1. Introduction 

Welcome to the website https://www.moncler.com. 

Industries S.p.A., part of the so-called ‘Moncler group’, provides the following information regarding the collection and processing of the user’s personal data. 

During the use of the website https://www.moncler.com or related services (hereinafter, the “Site” and the “Services”), information and personal data concerning the users of the Site are collected. 

For this reason, in compliance with the provisions of the General Data Protection Regulation no. 2016/679 (“GDPR”) and the applicable national legislation (jointly, the “Privacy Legislation”), we have created this document (hereinafter “Privacy Policy”) for the purpose of describing the personal data we collect, the purposes and methods of processing, and the security measures in place to protect them. 

Pursuant to the GDPR, “processing” is defined as any operation, including simple collection and/or storage, of personal data of any natural person (hereinafter, the “Data Subject” or the “User”), “Data Controller” is defined as the natural or legal person that determines the purposes and means of the processing, and personal data means any information relating to an identified or identifiable natural person, including indirectly through reference to any other information. 

2. Data Controller and Data Protection Officer 

The Data Controller of the personal data is Industries S.p.A., part of the group of companies with the Moncler brand, with registered office in Milan – 20144, via Stendhal, 47, VAT number and Tax Code 04804070961 (hereinafter also “Industries”, “the Company” or “Controller”). 

You may contact the Controller free of charge by writing to the email address privacy@moncler.com, or by sending a registered letter with return receipt to the registered office, as identified above. 

Industries S.p.A. has appointed a Data Protection Officer (DPO), domiciled for this position at the offices of Industries S.p.A. and reachable at the following address: dpo@moncler.com¹. 

3. Data Processed, purposes of processing and nature of the provision of data 

The personal data listed below are defined as “Personal Data” and will be used exclusively for the following purposes: 

(a) To collect and fulfil the purchase order placed through the Website. Industries may process Users’ personal data to manage purchase orders for the products (hereinafter “Products”), placed on the Website, by completing the relevant form. 

Purchases can be made through a personal account if the User has opened one, which will thus keep track of purchases made and further information provided, or through the “buy as guest” function, with which it will not be necessary to create a personal account and the data provided will be stored by the Company for accounting purposes. 

The Company specifies that, to complete the payment transaction, Users will need to access a specific portal made available by the online payment platform, the operator of which will process the User's data as an independent data controller. 

Personal Data processed: (i) name and surname, (ii) nationality, (iii) email address, (iv) shipping address, (v) shipping and payment methods and, subject to the provision of consent, (vi) purchasing habits referred to in point h below, (vi) transaction data, (vii) payment method data.  

The size recommendation service and, where available, the virtual fitting room (Virtual Try-On) present on our site are provided by a third-party partner, Measmerize Ltd (“Measmerize”), which processes the data collected through these services as an independent data controller. This involves, for example, physical measurements and characteristics, fit preferences and, for the virtual fitting room, the uploaded images. 

Industries does not have access to the data collected by Measmerize through these services and does not process them for its own purposes.  

The User, for information on the processing of their data or to exercise their rights (access, rectification, erasure, objection, etc.), may contact Measmerize directly at the address privacy@measmerize.com. The Measmerize privacy policy is accessible at the following link https://www.measmerize.com/privacy-policy-v3  

(b) To create a personal account. To use the Site and to be able to proceed with a single purchase, creating a personal account is not required, as the “guest” mode is available. However, to access certain pages reserved for registered users, it will be necessary to create a personal account and log in as a “registered user”.  

Personal Data processed: (i) name and surname, (ii) email address, (iii) date of birth, (iv) gender, (v) phone number (optional), (vi) password 

(c) To manage sales activities and provide sales and after-sales services, including administration, accounting, management of returns and warranties, management of customer relationships through specific services (for example “in-store collection”, “in-store return”, “order in-store” and “click & reserve”). 

Personal Data processed: (i) name and surname, (ii) shipping and billing address (iii) purchase and payment information, (iv) history of returns and refunds. 

(d) To respond to and manage requests for information and/or complaints from users and/or User feedback via the online form, the live chat available on the Site, the WhatsApp chat at the number +390242203315, by telephone at the number +0080010204000 or via email at the addresses client.service@moncler.com or privacy@moncler.com. 

