Last Updated August 31, 2022

 

This Privacy Policy describes how Sergio Rossi S.p.A. (hereinafter referred to as “we”) collect, maintain, use, disclose or sell information (which may include personal information) we collect from you, or that you provide to us both online and offline, and your rights regarding your personal information. The website, us.sergiorossi.com (hereinafter simply the “Website”) is technically managed by LANVIN GROUP and maintained by Hermes NexTec (hereinafter the “Manager”).

 

Please read this Privacy Policy carefully to understand how we will treat your information.

We use your information based on your consent to our practices. Your use of this website indicates that you agree to our collection, disclosure, and use of your information as described in this Privacy Policy.

 

The basic terms of this Privacy Policy cover all of Sergio Rossi S.p.A.’s and Sergio Rossi USA Inc]’s consumer facing operations in the United States, Canada, the United Kingdom, and the European Union. Pursuant to and for the purposes of the provisions that protect individuals in regard to personal data processing and the free movement of such data, (hereinafter also referred to simply as “GDPR”) and the provision of the data protection legislation in United States and Canada, we would like to inform you that the processing of users’ and/or visitors’ personal data (hereinafter also simply the “User” or collectively also the “Users”) who consult and/or visit and/or register on the “sergiorossi.com” Website and/or make use of the relative services – regardless of whether they purchase products – is carried out in compliance with personal data protection and confidentiality legislation to which our business is duly bound, for the purposes and methods described in detail in this Privacy Policy.

 

*  For Users residing in the State of California only: The CCPA – California Consumers Privacy Act – issued on June 20, 2018 (AB-375) (hereinafter also simply the “CCPA”) applies to Users who are residents of California.

 

*  For Users residing in Canada: The Personal Information Protection and Electronic Documents Act (hereinafter also simply the “PIPEDA”) applies to Canadian residents.

 

GDPR, CCPA and PIPEDA are hereinafter collectively referred to as “Applicable Laws”.

 

Indeed, the Website Privacy Policy is based on the following principles:

 

1. process personal data solely for the purposes and in accordance with the methods described in the privacy policy that is provided when said data is collected;
2. only use personal data for purposes other than those for which it was specifically provided with the prior specific and express consent of the User;
3. only make the personal data available to third-party companies for purposes that are essential for providing the requested service; do not communicate, sell or transfer personal data to third parties for their own processing without informing Users in advance and obtaining their consent;
4. respond to requests for the deletion, amendment and integration of the personal data provided and the opposition to the processing of personal data for the purposes of sending commercial and advertising information;
5. ensure the proper and legal management of personal data, safeguarding the privacy of Website Users, as well as apply suitable security measures to protect the confidentiality, integrity, availability and resilience of the personal data provided;
6. ensure that the Users cannot be discriminated against for exercising their privacy rights.

 

We would like to inform you that the Privacy Policy applies to this Website only and no other websites that the User may consult via other links.

 

This Privacy Policy is readily available as it is accessible from the Website homepage and via links on every other page on the Website where personal data is collected. To use specific services provided on the request of the User, specific privacy policies will be provided and, where necessary, consent to process personal data will be requested.

 

1. The Data Controller of the Personal Data

 

The Data Controllers of the personal data gathered via the Website are: Sergio Rossi S.p.A. , based in Via Stradone, 600/602, 47030, San Mauro Pascoli (Forlì-Cesena), Italy; telephone: +39 0541 – 813111; fax: +39 0541 – 813345; email: privacy@sergiorossi.com and Sergio Rossi USA Inc, with registered office c/o Funaro & Co., P.C. Empire State Building, 350 Fifth Avenue, 41st Floor, New York, NY 10118 USA, Tax ID Number 13-3900375 (hereinafter also simply individually “Data Controller” or collectively as “Sergio Rossi”).

Sergio Rossi S.p.A. as Data Controller has also appointed a Data Protection Officer (“DPO”) who may be directly contacted at the following email address: dpoprivacy@sergiorossi.com.

2. Category of Personal Data Processed

 

2.1. Data Provided Directly by the User

The elective, explicit and voluntary sending of emails to the email addresses posted on the Website entails the subsequent acquisition of the sender's email address – which is necessary to answer any requests – as well as the acquisition of any other personal information included in the message.

