1. Preamble

Welcome to our website code.moncler.com. Industries S.p.A., a company belonging to Moncler Group ("Moncler") hereby provide you with the following information about the collection and processing of your personal data. When you access the site or use its services (hereinafter, the "Website" and the “Services"), information and personal data about you is collected. For this reason, in accordance with the provisions of the General Data Protection Regulation no. 2016/679 ("GDPR") and applicable national legislation (collectively, "Privacy Legislation"), we have created this document (hereinafter "Privacy Policy") for the purpose of describing which personal data we collect, the purposes and methods of its processing and the security measures used to protect it.

2. Data controllers and Data protection officer

Moncler will process your personal data on the Website acting as data controller. Moncler can be contacted by writing to Industries S.p.A., via Stendhal n. 47, 20144 - Milan (MI), Italy or by email at privacy@moncler.com.

Moncler has appointed a Data Protection Officer (DPO), who is domiciled at the offices of Industries S.p.A. and it is available as follows: dpo@moncler.com.

3. Sources of data and the purposes of data processing

3.1 Browsing data

During their normal operation, the computer systems used to operate the Website acquire some of your personal data, the transmission of which is implicit in the use of Internet communication protocols. This information is not collected for the purpose of identifying you, but may lead to your identification if, for example, it is combined with information held by a third party. This category of data includes the IP address and domain name of your computer, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in reply, the numerical code indicating the status of the reply given by the server and other parameters relating to your operating system. We use this data for the sole purpose of obtaining anonymous statistical information on the use of the Website and to check it is working properly. The data collected is deleted immediately after processing. The data could be used to ascertain responsibility in the event of cybercrime committed to the detriment of the Services.

3.2 Registration information and further information provided by the user

Use of the Website requires the creation of a personal account. You must create a personal account and become a registered user. When you create your account, you will be asked to enter the following registration information:

• first name and surname,
• email address,
• password,
• gender,
• country of residence

In addition, Moncler collects and processes personal data voluntarily provided by you that consist of those data collected through the sending of e-mail, the interaction with the Website’s features and the request for services offered by the Website. Personal data that Moncler collects and processes include name, surname, gender, country of residence and e-mail address.
Should you collect, process and disclose information about third parties to us, you must do so in accordance with the provisions of the Privacy Policy and, therefore, you must provide them with prior notice of the processing and, if necessary, you must obtain their free and express consent before carrying out the processing.

3.3 Purpose of the processing

Providing the above information is necessary to provide the verification service of the authenticity of your purchased items (Anti-Counterfeiting Service); for purposes needed to manage and to respond to your requests for information and/or materials and to your questions; to provide the services required through the Website, including the registration and subsequent updates, and to manage the activities organized through the Website; to comply with legal obligations, national and EU regulations (including anti-money laundering regulations), to prevent fraud and to exercise rights in legal proceedings.

Any refusal by you to provide this information entails the inability to answer questions and requests for information and/or materials, to provide the authenticity control service of the products you purchase or to provide the Services or, moreover, to comply with legal and regulatory obligations set forth above. Failure to provide data may thus constitute, depending on the case, a legitimate and justified reason for not providing Services offered through the Website. You are free to disclose your data to us or not, but in the absence of the requested data it will not be possible to conclude or execute your requests. This means that it will not be possible to handle your requests. In some circumstances and if required, from time to time we will duly inform you if the personal data you are disclosing to Moncler is compulsory or optional. We will point out to you whether the disclosure of your data is compulsory or optional by marking with an appropriate symbol (*) the information that is compulsory or data needed for providing the required services.

3.4 Further purposes of the processing

With your consent, which is optional, Moncler will use your personal data for for marketing purposes in order to receive promotional communications, in particular advertising relating to Moncler products and services (including e-mail and newsletter), invites to events relating to Moncler products and services, and market surveys through e-mail, telephone, SMS, MMS, instant messaging or postal mail. You may at any time indicate your preferred means of contact from among those listed above and you may refuse the receipt of promotional communication by any or all of these means of contact. If you don't provide any preference we will use all of means of contact indicated to the extent you provide your contact details.

With your consent, which is optional, Moncler collects information about your preferences, habits and lifestyle for profiling purposes (e.g., individual and group marketing profiles in order to use such data for the building of group and individual profiles (profiling), business analytics for internal purposes, and customizing the above mentioned promotional communication and other types of promotional initiatives. Personalised communication may be sent by email (newsletter), telephone, SMS, MMS, instant messaging or postal mail. You may at any time indicate your preferred means of contact from among those listed above and you may refuse the receipt of promotional communication by any or all of these means of contact. If you don't provide any preference we will use all of the means of contact indicated to the extent you provide your contact details.

