Please carefully read this Privacy Policy, which applies whenever you access the Website, regardless of whether you purchase the products sold on it. Please also read the General Terms and Conditions of Use, since they contain important information on the Website. Please also note that you can also find within the Legal Area of this Website the repository containing all the boutique privacy policies used in the individual countries where CFCreations is present with its shops.

Please note that this Privacy Policy is governed by European Regulation no. 2016/679 (the “Regulation”) and any other local applicable privacy law (together with the Regulation, the “Privacy Laws”). The Privacy Laws guarantees that personal data (i.e. any information relating to an identified or, even indirectly, identifiable physical person) processing will be carried out in compliance with fundamental rights and freedoms, as well with respect for the dignity of the data subject, with particular reference to confidentiality, personal identification and the right to personal data protection.

1.  DATA CONTROLLER 

CFCreations is the data controller for the processing related to the Website, including therein navigation data, marketing data and profiling data, as well as all the data related to sales made through the Online Boutique and to the corresponding pre- and post-sales support activities. Please note that the data controller is the entity that determines the purposes and modalities of the processing of personal data, in accordance with the Regulation.

2. DATA PROTECTION OFFICER AND POINTS OF CONTACTS 

CFC has appointed a data protection officer, who can be contacted at the following e-mail address info@cfcouture.com .

3. TYPE AND PURPOSE OF PROCESSING PERFORMED ON THE WEBSITE 

Through the Website, different types of personal data are collected and processed, for the purposes below indicated: 

  
(a) personal data related to browsing, which is processed both for the purpose of allowing the Website to function properly, both to manage the sending of messages relating to purchases and the shopping cart, and to allow you to manage contractual relationships with third parties related to sales activities, and for marketing purposes. To this end, please read the Cookie Policy in the Legal Area of the Website;  

(b)  personal data provided voluntarily by the user (such as, e-mail address, personal information, contact details, password provided by filling in the “My Account” registration form) for the Account registration and to access to the personal account, or used to manage the same. 

Please note that registration and access through a social media profile will involve the disclosure of certain personal data (including first name, last name, email and any other data relating to the user and present on the same social profile) by the chosen social network. This requires user’s explicit permission to be given before logging in, which will allow you to carry out activities with the user account. In some cases, social networks require some feedback and information about the use of the log-in. For more information please refer to the relevant privacy documentation on the social network; 

(c) personal data provided by the users in the contact request form (i.e. personal information, contact details, purchase data and data related to the specific requests) addressed to the customer care and/or provided via telephone call to the customer care (it should be noted, in this regard, that upon explicit consent given by the user at the beginning of the phone call, the call may be recorded to enable CFCreations to monitor its service offered to customers) or email, and processed by CFCreations to respond to the user’s requests and to offer the requested services, assistance and information regarding products and the CFCreations world.

(d) personal data provided by the user (i.e. personal details, purchase data, delivery and contact details, payment preferences and data related to specific pre e post sale requests) as part of the processes of online purchase of products on the Online Boutique (and relevant interactions for activities necessary for the sale, as well as for any pre- and after-sales activities and assistance, and related services, including those provided at CFCreations boutiques around the world, as well as activities related to return rights, statutory and contractual guarantees and products assistance); 

(e) personal data (i.e. purchase data, personal and contact details) processed for marketing purposes (i.e. information and updates on products, sales, promotional campaigns, events and other initiatives promoted by CFCreations, using traditional tools  as post and telephone calls and by means of telematics, such as newsletters, e-mails, text messages, MMS and smart messages); Said commercial messages also includes messages suggesting purchases on hold to be completed (reminders on products viewed and abandoned carts), as well as activities and messages aimed at verifying customer satisfaction and the quality of service provided to them by CFCreations; 

(f) personal data (i.e. data related to the purchases and preferences showed by the users) processed for the purpose of studying shopping habits and choices in order to make products and initiatives more responsive to the tastes and needs of its customers and to offer each individual customer the products and experiences most relevant to their preferences; 

(g) personal data (i.e. identification data, payment data, localization, purchase data) processed for the prevention and suppression of fraud and illegal behavior and/or contrary to current regulations, applicable contractual provision, as well as the rules of fairness and good faith. Such processing may also be carried out by third parties, such as companies specialized in the identification of online fraud, Public Authorities, Investigative Bodies, police officers and judicial authorities.

