Privacy Policy

This Privacy Policy describes how Bruno Sport Di Bruno Luigi e C. SNC, operating online under the Fabbrica Ski Sises / Ski Sises brand, collects, uses, stores and discloses personal data of users and customers when they visit the website, use the online store, make a purchase, request support, use services connected to the store or communicate with us by email, telephone, WhatsApp or other channels.

Our website and online store are supported by Shopify, which allows us to provide e-commerce services, checkout, payment, order management and other features connected to the online store.

Please read this Policy carefully. Use of the Services does not constitute consent to processing activities for which the law requires specific consent. Where necessary, for example for newsletters, marketing, non-technical cookies, optional WhatsApp communications or back-in-stock notifications, your consent will be requested separately and may be withdrawn at any time.

In the event of a conflict between this Privacy Policy and other terms published on the website, this Privacy Policy prevails with regard to the collection, use, storage and disclosure of personal data.

1. Data controller

The data controller for personal data is:

For the purposes of applicable personal data protection laws, Bruno Sport Di Bruno Luigi e C. SNC is the controller of the personal data processed through the website, online store and connected services.

2. Definitions

For the purposes of this Policy:

Personal data means any information that identifies or makes a natural person identifiable, directly or indirectly.

Services means the website, online store, checkout, customer account, customer support, commercial communications, order notifications, back-in-stock notifications, WhatsApp services and other services offered by Ski Sises online or connected to the website.

User or customer means the person who visits the website, uses the Services, makes a purchase, creates an account, subscribes to the newsletter, requests a notification, contacts customer service or interacts with us.

Shopify means the technology platform that supports our online store and certain connected services.

WhatsApp means the messaging service used for customer support, order notifications, tracking, back-in-stock notifications or other communications, where requested or authorized by the user.

3. Personal data we collect

Depending on how you interact with us, we may collect and process the following categories of personal data.

3.1 Identification and contact data

We may collect first name, last name, email address, telephone number, billing address, shipping address, city, province/state, postal code, country and other data needed to identify you, contact you, fulfil an order or respond to a request.

3.2 Account data

If you create a customer account, we may process data such as username, email, password or login credentials, preferences, settings, order history, saved addresses, wishlist, favorite products and other information associated with the account.

3.3 Order and transaction data

We may collect data relating to items viewed, added to the cart, added to the wishlist, purchased, returned or exchanged; order data, order number, purchase date and time, amount, currency, payment status, shipping status, tracking, returns, refunds, exchanges and post-sale communications.

3.4 Payment data

We may process payment-related data, such as selected payment method, payment confirmation, amount, currency, transaction status and other data necessary to manage the purchase.

Full payment card details are processed by the payment providers available at checkout and are not stored in full by us.

3.5 Shipping and delivery data

We may process delivery address, recipient contact details, delivery preferences, tracking number, shipping status, information provided by couriers, delivery issues, support requests and data needed to manage shipments, returns or exchanges.

3.6 Communications with us

When you contact us by email, telephone, WhatsApp, form, social media or other channels, we may process name, contact details, content of the communication, date and time of contact, any attachments, order information and any other data you choose to provide.

Please do not send us unnecessary data, particularly sensitive data or confidential information that is not relevant to the request.

3.7 WhatsApp data and messaging notifications

If you communicate with us through WhatsApp or request to receive communications through WhatsApp, we may process telephone number, name, consent or opt-in, order status, shipping data, tracking number, product or variant concerned by the request, message content, date and time of communications, sending, delivery and read status where available, as well as technical data necessary to manage the communication.

3.8 Data for back-in-stock notifications

If you request to be notified when a product, size or variant becomes available again, we may process email, WhatsApp number if provided, requested product, variant, size, color, request date, consent given, notification status and date the communication was sent.

