PRIVACY POLICY

Who is the Data Controller?

YOOX NET-A-PORTER GROUP S.p.A, (hereinafter “YOOX”) is the Data Controller, i.e. the party that decides how and why your personal data should be processed, a company fully owned by LuxExperience B.V., with registered office at via Morimondo n. 17 - 20143 Milan (Italy), Tax Code and VAT no. 02050461207.

You can contact YOOX at any time by writing to the above address or to our Customer Care team (selecting “privacy”).

Who is the Data Protection Officer (DPO)?

YOOX has designated a Data Protection Officer or “ DPO” (Data Protection Officer).

If you have any questions regarding the protection of your Personal Data or the exercise of your rights, please contact our Data Protection Officer (DPO), either by way of a written letter addressed to the “Data Protection Officer” at the YOOX address indicated above, or via email to the DPO email address.

The categories of personal data that YOOX collects and processes in relation to the use of the Website and the related services offered are as follows:

a) the personal data necessary to conclude and execute your purchase on the Website, such as name and surname, email address, shipping address, billing address, telephone number, payment details, product purchased and other information present in the purchase orders, information on shipments and returns;

b) email address, when you subscribe to our newsletter service or for commercial communication activities or to carry out opinion polls and market research;

c) mobile phone number, when you subscribe to our promotional SMS messaging service or to carry out opinion polls and market research;

d) the personal data that you provide us when you contact our Customer Care team;

e) information regarding your interests and preferences with regard to the contents of the Website, our products and services, which we use in order to personalise the contents of the Website and the commercial communications, as well as for statistical surveys and analyses (for more information, see letters j), k) and l) of the following paragraph 3). In particular: information regarding your previous purchases, on the use of the services of the Website reserved for registered users, on the sections of the Website you visit most often or the services you use most frequently, on your IP address, the pages of the Website you have visited, the products viewed and those added to your cart, the purchases made and any withdrawals/returns, the time spent on each page of the Website, the frequency of access to the Website, the interactions between you and the pages of the Website that you visit and any personalised content present on these pages, information contained in the "log files" of the Website servers (IP address, date and time of the request, resource requested, status codes of the responses given by the server, other information regarding the user's IT environment), with reference to letter j) of the following paragraph 3; the pages of the Website you have visited, the products viewed, your interactions with the pages of the Website you have visited and with any personalised content present on these pages, products added to your cart, time spent on each page of the Website, information contained in the "log files" of the Website's servers (date and time of the request, requested resource, codes on the status of the responses given by the server), with reference to letter k) of the following paragraph 3.

f) name and surname, email address and password, for registering your Myoox account. In case of registration/authentication of the Myoox account via the services of third-party operators ("Facebook Login" or "Login with Google"), we collect the data necessary for registration/authentication on the Website, i.e. your email address, from these operators. In particular: i) in the event of registration/authentication using "Facebook Login", YOOX and Meta Platforms Ireland Limited (the company that provides the function for accessing the "Facebook Login" website) act as joint data controllers for the processing of your data on the basis of a specific "joint controllership agreement" that has been stipulated between the parties, and which you can view here. For more information, see also the documentation made available by Meta Platforms Ireland Limited and its privacy policy; ii) in case of registration/authentication using "Login with Google", Google Ireland Limited will also process your data (further information is available in the Google privacy policy );

g) data processed when you access the area reserved for registered users, such as which services you use and when, as referred to in paragraph 5 below (order history, products of interest, virtual credit, saved searches, card payment details, size information);

h) information regarding other people that you provide us with in the case of purchase of a product to be delivered to a friend, or to be delivered as a gift (name and surname, address). In these hypotheses, we deliver the privacy policy to the person indicated by you at the time of the initial communication with this person, and in any case in compliance with the times and methods established by law. We would like to remind you that the use of other people's personal data may be subject to the regulations on the protection of personal data;

YOOX does not process personal data concerning minors. By accessing yoox.com and using the services offered by YOOX, you declare that you are over the age of 18.

In addition to the data listed in this paragraph, when you use the app or mobile version of our Website, YOOX may:

- collect personal data for marketing purposes in order to send push notifications to your device, with your express prior consent. You may disable push notifications at any time by modifying your preferences in the settings on your mobile device.