4. LEGAL BASIS FOR THE PROCESSING  

Please note that the processing of personal data is based on the following legal basis 

5. SOURCE OF PERSONAL DATA 

CFCreations collects personal data directly from the user (by registration or during the purchase steps) with the exception of: 

– data collected with the navigation as per section 3 (a)-(f); 

– data collected with the social log-in as per section 3 (b); 

– data collected and processed for the purpose of preventing fraud and malfeasance on the Website as per section 3 (g).  

6. ANALYSIS OF USER’S BUYING HABITS AND SELECTIONS 

As indicated in Section 2 (f) above, with the user’s explicit consent, CFCreations may also process the latter’s personal data for the purposes of analysing user’s buying habits and selections, in order to make the CFCreations products, services and initiatives more responsive to its customers’ tastes and needs. 

CFCreations will process, by automatic means the value purchased within a framework of time, the frequency of the purchases (even if the purchases are made during the sale period) and the kind of product purchased (accessories, clothes, haute couture, pret-a-porter). CFCreations will not proceed with an intrusive study of the users’ behaviour and the study is only intended to propose to clients and users products, services and initiatives more responsive to their tastes and needs. 

Moreover, please note that as per Section 2 (a), with the user’s express consent, CFCreations can process personal data through an automatic means to study cookies in order to verify the navigation through the Website and to propose products and services in line with the navigation. 

7. PERSONAL DATA PROCESSING METHODS CARRIED OUT BY CFCOUTURE

The personal data collected through the Website of CFCreations is primarily processed using computer and electronic means, adopting security measures in order to reduce to a minimum the risks of destruction or loss, including accidental loss, of the data itself, unauthorized access or processing without consent, or processing that is not in conformity with the purposes of collection indicated in this Privacy Policy. 

However, these measures, due to the nature of the online transmission method, cannot limit or absolutely exclude the risk of access without consent, or of dissemination of data. To that end, we recommend that you periodically verify that your computer is equipped with the appropriate software devices to protect from the transmission of incoming and outgoing data on the network (such as up-to-date antivirus systems) and that the Internet service provider has adopted suitable measures to ensure the security of data transmission on the network (such as, for example, firewalls and antispam filters). 

Each purchase on the Website is made with the utmost security thanks to the use of the most advanced technological systems and coding (SSL). 

8. MANDATORY OR VOLUNTARY NATURE OF PROVIDING DATA

With the exception of the navigation data (the provision and collection of which are regulated by the Cookie Policy), the provision to CFCreations of personal data, both for requests and queries, and for the purposes of marketing and analysing consumer habits and preferences, is voluntary and optional. Failure to provide such data does not limit the use of the Website, although it may make it impossible for CFCreations to respond to requests for information and queries, or to purpose customized products and services, or to send informational material, updates, newsletters and invites to CFCreations events.

The provision of the data, especially personal details, email address, postal address, telephone number and bank details in case of credit card payments, is compulsory for executing, through the Website, the product purchase agreement.

Some of said data, moreover, may be necessary for providing to the user other services made available on the Website in connection with the sales (post sales and pre sales services such as made to measure services, pickup in boutique service, delivery, exchange, etc.) or for discharging the obligations deriving from the law or regulatory provisions (tax obligations and antimoney laundering). Any failure by the data subject to provide us with the data may therefore constitute, as the case may be, a lawful and justified reason for not performing the agreement of the products purchased on the Website and not providing the related services.

The mandatory or voluntary nature of the data to be provided will be, if necessary, and as the case may be indicated by means of a special character (*) placed next to the relevant information or to the data the provision of which is necessary for the purpose of providing the services and for purchasing the products on the Website. Any failure to furnish the data the provision of which is voluntary, does not entail obligations or disadvantages of whatever type.