In some sections of the Website the User will be asked to provide personal data, such as their name, surname, address, telephone numbers, email addresses, national insurance number, VAT no., credit card number, bank details, date of birth and password. In this instance, the User will be provided with the specific privacy policy pursuant to Article 13 of the Privacy Act and Article 13 of the GDPR related to personal data processing concerned with the individual purposes and specific express consent may be requested if necessary.

 

2.2 Data Collected by Sergio Rossi

(i) In the course of their normal operations, the IT systems and software procedures for the functioning of the Website acquire some personal data, the transmission of which is implicit in the use of internet communication protocols.

This information is not collected in order to be associated with identified data subjects, but given the nature of such data, may allow Users to be identified if processed and combined with data held by third parties. This category of data includes the IP addresses or the domain names of the computers used by visitors to the Website, the URI addresses (Uniform Resource Identifier) of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (completed successfully, error, etc.) and other parameters related to the operating system and the User’s IT environment.

(ii) We collect Sales data for Sergio Rossi products: purchase method, type, quantity and price of the Sergio Rossi products purchased.

 

2.3 Personal Data of Third Parties

If Sergio Rossi were to process the personal data of third parties communicated directly by one of its Users (for example, if the User has purchased a product to be sent to another per-son or when the person who pays for the purchase is not the person to whom the product is being sent, or when the User wants to recommend a service on this Website to a friend), the User acknowledges that in this case they are the data controller of the processing of the personal data of the aforementioned persons. For this reason, when providing Sergio Rossi with this data, you must guarantee that: i) the personal data that the User may disclose to Sergio Rossi has been processed by said User in accordance with current privacy provisions and ii) the aforementioned third parties have been duly informed by the User in advance concerning the methods and purposes of the processing and have given their consent.

The User will be solely liable for communicating information and data concerning third parties that have not given their consent, as well as for any improper or illegal use of such data or information.

 

3. Purposes of Processing and Legal Basis

The User’s personal data is collected and processed by Sergio Rossi for purposes strictly required for the use of the Website and its services.

 

3.1. Establishing, Executing and Managing the Commercial Relationship

The personal data referred to in paragraphs 2.1, 2.2 (i) and 2.3 above will be processed to:

• fulfil the legal obligations which apply to Sergio Rossi in accordance with civil, fiscal and accounting regulations, as well as to ascertain responsibility in the case of a hypothetical cybercrime;
• establish, execute and manage the commercial relationship and/or to provide auxiliary services for the same commercial relationship. Specifically, for: administrative and accounting purposes; issuing invoices and credit notes; customer data management; fulfilling and sending purchase orders; IT support when using the Website; post-sales support: management of returns and any complaints; contacting customer care;
• registration on the Website and the management of the technical administration of the Website and the User’s personal account.

 

The legal basis for the processing of personal data for the purposes referred to above in paragraph 3.1 is the commercial relationship to which the User is party.

 

 

3.2 Sergio Rossi Marketing Activity

The personal data referred to in paragraphs 2.1 and 2.2 (ii) above will be processed for promotional activities by Sergio Rossi via automatic (email, fax, SMS and MMS) or traditional tools (telephone calls with an operator, paper-based mail), which include:

• sending newsletters, brochures, catalogues and presentations;
• sending commercial and/or promotional communications, information and updates on Sergio Rossi products and services;
• invitations to special events;
• studies, market research and statistical surveys.

 

For European Users, the legal basis for the processing of personal data for the purposes referred to above in paragraph 3.2 is the User's explicit prior consent. California Users may opt-out of such marketing activity by selecting the opt-out option provided at the time of transaction or by emailing clientservice-us@sergiorossi.com.

 

3.3 Sergio Rossi Profiling Activities

The personal data referred to in paragraphs 2.1 and 2.2 (ii) above will be processed via partly-automated profiling. In this instance, the Data Controller will only analyze the sales data of Sergio Rossi products, i.e. the purchase method, type, quantity and price of the Sergio Rossi products the User purchased and/or viewed to:

• develop and/or create profiles based on the User’s preferences and purchases;
• personalize the User’s experience with Sergio Rossi in line with their interests and purchase habits.