3.9 Data for newsletters and marketing

If you subscribe to the newsletter, request a discount code, accept promotional communications or interact with marketing campaigns, we may process name, email, telephone number where provided, commercial preferences, consent given, subscription and unsubscribe history, email opens, clicks, campaign interactions and data needed to manage promotional communications.

3.10 Data relating to reviews and published content

If you leave a review or public content on the website, we may process name, nickname, rating, review text, any images uploaded, review date, reviewed product and other data voluntarily entered.

Reviews and published content may be visible to other users. Please do not include unnecessary personal information in reviews.

3.11 Data relating to in-store services or connected services

If you request information or services connected to the physical store, such as ski or snowboard rental, workshop, repairs, maintenance, racket stringing or product advice, we may process contact data, data relating to the requested service, technical preferences, measurements or information useful for choosing equipment, such as height, weight, shoe size, usage dates, stated needs and communications connected to the request.

Such data is used only to manage the request, provide the service, respond to communications or fulfil connected obligations.

3.12 Technical, navigation and usage data

When you visit the website, we may collect technical information such as IP address, browser type, device, operating system, language, country, pages visited, date and time of visit, products viewed, interactions with the website, cart, checkout, referrer URL, online identifiers, cookies and similar technologies.

3.13 Cookies and similar technologies

We use cookies, pixels, tags, scripts and similar technologies to operate the website, manage the cart and checkout, remember preferences, improve the Services, analyze website use and, subject to consent where required, carry out marketing, retargeting or profiling activities.

3.14 Ski Sises Club data

If you are a member of the Ski Sises Club, our loyalty programme, we process your points, tier and discount codes, calculated from your online orders and their returns. If you choose to give them to us on the Ski Sises Club page of your account, we also process your date of birth, the sizes of the clothes you own, your answers to the style questionnaire and the ways you follow us. For "Invite a friend" we process your personal code and the orders placed with it.

3.15 Your sizes ("My sizes")

If you choose sizes in a collection or in the search and press "Remember as my sizes", we save them in your browser and in your cart, to show you the sizes you wear first; if you complete an order, they stay with the order's details. If we recognise you (you are signed in, you are a Ski Sises Club member or you opened a link in our e-mails), we also save them in your customer profile; otherwise we link them to your profile the first time we recognise you. Each choice also counts, without any identifier, in the daily totals of the sizes asked for, which we use for purchasing. You can change them by choosing others, delete them from your browser by clearing the site's data, and ask for their deletion from your profile as set out in section 13.

4. Sources of personal data

We may collect personal data:

• directly from you, when you visit the website, create an account, make a purchase, fill in a form, subscribe to the newsletter, request a back-in-stock notification, communicate with us or use WhatsApp;
• automatically through the website, Shopify, cookies, pixels and similar technologies;
• from service providers, such as Shopify, payment providers, couriers, integrated apps, customer support tools, newsletter tools, analytics tools, marketing tools and communication platforms;
• from partners or third parties, within the limits permitted by law and based on applicable settings, consents or preferences.

5. Purposes of processing and legal bases

We process personal data for the purposes and on the legal bases set out below.

5.1 Provision of the website and online store

We use personal data to make the website available, enable browsing, manage the cart, checkout, customer account, wishlists, security and technical operation of the Services.

Legal basis: performance of a contract or pre-contractual measures; legitimate interest in the technical and secure management of the website; legal obligations where applicable.

5.2 Management of orders and purchase contract

We use personal data to receive, confirm, process and fulfil orders; manage payments, shipments, deliveries, invoices, receipts, returns, exchanges, refunds and post-sale support.

Legal basis: performance of the contract; tax, accounting and administrative legal obligations.

5.3 Payments and fraud prevention

We use the necessary data to manage payments, verify transactions, prevent fraud, protect the checkout and keep the purchase process secure.

Legal basis: performance of the contract; legal obligations; legitimate interest in security and fraud prevention.

5.4 Shipping, tracking and delivery

We use personal data to organize shipments, provide order updates, communicate tracking information, manage delivery issues, returns and exchanges.

