1 • Preamble

Welcome to our website moncler.com. As data controller, the company Industries S.p.A. - Moncler Group ("Moncler") hereby provides you with the following information about the collection and processing of your personal data. When you use our Website or use its services (hereinafter, the "Website" and the "Services"), we collect information and personal data about you. For this reason, in accordance with the provisions of the General Data Protection Regulation no. 679/2016 ("GDPR") and applicable national legislation (collectively, "Privacy Legislation"), we have created this document (hereinafter "Privacy Policy") for the purpose of describing what personal data we collect, the purposes and methods of its processing and the security measures we use to protect it.

2 • Sources of data and purposes of data processing

2.1 Browsing data

During their normal operation, the computer systems used to operate the Website acquire some of your personal data, the transmission of which is implicit in the use of Internet communication protocols. This information is not collected for the purpose of identifying you, but may lead to your identification if, for example, it is combined with information held by a third party. This category of data includes the IP address and domain name of your computer, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the reply given by the server and other parameters relating to your operating system. We use this data for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check it is working properly. We delete the data collected immediately after processing. The data could be used to ascertain responsibility in the event of cybercrime committed to the detriment of the Services.

2.2 Registration information and further information provided by the user

Use of our Website does not require the creation of a personal account. However, in order to access certain pages reserved for registered users and, for example, to send us a request for information or feedback on our Services, you must create a personal account and become a registered user. When you create your account, we will ask you to enter the following registration information:

• first name and surname,
• email address,
• password,
• date of birth,
• gender.

In addition, we collect and process personal data voluntarily provided by you when you place an order to purchase an item, which consists of data collected by sending electronic mail, interacting with the functionality of the Website and requesting services offered by the Website. The personal data we collect and process includes your first name, surname, gender, nationality, email address, and shopping habits. Should you collect, process and disclose information about third parties to us, you must do so in accordance with the provisions of the Privacy Policy and, therefore, you must provide them with prior notice of the processing and, if necessary, you must obtain their free and express consent before carrying out the processing.

2.3 Purpose of the processing

Providing us with the above registration information is necessary in order to create an account and also to respond to and manage requests for information and/or user feedback; to provide the services requested through the Website, including registration and subsequent updates and to manage the activities organised through the Website; to carry out statistical analysis and surveys; to manage sales activities and to provide sales and after-sales services, such as administration, accounting, returns and guarantee management, fraud prevention, customer relationship management, including compliance with legal obligations, regulations and EU regulations (including anti-money laundering regulations) and to exercise rights in legal proceedings.

Any refusal by you to provide this information would still allow you to use the Website, but would prevent you from using some of our Services reserved for registered users.

In addition, your personal data must be processed in order to fulfil the contractual relationship arising from the purchase of Moncler products. The provision of such data is a contractual obligation. You are free to communicate your data to us or not, but in the absence of the requested data, it will not be possible to conclude or execute the agreement and your requests. This means that you will not be able to purchase Moncler products and that Moncler will not be able to handle your requests.

2.4 Further purposes of the processing

With your consent, which is optional, Moncler will use your personal data for further purposes such as marketing, commercial or advertising communications, direct sales, market research, in-store sales support worldwide through email (newsletter), telephone, SMS, MMS, chat, instant messaging, social networking and traditional mail, including sending invitations to events. You may at any time indicate your preferred means of contact from among those listed above and you may refuse the receipt of promotional communication by any or all of these means of contact.

With your consent, which is optional, Moncler collects information about your preferences, habits and lifestyle as well as details of purchases made in order to use these to create group and individual profiles ("profiling") and to send you personalised communications. Personalised communication may be sent by email (newsletter), phone, SMS, MMS, chat, instant messaging, social networking and traditional mail. You may at any time indicate your preferred means of contact from among those listed above and you may refuse the receipt of promotional communication by any or all of these means of contact.

Consent for the above marketing and profiling purposes is optional and refusal will not have any consequences. Data may be provided by you on registration at our points of sale by means of paper and/or electronic forms, acquired during visits to our stores belonging to the Moncler Group or through interaction with websites, internet applications and mobile applications belonging to the Moncler Group.

2.5 Legal grounds for processing

We only process your personal data if one of the legal requirements laid down by current legislation is met, and specifically:

1. for the conclusion and execution of a contract to which you are party in relation to the purchase of products offered on the Website, as well as the provision of Services for registered users;
2. to fulfil a legal obligation to which Moncler is subject;
3. for the legitimate interests of Moncler, with particular reference to the prevention and prosecution of fraudulent activities, as well as for internal administrative purposes, on the basis of which communication of the data to companies belonging to the Moncler entrepreneurial group is legitimate;
4. with your consent in respect of marketing and profiling activities.

2.6 Information collected through cookies and other technologies

Cookies are small files sent by websites that you visit and that are stored on the device you use to access those websites. When users visit the same site again, your browser reads the cookies stored on your device and sends the information back to the site that originally created the cookies. Our site also uses different types of cookies and other technologies to read and store information on the user's device, for example to carry out statistical analyses. We do not use cookies that are able to launch programs on your devices or send viruses to them, or that allow us to control your devices.

On the Website you may also find social buttons/widgets, in other words those distinctive "buttons" showing social network icons like Facebook and Google+. These buttons allow users who are browsing the Website to share and interact with social networks with a simple "click".