However, it is not deemed that partly-automated profiling will produce legal ramifications for the User or have a significant effect on the User in a similar manner.

 

For European Users, the legal basis for the processing of personal data for the purposes referred to above in paragraph 3.3 is the User's explicit prior consent. California Users may opt-out of such marketing activity by selecting the opt-out option provided at the time of transaction or by emailing clientservice-us@sergiorossi.com.

 

Any processing purpose other than the specific purpose for which the personal data was provided will be highlighted in the specific privacy policy and, for European Users, will be pursued by Sergio Rossi only after obtaining the User’s express consent.

 

4. Mandatory or Optional Provision of the User's Personal Data and the Consequences Should They Refuse

The provision of the User’s personal data to Sergio Rossi, as requested by the Website for various data collection purposes, may be necessary to pursue the purposes outlined in the specific privacy policy or may be optional.

It is understood that the mandatory or optional nature of data provision is specified each time when the personal data is collected via specific privacy policies. Should the User refuse to disclose personal data identified as being necessary, this will make it impossible to achieve the purpose of the specific collection.

The provision of the User's personal data for the purposes referred to in paragraph 3.1 is optional, however, failure to provide said data will make it impossible for them to register on the Website and to establish and/or continue a commercial relationship and/or for the services connected to this relationship to be provided.

The provision of the User’s personal data for the purposes referred to in paragraphs 3.2 and 3.3 is optional and failure to provide said data will have no effect on their ability to register on the Website and/or purchase products and/or receive the services requested, however we will not be able to inform the User about promotions and commercial initiatives or send invitations to events or assess their interests and preferences.

 

5. Personal Data Processing Methods

The User’s personal data is mainly processed in electronic format and sometimes in paper format also.

The personal data the User has provided will not be subject to fully-automated decision making.

 

6. Recipients of personal data

Your personal data may be communicated and/or transferred to:

(i) persons appointed by Sergio Rossi to process data, who have been given specific written instructions:

• employees in the marketing and event organization department;
• employees in the public relations department;
• employees in the retail and wholesale department;
• employees in the IT department;
• employees in the purchasing department;
• employees in the administration and finance department;
• employees in the quality control department;
• employees in the shipping department;

(ii) entities that provide services to Sergio Rossi which the latter has appointed as data processors:

• event service companies and public relations agencies;
• banks we use or those you have indicated to carry out and verify payments;
• IT service providers connected to running the Website and its e-commerce service, as well as to respond to requests regarding the rights of the data subject and for information in general;
• entities that provide delivery and labelling services, also for invitations;
• Sergio Rossi subsidiaries and associated companies: Sergio Rossi USA Inc., Sergio Rossi Hong Kong Ltd, Sergio Rossi Shanghai Ltd, Sergio Rossi Japan Ltd and Sergio Rossi Retail S.r.l.;

(iii) entities that provide services for Sergio Rossi as independent data controllers:

• legal, fiscal and accounting consultants;
• external auditing firm: Ria Grant Thornton;
• public authorities in the event of fiscal and financial audits.

For a complete and updated list of the entities to whom data is communicated, you can write to the addresses given in Article 10 below “Contacts for exercising the rights of the data subject and other in-formation”.

 

7. Duration of personal data storage

7.1 For the purposes referred to in paragraph 3.1, your personal data will be kept for the entire duration of the commercial relationship and for a period of 10 years after the commercial relationship has come to an end.

 

7.2 For the purposes referred to in paragraph 3.2, your personal data will be kept for 2 years from the relative registration in our systems. The User’s personal data will be stored on the servers of Hermes NexTec LLC which are located within the European Union. In order to guarantee that the User’s personal data is always accurate and up-to-date, and thus pertinent and complete, we suggest that the User update the personal data they have entered in their account or that they contact

 

7.3 In any case, personal data will be kept and stored in accordance to the provisions set forth in the Applicable Laws.

 

8. Transfer and Communication of Personal Data to Third Parties

The User's personal data will not be transferred to foreign countries outside the United States, Canada, the United Kingdom, and the European Union.