Legal basis: performance of the contract; legitimate interest in providing support and updates relating to the order.

5.5 Customer support and service communications

We use personal data to respond to requests, provide information about products, sizes, availability, orders, returns, shipping, in-store services or other questions sent by email, telephone, WhatsApp, form or social media.

Legal basis: performance of the contract or pre-contractual measures; legitimate interest in responding to requests and maintaining the customer relationship.

5.6 Communications via WhatsApp

If you give your consent or opt in, we may use WhatsApp to send you communications relating to the Services, including:

• order confirmation;
• updates on order status;
• shipping information;
• tracking;
• delivery updates;
• delivery issues;
• returns and post-sale support;
• responses to support requests you send us via WhatsApp;
• back-in-stock notifications, if you request them;
• promotional communications via WhatsApp only if you have given separate and specific consent for that purpose, for example by ticking the box for WhatsApp news and offers at checkout, which is never pre-ticked.

Using WhatsApp for order updates and tracking is optional. If you do not give consent or if you withdraw it, we will continue to manage your order and send you necessary communications through other available channels, such as email.

To send and manage WhatsApp messages, we may share with Meta/WhatsApp and with any technical providers or integrated apps the necessary data, such as telephone number, name, message content, communication status, order data, shipping data and product or variant concerned by the requested notification.

You can withdraw consent or stop WhatsApp communications at any time by replying STOP, ANNULLA or another equivalent wording indicated in the message, or by contacting us using the details indicated in this Policy.

Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

Legal basis: consent for optional WhatsApp communications, back-in-stock notifications and marketing; performance of the contract or legitimate interest for responses to requests spontaneously sent by the user and customer support; legal obligations where applicable.

5.7 Alerts, back-in-stock notifications and wishlist

If you request a notification when a product, size, color or variant becomes available again, we use the data provided, such as email or WhatsApp number, requested product, variant and request date, to send you the availability notification and, as stated in the request form, Fabbrica Ski Sises marketing communications by email.

The same applies to the other alerts you can request on the site: when a product drops in price, sales included, when your size arrives in a model or a category, new arrivals from the brands you follow, the rental quote calculated on the site and the guide to a route. We use your email, the chosen product, size, category or brand, the price at the time of the request, the items and pickup date of the quote, the guide's article and the request date to send you the alert or what you asked for and, as stated in the form, Fabbrica Ski Sises marketing communications by email.

The price alert sends a single email and expires after 180 days; the alert for your size in a model sends a single email and expires after one year. The alert for your size in a category writes at most every 3 days and followed brands once a week, until you cancel them. The rental quote arrives at once, with a single reminder before the pickup date or the start of the winter season; the route guide arrives at once.

The same applies when you save a product to your wishlist: we use your email, the saved products and the date to send you reminders about those products and, as stated when you save them, Fabbrica Ski Sises marketing communications by email.

With your consent to marketing communications, we also use these requests, together with your other interactions with the site, to understand which brands, sizes, categories and activities interest you and to suggest more relevant products and communications.

You can cancel a single alert or unsubscribe at any time using the links in every email.

Legal basis: consent.

5.8 Newsletters, discount codes and marketing

We use personal data to send you newsletters, discount codes, offers, promotions, news, commercial communications and content relating to Ski Sises products or services, only within the limits permitted by law.

For newsletters, SMS, WhatsApp marketing, automated promotional messages, marketing cookies, retargeting or profiling, we use your data only if you have given specific consent, except in limited cases where the law permits email communications relating to products or services similar to those already purchased, always with the possibility to object. In particular, if you buy from us we may e-mail you about products similar to those you bought even without consent (art. 130(4) of the Italian Privacy Code): you can object at any time with the link in every e-mail.

You may withdraw consent or object to marketing at any time using the unsubscribe link in the emails, by replying STOP or ANNULLA to WhatsApp messages where applicable, through the preference panel where available, or by contacting us using the details indicated in this Policy.

