PRIVACY POLICY
Privacy Notice on the processing of personal data pursuant to Articles 13 and 14 of Regulation (EU) 2016/679
BREVEMENTE SRLS, owner of the BREVEMENTE LIVE, LOVE, SEXY brand, acting as Data Controller (hereinafter: “BREVEMENTE, LIVE, LOVE, SEXY” or “Controller”) pursuant to Regulation (EU) 2016/679 (the so-called General Data Protection Regulation, hereinafter “Regulation”) and Legislative Decree no. 196/2003 (the so-called Personal Data Protection Code, hereinafter “Code”), considers privacy and the protection of personal data as one of the main objectives of its activities.
Therefore, before providing any personal data to the Controller, you are invited to carefully read this Privacy Policy because it contains important information on the protection of your personal data.
This Privacy Policy:
is provided for the websites www.brevemente.eu, www.brevemente.ru, www.livelovesexy.com (hereinafter: the “Website”);
forms an integral part of the Website and the services we offer;
is provided, pursuant to Articles 13 and 14 of the Regulation, to those who interact with the Website’s web services, both through simple browsing and through the use of specific services made available via the Website (by way of example, purchasing products, completing online forms to request information or to subscribe to the newsletter), as well as other services provided through the Website (telephone assistance and assistance via WhatsApp and Live Chat).
The processing of your personal data will be carried out in accordance with the principles of fairness, lawfulness, transparency, purpose limitation and storage limitation, data minimisation and accuracy, integrity and confidentiality, as well as the principle of accountability under Article 5 of the Regulation. Your personal data will therefore be processed in compliance with personal data protection legislation and the applicable confidentiality obligations.
By “processing of personal data” we mean any operation or set of operations performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
INDEX
Below is the index of this Privacy Policy so that you can easily find the information relevant to the processing of your personal data.
DATA CONTROLLER AND DATA PROTECTION OFFICER
PERSONAL DATA SUBJECT TO PROCESSING
a. Browsing data
b. Data voluntarily provided by the user
c. Data processed in connection with online services
d. Third-party data voluntarily provided by the user
e. Special categories of data
f. CookiesPURPOSES OF PROCESSING
LEGAL BASIS AND WHETHER PROVISION OF DATA IS MANDATORY OR OPTIONAL
RECIPIENTS OF PERSONAL DATA
TRANSFERS OF PERSONAL DATA
RETENTION OF PERSONAL DATA
DATA SUBJECT RIGHTS
COMPLAINT TO THE DATA PROTECTION AUTHORITY
CHANGES
CONTACTS
1. DATA CONTROLLER AND DATA PROTECTION OFFICER
The Data Controller is BREVEMENTE SRLS, with registered office in Trento (Trento, Italy), Via Renato Lunelli no. 32, tax code and registration number with the Companies Register of Trento 02749140220 – TN 247078.
The Data Protection Officer of BREVEMENTE SRLS may be contacted at the Controller’s registered office at the address indicated above and by email at: info@brevemente.eu
2. PERSONAL DATA SUBJECT TO PROCESSING
Please note that the personal data subject to processing may include an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to your physical, physiological, genetic, mental, economic, cultural or social identity that may enable you to be identified or identifiable, depending on the type of services requested (hereinafter “personal data”).
The personal data processed through the Website are as follows:
a. Browsing data
The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
This category includes IP addresses or domain names of the computers used by users connecting to the Website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response from the server (success, error, etc.), and other parameters relating to the user’s operating system and IT environment.
These data are used solely to obtain anonymous statistical information on Website usage and to check its correct functioning, as well as to identify anomalies and/or abuse. In any case, they are deleted immediately after processing. The data may be used to establish liability in the event of hypothetical computer crimes against the Website or third parties.
b. Data voluntarily provided by the user
Unless specific notices are available in different sections of the Website, this Privacy Policy also applies to the processing of data that you voluntarily enter in the various forms on the Website, such as, for example:
the information request form in the “Contact Us” section, through which you will be asked to provide your first name, last name and contact details (email address and phone number), as well as your specific request, which may contain additional personal data;
the chat and instant messaging service, through which you will be put in contact with an operator of BREVEMENTE, LIVE, LOVE, SEXY who can assist you by responding to your requests in real time.
