Privacy Policy

CUSTOMER AND USER PRIVACY POLICY

This information is provided pursuant to and for the effects of the General Data Protection Regulation (EU) 2016/679 (hereinafter: “Regulation” or “GDPR”). Its purpose is to illustrate how the personal data of its visitors and customers (hereinafter “users”) are collected and used.

This information notice concerns exclusively Biffi Boutique S.p.A. and does not extend to any website other than www.biffi.com (hereinafter: “biffi.com”) or any application/platform connected to biffi.com.

DATA CONTROLLER

The data controller of your personal data is Biffi Boutique S.p.A. (hereinafter “biffi”), an Italian company based in Milan, Corso Genova 6, 20123 Milan, VAT number: 05935720150.
The contact details of the data controller are as follows: Corso Genova 6 – 20123, Milan. Tel. 02 8311 6052 and privacy@biffi.com

DATA COLLECTION

The personal data subject to processing is collected via the biffi.com site or by expressly authorized third parties.

Collection is carried out through various channels (automatic collection by the site, or collection via forms, chat, e-mail, apps, devices, social media and other means).

PERSONAL DATA PROCESSED AND PURPOSE OF PROCESSING

Biffi.com does not process personal data relating to minors. By accessing biffi.com and using the services offered, the user declares that they are of legal age.

Users' personal data are processed within the activities and for the purposes specified below:

 

1. Finalization and execution of purchase contracts.

To complete purchase orders and execute them, we ask users to provide certain common personal data such as personal details (first name, last name and tax code), contact details (email address, phone number, delivery and billing addresses); any additional data necessary to fulfill the purchase orders.

The data provided by you are processed by us for the purpose of managing orders, including activities such as payment, antifraud prevention, shipping, handling of any returns, customer support, for the execution of administrative and accounting activities related to order management and for compliance with obligations provided by the applicable law.

 

2. Newsletter subscription and commercial/promotional communications.

Following newsletter registration, we process the e-mail address, the country of origin and the gender of interest (obligatory data for registration) and any additional optional data (such as name and surname, phone number) that users provide to personalize offers, in order to perform the requested service, namely sending commercial or promotional communications related to offers and promotions, updates, events. Promotional material may be sent via email, SMS, MMS and instant messaging for services and products of biffi or third parties. Biffi may also carry out, for the same services and products, direct telephone marketing or conduct its own market research via email. It is understood that we will contact you only on the contacts you provide to us.

In order to send communications of genuine interest, we may divide subscribers into macro-categories based on raw data (such as location and gender - the so-called Classification) and without any further processing.

These processing activities are carried out for the following purposes:

- Regarding newsletter registration, the purpose is to send the interested party promotional material via email, SMS, MMS and instant messaging for services and products of biffi or third parties; to carry out, for the same services and products, direct marketing by telephone; as well as to send promotional material or conduct our own market research for the same services and products. The legal basis is thus Art. 6(1)(a) of the Regulation as the data subject has given consent and provided the data for these contact modalities;

- Regarding the classification, the purpose is to divide interested parties within our database into macro-categories based only on raw data (e.g., age range, gender, area of residence) and provided that the interested parties do not raise an objection. The legal basis for this processing is therefore Art. 6(1)(f) of the Regulation, as it is necessary to pursue our legitimate interest in carrying out promotional activity in compliance with the data minimization principle.

At any time you can revoke your consent to receive such communications or exercise the right to object to the classification by clicking the unsubscribe link shown at the bottom of the emails or by contacting our Customer Service by sending an email to support@biffi.com.

 

3. Registration on biffi.com

For site registration, we ask the user to provide a set of mandatory common data [such as: demographic data (name, surname, gender); contact data (email address); other data necessary for registration (password)], plus any other optional data (for example date of birth, phone number, shipping and billing address), which are processed to create and manage a personal profile useful to speed up the purchase process, view the status of orders placed and any returns.

The user is solely responsible for the truthfulness and accuracy of the information and data provided to biffi.com and undertakes to promptly communicate any changes to previously provided data.

Following site registration, we may process the e-mail address, first and last name and gender (mandatory data for registration) and any other optional data (such as date of birth) that users provide us for offer personalization, to send promotional communications related to our products and services similar to those for which the user has shown interest (so-called Soft spam). It is understood that, in order to send communications of genuine interest, we may divide registered site users into macro-categories based on raw data (such as location and gender — so-called Classification) and without any further processing. The legal basis for both of these treatments is therefore Article 6(1)(f) of the Regulation, as it is necessary to pursue our legitimate interest in carrying out promotional activity in compliance with the principle of data minimization and as long as the user does not oppose.