Legal basis: consent; legitimate interest in the limited cases of communications relating to products or services similar to those already purchased, within the limits permitted by applicable law.

5.9 Personalization, recommendations and improvement of the Services

We may use data relating to browsing, purchases, preferences and interactions with the website to improve the shopping experience, suggest relevant products, remember preferences, improve the catalog, optimize the website, analyze trends and measure feature effectiveness.

Where this processing involves profiling, behavioral marketing, retargeting or the use of non-technical cookies, it is carried out only with prior consent where required by law.

Legal basis: legitimate interest in improving the Services; consent for non-technical cookies, marketing, profiling and retargeting where required.

We process the sizes you ask us to remember (3.15) to show you the products and sizes that fit you. Legal basis: performance of your request; the totals without an identifier are not personal data.

5.10 Reviews, public content and social media

If you leave reviews, comments, content or public interactions, we may process such data to publish the review, manage the community, moderate content, prevent abuse and improve service quality.

Legal basis: consent or voluntary action by the user; legitimate interest in managing the website, protecting rights and preventing abuse.

5.11 Security, fraud prevention and protection of rights

We use personal data to protect the website, accounts, checkout, users and our business; prevent fraud, unauthorized access, illegal, harmful or unsafe activities; establish, exercise or defend a right.

Legal basis: legitimate interest; legal obligations; performance of the contract where applicable.

5.12 Legal, tax and accounting obligations

We use personal data to comply with legal, tax, accounting, administrative obligations, authority requests, record keeping, management of complaints, disputes and proceedings.

Legal basis: legal obligation; legitimate interest in protecting rights.

5.13 Corporate transactions

In the event of extraordinary transactions, business transfer, merger, reorganization, transfer of activities, financing or other commercial transaction, personal data may be processed or transferred to the extent necessary.

Legal basis: legitimate interest; legal obligations; performance of agreements where applicable.

5.14 Anonymous analysis of browsing and website performance

To find and quickly fix malfunctions and obstacles to purchase, we record anonymously how the pages of the website are used: pages and type of page visited, clicks and taps with the page element involved, scroll depth, technical errors, page loading times and responsiveness, outcome of cart requests (for example an add to cart that did not succeed), language, market, currency, device type, screen size and referring website.

We do not record what you type into fields (search, email, addresses, passwords, payment data), we do not keep your IP address and we do not link this information to your account, your orders, the newsletter or other data that identifies you. Account pages and checkout are not recorded. To keep together the pages of the same visit we use a random identifier saved in the browser's session storage (sessionStorage), which is deleted when you close the tab; we do not use cookies for this purpose.

When a malfunction occurs (for example a technical error or repeated clicks without response), and for a small sample of visits, we may keep an anonymous reconstruction of the page in the preceding seconds, with the content of all fields masked, to understand what went wrong.

Records of individual pages are deleted after 14 days; we keep longer only aggregated data (for example the number of visits and errors per type of page and day), which does not relate to individual people. Visits from automated systems (bots) are excluded and counted only in aggregate form. The data is processed on the servers of our technical hosting and database providers, including outside the European Economic Area with the safeguards of section 10, and is never used for marketing, profiling or advertising.

Legal basis: legitimate interest in the proper functioning, security and improvement of the website.

5.15 Measuring ads on ChatGPT (OpenAI Ads)

We run ads on ChatGPT through OpenAI's advertising platform and measure their results in two ways.

Pixel in the browser. Only if you accept statistics and marketing cookies, OpenAI's pixel records:

• the pages and products you view;
• additions to the cart and the start of checkout;
• purchases (value, currency, products);
• the reference of the click on the ad and a random browser identifier (cookies described in section 9.3).

If you are logged in or enter your details at checkout, it also sends your email, phone number, first and last name turned into irreversible codes (SHA-256 hash), as well as country, city, province and postcode. If you withdraw your consent, the pixel stops sending data and deletes its cookies.

