill out the data marked as "optional" has no consequences.

Legal basis of the processing:

• execution of the contract of sale (article 6, 1, b of the Regulation).
• legal obligation (article 6, 1, c of the Regulation) => we are required to process the data necessary for the purpose of fulfilling legal, regulatory, EU, tax or accounting obligations (invoicing, keeping records and accounting records).

Retention period: 

• period necessary to fulfil contractual obligations;
• for purposes related to the settlement law obligations, EU legislation, tax or accounting matters (invoicing, keeping records and accounting records) the data will be kept for the period required by law.

"STEFANEL LOUNGE" LOYALTY PROGRAMME 

Purpose of the processing: management of participation in the "Stefanel Lounge" loyalty programme. The Data will be used to issue you the loyalty card and thus allow you to access the benefits reserved for cardholders and described in the regulations and information material (such as discounts, promotions, etc.). 

Personal data processed: personal and contact data (name, surname, postal address, email address, telephone number) indicated in the online registration form, or, in the case of registrations carried out at "Stefanel" stores, requested by our sales assistants; data relating to points and discounts provided.

You are free to choose whether or not to provide us with your personal data; if you choose to provide us with your personal data, please fill out the form by filling out all the mandatory fields (*) necessary for the card to function. If your data is missing or your form incomplete, we will not be able to issue you the card. However, failure to fill out the data marked as "optional" has no consequences.

Legal basis for processing: execution of the registration contract for the Stefanel Lounge loyalty programme (article 6.,1,b of the GDPR (Stefanel Lounge Loyalty Programme Regulation).

Retention period: 

• period necessary to manage your participation in the loyalty programme. 
• the data relating to purchases will be kept for a maximum period of 24 (twenty-four) months from registration (or for any other period provided for by current legislation or provisions of the Guarantor) for direct marketing and profiling purposes (only if you have given your consent for such processing purposes), after which they will be destroyed or made anonymous.
• for accounting purposes, personal data will be kept for the period required by law.

SENDING COMMERCIAL COMMUNICATIONS (SO-CALLED DIRECT MARKETING) 

Purpose of processing: to contact you – by telephone, post, email, SMS, push notifications, social networks and other digital channels – for advertising or commercial communications, as well as conducting market research about your degree of satisfaction with our services. The forwarding of advertising or commercial communications may also concern the various brands of which OVS is the owner and which may be browsed, in their updated list, on the website www.ovscorporate.it.

Personal data processed: contact data (e.g. name, surname, email address, telephone number).

Legal basis for processing: for direct marketing purposes, we will only process your data with your consent. You can revoke your consent at any time by writing to servizioclienti@stefanel.com or by accessing your account.

Retention period: until consent is revoked.

PROFILING



Purposes of processing: we will use your personal data to analyse them and therefore for profiling purposes, to improve our commercial offer thanks to a better knowledge of the customers who frequent our stores and Website and your consumption habits.

Personal data processed: data relating to your purchases, personal data such as your country of origin, gender and age, your interaction with Stefanel through our Website and through our social media channels. We will be able to examine the data relating to your (possible) participation in the "Stefanel Lounge” loyalty programme.

Legal basis for processing: for profiling purposes, we will only process personal data with your consent. You can revoke your consent at any time by writing to servizioclienti@stefanel.com, accessing your account or using the contact form available on the Website.

Retention period: the data relating to your interactions with OVS will be kept for a maximum period of 12 (twelve) months from the date of collection; the data relating to purchases will in any case be kept for a maximum period of 24 (twenty-four) months from registration (or for any other period provided for by current legislation or provisions of the Guarantor).

ANTI-FRAUD



Purpose of the processing: to verify the correspondence between the person who purchases the products from the Website and the holder of the selected payment method.

Personal data processed: name, surname, e-commerce order details and information on the type of payment method used to make the purchase.