If the user expresses their specific consent and as long as they do not revoke it, we may process personal data for the following additional purposes

In the event of consent to receive the newsletter, we will transmit to the Interested Party promotional material via email, SMS, MMS and instant messaging for Biffi services and products or those of third parties; for the same services and products, we may undertake direct marketing activities by telephone; and send promotional material or to conduct our own market research by email.

- in case of consent to profiling activities, perform analysis, through automated tools, of the consumption and usage habits of the data subjects (Profiling). This processing will involve the analysis of correlations and trends between the information collected and the analysis of the activities carried out, purchases and use of the services offered by biffi. These elaborations are intended to send personalized promotional material based on the data subject's habits and will in no case discriminate or have negative effects on the data subject. This activity also enables biffi to evaluate its own products and services, allowing them to be improved, making them more efficient and usable by the data subject.

It is understood that, in these two cases, the legal basis for processing is Art. 6(1)(a) of the Regulation, since the data subject has given their consent.

The user may grant/revoke the aforementioned consents at any time by accessing their personal profile and selecting/deselecting the appropriate flags, or by contacting our Customer Service by sending an email to support@biffi.com. Consent to receive promotional material can also be revoked by clicking the unsubscribe link at the bottom of the emails.

To cancel the site registration and request deletion of the data provided, the user can contact our Customer Service or send an email to support@biffi.com.

 

4. Browsing

The biffi.com site automatically collects (also from third-party systems integrated into biffi.com) some non-sensitive information, including: the IP addresses or domain names of the devices used by the user connecting to the site, the URI addresses (Uniform Resource Identifier), the time of the request, the method used to forward the request to the server, the size of the file in response, the status code indicating the server's response, the source state, the browser and operating system characteristics used by the user, the temporal references of the visit (for example time spent on each page) and the details relating to the path followed within the site.

The collection of these data, which may also be processed – in anonymous form – for statistical purposes, is intended to enable access to the site and its services, as well as to allow us to monitor its functionalities to optimize the browsing experience and improve our services and offering.

 

5. Cookies

The biffi.com site uses cookies. For more information on this point, please refer to the dedicated Cookie Policy section.

PROCESSING METHODS AND ACCESSIBILITY

For Biffi, privacy and the security of users' personal data are very important, which is why we collect and manage personal data with the utmost care and implement specific measures to keep them safe.

We will process personal data primarily through computerized and electronic tools; the tools we use guarantee high security standards, in compliance with current regulations.

Personal data are accessible to individuals and companies belonging to the following categories:

- employees, collaborators and other authorized subjects (under Art. 29 of the Regulation);

- entities that need access to data to fulfill their contractual obligations: consultants; companies providing banking, financial, insurance services; entities performing printing, transmission, mailing, transportation and sorting of communications to customers; couriers and postal operators; advertising, digital, marketing and social media agencies; entities providing IT services designated as data processors (under Art. 28 of the Regulation) or autonomous data controllers.

Some of these entities may also be based in non-EU countries, and in such cases, the transfer of your personal data to those countries is carried out in compliance with the guarantees provided by law.

In particular, transfers of personal data to countries outside the European Union that do not ensure adequate levels of protection (as established by specific decisions of the European Commission) will be carried out only after an agreement between the data controller and such entities containing safeguarding clauses, also approved by the European Commission, or when the transfer is necessary for the conclusion and execution of a contract between you and the data controller (for the purchase of goods offered on our Site, for Site registration or for the use of Site services) or for handling your requests.

Personal data may be communicated to competent authorities in accordance with applicable law.
Personal data will not be disclosed.

The updated list of data processors can be requested by e-mail at the address privacy@biffi.com.

 

DATA RETENTION PERIOD

The data processed for the execution of the contractual service are kept for the period provided by fiscal and civil law, also to manage any disputes.

The data requested to fulfill legal obligations are kept for the period provided by applicable law.

The data collected during newsletter subscription or otherwise processed within the marketing activities related to site registration are kept respectively until opposition or withdrawal of consent. Please note that opposition and withdrawal can be exercised at any time.