Order data sent from our server. For every order completed on the website we send OpenAI:

• number, date, value and products of the order;
• email, phone number, customer identifier, first and last name turned into irreversible codes (SHA-256 hash);
• country, city, province and postcode;
• IP address and type of browser used for the order;
• where available, the reference of the click on the ad and the browser identifier.

This tells us which sales come from the ads, without counting them twice, and helps us optimise the campaigns. If you have not accepted marketing cookies, the order is still sent, but marked so that OpenAI does not use it to personalise advertising.

OpenAI also processes this data in the United States, with the safeguards of section 10, under its own advertiser terms and privacy policy.

Legal basis: consent for the pixel and cookies; legitimate interest in measuring the effectiveness of our advertising for the order data sent from our server. You can object to this transmission at any time by writing to us at the contacts in section 19: from then on your orders will no longer be sent.

5.16 Where orders come from

We pay for the clicks that price comparison sites (idealo, Trovaprezzi, Stileo) bring to our shop, and we measure how many orders come from each of them to decide how much to spend on each. We do this also without statistics or marketing cookies, in four ways:

• Site name in the cart. If you arrive from one of these sites, we write in the cart and on the products you add only the name of the site (for example "idealo_de"). It contains no identifier of you or your device, uses no new cookie and stays with the order.
• Signup page. When you subscribe to the newsletter we record, with the subscription, the page where you subscribed, the campaign parameters in its address and the domain of the site you came from.
• Question after the purchase. On the order confirmation or order status page you can tell us, if you wish, where you found us. The answer is optional and we store it only with the order number and confirmation code, the language and page where you answered and the time of the answer.
• Comparison with idealo's reports. For every click on one of our products, idealo tells us the time, the product and a SHA-256 hash of the visitor's IP address, never the address itself. We compute the same hash from the order's IP address, turn both into irreversible codes with a secret key and compare codes, time and products. We keep neither IP addresses nor idealo's hashes, and we delete the codes after 35 days.

We use this data only to count the orders and revenue each price comparison site brings. We do not use it to profile you or to show you ads, and we do not pass it to the price comparison sites.

Google and Meta ads. Even without cookies, if you arrive from one of our ads we write in the same way, in the cart and on the products you add, only "google" or "meta", never the click code, to count the orders and revenue of each channel. This information stays with the order and we do not pass it to Google or Meta.

Legal basis: legitimate interest in measuring the effectiveness of our advertising and spending in proportion to what it returns. You can object at any time by writing to us at the contacts in section 19: from then on we will no longer use this data for your orders.

5.17 Ski Sises Club

We use this data to run the programme: to credit points and let them expire after 12 months; to work out your tier; to create discount codes; to suggest your size on products; to send you the Club e-mails. You can stop the e-mails with the link at the bottom of each one, and we do not send them to anyone who has refused promotional e-mails. If you use more than one e-mail address, we may merge your points into a single balance.

For "Invite a friend", before giving you your code we check that the friend is a new customer and a different person from you, by comparing the e-mail and shipping address of their order with yours. The person who invited you only sees that a friend placed an order, not who you are or what you bought.

Legal basis: performance of the programme's terms.

Your questionnaire answers and sizes are also used to recommend products and to build your customer profile (section 5.9), only if you have consented to promotional communications or can receive them as a customer (section 5.8). Date of birth, sizes and questionnaire are optional. You can change sizes and answers on the Club page; to correct your date of birth or delete this data, write to us. We keep Club data while you remain a customer or until you ask us to delete it, unless the law requires otherwise.

5.18 Google Customer Reviews

After an order, on the confirmation page you can choose to receive one email from Google with a survey about your purchase experience. The choice is optional and never pre-selected. Only if you accept does Google receive your email address, the order number, the delivery country and estimated delivery date and the GTIN codes of the products you bought.