 

9. Exercising the rights of the data subject

Pursuant to Articles 13, paragraph 2, letters b), c) and d), 15, 16, 17, 18, 19, 20 and 21 of the GDPR, Users may exercise the following rights:

1. the right to request access to their personal data combined with information on the purposes for which it is being processed, the category of personal data processed, the entities or categories of entities to which it has been or will be communicated (with an indication of whether these entities are located in third countries or are organized internationally) and – when possible – indications on the storage period of personal data or the criteria used to determine this period, the existence of their rights to rectify and/or delete the personal data, to limit its processing and to object to its processing and their right to lodge a complaint with a supervisory body, as well as indications on the origin of the data and the existence and reasoning applied in the instance of automated decision making. If they exercise this right, and unless otherwise indicated by the User, they will receive an electronic copy of their personal data that is subject to processing;
2. the right to obtain:
   1. the rectification of their personal data if it is inaccurate or incomplete;
   2. the deletion of their personal data if one of the conditions pursuant to Article 17 of the GDPR exists (for example: if the User’s personal data is no longer required for the purposes for which it was collected, the User decides to withdraw their consent to processing – where this is the legal basis – and there is no other legal foundation for the processing, the User opposes the processing and there is no other legitimate interest of the Data Controller or their personal data has been processed illegally);

• the restriction of the processing of the User's personal data 1) for the time required by Sergio Rossi to ascertain the accuracy of the User’s person-al data (in the instance that the User has disputed it), or 2) where the processing of their personal data is illegal or the User requests the restriction of its processing in-stead of its deletion, or 3) when Sergio Rossi no longer requires the User’s personal data but it is needed for the User to ascertain, exercise or defend a right in court, or, lastly, 4) for the time needed to assess the possible prevalence of the legitimate reasons of the Data Controller with respect to those of the User, if they have opposed the processing of their personal data pursuant to point c below;

1. the User’s personal data in a structured, commonly used and machine-readable for-mat, also in order to transfer it to another data controller, if the processing is based on consent or on a contract and is carried out with automated methods (the right to data portability). If the User would so like, they may ask Sergio Rossi to send their personal data directly to another data controller if this is technically feasible.

 

6. the right to oppose the processing of their personal data if it is processed pursuant to Article 6.1, lett. e) (i.e. to carry out a public service with which the Data Controller is vested) or lett. f) (i.e. to pursue a legitimate interest of the Data Controller) of the GDPR, unless compelling legitimate reasons of the Data Controller exist to proceed with the processing, pursuant to Article 21 of the GDPR;

 

1. the withdrawal of their consent at any time without impairment to the lawfulness of the processing of the User's personal data based on consent that was carried out before their withdrawal.

 

1. if they are not satisfied by the way their personal data is processed by Sergio Rossi, the User can lodge a complaint with the following governing authorities:

 

1. European residents: Italian Data Protection Authority, following the procedures and instructions published on the Authority’s official website (www.garanteprivacy.it);
2. United States residents may file a consumer complaint with the Office of the Attorney General at https://oag.ca.gov/contact/consumer-complaint-against-business-or-company;

• Canadian Residents can make a consumer complaint to The Officer of Privacy Administration of Canada pursuant to Canada's Protection of Personal Information and Electronic Documents Act (PIPEDA) by going to https://www.priv.gc.ca/en/report-a-concern/file-a-formal-privacy-complaint/file-a-complaint-about-a-business/#s5

 

1. any rectification or deletion of the User’s personal data or processing restrictions implemented at their request – except where impossible or if it implies unreasonable effort – will be communicated by Sergio Rossi to each of the recipients to whom the User’s personal data may have been transmitted in accordance with this Privacy Policy.

 

Sergio Rossi shall provide information on action taken on an aforesaid request under Articles 15 to 22 to the User without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, considering the complexity and number of the requests. In such a case Sergio Rossi shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay.

Exercising the above rights is without any form of restriction and free of charge. Sergio Rossi may only ask that the User verify their identity before carrying out further actions subsequent to the User’s request.