Consent for the above marketing and profiling purposes is optional and refusal will not have any consequences. Data may be provided by you on registration at our points of sale by means of paper and/or electronic forms, acquired during visits to our stores belonging to the Moncler Group or through interaction with websites, internet applications and mobile applications belonging to the Moncler Group.

3.5 Legal grounds for processing

Your personal data is only processed if one of the legal requirements laid down by current legislation is met, and specifically:

• for the conclusion and execution of a contract for the provision of Services as applicable to the purposes described in section 3.3;
• to fulfil a legal obligation to which the controllers may be subject within the context of the purposes of their activities;
• for the legitimate interest of controllers to ensure the browsing activity and registration for reserved users as per section 3.1 and 3.2, prevent and prosecute fraudulent activities, as well as for internal administrative purposes, on the basis of which communication of the data to companies belonging to the controller’s group of companies is legitimate;
• with your consent in respect of marketing and profiling activities as per section 3.4.

3.6 Information collected through cookies and other technologies

Cookies are small files sent by websites that you visit and that are stored on the device you use to access those websites. When users visit the same site again, your browser reads the cookies stored on your device and sends the information back to the site that originally created the cookies. Our site also uses different types of cookies and other technologies to read and store information on the user's device, for example to carry out statistical analyses. We do not use cookies that are able to launch programs on your devices or send viruses to them, or that allow us to control your devices.

We hereby inform you that our Services use:

• technical cookies necessary for the functioning of the Website, including the provision of the Services offered by the Website. This category of cookies includes analytics, session and functionality cookies, used by the owner to, for example, collect information, in aggregate form, about the number of users and how they use the Website or to save your browsing preferences, such as the language.
• analytics cookies are used to carry out statistical analyses of how users navigate the website and are collected anonymously and exclusively for statistical purposes

The above cookies may be:

• temporary, when they are automatically deleted at the end of the connection;
• permanent, when they remain on the user's hard drive, unless the user deletes them;
• first party, when they are issued and managed directly by the Website administrator;
• third party, when they are managed by a domain other than the one visited by the user.

The use of technical cookies does not require the user's consent.

Cookies can be managed and disabled using the browser settings (e.g Internet Explorer, Google Chrome, Safari, Firefox) or the dedicated cookie consent tool, when accessing the website.

Once on the website, the user will be able to access the "Your choices" area and view the list of third party companies that place cookies on our site ("Company"); check the presence and activity status of the installed cookie ("Status") and selectively manage your consent ("On/Off"). Expanding the entry (Info) for each company will provide more information about the company and will link to the specific privacy and cookie policy.

The table below shows the cookies used to offer our Services:

Name of cookie	Type	1st or 3rd party	Purpose and type of used information	Duration
_cs_c	Marketing	First Party Cookie	This cookie is used by ContentSquare to save the user consent to be tracked.	13 months
_cs_id	Marketing	First Party Cookie	This cookie contains ContentSquare’s user identifier.	13 months
_cs_s	Marketing	First Party Cookie	This cookie contains the number of page views within the running session for ContentSquare Solution.	30 minutes
_cs_mk	Marketing	First Party Cookie	This cookie is used for the Google Analytics and Adobe Analytics integrations	13 months
_ga	Statistics	First Party Cookie	Registers a unique ID that is used to generate statistical data on how the visitor uses the website.	12 months
_gid	Statistics	First Party Cookie	Registers a unique ID that is used to generate statistical data on how the visitor uses the website.	1 hour
_gcl_au	Statistics	First Party Cookie	Used by Google AdSense for experimenting with advertisement efficiency across websites using their services.	3 months
PHPSESSID	Technical	First Party Cookie	The PHPSESSID cookie is native to PHP and enables websites to store serialized state data. On the website, it is used to establish a user session and to pass state data via a temporary cookie, which is commonly referred to as a session cookie.	12 months

4. Methods of data processing and data storage

Your personal data will be processed both in paper form and using electronic means and always in compliance with the security requirements to reduce the risks of destruction or loss, including accidental loss of the data itself, of unauthorised access, or processing that was not permitted or that does not comply with the collection purposes indicated in our Privacy Policy, with particular but not exclusive reference to art. 32 of the GDPR. Our security measures include contractual arrangements with any contractor (e.g. service providers) or other party in order to protect the security and confidentiality of your personal data in accordance with the provisions of our Privacy Policy. It is however advisable that your computer be provided with software devices that protect network data transmission/receipt (such as updated antivirus systems) and that your internet service provider take appropriate measures for the security of network data transmission (such as, for example, firewalls and anti-spam filtering).