Google processes this data as an independent controller, to send you the survey and publish the store and product ratings, including outside the European Economic Area with the safeguards of section 10, under its own privacy policy: https://policies.google.com/privacy.

Legal basis: consent, given on the confirmation page. If you decline, nothing changes for your order; you can also simply not answer the survey. To withdraw your consent or object to Google's processing, use the tools given in its privacy policy.

5.19 Ski Sises Club in Google ads

If you are a Ski Sises Club member and have consented to promotional communications, we share with Google Ads (Customer Match) your e-mail address in hashed form (SHA-256) and your Club tier, to show you the Club's benefits in Google ads and on Google Shopping. Google processes this data on our behalf, under the Google Ads Data Processing Terms, including outside the European Economic Area with the safeguards of section 10.

Legal basis: consent. If you withdraw your consent to promotional communications or leave the Club, we remove you from the lists with the daily update, normally within two days. You can also manage personalised ads in your Google settings: https://myadcenter.google.com/.

5.20 Ad audiences on Google and Meta

To show our ads to people who already know us, and to avoid showing them needlessly (for example to someone who has just bought), we send Google Ads (Customer Match) and Meta (Facebook and Instagram custom audiences) the e-mail address of our customers and contacts, including those who do not receive our promotional e-mails, in hashed form (SHA-256) and split into groups: recent or older purchase, no purchase, best customers, city or sport style. We send no other data. We update the lists every day; Google and Meta process this data on our behalf, including outside the European Economic Area with the safeguards of section 10.

Legal basis: legitimate interest in promoting our products to our customers and contacts. You can object at any time by writing to us at the contacts in section 19: we remove you from the lists within a few days, as when you ask us to delete your data. You can also manage personalised ads in your Google settings (https://myadcenter.google.com/) and Meta settings (https://accountscenter.facebook.com/ad_preferences).

6. Provision of data

The provision of data necessary to make a purchase, manage payment, shipping, billing, delivery, returns or support is necessary to conclude and perform the contract. If you do not provide such data, we may not be able to manage the order or provide the requested service.

The provision of data for newsletters, marketing, optional WhatsApp, back-in-stock notifications, non-technical cookies and profiling is optional. Failure to provide such data or withdrawal of consent does not prevent you from purchasing products or using the essential Services.

7. How we disclose personal data

We may share personal data, within the limits necessary and for the purposes indicated in this Policy, with the following categories of recipients:

• Shopify, which provides the e-commerce platform, checkout, order management tools, customer account and other connected features;
• payment providers and financial services available at checkout;
• couriers, logistics operators and shipping providers;
• providers of hosting, IT infrastructure, security, maintenance, databases, email and technical tools;
• providers of customer support, CRM, ticket management and communications;
• Meta/WhatsApp and technical providers or integrated apps for WhatsApp communications, order notifications, tracking and back-in-stock where requested;
• providers of newsletters, marketing automation, SMS, email, notifications, back-in-stock, customer engagement and promotional tools;
• analytics, measurement, advertising, retargeting providers and social platforms, only within the limits permitted by law and according to the consents given;
• OpenAI, for running and measuring ads on ChatGPT, as described in section 5.15;
• Google, for the optional post-purchase survey, as described in section 5.18;
• providers of Shopify apps or integrations installed on the store;
• professional advisors, accountants, lawyers, insurers and parties necessary for administrative or tax compliance or for the protection of rights;
• public authorities, judicial, administrative or supervisory authorities, when required by law or necessary to protect our rights;
• parties involved in corporate transactions, mergers, acquisitions, transfers or reorganizations.

We do not sell your personal data in the ordinary meaning of the term. Certain advertising or marketing tools may involve sharing data with third-party partners for personalized advertising or measurement, always within the limits provided by law and, where required, only with prior consent.

8. Relationship with Shopify

Our online store is supported by Shopify. Shopify collects and processes personal data relating to access to and use of the Services in order to allow us to provide the online store, checkout, order management, payments, security and other features.

