1 • Preamble

Welcome to our website moncler.com. The companies YOOX NET-A-PORTER GROUP S.p.A. ("YNAP") and Industries S.p.A. - Moncler Group ("Moncler") hereby provide you with the following information about the collection and processing of your personal data. When you use the site or its services (hereinafter, the "website" and the "Services"), information and personal data about you is collected. For this reason, in accordance with the provisions of the General Data Protection Regulation no. 2016/679 ("GDPR") and applicable national legislation (collectively, "Privacy Legislation"), we have created this document (hereinafter "Privacy Policy") for the purpose of describing what personal data we collect, the purposes and methods of its processing and the security measures used to protect it.

2 • Data controllers and their respective Data protection officers

YNAP and Moncler act as independent data controllers.

As an independent data controller, YNAP will process your personal data in order to manage online sales activity (e.g. managing orders and payments), as well as for "pick-up in store", "return in store" and "click from store" services.
YNAP can be contacted by writing to YOOX NET-A-PORTER GROUP S.p.A., via Morimondo 17 – 20143 Milano, Italy.
YNAP has appointed a Data Protection Officer (DPO), who can be contacted personally at the following addresses:
Address: Data Protection Officer - DPO at YOOX NET-A-PORTER GROUP S.p.A., via N. Nannetti n. 1, 40069 – Zola Predosa, Bologna (BO), Italy;
Email: DPO@ynap.com.

As an independent data controller, Moncler will process your personal data in order to carry out marketing activities (e.g. newsletters), profiling, as well as for the "click and reserve" service.
Moncler can be contacted by writing to Industries S.p.A. – Moncler Group, via Stendhal n. 47, 20144 - Milan (MI), Italy.
Moncler has appointed a Data Protection Officer (DPO), who can be contacted personally at the following addresses:
Address: Data Protection Officer - DPO at Industries S.p.A. – Moncler Group, via Stendhal n. 47, 20144 - Milan (MI), Italy;
Email: privacy@moncler.com and dpo@moncler.com.

3 • Sources of data and the purposes of data processing

3.1 Browsing data

During their normal operation, the computer systems used to operate the Website acquire some of your personal data, the transmission of which is implicit in the use of Internet communication protocols. This information is not collected for the purpose of identifying you, but may lead to your identification if, for example, it is combined with information held by a third party. This category of data includes the IP address and domain name of your computer, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the reply given by the server and other parameters relating to your operating system. We use this data for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check it is working properly. The data collected is deleted immediately after processing. The data could be used to ascertain responsibility in the event of cybercrime committed to the detriment of the Services.

3.2 Registration information and further information provided by the user

Use of the Website does not require the creation of a personal account. However, in order to access certain pages reserved for registered users and, for example, to send us a request for information or feedback on the Services, you must create a personal account and become a registered user. When you create your account, you will be asked to enter the following registration information:

• first name and surname,
• email address,
• password,
• date of birth,
• gender.

In addition, personal data voluntarily provided by you when you place an order to purchase an item will be collected and processed, this consists of data collected by sending electronic mail, interacting with the functionality of the Website and requesting services offered by the Website. The personal data we collect and process includes your first name, surname, gender, nationality, email address, and shopping habits.
Should you collect, process and disclose information about third parties to us, you must do so in accordance with the provisions of the Privacy Policy and, therefore, you must provide them with prior notice of the processing and, if necessary, you must obtain their free and express consent before carrying out the processing.