- collect information automatically, such as site traffic data, data on how long you spend on the app, or your IP address, in order to improve our offering of products and services;

- collect the information that you provide us with, such as your photo and your clothing and accessory sizes, in order to facilitate your use of the YOOXMIRROR service. We shall store such data until you decide to delete your profile (as created by you), or until you request that we delete your Myoox account.

YOOX collects and processes your personal data for the following purposes:

a) To conclude and perform the agreement for the purchase of goods offered on the YOOX Website.

We process your personal data (in particular as referred to in letter a) of the previous paragraph 2) to conclude the contract for the purchase of the products that we offer on the Website and to execute contractual activities such as the shipment of the product, the management of the payment and the management of the return and refund, where applicable.

We also process the data in order to send you communications regarding the conclusion and execution of the contract, such as emails confirming the receipt of your order, the acceptance thereof and the successful shipment of the product. In countries where it is available as a service, you can also choose to receive these communications via "WhatsApp"; you can always change your mind by replying "Stop Order" to our message, which will arrive via "WhatsApp"; in this case, you will continue to receive communications by email only.

b) Registration on the Website and use of the services offered to registered users .

Registration on the Website can be carried out by entering some personal information (as referred to in letter f) of the previous paragraph 2), required in order to enable you to be identified, and to allow the services reserved for registered users as described in the following paragraph 5 to be carried out.

c) Provision of the services offered on the Website and in the app .

To this end, in relation to each service and the characteristics thereof, YOOX needs to collect the personal data necessary to perform the service you requested (see the relevant service in the previous paragraph 2).

d) Management of requests made to our Customer Care team.

Our Customer Care team uses the personal data you provide (specifically that referred to in letter d) of the previous paragraph 2) to fulfil your requests for information and assistance.

The contact details published on the Website are not intended for the receipt of spontaneous applications from those wishing to work for YOOX: any CVs and applications sent to these addresses will be discarded and the related data deleted. To submit your application to YOOX, the user is invited to use the appropriate section of the website https://www.ynap.com.

e) Fulfilment of legal obligations.

We process your data (as referred to specifically in letter a) of the previous paragraph 2) in order to fulfil the obligations imposed on us by national and European Union laws and regulations, primarily civil and fiscal obligations deriving from the contract for the purchase of products on the Website (such as, for example, the issuance of the invoice and archiving thereof, the management of the legal guarantee of conformity).

f) Sending of newsletters.

Subject to your consent, we will send you (see letter b) of the previous paragraph 2) all newsletters (communications regarding YOOX news and commercial promotions) via email.

g) Sending of promotional text messages.

Subject to your consent, we will send you messages regarding our news and commercial promotions ("SMS service") via SMS (see letter c) of the previous paragraph 2).

h) Opinion polls and market research.

Subject to your consent, we will contact you in order to carry out market research and satisfaction surveys, which we implement in order to improve the Website, our products and services, the relationship with our users and customers and the quality of our commercial offering. These communications may be sent via email, SMS, telephone and paper-based mail (see letters a, b and c of the previous paragraph 2).

i) Personalised Website content and sending of personalised marketing communications for registered users .

Subject to your consent, YOOX will personalise the contents of the Website which will be presented to you as a registered user thereof, as well as customising commercial communications addressed to you (by email, SMS, telephone and paper mail), on the basis of a profiling activity (construction of a profile), with a view to be able to offer you previews and offers that are more in line with your tastes and preferences.

This activity allows us to help you to identify products and services that are of real interest to you, and to improve your shopping experience on the Website.

As a result of this data processing activity, you will be able to view personalised content on the Website and receive personalised promotional communications.

The personalisation of the contents and communications will be carried out by means of a profiling activity which entails the collection and analysis of information on your previous purchases, on the use of Website services reserved for registered users, on the sections of the Website you visit most often or the services you use most frequently, on your IP address, the pages of the Website you have visited, the products viewed and those placed in the cart, the purchases made and any withdrawals/returns, the time spent on each page of the Website, the frequency of access to the Website, the interactions between you and the pages of the Website visited and with any customised content present therein, the information contained in the "log files" of the Website's servers (IP address, date and time of the request, requested resource, codes on the status of the responses given by the server, other information on the user's IT environment) (see letter e) of the previous paragraph 2). This information helps us understand which products and services you are most interested in.

In order to ensure that the information in our possession is correct and allows us to adequately carry out the personalisation activities described, please go to the “my profile” section of your Myoox account and, if necessary, update it.