 

If you reside in California, you have the right to ask us one time each calendar year if we have shared personal information with third parties for their direct marketing purposes. To make a request, please send us an email at Sergio Rossi S.p.A., Via Stradone 600/602, San Mauro Pascoli (FC) Italy or send a fax to +39 0541 – 813345 or an email to: dpoprivacy@sergiorossi.com

 

10. Contacts for Exercising the Rights of the User and Other Information

To exercise their rights and/or receive any kind of information concerning how the commercial relationship established via the Website is managed, Users can write to: Sergio Rossi S.p.A., Via Stradone 600/602, San Mauro Pascoli (FC) Italy
or send a fax to +39 0541 - 813345 or an email to: dpoprivacy@sergiorossi.com.

 

11. Cookies

The Data Controller uses cookies to facilitate secure and efficient site navigation. For more information on cookies and their usage on the Website, please see the Cookies page, which is an integral part of this privacy policy.

 

12. Social Sharing Buttons

The Website may also contain social sharing buttons. Specifically, these are “buttons” that carry social network icons, such as Facebook, Twitter, Instagram, Pinterest and Google+. These allow Users to reach and interact with social networks just by clicking on the icon. For example, the User can share content or recommend products from the Website on the social networks by using these tools.

After clicking on the social sharing buttons, the social network may collect data concerning the User’s visit to the Website. As mentioned above, this privacy policy does not include the processing of the User’s personal data by the social network. Therefore, the User must refer exclusively to the privacy policy provided by the social network.

Except for cases where the User freely shares their browsing data with the selected social networks by clicking on the social buttons/widgets, the Data Controller does not share or disseminate any of the User’s personal data with the social network.

 

13. Security Measures

Pursuant to Applicable Law, Sergio Rossi and its appointed data processors, including Hermes NexTec LLC, adopt suitable security measures to minimize the risk of the destruction or loss – even accidental – of personal data and of unauthorized access or unauthorized processing or processing that does not comply with the collection purposes indicated in our Privacy Policy.

However, Sergio Rossi cannot guarantee its Users that the measures adopted for the security of the Website and the transmission of personal data and information on the Website limit or exclude all risks of unauthorized access or leaks of personal data from the User’s devices.

It is always advisable that the User’s computer has suitable software to protect against the transmission of their personal data on the internet, both incoming and outgoing, and that their internet service provider has adopted suitable security measures for sending personal data across the internet.

 

14. Links to Other Websites

This Website contains links to other websites that may have no connection to Sergio Rossi.

The Data Controller does not control or monitor such third-party websites or their content. The Data Controller shall not be held liable for the content of such sites and for the rules adopted by them in respect to the User’s privacy and the processing of their personal data when visiting those websites.

This Privacy Policy does not apply to third-party websites. The Website provides links to these sites merely to help the User in their searches and when browsing and to facilitate hyperlinks to other sites on the internet. The provision of links to other websites is in no way a recommendation or indication to access or browse these websites, nor does it provide any guarantees to the content, services or goods supplied and sold to internet users.

 

15. Website Usage by Minors

Our site where this Policy is found is meant for adults. We do not knowingly collect personally identifiable information from children under 13 without permission from a parent or guardian. If you are a parent or legal guardian and think your child under 13 has given us information, you can email us at privacy@sergiorossi.com. You can also write to us at the address listed at the end of this policy. Please mark your inquiries “COPPA Information Request.” Parents, you can learn more about how to protect children's privacy on-line here.

 

16. Governing law

This Privacy Policy is governed by the Applicable Laws of the jurisdiction where the website is located and, in particular, data privacy legislation, including the GDPR, CCPA, PIPEDA and the Privacy Act and the provisions, authorization and guidelines adopted by the Italian Data Protection Authority, which regulate personal data processing, where applicable.

 

17. Amendments and Updates to the Privacy Policy

The Data Controller may amend or simply update, in whole or in part, the Website Privacy Policy, also in consideration of amendments to laws or regulations that govern the matter. Users will be notified of any amendments and updates to the Privacy Policy on the homepage as soon as they are made and they will become binding as soon as they are published and can be viewed on the Website. We therefore recommend that you access this section regularly to check for the most recent and up-to-date version of the Privacy Policy.

 

This Information Privacy Policy shall be updated every 12 months.