3.3 Purpose of the processing

Providing the above registration information is necessary in order to create an account and also to respond to and manage requests for information and/or user feedback; to provide the services requested through the Website, including registration and subsequent updates and to manage the activities organised through the Website; to carry out statistical analysis and surveys; to manage sales activities and to provide sales and after-sales services, such as administration, accounting, returns and guarantee management, fraud prevention, customer relationship management, including compliance with legal obligations, regulations and EU regulations (including anti-money laundering regulations) and to exercise rights in legal proceedings.
Any refusal by you to provide this information would still allow you to use the Website, but would prevent you from using some of our Services reserved for registered users.
In addition, your personal data must be processed in order to fulfil the contractual relationship arising from the purchase of Moncler products. The provision of such data is a contractual obligation. You are free to disclose your data to us or not, but in the absence of the requested data it will not be possible to conclude or execute the agreement and your requests. This means that you will not be able to purchase Moncler products and that it will not be possible to handle your requests.

3.4 Further purposes of the processing

With your consent, which is optional, Moncler will use your personal data for further purposes such as marketing, commercial or advertising communications, direct sales, market research, in-store sales support worldwide through email (newsletter), telephone, SMS, MMS, chat, instant messaging, social networking and traditional mail, including sending invitations to events. You may at any time indicate your preferred means of contact from among those listed above and you may refuse the receipt of promotional communication by any or all of these means of contact.

With your consent, which is optional, Moncler collects information about your preferences, habits and lifestyle as well as details of purchases made in order to use these to create group and individual profiles ("profiling") and to send you personalised communications. Personalised communication may be sent by email (newsletter), phone, SMS, MMS, chat, instant messaging, social networking and traditional mail. You may at any time indicate your preferred means of contact from among those listed above and you may refuse the receipt of promotional communication by any or all of these means of contact.

Consent for the above marketing and profiling purposes is optional and refusal will not have any consequences. Data may be provided by you on registration at our points of sale by means of paper and/or electronic forms, acquired during visits to our stores belonging to the Moncler Group or through interaction with websites, internet applications and mobile applications belonging to the Moncler Group.

3.5 Legal grounds for processing

Your personal data is only processed if one of the legal requirements laid down by current legislation is met, and specifically:

1. for the conclusion and execution of a contract to which you are party in relation to the purchase of products offered on the Website, as well as the provision of Services for registered users;
2. to fulfil a legal obligation to which the controllers are subject within the context of the purposes of their activities;
3. for the legitimate interests of the controller, with particular reference to the prevention and prosecution of fraudulent activities, as well as for internal administrative purposes, on the basis of which communication of the data to companies belonging to the controller’s group of companies is legitimate;
4. with your consent in respect of marketing and profiling activities.

3.6 Information collected through cookies and other technologies

Cookies are small files sent by websites that you visit and that are stored on the device you use to access those websites. When users visit the same site again, your browser reads the cookies stored on your device and sends the information back to the site that originally created the cookies. Our site also uses different types of cookies and other technologies to read and store information on the user's device, for example to carry out statistical analyses. We do not use cookies that are able to launch programs on your devices or send viruses to them, or that allow us to control your devices.

On the Website you may also find social buttons/widgets, in other words those distinctive "buttons" showing social network icons like Facebook and Google+. These buttons allow users who are browsing the Website to share and interact with social networks with a simple "click".

In accordance with the provision of 8 May 2014 issued by the Italian Data Protection Authority, we hereby inform you that our Services use:

• technical cookies necessary for the functioning of the Website, including the provision of the Services offered by the Website. This category of cookies includes analytics, session and functionality cookies, used by the owner to, for example, collect information, in aggregate form, about the number of users and how they use the Website or to save your browsing preferences, such as the language.
• analytics cookies are used to carry out statistical analyses of how users navigate the website and are collected anonymously and exclusively for statistical purposes.
• our own and third party profiling cookies, designed to create user profiles and used to send and display advertising messages in line with the preferences expressed by users during their browsing.

The above cookies may be:

• temporary, when they are automatically deleted at the end of the connection;
• permanent, when they remain on the user's hard drive, unless the user deletes them;
• first party, when they are issued and managed directly by the Website administrator;
• third party, when they are managed by a domain other than the one visited by the user.

While the use of technical cookies does not require the user's consent, the use of profiling cookies always requires the user's optional consent and the user can choose which profiling cookies to consent to.