On receipt of your express prior consent, we will send personalised marketing communications, including via "web push notification": information on this differing type of processing is provided in the following paragraph 5 “Web Push Notifications”.

You can withdraw your consent at any time

- to the personalisation of the contents of the Website through the appropriate option in the "My profile" section of your Myoox,

- upon receipt of personalised communications, by clicking on the link at the bottom of each email received,

- to receiving personalised push notifications, by following the instructions in the following paragraph 5 “Web Push Notifications”.

j) Personalisation of the contents of the Website for marketing purposes (i.e. on the Website, we display information about products that we think may be of interest to the user based on the analysis of the purchases made and information regarding the user's navigation on the Website, such as the products viewed or placed in the cart); We use information about your navigation on the Website to personalise the contents of the Website for marketing purposes, i.e. to show you the products and services that we believe are most in line with your interests, as expressed while browsing.

This activity allows us to help you to identify products and services that are of real interest to you, as well as improving the Website shopping experience for our users.

As a result of this processing activity, when browsing the Website, you will also see products that we believe are in line with your interests.

The information we use for this activity includes the following: pages of the Website you have visited, products viewed, interactions between you and the pages of the Website you visit and with any customised content present therein, products added to your shopping cart, time spent on each page of the Website , information contained in the "log files" of the Website servers (date and time of the request, resource requested, codes on the status of the responses given by the server) (see letter e) of the previous paragraph 2).

This customisation (so-called profiling) is not based on the use of "cookies" or other similar tracking tools, but rather is carried using the information we collect on from the server during individual browsing sessions on the Website. Where you have given your consent to YOOX regarding the use of profiling cookies (see the specific policy on YOOX cookies: “ Cookie Policy"), the personalisation will also take place through these cookies.

k) Analysis and statistical surveys to improve the commercial offering and services of the Website .

We collect some information on your use of the Website in order to carry out analyses and statistical surveys in aggregate form, with the goal of obtaining useful information to improve our commercial offering and our services on the Website and the way in which these are presented, i.e. to understand how the Website is used and to render this use easier and more intuitive for users, as well as to improve our commercial offering and the shopping experience of our users.

The information collected and used for these purposes includes the following: pages of the Website visited, products placed in the cart, time spent on each page of the Website, interactions with the contents of the Website (see letter e) of the previous paragraph 2).

l) Prevention and suppression of fraud, counterfeiting and abusive conduct .

Your data (as referred to in the previous paragraph 2) will also be processed to allow YOOX to carry out security checks and anti-fraud activities, with a view to implementing prevention and protection measures against fraudulent activities, counterfeiting and abusive behaviour (including by third parties) that is in violation of current regulations, contractual provisions applicable to the Website, the app and the related services, and the rules of fairness and good faith.

In carrying out these activities, we also consult external databases and "blacklists" for tracking fraudulent online activities. In these cases, your data is collected by the external providers of such databases and blacklists. It should be noted that in the event of items reported by customers as not delivered by the courier or as lost during a return procedure, you will be asked to forward a copy of an identity document, in order to allow YOOX to carry out the checks necessary to process the refund; any personal data that is not essential for the purpose will not be used. In the event of suspected theft of the goods not received, a copy of your identity document will be attached to any report filed with the competent authorities to protect your rights and those of YOOX.

m) To ensure the correct technical functioning and security of the Website.

We process your data in order to ascertain and ensure the correct technical functioning and security of the Website.

More specifically, for this purpose, we use your navigation data (IP address, information contained in the "log files" of the Website’s servers and other data indicated in paragraph 2), which allow us to detect anomalies connected to any technical malfunctions of the Website or to situations that may compromise the security of the Website, thus enabling us to intervene in order to ensure the correct technical functioning and security of the Website.

n) Protection of rights.

We will process your data (as referred to in the previous paragraph 2) in order to protect our rights or those of another subject in judicial, extrajudicial (mediation bodies and bodies with similar functions) and administrative settings, should this prove necessary.

In the event that you originally wish to authorise the activities referred to in letters f), g), h), i) and j) but then subsequently wish for these to cease, you can request this at any time: to stop these activities (including the sending of any promotional communications), you can contact YOOX via our Customer Care team, selecting "privacy" or by writing to YOOX at the address indicated in the first paragraph of this policy, or, with reference to the receipt of promotional communications, by following the instructions at the bottom of each message received (for example, by clicking on the appropriate link at the bottom of newsletters and other communications sent via email, or by sending "STOP" to the number indicated in the SMS received). If you are a registered user of the Website, you can also stop these activities and communications by going to the "My profile" section of your Myoox.