Personal Data processed: (i) name and surname, (ii) email address or telephone number, (iii) content of the request and/or feedback, (iv) history of communications relating to complaints. 

(d2) To carry out quality control and verification of the effectiveness of the assistance services offered by Industries (Customer Satisfaction). 

Personal Data processed: (i) possible recording/transcription of calls, (ii) voice and content of the recorded conversation; (iii) telephone number; (iv) date, time and duration of the call; (v) any data communicated during the telephone call. 

With specific reference to the purpose referred to in this point (d2), the User will be informed in advance of the recording by means of a brief notice provided by a recorded voice at the beginning of the telephone call, with a reference to this complete information policy. 

(e) Abandoned basket: in the event that the User has started a purchase process which is not completed, the Company may send two communications via email – within a limited timeframe of 24 hours – which will have the sole function of a reminder to help the User to conclude the purchase process. To this end, any data entered at the time of abandonment will be stored so as to facilitate the resumption of the order and its completion. 

Personal Data processed: i) email address.  

(f) To ensure compliance with legal obligations under national and European regulations and prevent fraud.  

Personal Data processed: (i) customer identification data (name, surname, billing and shipping address, email address, telephone number, account creation date, if any), (ii) transaction data, (iii) payment method data, (iv) technical and browsing data, (v) anti-fraud profiling data. 

(g) To carry out direct marketing activities. Subject to the User's consent, which is optional, Industries will use the User's personal data for purposes such as marketing activities, commercial or advertising communications, direct sales, market research, via email (newsletter), telephone, SMS, MMS, instant messaging. As part of this processing, communications based on mere segmentations/clusterings may also be carried out, determined by fixed parameters (geographical area, age, etc.) which do not involve the creation of a specific profile of the User. In this regard, the User may at any time indicate the contact method they prefer from those listed above and may object to receiving promotional communications via all or only some of these contact methods by using the Company's contact details, indicated in paragraph 1.  

Personal Data processed: (i) name and surname, (ii) email address and/or telephone number. 

(h) To carry out profiling activities for marketing purposes: Moncler has created a system, composed of various applications and related infrastructure, named “Moncler Digital Data Architecture for Customer Profilation” (hereinafter also “Moncler Digital Data Architecture”) which collects, from various data sources (for example, from your in-store purchases, through the Monclient App, from anti-counterfeiting sites, from profiling cookies), and processes information about preferences and purchasing habits made by you and collected on a global scale, including through other companies in the group appointed as data processors for this purpose, to build individual profiles in order to send you, subject to your consent, which is optional, personalised communications via email (newsletter), telephone, SMS, MMS, instant messaging and traditional mail or for the personalised management of the relationship with you. 

Also for profiling marketing purposes, the Company may process the User's personal data available in its customer relationship management system, to carry out such activities through digital marketing platforms managed by third parties (by way of example and not limited to, Google and Meta). 

To this end, the Company will share certain personal data with the platforms (in encrypted form - hashing) - email and telephone number - so that they can be compared with users already registered on the platforms themselves, in order to: (i) show the User personalised advertisements consistent with their interests and purchasing habits on the platforms' networks and services; (ii) create personalised audience segments; (iii) exclude certain Users from specific campaigns; (iv) identify new potential customers with characteristics similar to those of existing Users; (v) measure and optimise the effectiveness of the campaigns. 

Personal Data processed: (i) name and surname, (ii) email address and/or telephone number, (iii) gender, (iv) purchasing behaviour, (v) navigation behaviour, (vi) address (optional). 

1. Performing Online and Social Media advertising: in the event of interaction with the Data Controller's social media pages, if you have provided your consent to the use of profiling cookies on the Site, which will be described in more detail in section (n) below, Industries may process personal data to show you marketing advertisements and content consistent with your interests, based on preferences and consumption habits identified via cookies and/or other tracking systems of social media managers (such as Meta) and/or following the analysis that the social media themselves carry out on their users. In particular, Industries may display via digital platforms personalised marketing content based on your interests or your behaviour and based on all information that may be collected based on the profiling activity carried out on the Site and shared with digital platforms or by using the tools made available by social media.