For these types of data, you are invited to enter in the forms (including chat and instant messaging) only the personal data strictly necessary to manage your request, excluding irrelevant information and/or information that may fall within the special categories of personal data under Article 9 of the Regulation (…personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation).
c. Data processed in connection with online services
Unless specific notices are available in different sections of the Website, this Privacy Policy also applies to the processing of data that you voluntarily provide in order to use online services, in particular the following services:
registration and access to your personal area, within which (based on the data you save) your personal details, contact details, shipping addresses, credit card details and product preferences may be processed. Any credit card details saved in your personal area will be managed via an external service provider in compliance with PCI standards;
conclusion and performance of purchase contracts (including the order status checking service), within which your personal details, contact details and delivery address for purchased products will be processed, as well as any information related to your shopping experience, including confirmation of payment via Apple Pay or PayPal. In this respect, following your choice to use such payment methods, Apple and PayPal, acting as independent data controllers, will communicate to BREVEMENTE, LIVE, LOVE, SEXY the fact that payment has been made and the information necessary to ship the order;
processing of returns, within which your personal details, contact details and the address for any collection of returned products will be processed, as well as any information related to your shopping and return experience;
the “Book an appointment” function, through which you will enter personal information in order to arrange appointments in our boutiques;
specific customer assistance, through which you may request suggestions regarding sizes, product categories by line (women/men), fit, new arrivals or other information;
the wishlist service, through which you may add items to your wish list.
In general, the Controller will also process any information related to your purchases (product type, purchase date, amount spent and, more generally, your purchasing choices, preferences and browsing behaviour on the Website) and derived from activities carried out online on the Website for profiling purposes, with or without personalised outcomes, as further specified below; the Controller will also process information deriving from your choices to personalise newsletter content.
d. Third-party data voluntarily provided by the user
When using the Website services, it may occur that personal data of third parties are processed, which you communicate to BREVEMENTE, LIVE, LOVE, SEXY (for example, when purchasing products to be shipped to third parties; for payments made using third parties’ bank details; for invoicing purposes; or when you request information in the “Contact Us” section).
In these cases, you act as an independent data controller, assuming all legal obligations and responsibilities. In this regard, you indemnify the Controller to the fullest extent against any dispute, claim, request for damages resulting from processing, etc. that may be received from third parties whose personal data have been processed through your use of the Website services in breach of applicable personal data protection rules.
In any event, if you provide or otherwise process third-party personal data when using the Website, you warrant from now on—assuming all related responsibility—that such processing, where necessary, is based on your prior collection of the third party’s consent to the processing of their information.
e. Cookies and other tracking technologies
Information on the cookies served by the Website is available here.
3. PURPOSES OF PROCESSING
Your personal data will be processed, with your consent where required, for the following purposes, where applicable:
3.1
to enable browsing of the Website, registration in private areas, deactivation of your account—upon your request—for a maximum period of 12 months, and the provision of all other services made available by the Controller (including, by way of example and not limitation: online sales, returns, product warranty management services, wishlist service, the “Book an appointment” function, the “Contact Us” section relating to your customer care requests, order status verification, saving preferred delivery addresses and preferred boutiques, etc.), including Website security management, as well as contractual relationships, administrative/accounting activities and after-sales services.
Please note that, with regard to the boutique locator service, the data controller for your geolocation data and other information provided within such service is Google and, for China, Baidu (whose privacy policies are available respectively here and here).
Please also note that, through the Website, further assistance services are available to customers, including telephone assistance and assistance via WhatsApp or LiveChat, through which you may submit specific requests and receive support from BREVEMENTE, LIVE, LOVE, SEXY customer service; as regards telephone assistance, please note that, subject to your consent, calls may be recorded to monitor service quality and for internal training purposes.
3.2
to respond to specific requests addressed to the Controller, including post-sales requests, customer assistance and information requests (e.g., regarding product warranty management) submitted through the relevant contact forms on the Website and through chat and instant messaging services;
3.3
to comply with any obligations under applicable laws, regulations or EU legislation, or to satisfy requests from authorities;
3.4
direct sending via email and postal mail of advertising material and commercial communications relating to products or services similar to those you have purchased, pursuant to Article 130, paragraph 4 of the Code and the decision of the Italian Data Protection Authority dated 19 June 2008, unless you expressly refuse to receive such communications, which you may do during registration on the Website or subsequently;
3.5
to send you marketing communications and commercial proposals, including newsletters (the content of which you may personalise), through automated means (SMS, MMS, email, instant messaging and chat) and non-automated means (postal mail, telephone).
Please note that the Controller collects a single consent for the marketing purposes described here, pursuant to the Italian Data Protection Authority’s General Decision “Guidelines on promotional activities and combating spam” of 4 July 2013.