Depending on the services used, Shopify may process personal data as a processor on our behalf or, for certain advanced services or its own features, as an independent controller.

Data transmitted through the online store may be shared with Shopify and with providers connected to Shopify, including in countries other than your country of residence, in compliance with the transfer mechanisms provided by applicable law.

For more information about how Shopify uses consumers' personal data and about the rights you may have in relation to processing carried out by Shopify, you can consult Shopify's Consumer Privacy Policy and Shopify's privacy portal:

https://privacy.shopify.com/en

9. Cookies and similar technologies

We use cookies and similar technologies to operate the website, manage cart, checkout, security, preferences, analytics and, where present and subject to consent, marketing, retargeting or profiling activities.

9.1 Technical or necessary cookies

Technical or necessary cookies are used for the operation of the website, security, cart, checkout, authentication, preference management and the proper provision of the Services. These cookies do not require consent.

9.2 Analytics cookies

Analytics cookies are used to understand website use, measure performance, identify technical issues and improve the Services.

Where analytics cookies are configured in such a way that they can be treated as technical cookies under applicable law, they do not require consent. In other cases they are used only with prior consent.

The anonymous browsing analysis described in section 5.14 is carried out directly by us, uses no cookies, does not keep the IP address and is not combined with other data: for this reason, like technical cookies, it does not require consent.

9.3 Marketing, profiling and retargeting cookies

Marketing, profiling, retargeting cookies, pixels or similar technologies are used to show you personalized ads, measure campaigns, create audiences, analyze interactions with promotional content and suggest products or offers based on interactions with the website.

These tools are used only with prior consent, where required by applicable law.

These tools include OpenAI's pixel for ads on ChatGPT. It uses the cookies __oppref (reference of the click on the ad, 30 days) and __obref (random browser identifier, 12 months), remembers your choice in the cookie __oaiq_consent and keeps the encoded data of section 5.15 in the browser's storage for 30 days. It sets them only after your consent and deletes them if you withdraw it.

9.4 Managing cookie preferences

You can accept, reject or change preferences through the cookie banner or the preference management panel available on the website.

The cookie policy or cookie panel indicates, where applicable, cookie categories, purposes, duration, third-party providers and ways to change or withdraw preferences.

10. International transfers

Personal data may be processed, stored or transferred outside the European Economic Area, including in connection with the use of Shopify, Meta/WhatsApp, OpenAI, Google, technical providers, payment, marketing, analytics or other services.

When we transfer personal data outside the European Economic Area or the United Kingdom, we adopt appropriate measures provided by applicable law, such as adequacy decisions, Standard Contractual Clauses of the European Commission, equivalent agreements approved by competent authorities or other valid transfer mechanisms.

11. Data retention

We retain personal data only for the time necessary for the purposes for which it was collected or for the period required by law.

In particular:

• data relating to orders, payments, invoices, shipping, returns and support is retained for the time necessary to manage the contractual relationship and to comply with tax, accounting and legal obligations;
• data relating to the customer account is retained until account deletion, subject to legal obligations or the need to protect rights;
• data relating to support requests is retained for the time necessary to manage the request and for any need to protect rights;
• data relating to newsletters and marketing is retained until consent is withdrawn, objection is made or unsubscribe occurs;
• data relating to back-in-stock notifications is retained until the notification is sent, consent is withdrawn or for a maximum period proportionate to the request, indicatively not exceeding 12 months unless a new request is made;
• data relating to WhatsApp communications is retained for the time necessary to manage the communication, support, notification or requested service, subject to legal obligations or the need to protect rights;
• data relating to consent, opt-in, opt-out, unsubscribes and preferences may be retained for the time necessary to demonstrate compliance with applicable law;
• data relating to cookies and tracking tools is retained according to the durations indicated in the cookie panel or cookie policy;
• the data sent to OpenAI to measure ads (section 5.15) is kept by OpenAI under its own terms; in our systems only the order number with the outcome of the transmission remains, for 90 days;
• the anonymous browsing records described in section 5.14 are deleted after 14 days; the aggregated data derived from them does not relate to individual people;
• for the origin of orders (section 5.16), the IP address codes are deleted after 35 days; the name of the price comparison site and the answer to the post-purchase question stay with the order, the signup page with the newsletter subscription;
• data necessary for tax and accounting compliance is retained for the terms provided by law;
• data necessary to establish, exercise or defend a right may be retained for the time necessary to protect our rights.

