YOOX Privacy Policy

 

 

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF EU REGULATION 679/2016 (“GDPR”)

Your privacy is extremely important to us, please read this information notice carefully.

We wish to inform you in a complete and transparent manner about the personal data processing that the company indicated below will carry out on your personal data provided by you and/or collected in the context of the contacts you will possibly have with us, including for example the following:

  • contacting our Customer Service;
  • visiting the website yoox.com (hereinafter the “Site”).

If you provide personal data on behalf of someone else, you must ensure, in advance, that the interested parties have read this information notice.

  1. WHO COLLECT YOUR PERSONAL DATA

The company collecting and processing personal data as autonomous data controller is Brave Kid S.r.l. (“Brave Kid” or “Data Controller”), with registered office in Italy, Marostica (Vi), Via Fosse 14, 36063, telephone +39 0424478555, email customer_privacy@bravekid.com; the Brave Kid’s Data Protection Officer (“DPO”) can be contacted at dpo@otb.net.

 

Please note that Brave Kid entered into a specific joint-controllership agreement, pursuant to article 26 of the GDPR, with YOOX Net-A-Porter Group S.p.A. (“Yoox”). For all purposes for which Brave Kid processes Personal Data jointly with Yoox, including for an extract of the above-mentioned joint controllership agreement, as well as for the purposes for which Yoox will act as autonomous data controller, please refer to Yoox’s privacy notice available at the following link https://www.yoox.com/legal/PrivacyPolicy.

 

To facilitate your understanding of the processing activities carried out by Brave Kid, we have prepared this document explaining which processing activities are carried out as autonomous data controller.

Please consider that said processing activities are not intended for minors and the Data Controller do not knowingly collect or solicit Personal Data from anyone under the age of 16. If you are less than 16 years old, please refrain from provide any Personal Data. This does not affect the applicable contract law such as the rules on the validity, formation or effect of a contract in relation to a child.

  1. WHAT PERSONAL DATA WE PROCESS

Brave Kid collects different categories of Personal Data according to the purposes for which it processes them.

Herein below, we specify which categories of Personal Data are collected; in the following paragraph we will explain for what purposes each category of data is processed by Brave Kid (hereinafter also “Personal Data” if processed jointly).

  • Biographical Data: name, middle name, surname, date of birth, gender;
  • Sales Data: shipping and billing address, method of delivery and payment, name of the credit card holder and expiry date of the card, information requested by the Customer Service, VAT number and/or tax code, passport number (the passport number will be used only for purposes related to payment where required by a law and within the limits of that law), Global Blue card number;
  • Purchase Data: detail of the purchased products (e.g., size, price, discount, model, collection, calculated spending level, abandoned cart, etc.).

 

  1. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA

In this paragraph we explain for what purposes each category of data is processed by the Data Controller.

Brave Kid is the company that produces, sells and distributes, as authorized worldwide licensee, kids apparel and accessories (from 0 to 16 years) bearing the DIESEL, DSQUARED2, MARNI, MM6-MAISON MARGIELA, N°21, MYAR and MAX&Co. trademarks. It is the company maintaining the contacts with you if you decide to purchase the products through the dedicated area of the Site. Brave Kid will process Personal Data for the following purposes.

  1. a) Sales activities and response to other requests made by customers

If you purchase Brave Kid’s products through the e-commerce service on the Site, Brave Kid will process your Biographical Data, Contact Data, Sales Data and Purchase Data to conclude the sale, as well as for all activities strictly connected and related to it, such as delivery or other administrative and accounting obligations (e.g., to issue the invoice).

Legal basis: this processing is based on the performance of a purchase contract to which you are a party; the provision of the Personal Data listed above is necessary for this purpose, since otherwise Brave Kid will not be able to process your request.

  1. b) Purposes related to the obligations established by laws or regulations, by decisions/requests of competent authorities or by supervisory and control bodies

Brave Kid may process your Personal Data to comply with a legal obligation to which it is subject, only in the context of the sales activities indicated in purpose a).

Legal basis: compliance with a legal obligation.

The provision of data for this purpose is mandatory because in the absence of data Brave Kid will not be in a position to comply with their legal obligations.

  1. c) Defense of rights during judicial, administrative or extra-judicial proceedings and in disputes arising in connection with the services offered

Your Personal Data may be processed by Brave Kid to defend its rights or take legal action or make claims against you or third parties, only in the context of the sales activities indicated in purpose a).

Legal basis: this processing is based on the legitimate interest pursued by Brave Kid to protect its rights.