In accordance with the provision of 8 May 2014 issued by the Italian Data Protection Authority, we hereby inform you that our Services use:

• technical cookies necessary for the functioning of the Website, including the provision of the Services offered by the Website. This category of cookies includes analytics, session and functionality cookies, used by the owner to, for example, collect information, in aggregate form, about the number of users and how they use the Website or to save your browsing preferences, such as the language.
• analytics cookies are used to carry out statistical analyses of how users navigate the website and are collected anonymously and exclusively for statistical purposes.
• our own and third party profiling cookies, designed to create user profiles and used to send and display advertising messages in line with the preferences expressed by users during their browsing.

The above cookies may be:

• temporary, when they are automatically deleted at the end of the connection;
• permanent, when they remain on the user's hard drive, unless the user deletes them;
• first party, when they are issued and managed directly by the Website administrator;
• third party, when they are managed by a domain other than the one visited by the user.

While the use of technical cookies does not require the user's consent, the use of profiling cookies always requires the user's optional consent and the user can choose which profiling cookies to consent to.

Cookies can be managed and disabled using the browser settings (e.g. Internet Explorer, Google Chrome, Safari, Firefox). Once on the site, the user will be able to access the "Your choices" area and view the list of third party companies that place cookies on our site ("Company"); check the presence and activity status of the installed cookie ("Status") and selectively manage your consent ("On/Off"). Expanding the entry (Info) for each company will provide more information about the company and will link to the specific privacy and cookie policy.

The table below shows the cookies used to offer our Services:

3 • Methods of data processing and data storage

We process your personal data both on paper and with the aid of electronic equipment and always in compliance with the security requirements imposed by applicable legislation, with particular but not exclusive reference to Annex B of Legislative Decree 196/2003 (Technical specifications in relation to minimum security measures). Our security measures include contractual arrangements with any contractor (e.g. service providers) or other party in order to protect the security and confidentiality of your personal data in accordance with the provisions of our Privacy Policy.

Your personal data is stored in compliance with the following terms and criteria:

1. data collected to conclude and execute agreements for the purchase of products on the website: until the administrative and accounting formalities have been completed. Billing information will be retained for ten years from the date of the original invoice;
2. registered user data: this data will be stored for as long as the account is active. Even after the account is closed, we will retain your information if it is necessary to do so in order to comply with legal or regulatory obligations, to protect our rights, to prevent fraud, or to comply with this Privacy Policy;
3. data relating to payment: until such time as the payment has been confirmed and the administrative and accounting formalities relating thereto have been completed, after the expiry of the right of withdrawal and after the deadline for contesting the payment;
4. data collected in the context of the use of services offered on the Website and data used for commercial communication with users who purchase products on the Website (soft spam): such data is stored until the termination of the service or the request by the user to unsubscribe from the service;
5. data related to user requests to our Customer Service department: relevant data will be retained until your request is resolved;
6. If you have consented to your personal data being processed, the data relating to your purchases will be kept for marketing and profiling purposes for a period of 7 years, after which time the data will be automatically deleted or permanently and irreversibly anonymised.

In any case, for technical reasons, the termination of the processing and the subsequent cancellation or irreversible anonymisation of the related personal data will be final within thirty days of the terms indicated above.

With particular reference to the legal protection of our rights, we hereby specify that we have a retention period of ten years for personal data commencing from the closure of the account, based on the ten-year limitation period referred to in art. 2946 of the Italian Civil Code.

4 • Scope of communication

4.1 Internal and external communication of personal data

Personal data is accessible to our duly authorised personnel (e.g., Digital, CRM, Retail, IT personnel) as necessary and is disclosed to third parties in the following cases:

1. when disclosure is required by laws and regulations applicable to legitimate third party recipients, such as authorities and public bodies for their respective institutional purposes, e.g. anti-money laundering legislation, court authorities;
2. disclosure to third parties in the event of extraordinary transactions (e.g. mergers, acquisitions, sale of business, etc.).

Personal data is also shared with our service providers, e.g. for services of a technical and organisational nature that are necessary for the purposes indicated above, such as independent partners, including associates, shipping companies, marketing, payment management, etc.. We provide such parties only with the data necessary to perform the agreed services and they act as data processors, based on instructions received from Moncler. It is expressly stated that Moncler does not disclose your personal data to third parties for marketing or profiling purposes.

Finally, for the purposes of profiling, marketing and customer relationship management (to provide you with the same level of service worldwide), other companies in the Moncler Group may access your personal data as our data processors, based on instructions received from us.

4.2 Data transfer abroad

We may transfer your personal data outside of Italy to third party recipients established within the European Union. This is a free transfer as each EU country guarantees an adequate level of data protection. However, for the purposes indicated above, we may also transfer your data to third party countries, not belonging to the European Union, which do not guarantee the same level of data protection. However, you are advised that such transfer to third party countries will always be in accordance with the provisions of the Privacy Policy, i.e. by obtaining your consent, when necessary, or by adopting any other measure necessary to ensure the security of the data being transferred. These measures include possible contractual agreements based on the standard contractual clauses as drafted by the European Commission.

5 • Rights of the data subject

You may exercise your rights under the Privacy Policy at any time, and you may, for example, obtain an updated list of our external Processors, of the parties to whom the data is disclosed, access the data, verify its content, origin, accuracy, request additions, updates, modifications, deletions, object to its processing or request its limitation, or even request its transfer. You may revoke your consent to data processing at any time and you may submit a request to the Supervisory Authority (the "Garante per la Protezione dei Dati Personali" Italian Data Protection Authority). To exercise these rights, please contact us using the contact details in section 6.

6 • Data controller and Data protection officer

The Website and Services are managed by Industries S.p.A., with registered office at Via Stendhal 47, Milan - 20144 - Tel. 02/422041. The Data Protection Officer is based at the registered office of the Data Controller and can be contacted via the following email address: privacy@moncler.com.