PRIVACY POLICY – WEBSITE

Information Notice pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)

WHY THIS INFORMATION?

Pursuant to Regulation (EU) 2016/679 (hereinafter the “GDPR”), this page describes how personal data are processed. This privacy notice is provided in accordance with Article 13 of the GDPR. This notice does not apply to any third-party websites that may be accessed through links available on this website, for which no responsibility is assumed.

Personal Data Processed

•    Personal Data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Recitals 26, 27 and 30 GDPR).

•    Customer/User Data.

•    Browsing Data: the IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This category includes IP addresses or domain names of the computers and devices used by users, the URI/URL (Uniform Resource Identifier/Locator) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), and other parameters relating to the user’s operating system and IT environment.

•    Data Voluntarily Provided by the User: the optional, explicit and voluntary sending of messages to the contact addresses indicated on this website and/or the completion of data collection forms entails the subsequent acquisition of the sender’s address, which is necessary in order to respond to requests, as well as any other personal data included in the communication.

Information Regarding the Processing of Personal Data Through Social Media Platforms

With regard to the processing of personal data carried out by the operators of social media platforms used by the Data Controller, please refer to the information provided by those operators in their respective privacy policies.
The Data Controller processes personal data provided by users through its dedicated social media pages in order to manage interactions with users (comments, public posts, etc.) in compliance with applicable legislation.

Specific Notices

Specific privacy notices may be available on certain pages of the Website in relation to particular services or data processing activities.

COOKIES AND OTHER TRACKING TECHNOLOGIES. WHAT ARE THEY? WHAT ARE THEY USED FOR?

For information regarding Cookies and other tracking technologies, please refer to the Cookie Policy available in the footer of the website and at the following link: https://en.carreraworld.com/pages/cookie-policy

1. DATA CONTROLLER AND DATA PROTECTION OFFICER

The Data Controller is Safilo S.p.A., with registered office at Settima Strada 15, 35129 Padua, Italy, represented by its Legal Representative, who has appointed a Data Protection Officer (DPO) pursuant to Articles 37, 38 and 39 of the GDPR.
The DPO can be contacted at the registered office of the Data Controller indicated above or by email at: [email protected].

2. PURPOSES OF PROCESSING, LEGAL BASIS, DATA RETENTION PERIOD AND NATURE OF THE PROVISION OF DATA

A. Navigation on this website

The data necessary for the use of the web services are also processed for the following purposes:

•    obtaining statistical information on the use of the services (most visited pages, number of visitors by time slot or day, geographical areas of origin, etc.);
•    monitoring the proper functioning of the services offered.

Legal basis and nature of the provision of data: Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject that require the protection of personal data, taking into consideration the reasonable expectations of the data subject and the activities strictly necessary for the operation of the website and browsing itself (Art. 6(1)(f) and Recital 47 GDPR). The provision of data is necessary for browsing the website.

Data retention period: Browsing data will be retained for the duration of the browsing session. In any event, such data will not be retained for more than seven days (except where required for the investigation of criminal offences by the Judicial Authority).

B. Use of Cookies and Equivalent Technologies

The website uses technical cookies to enable safe, fast and efficient browsing and to provide users with the requested services. The installation of such cookies does not require the user's prior consent.

For non-technical cookies and equivalent technologies, processing is based on the data subject’s consent to the processing of personal data (Art. 6(1)(a) and Recitals 42 and 43 GDPR). Consent is provided through the website’s cookie banner and cookie policy. Please refer to the cookie policy for further information on retention periods.

C. Management of Contact Requests or Information Requests Submitted by the User Through a Specific Form Available on the Website or Through the Data Controller’s Contact Details

Legal basis and nature of the provision of data: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) and Recital 44 GDPR). The provision of data is necessary; failure to provide the required data will make it impossible to contact the user and provide the requested information.

Data retention period: Personal data will be deleted after 24 months from the response provided to the User, unless further retention is strictly necessary in relation to the request itself.

D. Performance of the Sales Contract to Which You Are a Party, Whether as a Registered or Unregistered User of the Website

Data will be processed to manage all phases of the contractual relationship (in particular, the fulfilment of contractual obligations and administrative, accounting and legal purposes related to the establishment, performance and termination of the contractual relationship), including after-sales services, returns/withdrawals and compliance with administrative and accounting obligations.

Legal basis and nature of the provision of data: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) and Recital 44 GDPR). The provision of data is necessary to manage your purchases and provide the services related to the sale. Failure to provide the required data will make it impossible to complete the sale and provide the related services.

Data retention period: For the entire duration of the contractual relationship and, following its termination, for a maximum period of 10 years for administrative and accounting purposes (pursuant to Art. 2220 of the Italian Civil Code).

E. Direct Marketing Activities

For the sending of advertising material or direct sales communications, conducting market research, and sending commercial and promotional communications and newsletters by automated means (email).

Communications may contain promotional activities and/or logos of third-party partners and companies belonging to the Group. No personal data will be disclosed to such parties.

For the complete list of Group companies and partners, data subjects may contact the Data Controller using the contact details provided above.

Legal basis and nature of the provision of data: Processing is based on the data subject’s consent to the processing of personal data (Art. 6(1)(a) GDPR and Recitals 42 and 43 GDPR). The provision of data is optional. Failure to provide the necessary data will result in the inability to receive direct marketing communications.

Data retention period: Your Data will be processed for 24 months from the date consent is given, unless consent is withdrawn earlier. This period may be extended if the data subject renews consent for this purpose.

F. Management of Your Requests and Requests from Other Data Subjects Pursuant to Articles 15 et seq. of the GDPR (Data Subject Rights)

Legal basis and nature of the provision of data: Processing is necessary for compliance with a legal obligation to which the Data Controller is subject (Art. 6(1)(c) and Recital 45 GDPR). The provision of personal data is mandatory, as it is necessary to fulfil legal obligations.