 

RIGHTS

The user has numerous rights, listed below:

· the right to obtain access to personal data and their rectification (arts. 15-16 of the Regulation);

· where provided by law, the right to obtain the erasure of the same (right to be forgotten, Art. 17 of the Regulation),

· the right to obtain restriction of processing concerning them (Art. 18 of the Regulation),

· the right to data portability (Art. 20 of the Regulation),

· the right to object to their processing in cases provided for by the regulations (Art. 21 of the Regulation);

· in case of processing based on consent, the right to withdraw consent at any time, without prejudice to the lawfulness of processing based on consent before withdrawal (Art. 7 of the Regulation).

The user may exercise their rights by contacting the data controller at the following contact details: Biffi Boutique S.p.A. Corso Genova 6 – 20123, Milan and privacy@biffi.com.

If you believe a processing activity violates the law, you have the right to lodge a complaint with the supervisory authority, which for Italy is the Italian Data Protection Authority. Alternatively, you may file a complaint with the competent authority of the European Union Member State where you normally reside, where you carry out your work, or where the alleged violation occurred.

 

SUPPLIERS' PRIVACY NOTICE

 

This information is provided pursuant to and for the purposes of the General Data Protection Regulation (EU) 2016/679 (hereinafter: “Regulation” or “GDPR”). Its purpose is to illustrate how the personal data of our suppliers (and their contact personnel) are collected and used.

 

Data Controller

The data controller is Biffi Boutique S.p.A., located at Corso Genova, 6, 20123, Milan (Italy), VAT number 05935720152. If you have requests regarding the processing of your Personal Data, you can write to us at privacy@biffi.com.

 

Purpose and legal basis for processing

All personal data you will be asked to provide or that you voluntarily communicate will be processed for the purposes of:

a) manage our contractual relationship – legal basis: Article 6.1.b of the GDPR – processing is necessary for the performance of a contract to which the data subject is a party or for the execution of pre‑contractual activities undertaken at the data subject's request;

b) to comply with any law, regulation, EU provisions, provisions issued by any competent authority and/or by other supervisory authorities, as well as to fulfill any obligation arising from the contractual relationship (such as, for example, accounting, payroll, social security, workplace safety, tax obligations) – legal basis: Article 6.1.c of the GDPR;

c) if it is necessary for establishing, exercising or defending one's rights through legal actions or if necessary in order to comply with a request from a judicial authority - legal basis: Article 9.2.f of the GDPR.

 

Nature of data provision

Providing the data necessary to execute the contractual relationship is mandatory. The provision of any additional data is, by contrast, optional

 

Categories of recipients to whom the data may be disclosed

We will share your personal information with third parties where required by law, where necessary to manage the employment relationship with you and your company, or where we have another legitimate interest to do so. For example (but not limited to) your personal data will be accessible to parties responsible for performing the contractual relationship and to public and private entities to comply with specific legal obligations.

 

Data retention period

The data will be retained for administration, accounting, payroll, contract and labor law management, handling of any disputes, in accordance with applicable law.

Exercise of rights by the data subject.

Pursuant to Article 13, paragraph 2, letters (b) and (d) and Articles 15 to 23 of the GDPR, we inform you that, under the GDPR, the data subject has the following specific rights, where applicable:

a) be informed about the collection and use of your personal data;

b) have access to your personal data at no cost;

c) obtain the correction or completion of inaccurate or incomplete personal data;

d) under certain conditions, obtain the limitation or erasure of personal data;

e) obtain and reuse your personal data for your own purposes across different services when the processing is under contract or consent and is carried out automatically ("right to data portability");

f) under certain conditions, object to the processing of your personal data;

g) to file complaints regarding the collection and processing of personal data before the competent supervisory authority – refer to the relevant information at www.garanteprivacy.it;

h) where processing is based on consent, withdraw that consent at any time, without prejudice to the processing carried out lawfully on the basis of the consent withdrawn.

The exercise of rights is not subject to any formal requirement and is free of charge. To exercise one of the rights mentioned above, you may write to the following e-mail address privacy@biffi.com

Transparency on the use of Artificial Intelligence (AI)

To improve the accessibility of content for an international audience, this site uses artificial intelligence tools exclusively as support for translating texts into other languages. The artificial intelligence is not used to generate the site's original content nor to undertake automated decisions that affect users. Translations are subject to verification by our staff before publication.