For processing activities that require the sending of communications in various ways (via SMS, email, paper mail, etc.), you can request that the sending of communications be ceased only with respect to some of the aforementioned methods, by contacting YOOX on 800593888 or via the Customer Care team, selecting "privacy", or by writing to the address indicated in paragraph 1.

Please be aware that you may receive further communications from us even after you have requested termination thereof, due to the fact that for technical reasons, your request may take up to 15 (fifteen) days to come into effect.

With regard to all the activities indicated above, we will process your personal data primarily through IT and electronic tools.

Registering on the Website enables you to create a Myoox profile, through which you can use the services indicated below.

• My Orders: track your orders, exchange and return items that weren't right for you and view your order history.

• Dream Box: save your favourite items and receive updates via email when they become available or if they drop in price. You can disable Dream Box notifications at any time from your Myoox account. You may choose to receive Dream Box notifications via WhatsApp in the countries in which this service is available (you can always change your mind by responding to any of our WhatsApp messages with “Stop Dream Box”, and you will then continue to receive Dream Box notifications via email only).

• Moneyoox: choose the easiest and fastest refund method for any items you want to return. Use your virtual credit for future orders.

• Première: save your searches while you shop and receive email updates when items you show interest in become available. You can disable Première notifications at any time from your Myoox account.

• My details: manage your log-in details and your consent regarding communications (personalised or standard) on our news and promotions.

• My addresses: save or modify your addresses to make placing your next order easier and faster.

• My cards: save or modify your card details to make placing your next order faster and just as secure. You can modify or delete the cards saved using this function at any time.

• My Sizes: create your profile and only browse the items in your size.

• YOOXMIRROR, only available on the app: create your own personalised avatar.

We use your personal data to send you "web push notifications", through your browser and subject to your express consent, and in particular, personalised notifications regarding YOOX products and commercial news.

To be able to send you these notifications we use technologies similar to cookies (more specifically, "HTML5 Local Storage"), which store information on your device (in "local storage"). Some of your personal data and, more specifically, the information indicated below this paragraph, is also stored on our servers, which are located in the European Union. YOOX cannot delete the information stored in the local storage area of your device; in order to delete this information, please follow the instructions indicated in the "Cookie Policy ” by YOOX.

Communications are personalised according to: the way you navigate and use the Website (in particular the products you view, purchase or place in your shopping cart), as well as the data you enter in the registration form when purchasing products on the Website (in particular, the name used to personalise communications sent to you and your date of birth so that we can send you promotions and discounts on your birthday).

The categories of personal data used for this purpose are: products purchased, displayed or placed in the shopping cart, name, date of birth, gender (male or female), preferred language and version of the Website used (country), information about the device and browser that you are using, date and time you gave your consent to receive the web push notifications, My Account/MYOOX creation date,
date of your last visit to the Website.

This activity allows us to help you identify products and services that are of greater interest to you, and to improve your shopping experience on the Website.

As a result of this processing activity, you will receive communications of the type described above.

You may revoke your consent to receiving such personalised commercial communications at any time by following the instructions below, in accordance with the browser you are using.

Most popular browsers:

- Chrome: Settings > Show Advanced Settings > Privacy – Content Settings > Notifications - Manage exceptions> Enter www.OFS.com and select “Block”

- Firefox: Options > Content > Notifications – Select > www.OFS.com – “Block”

- Safari: Preferences > Notifications > From here select "Deny"

You may also revoke your consent to receiving notifications directly from the messages you receive, by following the instructions below.

- Desktop: Right-click on the notification > disable notifications from www.yoox.com

- Mobile: Access the notification centre > Site parameters > Notifications > Block notifications from www.yoox.com

In any case, the service shall be terminated and the corresponding personal data in our possession erased after 365 (three hundred and sixty-five) days from the date of your last visit to our Website.

In order to ensure that the information in our possession is correct and allows us to send the personalised push notifications correctly, please go to the “my profile” section of your Myoox account and, if necessary, update it.