In any case, if you wish to object to the processing of your data for marketing purposes carried out via the means indicated above, you may do so at any time by contacting the Controller at the details provided in the “Contacts” section of this notice, without affecting the lawfulness of processing carried out before the objection;
3.6
to analyse your personal details, purchasing choices, preferences and browsing behaviour on the Website in order to send you personalised communications and commercial proposals and, more generally, to carry out profiling activities;
3.7
for general profiling purposes without personalised outcomes, by performing general analyses (including predictive or strategic-orientation analyses) aimed at creating statistical elaborations and calculation models relating to the entire customer base; this purpose entails processing your data in aggregated and pseudonymised form and is directly preparatory and instrumental to pursuing the purposes set out in sections 3.5 and 3.6 of this notice, although distinct from them;
3.8
to meet possible defence needs;
3.9
for statistical assessment and monitoring purposes; this entails analysing aggregated information that does not relate to identified or identifiable natural persons and therefore does not constitute personal data and does not allow the Controller to identify you in any way.
Specific security measures are implemented to prevent data loss, unlawful or incorrect use, and unauthorised access.
4. LEGAL BASIS AND WHETHER PROVISION OF DATA IS MANDATORY OR OPTIONAL
The legal basis for processing personal data for the purposes set out in sections 3.1 and 3.2 is Article 6(1)(b) of the Regulation (…processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract), as the processing is necessary to provide the services. Providing personal data for these purposes is optional; however, failure to provide such data would make it impossible to activate the requested services.
The purpose referred to in section 3.3 constitutes lawful processing pursuant to Article 6(1)(c) of the Regulation (…processing is necessary for compliance with a legal obligation to which the controller is subject). Once personal data are provided, processing is necessary to comply with legal obligations applicable to the Controller.
Processing carried out for the purposes referred to in sections 3.5 and 3.6 is based on your consent pursuant to Article 6(1)(a) (…the data subject has given consent to the processing of his or her personal data for one or more specific purposes) and Article 22(2)(c) of the Regulation. Such consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal, in accordance with Article 7 of the Regulation.
Providing your personal data for these purposes is therefore entirely optional and does not affect the use of services. If you wish to object to the processing of your data for marketing and profiling purposes, you may do so at any time by contacting the Controller at the details provided in the “Contacts” section of this notice or, where available, through the Privacy Settings within your Personal Area.
With reference to the purpose referred to in point 3.4, please note that where the Controller uses email or postal contact details provided by the data subject in the context of the sale of a product or service for the purpose of direct marketing of its own products or services, it may, pursuant to Article 130(4) of the Code, not require the data subject’s consent, provided that the products or services are similar to those sold and that the data subject, having been adequately informed, does not object to such use, initially or in subsequent communications.
Processing under section 3.7 is carried out to pursue the Controller’s legitimate interest pursuant to Article 6(1)(f) of the Regulation.
Please also note that processing under section 3.8 is carried out to meet possible defence needs pursuant to Article 6(1)(f) of the Regulation.
Processing under section 3.9, since it does not concern personal data, does not fall within the scope of personal data protection legislation and may therefore be carried out freely by the Controller.
5. RECIPIENTS OF PERSONAL DATA
Your personal data may be shared, for the purposes set out in section 3 of this Privacy Policy, with:
5.1
persons authorised by the Controller to process personal data pursuant to Article 29 of the Regulation and Article 2-quaterdecies of the Code (e.g., staff responsible for sales, administration and accounting, after-sales assistance, CRM, and IT systems management);
5.2
third parties who, in providing services (by way of example: technology services, assistance and consultancy in accounting, administrative, legal, tax and financial matters, technical maintenance, transport services, banking and insurance services), typically act as data processors pursuant to Article 28 of the Regulation. The Controller maintains an updated list of appointed processors and makes it available to the data subject at the address indicated above or upon request sent to the contact details indicated above;
5.3
companies within the BREVEMENTE, LIVE, LOVE, SEXY group located both within and outside the EU ……. acting as independent data controllers for administrative/accounting purposes on the basis of legitimate interest pursuant to Article 6(1)(f) and Recitals 47 and 48 of the Regulation;
5.4
third parties entrusted with carrying out the activities described in this notice with whom BREVEMENTE SRLS has entered into commercial agreements;
5.5
persons, entities or authorities to whom it is mandatory to disclose your personal data by virtue of legal provisions or orders of authorities.
These parties are collectively referred to below as “Recipients”.