Legal basis for processing: legitimate interest of OVS in preventing and combating fraud

Retention period: 5 (five) years following the collection of the data, without prejudice to the different retention period for the protection of the rights of OVS in court.

ACCOUNT REGISTRATION



Purpose of the processing: (i) allow you to register on the Website by creating an account; (ii) allow you to proceed with the purchase of products, fulfil the obligations and exercise the rights deriving from the concluded contract, save some content (e.g. the "wishlist" for the list of your favourite products, purchase history, etc.); (iii) comply with legal, regulatory, EU, tax or accounting obligations (invoicing, keeping records and accounting records).

Personal data processed: personal and contact data indicated in the online form for account registration. You are free to choose whether or not to provide us with your personal data; if you choose to provide us with your personal data, fill out the form by filling out all the mandatory fields (*) necessary to register. If your data is missing or your form incomplete, we will not be able to proceed with your registration. However, failure to fill out the data marked as "optional" has no consequences.

Legal basis of the processing:

• execution of the contract of registration to the Website (article 6, 1, b of the Regulation).
• legal obligation (article 6, 1, c of the Regulation) => we are required to process the data necessary for the purpose of fulfilling legal, regulatory, EU, tax or accounting obligations (invoicing, keeping records and accounting records).

Retention period:

• your account and the data relating to it will be deleted in the event of non-use of the account for more than 5 (five) years.

for accounting purposes, personal data will be kept for the period required by law.

SAVING ACCOUNT LOGIN CREDENTIALS AFTER THE END OF THE SESSION ("PERSISTENT LOGIN")

Purpose of processing: to facilitate the user experience when using the account by allowing you to remain connected to your account after the end of the browsing session (in order to view any active promotions on your account, recommended products, access your Wishlist, etc.).

Personal data processed: your access credentials to your account.

Legal basis for processing: your consent which is expressed through the acceptance of a cookie (please also see our Cookie Policy).

Retention period: the cookie that allows you to save your login credentials will remain active for a period of 3 months.

You can disable cookies at any time by accessing the Cookie Settings section available in the Cookie Policy document.

PURCHASE OF PRODUCTS IN-STORE WITH DELIVERY TO HOME OR STORE

Purpose of processing: if the product you want is not available, you can order it in our stores and receive it at home or at your favourite "Stefanel" store. Personal data will be collected to complete your purchase order and to carry out the activities related to it (by way of example and not limited to, sending, tracking the shipment and delivery of products, payment management, any return, etc.).

Personal data processed: personal and contact data (name, surname, shipping address, email address, telephone number), information relating to the product purchased (e.g. size). 

You are free to choose whether or not to provide us with your personal data; if you choose to provide us with your personal data, insert those labelled as mandatory fields (*) as they are necessary to provide you with the requested service. If your data is missing or your form incomplete, we will not be able to provide you with the requested service.

Legal basis of the processing:

• execution of the contract of sale (article 6, 1, b of the Regulation).
• legal obligation (article 6, 1, c of the Regulation) => we are required to process the data necessary for the purpose of fulfilling legal, regulatory, EU, tax or accounting obligations (invoicing, keeping records and accounting records).

Retention period: 

• time necessary to fulfil contractual obligations;
• for purposes related to the settlement law obligations, EU legislation, tax or accounting matters (invoicing, keeping records and accounting records) the data will be kept for the period required by law

To allow us to achieve the purposes listed above, we may communicate your data to:

• OVS personnel within the scope of their work duties;
• OVS suppliers (for example (i) companies and consultants that on our behalf carry out the service of storage and processing of computer archives and other providers of services and IT platforms, (ii) companies that take care of the packaging and/or the sending or shipment of promotions and advertising or carrying out promotional activities (limited to name, surname and address for sending general mail; email address for sending electronic mailing; telephone/mobile number for telemarketing activities) (iii) companies in charge of managing warehouse logistics, shipping of purchased products, (iv) our affiliated companies that manage the points of sale in relation to the loyalty programme (e.g. "OVS Friends"); (v) any companies in charge of customer care activities on behalf of OVS): these subjects will operate as external Data Processors pursuant to art. 28 of the Regulation;
• Credit institutions (for managing the payment of your purchases): these subjects act as independent data controllers and their involvement is necessary for operations related to the use of our services (e.g. making payments).