We only process your personal data in the presence of one of the conditions established by the legislation currently in force (the so-called "legal bases" or "conditions of lawfulness"), and more specifically:

a) due to the need to execute a contract of which you are a part, or to carry out pre-contractual measures adopted at your request.

When we process your data for the purpose of concluding and performing an agreement to which you are a party, we take care to ensure that only the minimum information necessary is used. This legal basis legitimises the processing of personal data that takes place as part of the following activities:

- Conclusion and execution of a purchase agreement for the products offered on the Website by YOOX;

- Registration on the Website and use of the services reserved for registered users;

- provision of the services offered on the Website and in the app;

- the processing of your requests by our Customer Care team.

The provision of your personal data for these activities is optional, although, depending on the case, it may be a necessary requirement for the conclusion or fulfilment of a contract. You are free to decide whether or not you wish to provide us with your data; however, if we do not have the data requested, we will not be able to conclude or carry out the agreement or fulfil your requests. This means that you will not be able to purchase the products and benefit from any YOOX services, register on the Website or benefit from the services of the Website, and that YOOX will not be able to process your requests;

b) due to the need to fulfil a legal obligation imposed on us by law.

This legal basis authorises us to process your data in order to fulfil the legal obligations to which we are subject. In particular, in the event that an agreement for the purchase of goods on the Website is concluded, we must process your data in order to fulfil any legal obligations with which YOOX must comply, in accordance with the tax obligations and other regulations to which YOOX is subject.

You are free to decide whether or not to provide us with your data and to conclude a contract with YOOX, but if you do so, your data will be processed in order to fulfil the relevant legal obligations to which YOOX is subject;

c) Based on your consent.

We will only carry out the following processing activities if you have provided us with your express consent:

- sending of our newsletters by email;

- sending of promotional text messages (“SMS service”);

- conducting opinion polls and market research;

- personalisation of the contents of the Website and sending of personalised marketing communications.

Providing us with your personal data for such activities is entirely optional. You are free to decide whether or not to provide us with your data for these purposes, but a failure to do so will mean that you cannot receive our newsletters, SMS messages regarding our news and commercial promotions or personalised marketing communications, nor will it be possible for YOOX to carry out opinion polls and market research.

d) for a legitimate interest of YOOX or of a third party.

We process your data on this legal basis in the following cases:

- analyses and statistical surveys to improve the commercial offering and the services of the Website. In this instance, the processing is carried out on the basis of our legitimate interest in acquiring useful information to improve the quality and effectiveness of the commercial offering and services provided through the Website. The provision of data for this processing activity is entirely optional. However, failure to provide it, with opposition to the activity in question, will only make it impossible for YOOX to use the data to improve the commercial offering and services on the Website;

- to prevent and suppress fraud, counterfeiting and abusive conduct; In this case, the processing activity is carried out on the basis of our legitimate interest in the prevention and suppression of fraudulent activities that may compromise the profitability of the Website and the security of its users. The provision of data for this processing activity is optional, although it is a necessary requirement for the sending of an order or fulfillment of a purchase agreement, and failure to provide the data will render this impossible;

- personalisation of the contents of the Website for marketing purposes. In this case, the data processing is carried out on the basis of our legitimate interest in increasing the profitability of the Website by personalising the users' browsing experience. The provision of data for this processing activity is entirely optional. Failure to provide the data, with opposition to the activity in question, will only make it impossible to view the customised Website content;

- to ensure the correct technical functioning and security of the Website; In this case, the data processing is carried out on the basis of our legitimate interest in preventing and resolving situations that could compromise the functioning of the Website and its services, as well as user security. The provision of data for this processing activity is optional, although it is a necessary requirement for the browsing and use of the Website, and failure to provide the data will render this impossible;

- Protection of rights. In this instance, the data processing is carried out on the basis of the legitimate interest of YOOX or of a third party in protecting their rights. The provision of data for this processing activity is optional, although it is a necessary requirement for the browsing and use of the Website, and failure to provide the data will render this impossible.

Your data will be processed by YOOX and the subjects appointed by the latter only when this is indispensable with respect to the data processing purposes described above (see previous paragraph 3).

Your personal data will be processed by YOOX internal staff, who are specifically trained and authorised to do so.

YOOX also relies on third parties (suppliers or business partners) to carry out some of its services and the related processing activities, to whom it shall transmit the necessary personal data. In particular, depending on the service in question, the data will be communicated to the following categories of providers:

- Email service providers;

- Internet service providers;

- Companies specialised in IT and telematic services;

- Companies providing customer assistance;

- Companies offering marketing services;

- Companies specialised in market research and data processing.