6. TRANSFERS OF PERSONAL DATA
Some of your personal data are shared with Recipients that may be located outside the European Economic Area. The Controller ensures that the processing of your personal data by such Recipients is carried out in compliance with Articles 44–49 of the Regulation.
With regard to transfers to third countries, the Controller states that processing will take place according to one of the mechanisms permitted by applicable law, such as, for example, the data subject’s consent, the adoption of Standard Contractual Clauses approved by the European Commission, the selection of entities participating in international programmes for the free flow of data, or operating in countries deemed adequate by the European Commission on the basis of an adequacy decision. Further information is available by sending a written request to the Controller at the contact details provided in the “Contacts” section of this notice.
7. RETENTION OF PERSONAL DATA
Your personal data will be stored, in accordance with the data minimisation and storage limitation principles under Article 5(1)(c) and (e) of the Regulation, in the Controller’s IT systems, whose servers are located within the European Economic Area.
Personal data processed for the purposes referred to in sections 3.1 and 3.2 will be retained for the time strictly necessary to achieve those purposes, i.e., for the time necessary to perform the contract, provide statutory or contractual warranties, and in compliance with mandatory legal retention periods (see also, in particular, Article 2946 of the Italian Civil Code and following).
Personal data processed for the purposes referred to in section 3.3 will be retained for the time required by the relevant legal obligation or applicable law.
For the purposes referred to in section 3.4, your personal data will be processed until you object to such processing.
For the purposes referred to in sections 3.5 and 3.6, your personal data will be retained until you withdraw your consent and, in any case, with respect to the purpose in section 3.6 and the related activities, no longer than seven years from the time of collection, in accordance with the decision of the Italian Data Protection Authority accepting the Controller’s prior consultation request. Similarly, for the purpose referred to in section 3.7, your data will be retained for no longer than seven years from the time of collection. Upon withdrawal of consent or upon expiry of the seven-year retention period (whichever occurs first), data processed for the purposes above will be erased or permanently anonymised.
In general, the Controller reserves the right to retain your data for the time necessary to comply with any applicable legal obligations or to meet possible defence needs. The Controller may also retain your personal data for the period provided for and permitted by Italian law to protect its interests (Article 2947 of the Italian Civil Code).
Please note that, in the event your account is deactivated, your personal data will continue to be processed by BREVEMENTE SRLS in accordance with the criteria and principles described above for the entire period of deactivation (12 months). Please also note that, subject to those criteria and principles, BREVEMENTE SRLS may retain such data even after that period and in the event of complete removal of your account; therefore, the expiry of that period and complete removal of your account will not necessarily entail the deletion of your personal data or the withdrawal of privacy consents you have lawfully provided. For further information about data erasure requests and withdrawal of consents, please refer to section 8 “Data subject rights” of this notice.
Further information on retention periods and the criteria used to determine such periods may be requested by sending a written request to the Controller at the contact details provided in the “Contacts” section of this notice.
8. DATA SUBJECT RIGHTS
As a data subject, you may exercise the rights set out in Articles 15–22 GDPR and withdraw any consents given at any time, without prejudice to the lawfulness of processing carried out before withdrawal.
In particular, you may request access to your personal data pursuant to Article 15 GDPR, rectification pursuant to Article 16 GDPR, erasure pursuant to Article 17 GDPR, restriction of processing in the cases provided for by Article 18 GDPR, as well as data portability in the cases provided for by Article 20 GDPR.
You may submit an objection request pursuant to Article 21 GDPR, indicating the reasons justifying the objection. The Controller reserves the right to assess the request, which may not be accepted where there are compelling legitimate grounds for processing that override your interests, rights and freedoms.
Requests must be submitted in writing to the Controller using the contact details provided in the “Contacts” section of this notice.
9. COMPLAINT TO THE DATA PROTECTION AUTHORITY
If you believe that the processing of your personal data by the Controller violates the GDPR, you have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) as provided for by Article 77 GDPR, or to bring the matter before the competent courts (Article 79 GDPR).
10. CHANGES
The Controller reserves the right to amend or update the content of this Privacy Policy, in whole or in part, also due to changes in applicable legislation. You are therefore invited to regularly visit this section to review the most recent and updated version of the Privacy Policy, so that you remain informed about the data collected and how BREVEMENTE, LIVE, LOVE, SEXY uses them.
11. CONTACTS
To exercise the rights listed above or for any other request, you may write to the Data Controller at the physical address indicated above, or via the dedicated contact, preferably stating in the subject line: “privacy rights request”.