OVS uses cookies in some areas of the Website. Cookies are usually text strings which websites (also referred to as publishers or “first party”) visited by the user or other websites or web servers (also referred to as "third parties") place and store within a terminal device used by the user. We invite you to read our Cookie Policy, to be consulted together with this policy.

On the Website you may also find some social network icons (for example, Google, Facebook, Amazon, etc.) that allow the user who is browsing the Website to interact directly with the social network by clicking on it and will allow the latter to acquire data relating to the visit. In some areas of the Website, the so-called "social login" (that is, authentication via social networks), which will allow you to access your account through the account of the relevant social network. Note that when you log in to the social network, you will accept the terms and conditions of use and the privacy policy of the social network itself.

The personal data collected may be transferred outside the European Union (EU). In this case, the transfer will take place in compliance with the provisions of EU Regulation 2016/679 ("GDPR") (in particular, the data will be transferred only after signing the Standard Contractual Clauses approved by the EU Commission with decision n.2021/914/UE or to countries that can guarantee an adequate level of protection of personal data and therefore recipients of an Adequacy Decision adopted by the EU Commission).

Some of your personal data may be transferred abroad to locations outside the European Union. This transfer will in any case be carried out in compliance with the guarantees prescribed by the GDPR for this type of activity (articles 45 to 49). Including: transfer to companies located in Countries for which the existence of personal data protection guarantees comparable to those of the GDPR is recognised and therefore recipients of an Adequacy Decision adopted by the EU Commission (White List countries); or to companies with which specific personal data protection contractual clauses approved by the Data Protection Authority or binding corporate rules approved by the Data Protection Authority have been signed, or the transfer takes place on the basis of specific exceptions. For more information, you can contact the Data Controller as indicated in the point below entitled "Rights you can exercise, the possibility to lodge a complaint and contact details".

OVS S.p.A. has appointed a Personal Data Protection Officer, also known by the acronym of DPO (Data Protection Officer), in charge of overseeing compliance with the legislation on the protection of personal data and who acts as a point of contact for the requests of the subjects to whom the personal data refers to.

If you would like to contact our Data Protection Officer - DPO, you can do so at the email address responsabileprotezionedati@ovs.it, as well as at the telephone number (+39) 041 239 7500.

In accordance with current legislation (articles 15 to 22 of the Regulation) you have the right to obtain access to your information (Article 15), its correction or integration (Article 16), its cancellation (the so called right to be forgotten, Article 17), the limitation of processing (Article 18) the right to the portability of your data (Article.20), the right to object to the processing of your data for special reasons (Article 21) and not to be subjected to an automated decision-making process (Article 22); furthermore, we remind you that you are always entitled to lodge a complaint with the Privacy Protection Authority for the processing of personal data (www.garanteprivacy.it).

To exercise said rights you can (i) write using the contact form on the Website, (ii) send an email to servizioclienti@stefanel.com , or (iii) write to OVS S.p.A., via Terraglio n.17, 30174, Mestre (VE), to the attention of the Data Protection Officer - DPO.

Note that you also have the right:

(i) to revoke at any time your consent for the performance of the contact activities related to advertising/promotional communications. In this case, you will no longer be the recipient of any type of electronic or paper communication. Instead, if you wish to do so, you may revoke your consent only for the receipt of communications via social network or other digital channels, email, sms, mms, etc., continuing to receive commercial communications only by post or personal phone call, if applicable.

(ii) to revoke at any time your consent for the performance of the profiling activities.

We reserve the right to periodically update the content of this page. Check this policy regularly to stay up to date on any changes since your last consultation.