Having been appropriately selected and on the provision of suitable guarantees of compliance with the rules on the protection of personal data, these parties shall process the personal data on behalf of YOOX, acting as their “Data Processors” on the basis of a specific written designation.

As part of the services offered by YOOX, your data is also communicated by YOOX to other third parties, who will process this data in their capacity as independent data controllers. These include:

- Couriers and freight forwarders;

- Banking operators.

Finally, in accordance with the law and where deemed necessary, your data is shared with the tax authorities, police forces and judicial and administrative authorities for the detection and prosecution of crimes, the prevention and safeguarding against threats to public security, to allow YOOX or third parties to ascertain, exercise or defend a right in judicial, extrajudicial (mediation bodies and bodies with similar functions) and administrative settings, to fulfil legal obligations, as well as for other reasons related to the protection of the rights and freedoms of others.

In carrying out the data processing for pre-contractual performance and fulfilment as well as for marketing measures, YOOX, as a part of LuxExperience Group, will share your personal data with other affiliated entities of our parent company LuxExperience B.V. based on Art. 6 (1)(a) or (f) of the General Data Protection Regulation (Regulation (EU) 2016/679).

To fulfil the purposes described above, where strictly necessary, your data will also be transferred to countries outside the European Union or the European Economic Area (EEA).

The data will be transferred in compliance with the related conditions provided for by the legislation currently in force. Specifically:

1) in accordance with the “adequacy decisions” adopted by the European Commission (more information, including the list of countries to which an adequacy decision applies, is available here );

2) in the absence of an adequacy decision, in compliance with “standard data protection clauses” (or “standard contractual clauses”) and in any case, where necessary, including “additional measures” ensuring an equivalent level of data protection to that established by European legislation;

3) in the absence of “standard data protection clauses”, in compliance with one of the other “appropriate safeguards” provided by law (Article 46, Regulation (EU) 2016/679).

We will store your personal data for a limited period of time, which varies according to the purpose for which your personal data is processed. At the end of this period, your data will be permanently erased or anonymised in an irreversible manner, except in cases where the data must be retained for a longer period due to disputes, requests from the competent authorities, or pursuant to applicable legislation.

Your personal data is stored by us in compliance with the terms and criteria specified below for each data processing purpose.

a) To conclude and execute the contract for the purchase of the products offered on the Website by YOOX: up to the conclusion of the administrative and accounting formalities and in any case up to 10 (ten) years from the date of conclusion of the purchase agreement;

b) To enable registration on the Website and use of the services offered to registered users: until the user unsubscribes from the service or following a request by the user to cease the activity;

c) To enable provision of the services offered on the Website: until the user unsubscribes from the service or following a request by the user to cease the activity;

d) To manage requests send to our Customer Care team: for the time necessary to fulfil the request and without prejudice to any further period of data storage that is necessary for the purpose of protecting the rights of the Data Controller or third parties;

e) To fulfil legal obligations: your data will be kept for as long as necessary for YOOX to fulfil the obligations established by law and, in any case, in compliance with any mandatory retention periods established by law. Civil law requires that accounting records be kept for 10 (ten) years from the date of the last registration (Article 2220 of the Italian Civil Code);

f) To send newsletters: until the consent given for this activity is revoked or until a request for termination of the same is received, and, in any case, no later than 4 (four) years from the date of the last relevant interaction by the user;

g) To send promotional SMS messages: until the consent given for this activity is revoked or until the request for termination of the same is received, and, in any case, no later than 4 (four) years from the date of the last relevant interaction by the user;

h) To carry out opinion polls and market research: until the consent given for this activity is revoked or until the request for cessation of the same is received, and, in any case, no later than 4 (four) years from the date of the last relevant interaction by the user;

i) To enable the personalisation of the contents of the Website and the sending of personalised marketing communications to registered users: until the revocation of the consent given for this activity or until the request for termination of the same is received, and in any case, no later than 2 (two) years from the last relevant interaction with the user;

j) To carry out analyses and statistical surveys to improve the commercial offering and the services provided by the Website: up to 12 (twelve) months from the last relevant interaction by the user, where any subsequent further processing will take place after aggregation and anonymisation of personal data;