Personal Data processed: (i) browsing behaviour (ii) interactions with social media (where applicable), (iii) purchase preferences acquired through cookies.  

(l) Business Intelligence: to carry out aggregate analyses of strategic orientation and business intelligence: through the Moncler Digital Data Architecture, Moncler may also carry out aggregate analyses of strategic orientation and business intelligence on the data and information processed, based on its legitimate interest, in consideration of the business and market necessity to conduct general analysis and forecasting activities, developing statistical elaborations and corporate strategic models, thus improving the products and services offered to its own customers. 

Personal Data processed: (i) transactions (ii) product information, (iii) geographic data, (iv) browsing behaviour. 

(m) To defend its rights. Industries may process personal data for the defence of rights in the course of judicial, administrative or extrajudicial proceedings and within the scope of disputes arising in relation to the Services. 

Personal Data processed: (i) name and surname (ii) other personal data necessary for the management of legal and administrative procedures (including complaints and enforcement of rights).  

(n) To analyse browsing data and cookies. During their normal operation, the IT systems used to operate the Site acquire some Personal Data of the User, the transmission of which is implicit in the use of Internet communication protocols. 

This information is not collected for the purpose of identifying the User, but may lead to their identification if, for example, it is combined with information in the possession of third parties.  We use this data for the sole purpose of obtaining anonymous statistical information on the use of the Site and to verify its correct functioning. The data collected is deleted immediately after processing. The data could be used by the competent authorities to establish liability in the event of cybercrimes concerning the Site and/or the Services. 

The Site uses technical cookies and, subject to the Data Subject’s consent, profiling, analytics, and social cookies, as well as further features such as plug-ins and/or buttons. For further information, Data Subjects are invited to read the Cookie Policy.  

Personal Data processed: (i) IP address (ii) URI (Uniform Resource Identifier) addresses (iii) the time slot of the request (iv) information about browser, device and operating system , (v) CRM ID, (vi) purchasing behaviour, (vii) browsing behaviour. 

(o) To verify email reading with pixels. In the context of communications sent to the User via email, the Company uses so-called tracking pixels: these are technical markers of minimal size, generally not perceptible by the recipient, inserted in the body of the email that allow the Company to detect the opening as well as certain related technical information. The pixels, potentially also in connection with profiling data (only if the User has given their relative consent on the Site), allow the effectiveness of promotional campaigns to be measured, to adapt their frequency and content, and/or to personalise subsequent mailings based on the interest shown.  

The pixels may be used within:  

1. direct marketing and profiling communications referred to in letters (g) and (h) above;
2. communications sent for the remaining purposes referred to in this paragraph 3 - including, by way of example, transactional, service, security, institutional and legal obligation compliance messages.

Personal Data processed: (i) IP address (where made available by the email client used; please note that some providers or email clients may mask or anonymise this information), (ii) type of device and email client used, (iii) date, (iv) time and (v) any number of subsequent openings of the same message. 

4. Legal bases for processing 

The legal basis for the processing of the Personal Data referred to in paragraph 3 above consists of: 

• with reference to points (a), (b), (c) and (d): fulfilment of a contractual obligation, pursuant to Art. 6 (1.) let. b) of the GDPR, in particular consisting of the provision of the Services requested by the User via the Site;
• with reference to points (d2), (l) and (m): legitimate interest of the Company pursuant to Art. 6 (1.) let. f) of the GDPR;
• with reference to point (f): compliance with legal obligations pursuant to Art. 6 (1.) letter c) of the GDPR;
• with reference to points (e), (g), (h) and (i): consent of the Data Subject, as referred to in Art. 6 (1.) letter a) of the GDPR, provided by means of a specific expression of will, expressed specifically and separately, only after perusal of this Privacy Policy. At any time, the User may specify the preferred contact method among those listed above and may refuse the receipt of promotional communications via one or all contact methods; Consent to the processing of Personal Data for marketing and profiling purposes as referred to in letters (g) and (h) and for the purpose of abandoned basket communications, is optional and any refusal will not have any consequence on navigation of the Site and/or on the purchase of Products. A new and specific provision is not required as the Company will pursue this further purpose, where necessary, by processing the data collected for the other purposes referred to above;
• with reference to point (n): we refer to the cookie policy (section 4). The consent in this case is provided through the specific banner present when accessing the Site and can be revoked at any time using the methods specified in the cookie control panel itself; 
• with reference to point (o): Art. 122 of the Privacy Code. In particular: (i) for direct marketing and profiling communications referred to in the preceding letters (g) and (h), consent of the Data Subject pursuant to art. 6, para. 1, letter a) of the GDPR, included in the more general consent provided for the aforementioned purposes; (ii) for the remaining communications sent by the Company (by way of example: transactional, service, security, institutional and legal obligation fulfilment communications), derogation from consent pursuant to art. 122 of the Privacy Code. The User's right to exercise the right of withdrawal, including in a granular form, remains unaffected in any case, with the unsubscribe methods via the specific link placed at the bottom of the communications, for the use of the pixels referred to in letter (o) for marketing purposes;