Cookies can be managed and disabled using the browser settings (e.g. Internet Explorer, Google Chrome, Safari, Firefox). 

Once on the site, the user will be able to access the "Your choices" area and view the list of third party companies that place cookies on our site ("Company"); check the presence and activity status of the installed cookie ("Status") and selectively manage your consent ("On/Off"). Expanding the entry (Info) for each company will provide more information about the company and will link to the specific privacy and cookie policy.

The table below shows the cookies used to offer our Services:

4 • Methods of data processing and data storage

Your personal data will be processed both in paper form and using electronic means and always in compliance with the security requirements of applicable legislation, with particular but not exclusive reference to art. 32 of the GDPR. Our security measures include contractual arrangements with any contractor (e.g. service providers) or other party in order to protect the security and confidentiality of your personal data in accordance with the provisions of our Privacy Policy.
Your personal data is stored in compliance with the following terms and criteria:

1. data collected to conclude and execute agreements for the purchase of products on the website: until the administrative and accounting formalities have been completed. Billing information will be retained for ten years from the date of the original invoice;
2. registered user data: this data will be stored for as long as the account is active. Even after the account is closed, we will retain your information if it is necessary to do so in order to comply with legal or regulatory obligations, to protect our rights, to prevent fraud, or to comply with this Privacy Policy;
3. data relating to payment: until such time as the payment has been confirmed and the administrative and accounting formalities relating thereto have been completed, after the expiry of the right of withdrawal and after the deadline for contesting the payment;
4. data collected in connection with the use of Services offered on the Website (e.g. "pick-up in store", "return in store", "click from store", "click and reserve"): such data is stored until the service has been fully performed;
5. data related to user requests to our Customer Service department: relevant data will be retained until your request is resolved;
6. If you have consented to your personal data being processed, the data relating to your purchases will be kept for marketing and profiling purposes for a period of 7 years, after which time the data will be automatically deleted or permanently and irreversibly anonymised.

In any case, for technical reasons, the termination of the processing and the subsequent cancellation or irreversible anonymisation of the related personal data will be final within thirty days of the terms indicated above.
With particular reference to the legal protection of our rights, we hereby specify that we have a retention period of ten years for personal data commencing from the closure of the account, based on the ten-year limitation period referred to in art. 2946 of the Italian Civil Code.

5 • Scope of disclosure

5.1 Internal and external communication of personal data

Personal data is accessible to our duly authorised personnel (e.g., Digital, CRM, Retail, IT personnel) as necessary and is disclosed to third parties in the following cases: (i) when disclosure is required by laws and regulations applicable to legitimate third party recipients, such as authorities and public bodies for their respective institutional purposes, e.g. anti-money laundering legislation, court authorities; (ii) disclosure to third parties in the event of extraordinary transactions (e.g. mergers, acquisitions, sale of business, etc.).
Personal data is also shared with our service providers, e.g. for services of a technical and organisational nature that are necessary for the purposes indicated above, such as independent partners, including associates, shipping companies, marketing, payment management, etc.. We provide such parties only with the data necessary to perform the agreed services and they act as data processors, based on instructions received from Moncler or YNAP (depending on the relevant data controller).
It is expressly stated that Moncler and YNAP do not disclose your personal data to third parties for marketing or profiling purposes.
Finally, for the purposes of profiling, marketing and customer relationship management (to provide you with the same level of service worldwide), other companies in the Moncler Group may access your personal data as data processors, based on instructions received from Moncler.

5.2 Data transfer abroad

Your personal data may be transferred outside of Italy to third party recipients established within the European Union. This is a free transfer as each EU country guarantees an adequate level of data protection. However, for the purposes indicated above, we may also transfer your data to third party countries, not belonging to the European Union, which do not guarantee the same level of data protection. However, you are advised that such transfer to third party countries will always be in accordance with the provisions of the Privacy Policy, i.e. by obtaining your consent, when necessary, or by adopting any other measure necessary to ensure the security of the data being transferred. These measures include possible contractual agreements based on the standard contractual clauses as drafted by the European Commission.