k) To enable prevention and repression of fraud, counterfeiting and abusive behaviour: data relating to payment, up to the certification of the payment and the conclusion of the related administrative-accounting formalities following the expiry of the right of withdrawal and the terms applied for disputing the payment, without prejudice to further storage of the data where there is a need to process this in order to protect the rights of the Data Controller or of a third party, as well as requests from the competent authorities for the prevention and repression of crimes; in the event of items reported by customers as not delivered by the courier or as lost during a return procedure, the requested copy of the identity document will be kept for 6 (six) months, except where this needs to be sent to the authorities, which may involve further conservation for the time necessary for this procedure to be included;

l) To ensure the correct technical functioning and security of the Website: for as long as necessary to achieve this purpose;

m) To protect the rights of the Data Controller or of third parties: until the situation of conflict or legal dispute that requires the processing of data can be considered definitively resolved.

In any case, for technical reasons, the definitive deletion or irreversible anonymisation of personal data shall be concluded within 60 (sixty) days of the terms indicated above.

You can exercise the rights described in the applicable data protection legislation at any time, with reference to the specific processing of your data as carried out by YOOX. Below is a description of these rights and how to exercise them.

a) Right to object: you have the right to object to the processing of your data for “direct marketing” purposes (i.e. for the purpose of sending advertising materials or for direct selling, or for undertaking market research or commercial communications) at any time, without having to indicate the reason why you object. You can also object to profiling activities carried out for direct marketing purposes. In these cases, we will cease processing your data for the direct marketing purposes to which you have objected. We would like to remind you that the data processing activities for direct marketing purposes are those described in the paragraph 3, letters f), g), h), i) and j).

You also have the right to object to the processing we carry out on the basis of “legitimate interest” (more information on these processing activities is provided in the previous paragraph 6), including profiling, by telling us the reasons that justify your request (the law requires these reasons to be related to your particular situation). In this case, after evaluating your request, we will cease the processing activities to which you have objected, unless there are reasons that result in us having to refuse your request, as required by current legislation.

b) Right to withdraw consent: you can withdraw the consent you have given for a particular processing activity involving your personal data at any time. Upon receipt of your request, we will promptly cease the processing of your data based on the consent you have chosen to revoke; however, we will continue to process the data in the ways other than that for which you have revoked your consent. The processing that was carried out before the withdrawal of consent will remain lawful (the withdrawal of consent does not affect the lawfulness of such processing);

c) Right to access: you can ask us for confirmation that we are processing your personal data, and in relation to the processing activities carried out, you can obtain access to your data and additional information regarding the processing thereof (purposes of processing, categories of data, recipients to whom the data has been disclosed, data retention period, exercisable rights, information on the origin of the data, any automated decision-making processes and data transfer to non-EU/EEA countries). In particular, you have the right to obtain a copy of the personal data of yours that we are processing.

d) Right to rectification: you have the right to have any inaccurate personal data corrected without undue delay. You can also request the supplementation of your personal data, in the event that the data is incomplete with respect to the purpose for which it is processed. We will not accept requests for supplementation of personal data that we do not need to process with respect to the purposes described in paragraph 3, in compliance with current legislation.

e) Right to erasure: you can have your personal data erased without undue delay in the following cases: (i) the data is no longer necessary in relation to the purposes described in paragraph 3 or (ii) you have revoked your consent and there is no other legal basis for processing the data, or (iii) the data has been unlawfully processed or (iv) the data must be erased to comply with a legal obligation or, finally, (v) when you have exercised your right to object and there is no overriding legitimate reason that allows us to continue the processing. Once we have received your request, if it is legitimate we will promptly cease processing activities and erase your personal data; if the data has been made public, depending on the available technology and cost of implementation, we will take reasonable steps to notify any other subjects that are processing your data of your request for erasure. The erasure of data cannot be fulfilled in some cases provided for by law, including those concerning data processing activities required in order to fulfil legal obligations and to protect a right in court.

e) Right to restrict processing: you can limit the processing of your data. In such cases, while we continue to retain your data, we will not use this, unless you ask us to do so or in the event of any exceptions required by law. Restricted data processing may be obtained solely in the following cases: (i) when you contest the accuracy of your personal data or (ii) when the processing is unlawful but you object to the erasure of your personal data or (iii) when we no longer need your personal data, but you need it in order to exercise a right in court or (iv) when you object to the processing of your data during the period in which we are assessing the grounds of your request.