5. Data processing and storage methods 

The User's Personal Data will be processed with the aid of electronic tools, and on a residual basis in paper form, and always in compliance with the security requirements provided for by the applicable legislation, with particular but not exclusive reference to art. 32 of the GDPR. Our security measures include contractual agreements with other entities (e.g. service providers) aimed at protecting the security and confidentiality of the User's personal data as provided for by this Policy. 

The Company, in the pursuit of one or more of the purposes indicated in paragraph 3, may make use of Artificial Intelligence systems. These systems are used exclusively as support tools for the professional activities carried out and do not operate in an autonomous or decision-making manner. 

6. Period of use and retention of personal data  

The Company will retain the User’s Personal Data until the purpose for which they are used is achieved, in accordance with the Company's internal data retention policy. 

The data referred to in points (a), (b) and (c) of paragraph 3 will be retained for ten years from the moment of collection of the personal data processed for billing and accounting purposes, except in circumstances where applicable national law provides for different retention requirements. In principle, the Company will destroy the User's Personal Data in its possession once the purpose of the collection and use of such Data has been achieved. In the case of use of the guest account for the purchase, the data will be deleted once the product supply activity has been completed. 

It is specified that the following categories of Personal Data will be retained for the duration indicated below: 

- User registered data (paragraph 3, point (b)): this data will be kept for the time that the account is active (7 years), except in the case of a previous deletion request by the User, and for the subsequent ten years from the last purchase, for administrative purposes. 

- payment-related data (paragraph 3, point (a)): this data will be kept until confirmation of payment and completion of the relative administrative and accounting formalities and for the subsequent ten years from the last purchase, for administrative purposes. 

- data collected in relation to the use of the Services offered on the Site (for example “collect in store”, “return in store”, “order in store” and “click & reserve”), referred to in paragraph 3, point (c): such data will be stored until the complete execution of the service and for the subsequent ten years from the last purchase, for administrative purposes. 

- data referred to in paragraph 3, point (d), relating to user requests to our Customer Service: such data will be retained until the resolution of the request and, in any case, no longer than 36 months from the relevant request.  

- data relating to the Customer Satisfaction service referred to in paragraph 3, point (d2): such data will be retained for a period of 90 days from the telephone call. 

- data referred to in paragraph 3, point (f): such data will be processed for the period of time provided for by the applicable legislation. 

• data referred to in paragraph 3, points (g) and (h): the Personal Data processed for marketing and/or profiling purposes will be retained for a period of 7 years, as per the authorisation obtained from the Data Protection Authority issued on 25 May 2018 in favour of Industries S.p.A. Once the retention period has expired, the data will be automatically deleted or permanently anonymised.

• data referred to in paragraph 3, point (e) (abandoned basket): such data will be retained for 24 hours .  

 - data referred to in paragraph 3, point (o): this data will be retained for a period of 7 years from the provision of consent 

- data referred to in paragraph 3, point (l): these data will be retained for a period of 7 years from their acquisition.  

For the data processed pursuant to paragraph 3, point (i), as well as for the cookie retention periods referred to in letter (n) of paragraph 3, please refer to what is described in more detail in the cookie policy. 

 - data referred to in paragraph 3, point (m): personal data used for legal defence will be retained for the time necessary to pursue the protection of the right. 

6.1 Procedure and methods for the retention and destruction of Personal Data 

In principle, the User's Personal Data in the Company's possession will be destroyed once the purpose of collecting and using the Data has been achieved. 