At the end of the retention period, personal data will be deleted, anonymized or retained only if required by law.

12. Data security

We adopt appropriate technical and organizational measures to protect personal data from loss, misuse, unauthorized access, disclosure, alteration or destruction.

No security measure is perfect or impenetrable. We therefore invite you to use only secure channels to communicate confidential information to us and not to send us unnecessary data.

If you create an account, you are responsible for keeping your credentials secure. Please do not share passwords, access codes or credentials with third parties.

13. Rights of the data subject

Within the limits and under the conditions provided by applicable law, you have the right to:

• access the personal data concerning you;
• obtain rectification of inaccurate data or completion of incomplete data;
• obtain deletion of personal data in the cases provided by law;
• obtain restriction of processing;
• object to processing based on legitimate interest;
• object at any time to processing for direct marketing purposes;
• receive personal data in a structured, commonly used and machine-readable format, in the cases provided by law;
• request data portability;
• withdraw consent given, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with the competent supervisory authority.

For Italy, the supervisory authority is the Garante per la protezione dei dati personali:

https://www.garanteprivacy.it

You can exercise your rights by contacting us using the details indicated in the "Contact" section.

Before fulfilling the request, we may need to verify your identity. We will respond within the time limits provided by applicable law.

14. Managing communication preferences

You can manage or withdraw communication preferences in the following ways:

• for email marketing, using the unsubscribe link in the communications;
• for WhatsApp, by replying STOP, ANNULLA or another equivalent wording indicated in the message, or by contacting us;
• for cookies and similar tools, through the cookie banner or preference management panel available on the website;
• for privacy requests, by contacting us using the details indicated in this Policy.

Even if you unsubscribe from promotional communications, we may continue to send you necessary non-promotional communications, such as order confirmations, shipping updates, account communications, customer support, returns or legal obligations.

15. Automated decision-making and profiling

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

We may use personalization, product recommendation, analytics, marketing or retargeting tools to improve the shopping experience or offer you more relevant content. Where such processing requires consent, it is carried out only after obtaining it through appropriate tools, such as the cookie banner or dedicated checkboxes.

16. Children's data

The Services are not intended for children under 14 years of age. We do not knowingly collect personal data from children under 14 without the consent or authorization of the person exercising parental responsibility, where such consent is required by law.

If you are a parent or guardian and believe that a child has provided us with personal data without authorization, you can contact us using the details indicated in this Policy to request deletion.

The rules applicable to the validity of purchases and contracts entered into by minors under applicable law and our Terms and Conditions remain unaffected.

17. Links to third-party websites, social networks and services

The website may contain links to websites, social networks, payment platforms, shipping services, widgets or third-party services not directly managed by us.

When you interact with such third parties, your personal data may be processed according to their respective privacy policies. Please consult third-party policies before providing personal data or using their services.

We are not responsible for the privacy practices, content or security measures of third-party websites and services not controlled by us.

18. Changes to this Policy

We may update this Privacy Policy from time to time, for example to reflect changes to the Services, technologies used, integrations, installed apps, processing practices or legal obligations.

The updated version will be published on the website with the date of last update. Please consult this page periodically.

19. Contact

For questions about this Privacy Policy, to exercise your rights or for requests relating to the processing of your personal data, you can contact us at the following details:

For the purposes of applicable personal data protection laws, Bruno Sport Di Bruno Luigi e C. SNC is the controller of your personal data.