f) Right to data portability: you can request to receive your data in standard electronic format, so that you can transfer it to another data controller. Upon request, where technically possible, we will transfer your data directly to the third party indicated by you. This right can be exercised only if the legal basis of the processing is your consent or the need to execute a contract or pre-contractual measures adopted at your request (for information on the legal bases, see paragraph 6). Unlike the right to access, in this case, you will only obtain the data you have provided to us, which does not include the data that we ourselves have created (in particular, the data from your "profile" created during processing activities that involve personalisation activities). When we receive and fulfil a portability request, we only transmit the data that is compatible and necessary for the pursuit of the purposes described in this policy and, in any case, we adhere to the choices expressed by the data subject.

To exercise these rights, you can contact YOOX by calling 800593888, by contacting our Customer Care team through the appropriate form on our Website (selecting "privacy") or by sending a letter to our address (provided in paragraph 1 above).

Users registered on the Website can view the data relating to the Myoox services (see paragraph 4 above), access and modify the data provided during registration and manage their consent, as well as accessing their Myoox profile. For processing activities for purposes f), g), h), i) and j) as indicated in the previous paragraph 3 and which provide for the sending of promotional communications, the right to object or to revoke the consent regarding the aforementioned can also be exercised using the appropriate link or the procedure indicated in each communication sent, as already indicated in paragraph 3.

YOOX will respond to requests to exercise the rights without undue delay and, in any case, within one month of receipt of the request at the latest. This period may be extended by two months, if necessary, depending on the complexity and number of requests.

Please be aware that due to technical reasons, the activities resulting from the exercise of one of the aforementioned rights, such as erasure or objection, may take up to 15 (fifteen) days to be carried out: you may therefore receive, for example, further communications from us even after requesting the termination thereof, due to the fact that for technical reasons related to system updates, your request may take up to 15 (fifteen) days to come into effect.

To ensure that our users’ data is not breached or used unlawfully, we may need to ask you for some additional information before granting your request to exercise any of the rights described, in order to verify your identity.

For any requirements regarding your rights and personal data, you can also contact our Data Protection Officer using the contact details indicated in paragraph 1 above.

If you believe that the processing of your personal data has been carried out illegally, you can file a complaint with one of the supervisory authorities responsible for compliance with the rules on personal data protection.

In Italy, complaints may be submitted to the Italian Authority for the Protection of Personal Data (Garante per la Protezione dei Dati Personali). You can also submit the complaint to a supervisory authority of another EU country, if the latter authority is that of the state in which you usually reside, work or where the alleged violation occurred.

More information on how to submit a complaint can be found on the Italian Authority for the Protection of Personal Data website at http://www.garanteprivacy.it/.

You can also contact the Data Protection Officer (DPO) of YOOX, using the contact details indicated in the paragraph 1 to submit any requirement relating to the processing of your personal data.

We protect your personal data using specific technical and organisational security measures, in order to prevent it from being used in an illegal or fraudulent manner. In particular, we use security measures that guarantee: the pseudonymisation and encryption of your data; the confidentiality, integrity and availability of your data, as well as the resilience of the systems and services that process it; and the ability to recover the data in the event of incidents. YOOX shall also undertake to regularly test, verify and measure the effectiveness of the measures it has adopted with a view to ensuring the continuous improvement of data processing security levels.

This policy may be subject to changes and additions over time, due to the need to review its contents in relation to the possible evolution of the Website, its services, the technologies used, as well as with reference to any new regulatory provisions.

You can view the key contents of the Joint Controllership Agreement We shall inform you in an adequate and timely manner in case of substantial changes to this Privacy Policy. In any case, the updated version of the Privacy Policy will be published on this page, with an indication of the date of its last update.

The processing of your personal data is carried out by YOOX in full compliance with current legislation on the protection of personal data, consisting in particular of Regulation (EU) 2016/679 (General Data Protection Regulation) and, for YOOX by the Personal Data Protection Code (Legislative Decree 196/2003, as last amended and supplemented by Italian Legislative Decree 101/2018), as well as by the provisions of the Italian Authority for the Protection of Personal Data.

For further information regarding the legislation on the protection of personal data and your rights, please visit the website of the Italian Authority for the Protection of Personal Data: www.garanteprivacy.it.