Data retention period: 5 years from the closure of the request, unless legal disputes are pending.

G. Non-Automated Profiling

Personal data will be entered into company databases, CRM systems and/or platforms in order to carry out analyses, assessments and segmentation of data subjects into homogeneous groups based on specific characteristics related to business activities, for the purpose of improving service management and sending targeted promotional communications.

Legal basis and nature of the provision of data: Processing is based on the data subject’s consent to the processing of personal data (Art. 6(1)(a) GDPR and Recitals 42 and 43 GDPR). The provision of data is optional. Failure to provide the necessary data will make it impossible to carry out analyses and send targeted communications.

Data retention period: Data will be retained for 12 months from the date consent is provided, unless consent is withdrawn earlier. This period may be extended through a renewal of consent by the User.

H. Account Creation and Management – Restricted Area

Data will be processed to enable the user to create an account, for the management of such account, and to access the related services.

Legal basis and nature of the provision of data: Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) and Recital 44 GDPR). The provision of data is necessary; failure to provide the required data will make it impossible to create an account and access the restricted area of the website.

Data retention period: Until termination of the contractual relationship or deletion of the account, without prejudice to the technical time required to disable access credentials.

I. Abandoned Cart Reminder

Legal basis and nature of the provision of data: Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data (Art. 6(1)(f) and Recitals 47-50 GDPR). The provision of data is necessary; failure to provide such data will make it impossible to activate the reminder service.

Data retention period: For the time necessary to send reminder emails relating to your abandoned cart (maximum 48 hours).

3. WHO WILL THE PERSONAL DATA BE DISCLOSED TO? DATA RECIPIENTS

Personal data will be disclosed to entities that process the data as independent Data Controllers, or as Data Processors (Art. 28 GDPR), and processed by natural persons (Art. 29 GDPR) acting under the authority of the Data Controller and the Data Processors on the basis of specific instructions regarding the purposes and methods of processing.

The data will be disclosed to recipients belonging to the following categories:

•    Group companies and Partners;
•    Third parties providing IT and telematic services (e.g. hosting services, website management and development services, payment tools);
•    Parties with whom the Data Controller has entered into agreements and, where required, subject to prior consent;
•    For direct marketing purposes, subject to consent, entities responsible for managing direct marketing activities;
•    For profiling purposes, subject to consent, entities responsible for managing profiling activities;
•    Competent authorities for compliance with legal obligations and/or provisions issued by public authorities, upon request.

The list of Data Processors pursuant to Art. 28 GDPR is available upon request by contacting the Data Controller using the contact details provided above.

4. WILL THE DATA BE TRANSFERRED TO NON-EEA COUNTRIES?

Personal data may be processed both within and outside the European Economic Area (EEA). In the latter case, the transfer will take place in compliance with Articles 44 et seq. of the GDPR.

In particular, please note that the Data Controller uses service providers (specifically Microsoft Corporation and, for hosting services, Cloudflare Inc.) located in the United States/Canada that provide adequate safeguards through their participation in the Data Privacy Framework, an adequacy decision that allows the secure transfer of data from the European Economic Area to participating U.S. companies without the need for additional data protection safeguards (Art. 45 GDPR).

In addition, data will be transferred to Shopify Inc., located at 151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada. This transfer is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR - Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (notified under document number C(2001) 4539) (2002/2/EC).

For information regarding the safeguards applicable to transfers of personal data outside the EEA, data subjects may contact the Data Controller using the contact details provided above.

5. IS THERE ANY AUTOMATED PROCESSING?

Personal data will be processed through traditional manual, electronic and automated means. Please note that no fully automated decision-making processes are carried out.
With regard to profiling activities, which may be performed based on the explicit consent of the data subject as indicated in the purposes above, such activities will be carried out with human intervention. An operator will create and analyse the profile of the data subject, including habits and consumption preferences, in order to improve the Data Controller’s commercial offering and services (non-automated profiling).

6. WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?

Data subjects may exercise their rights as provided for under Articles 15 et seq. of the GDPR by contacting the DPO at: [email protected].

The Data Controller guarantees data subjects the right to request, at any time, access to their personal data (Art. 15), rectification (Art. 16), erasure (Art. 17), and restriction of processing (Art. 18).

The Data Controller shall communicate (Art. 19 GDPR) any rectification, erasure or restriction of processing carried out to each recipient to whom the personal data have been disclosed. The Data Controller shall also inform data subjects of such recipients upon request.

The Data Controller guarantees the right to data portability (Art. 20 GDPR) and, in response to requests under Art. 20, will provide the data subject with their data in a structured, commonly used and machine-readable format.

Data subjects have the right to object (Art. 21 GDPR), at any time, to the processing of personal data based on legitimate interest by contacting the Data Controller at the contact details above and indicating “objection” in the subject line.

To stop receiving automated direct marketing communications (email), data subjects may send an email to [email protected] with the subject line “unsubscribe from automated communications”, use our automatic unsubscribe systems (opt-out), or update their preferences through the preference management centre available in our emails.

At any time, data subjects may withdraw their consent to profiling (non-automated profiling) by sending an email to [email protected] with the subject line “no profiling” or through the preference management centre available in our emails.

Should data subjects consider that the processing of their personal data infringes Regulation (EU) 2016/679, they have the right to lodge a complaint with a supervisory authority, particularly in the Member State of their habitual residence, place of work or the place of the alleged infringement, or to seek a judicial remedy.

7. CHANGES TO THIS PRIVACY NOTICE

The Data Controller may change, modify, add to or remove any part of this Privacy Notice. To facilitate verification of any changes, this notice will indicate the date on which it was last updated.

Date of update: 26/10/2026