  1. WHAT HAPPENS IF YOU DO NOT PROVIDE PERSONAL DATA

Personal Data requested are necessary for the completion of the purchase contract and for administrative and accounting purposes; failure to provide such data may result in the impossibility to complete the sale.

  1. HOW AND HOW LONG WE WILL PROCESS PERSONAL DATA

The Personal Data provided to and/or collected by Brave Kid are processed and stored with automated tools and, in some cases, may be processed and stored on a paper backing.

The Personal Data (either electronical and paper copies) will be stored for the time necessary to achieve the purposes for which they were collected. In particular, the following rules will apply:

  • data collected to enter into and perform purchase contracts, including payments: up to the conclusion of administrative and accounting obligations. The billing data will be kept for 10 years from the billing date;
  • data related to data subjects’ requests: the data will be stored until the request is satisfied, except where the data are needed to obtain further feedback from you; in this case data will be retain not longer than what is necessary for manage your feedback;

In any case, for technical reasons, the termination of the processing and the consequent cancellation or irreversible anonymization of the related Personal Data will be definitive within thirty days from the terms indicated above.

The cancellation process is carried out periodically on the basis of the customer’s request or at the expiry of the retention period, through an automatic flow that involves the data bases concerned; otherwise, Personal Data will be permanently anonymized; the hard copies will be destroyed by using appropriate devices.

With particular reference to the judicial protection of our rights or in case of requests from the authority, the data processed will be stored for the time necessary to process the request or to protect the right.

  1. WHERE PERSONAL DATA MAY BE TRANSFERRED

For the purposes indicated above, we may also transfer your Personal Data to third countries, not belonging to the European Union, which may possibly do not guarantee the same level of protection. The transfer to third countries will always take place in accordance with the provisions of the GDPR, adopting any other measures necessary to ensure the security of the Personal Data being transferred. These measures possibly include agreements incorporating the so-called “standard contractual clauses” issued by the European Commission or your consent. You can ask for information regarding this third countries and how to obtain a copy of the appropriate safeguards using the following email address customer_privacy@bravekid.com or writing to the postal addresses indicated above.

  1. WHO WILL PROCESS PERSONAL DATA

Personal Data will be processed by:

  • employees and collaborators of the Data Controller that processing data under its authority;
  • employees and collaborators of the Data Processors designated by the Data Controller, including (i) the companies managing the online store (ii) the companies managing the storage of the Personal Data of the Data Controller based on agreements or local regulations;
  • third parties established in the European Union and also outside the European Union, Data Processors, used by the Data Controller in particular for services of: Personal Data acquisition and data entry, shipping, mailing of promotional material, after sales assistance and Customer Service, market research. The complete list of Data Processors appointed by the Data Controller can be requested to the following email address customer_privacy@bravekid.com or writing to the postal addresses indicated above.

Personal Data may also be disclosed to third parties, independent Data Controllers, in particular to freelancers or companies providing legal or tax advice and assistance.

Personal Data will not be disseminated in any way.

  1. YOUR RIGHTS

Pursuant to Chapter III of the GDPR, you have the right to ask to Brave Kid:

  • to access to your Personal Data;
  • to receive the copy of the Personal Data you provided us (so-called “data portability”) and to have data transmitted to another controller, if technically possible;
  • the rectification of the Personal Data in our possession;
  • the erasure of any Personal Data in relation to which we no longer have any legal basis for processing;
  • the limitation of the way in which we process your Personal Data, within the limits set by the applicable law data protection law.

Right to object: in addition to the rights listed above, you always have the right to object at any time to the processing of your Personal Data carried out by the Data Controller for the pursuit of its legitimate interest.

The exercise of these rights, which can be done through the contact details indicated in paragraph 1, is not subject to formal constraints. In the event that you exercise any of the above-mentioned rights, it will be the responsibility of the Data Controller to verify if you are entitled to exercise the right and to provide you with an answer, normally within a month.

If you believe that the processing of your Personal Data is carried out in breach of the provisions of the GDPR, you have the right to lodge a complaint with your local Data Protection Authority (whose contact details can be found here: https://edpb.europa.eu/about-edpb/about-edpb/members_en) or to start the appropriate legal actions before the competent courts.

To exercise your rights, you can send a request to the Data Controller by writing to the addresses indicated in paragraph 1. The Brave Kid’s Data Protection Officer can be contacted at the email address dpo@otb.net.

 

LAST UPDATE JUNE 2023