9. CATEGORIES OF RECIPIENT OF PERSONAL DATA

CFCreations will communicate personal data of the Website’s users only as permitted by the law and as indicated below. Further to what indicated in point 2 b. (namely the Social log-in) personal data shall be processed and disclosed to

• employees and consultants of CFCreations, which will process data in their capacity of persons in charge of the processing;
• other companies of the same Group acting as data processors (i.e. entities carrying out processing in the name and on behalf of the data controller, and having been appointed for that purpose), in order to carry out contractual activities and services (such as the pick-up in boutique services) and to carry out specific marketing activities (such as inviting the user to local events); and
• companies acting in their capacity of data processors (i.e. entities carrying out processing in the name and on behalf of the data controller, and having been appointed for that purpose) and providing CFCreations with specific technical and organizational services in relation to the Website (i.e. logistics services, IT services, customer care services and marketing services).

Personal data may also be disclosed to:

• third parties for the sole purpose of performing the purchase agreement (the financial institutions in charge of providing remote card payment services through credit/debit cards);
• third parties specialized in the prevention of computer and online payment-related fraud in order to protect the company from unlawful acts and damages;
• police officers and judicial authorities, in compliance with the law and upon their request, or in case there are good reasons to believe that such disclosure is reasonably necessary to (1) investigate, prevent or take initiatives in relation to suspected unlawful activities, or assist national supervisory authorities; (2) prepare a defence against third party claims or charges, protect the security of its own website and of the company; (3) exercise or protect the rights, property or security of CFCreations, the CFCreations Group companies, its affiliates, customers, employees and third parties.

10. CROSS-BORDER DATA TRANSFER

Personal data will not be disseminated, and will be transferred abroad only and if adequate levels of protection and sufficient safeguards, as provided for by the law, are guaranteed. 

CFCreations mainly process personal data using data centers located in EU.

However, CFCreations operates in the world through its subsidiaries as listed here  and, in order to allow the same to collaborate to provide specific services on the territory (such as in-store appointment and product exchange or in-store return) and to execute marketing activities on behalf of CFCreations, the data will be transferred to the relevant country (also non-EU countries). For this reason, in case of transfers to countries that are not covered by adequacy decisions of the Privacy Authority, CFCreations entered into with the relevant subsidiaries the Standard Contractual Clauses (please see here the relevant standard as approved by the EU Commission) and prodded with a data transfer impact assessment, in order to protect the transferred personal data. 

Personal data may be transferred also to IT services providers in order to grant the subsidiaries to have access to the transferred personal data (such as AWS) and CFCreations also entered with them a data processing agreement and Standard Contractual Clauses in order to protect the transferred personal data (carrying out the necessary impact and security assessment for the transfer of data).

You can always contact CFCreations and the DPO to learn more about the location of your data and the measures applied to protect it.

11. STORAGE PERIOD

Personal data collected and processed by the Website will be stored for the period of time indicated here below, after which the data are technically deleted or rendered totally anonymous using means that prevents it to be recovered. 

12. USER RIGHTS RECOGNIZED BY THE PRIVACY LAW

A user always has the right to obtain from CFCreations confirmation of whether or not personal data concerning him/her exists, even if it is not yet recorded, and to have it communicated to him/her in an intelligible form. A user also has the right to obtain information about the source of personal data; the purposes and methods of processing it, the logic applied in the event of processing that is performed with the aid of electronic instruments; the identification details of the controller and data processors; and indication of the persons or categories of persons whose personal data may be communicated, or who could end up being known by, for example, data processors or agents as data supervisors or data processors. A user also has the right to request an update, correction or, when s/he has an interest in doing so, an inclusion of personal data, deletion, conversion to an anonymous form or the blocking of personal data, that has been processed in violation of the law, including data which it is not necessary to keep in relation to the purposes for which it was collected or subsequently processed; a statement that the above operations were disclosed, including in terms of their content, to those parties to whom the data was communicated, except in the case in which such performance proves impossible or entails the use of methods that are clearly disproportionate to the right protected. The user can also ask for the portability of his/her data. Moreover, the user has the right to ask restriction of processing of his/her personal data.

You can exercise the above rights and ask information and further questions about the processing of your Personal Data by contacting CFCreations and the Data Protection Officer writing to INFO (please note that @CFCOUTURE.COM the delivery of an email request entails the subsequent acquisition of the sender’s address, necessary to respond to requests and keep track of them, as well as any other personal data included in the electronic communication, for legal purposes).