7. Scope of communication 

7.1 Internal and external data communication 

Personal Data are accessible, if necessary, to duly authorised Industries personnel (for example, personnel from the Digital, CRM, Retail, IT departments) and are communicated to third parties in the following cases: (i) when communication is required by applicable laws and regulations to legitimate third-party recipients, including public authorities and bodies, for their respective institutional purposes, judicial authorities; (ii) in the event of extraordinary transactions (e.g. mergers, acquisitions, business transfers, etc.); (iii) for the provision of fraud prevention services. 

Personal Data is also shared with the Company's service providers, for example, within the scope of technical and organisational services necessary for the purposes referred to in Article 3, including independent partners such as associates, shipping companies, marketing and payment management companies, etc., the list of which may be communicated to the Data Subject upon request. Such parties will be provided only with the Personal Data necessary for the performance of the agreed services, and they act as data processors in accordance with Art. 28 of the GDPR, based on the instructions received from Industries. 

Industries declares that it does not disclose the User's Personal Data to third parties for marketing or profiling purposes. 

However, with reference to profiling, marketing, and customer relationship management purposes (and in order to provide services of the same level worldwide), other companies of the Moncler Group may access the Users' Personal Data in their capacity as data processors pursuant to Art. 28 of the GDPR, based on the instructions received from Industries. 

7.2. Transfer of data abroad 

For the performance of certain Personal Data processing, Industries may communicate such data to external parties located in countries not belonging to the European Union (EU) or the European Economic Area (EEA) (“Third Countries”). 

In particular, Industries informs the Data Subject that their Personal Data may be transferred to Third Countries, the list of which will be periodically updated and available, upon request, to the Data Subject. The lawfulness of the transfer is in any case guaranteed by the mechanisms provided for by Art. 46 of the GDPR, as Industries has executed the Standard Contractual Clauses approved by the European Commission (supplemented by further technical/organisational/legal measures) or, depending on the case, by virtue of the existence of an adequacy decision pursuant to Art. 45 of the GDPR, issued by the European Commission. 

Such external parties will process Personal Data as independent controllers or processors, subject to formal appointment by Industries, in compliance with Privacy Legislation and depending on their respective role in relation to the processing. 

8. Rights of the Data Subject  

Every User has the right to request from Industries, subject to the existence of the legal basis for the request: 

1. access to personal data, as provided for by Art. 15 of the GDPR;
2. the rectification or completion of personal data in the Company's possession deemed inaccurate, as provided for by Art. 16 of the GDPR;
3. the erasure of personal data for which the Company no longer has any legal basis for processing, as provided for by Art. 17 of the GDPR;
4. the restriction of the manner in which personal data is processed, where one of the cases provided for by Art. 18 of the GDPR applies;
5. a copy of the personal data provided to the Company, in a structured, commonly used and machine-readable format and the transmission of such data to another controller (so-called portability), as provided for by Art. 20 of the GDPR;
6. withdrawal of consent, where the processing is based on that legal basis.

Right to object: in addition to the rights listed above, the User always has the right to object, at any time, to the processing of personal data carried out by the Company for the pursuit of its legitimate interest. Furthermore, the User may always object at any time if personal data is processed for marketing purposes, including profiling to the extent that it is related to such marketing.  

In the event of the exercise of the rights described above, the Company will process any personal data provided by the User exclusively to respond to the same. The data processed in this way will then be stored in a specific archive for 5 years from the sending of the last reply by the Company itself.   

In the event that the User believes that the processing of their personal data occurs in violation of the provisions of the GDPR, they have the right to lodge a complaint with the local personal data protection authority, or to take appropriate legal action. 

To exercise the rights described above: 

- for Countries/Regions where the freephone number is available, call Customer Service (00 800 10204000, Monday to Friday from 10.00 to 19.00 CEST, excluding public holidays); 

- write to Customer Service, selecting the topic “privacy” in the appropriate form in the “Contact” section of the Site; 

- contact the Data Protection Officer at the address dpo@moncler.com². 

To consult the list of our external data processors and third parties with whom Industries shares the User's Personal Data, we invite you to contact the Data Controller using the methods indicated above.