6 • Rights of the data subject

As a data subject, you may at any time exercise the rights acknowledged by the Privacy Policy with regard to the specific processing of your personal data.
Below is a general description of them and how to exercise them:

1. right of access to your personal data: you can obtain confirmation that your personal data is or is not being processed and, consequently, obtain access to your personal data and information about its processing. If you wish, you will be provided with a copy of your personal data;
2. right to rectification of your personal data: you can obtain the correction, modification or updating of any inaccurate or out-of-date information, as well as obtaining the supplementation of incomplete personal data, including by providing an additional statement;
3. right to withdraw your consent: you may at any time withdraw your consent to the processing of your personal data in connection with any activity for marketing purposes, including profiling. In this regard, please note that sending commercial and promotional communications, carrying out market research and surveys to measure satisfaction and tailoring commercial offers to your interests are considered marketing activities. On receipt of your request, the processing of your personal data based on such consent will cease, while different processing operations or processing based on other grounds will continue to be carried out in full compliance with applicable laws;
4. right to the deletion of your personal data (right to be forgotten) when your personal data, in particular, (i) is no longer necessary for the purposes for which it was collected or processed, or (ii) has been processed unlawfully, or (iii) must be deleted in order to comply with a legal obligation, or, lastly, (iv) you have objected to its processing (see "right of objection" below) and there is no overriding legitimate reason that would allow YNAP or Moncler to process your personal data in any way. Once we have received and reviewed your request, if it is lawful, your personal data will be deleted;
5. right to limit the processing of your personal data: you may request that the processing of your data be limited, i.e. that your personal data be stored but not used ( with the exception of your requests and exceptions provided for by law):
   • when you challenge the accuracy of your personal data for the period necessary for YNAP or Moncler to verify the accuracy of such data;
   • when the processing is unlawful, but you object to the deletion of your data;
   • when, although your data is no longer needed by YNAP or Moncler for processing purposes, you need it to ascertain, exercise or defend your rights in legal proceedings;
   • when you object to the processing, pending verification of whether YNAP or Moncler have legitimate grounds to continue processing the data;
6. right to data portability: you may request to receive data that is processed based on your consent or on a contract entered into with you, in a structured format and readable by an automated device. If you wish, where this is not excessive and technically possible, we may, at your request, transfer your data directly to a third party indicated by you.
7. right of objection: you may at any time object to the processing of your personal data carried out based on a legitimate interest, explaining the reasons supporting your request. Unless there are reasons to prevent acceptance of the same as provided by law, we will cease the processing to which you have objected. You have the right to object at any time to the processing of your data for marketing and/or profiling purposes, as long as it is related to that purpose, without the need to specify the reason for your objection. In this case, the processing of your data will cease immediately.

To exercise the rights described above, you can:

• call the freephone number 00 800 10204000 from Monday to Friday from 10 a.m. to 7 p.m., excluding public holidays; or
• write to Customer Services by selecting the "privacy" topic in the relevant form in the "Contact us" section of the Website; or
• contact YNAP and Moncler directly at the addresses indicated in paragraph 2 above.

To ensure that the data of users of the Website is not compromised or misused by third parties, prior to accepting your request to exercise any of the rights listed above, you may be asked to provide certain information to confirm your identity.

7 • Complaints

If you believe that your personal data have not been processed fairly, you may lodge a complaint with the competent supervisory authority in the Member State of the European Union where you normally reside, work or where the alleged breach occurred.
In Italy, complaints may be filed with the Garante per la Protezione dei Dati Personali, for further information please see www.garanteprivacy.it.
For contact details of all the other competent European supervisory authorities, please see https://edpb.europa.eu/about-edpb/board/members_en.