Period of Use and Retention of Personal Data

We will retain your personal data until the purpose for their use is achieved according to our internal data retention policy. In principle, we will therefore promptly destroy your personal data in our possession once we achieve the purpose of collection and use of your personal data stated in section 3.3 above.

However, the following categories of your personal data will be retained by us for the duration of the periods specified below.

Registered user data: this data will be stored for as long as the account is active to the extent that is strictly necessary to provide the user with the services. Even after the account is closed, we will retain your information if it is necessary to do so in order to comply with legal or regulatory obligations, to protect our rights, to prevent fraud, or to comply with this Privacy Policy.

With particular reference to the legal protection of our rights, we hereby specify that we keep data in accordance with the local statute of limitations.

If you have consented to your personal data being processed, the data relating to your purchases will be kept for marketing and profiling purposes for a period of 7 years as per the authorization obtained from the Italian Data Protection Authority, issued on May 25, 2018 in favour of Industries S.p.A., which is the entity in charge of such processing operations. After this retention period, the data will be automatically deleted or permanently and irreversibly anonymised.

In any case, for technical reasons, the termination of the processing and the subsequent cancellation or irreversible anonymisation of the related personal data will be final within thirty days of the terms indicated above.

Procedure and Method for Destruction of Personal Data

In principle, we will promptly destroy your personal data in our possession once we achieve the purpose of collection and use of your personal data.

The process and means of destroying your personal data are as follows.

A. Procedure

Your personal data will be transferred to a separate database (or separate document file for paper documents) and destroyed after storage for a certain period pursuant to our internal policy or applicable laws and regulations (please refer to the provisions on retention and use period). Such personal data will not be used for any purpose other than the purpose permitted under the applicable laws and regulations.

B. Method

The personal data that has been printed on paper will be shredded through the use of document shredder or incinerated.
The personal data stored in electronic file format will be deleted by using technical means that will not allow data recovery.

5. Scope of disclosure

5.1 Internal and external communication of personal data

Personal data is accessible to our duly authorised personnel e.g. personnel of the Legal and Brand Protection departments and of the CRM department) as necessary and is disclosed to third parties in the following cases: (i) when disclosure is required by laws and regulations applicable to legitimate third party recipients, such as authorities and public bodies for their respective institutional purposes, e.g. anti-money laundering legislation, court authorities; (ii) disclosure to third parties in the event of extraordinary transactions (e.g. mergers, acquisitions, sale of business, etc.); (iii) communication to the third party in charge of fraud prevention services.
Personal data is also shared with our service providers, e.g. for services of a technical and organisational nature that are necessary for the purposes indicated above, such as independent partners, including associates, shipping companies, marketing, payment management, etc, the list of which could be communicated upon request. We provide such parties only with the data necessary to perform the agreed services and they act as data processors in accordance with art. 28 GDPR, based on instructions received from Moncler.
It is expressly stated that the Moncler does not disclose your personal data to third parties for marketing or profiling purposes. Finally, for the purposes of profiling, marketing and customer relationship management (to provide you with the same level of service worldwide), third party service providers and other companies in the Moncler Group may access your personal data as data processors in accordance with art. 28 GDPR, based on instructions received from Moncler.

5.2 Data transfer abroad

For the performance of certain processing activities concerning your Personal Data, Moncler may communicate such data to external parties located in countries that do not belong to the European Union (EU) or the European Economic Area (EEA) (hereinafter referred to as "Third Countries").
In particular, Moncler inform you that your Personal Data could be transferred to Third Country; such list will be updated from time to time and available upon request; the lawfulness of such transfer is, in any case, guaranteed through the mechanisms provided for by art. 46 of the GDPR, since Moncler Companies have executed the then current version of Standard Contractual Clauses approved by the European Commission (supplemented by additional technical/organisational/legal measures) or, as applicable, due to the existence of an adequacy decision pursuant to Art. 45 of the GDPR issued by the European Commission.
These external parties will process your Personal Data as independent data controllers or as data processors, regularly appointed by Moncler Companies in accordance with the legislation regulating data protection (depending on the role they have in relation to the processing).

6. Rights of the data subject

As a data subject, you may at any time exercise the rights acknowledged by the Privacy Policy with regard to the specific processing of your personal data. If you are under the legal age of indicated by the law, your legal guardians will also have the rights described below.

Below is a general description of them and how to exercise them:

• right of access to your personal data: you can obtain confirmation that your personal data is or is not being processed and, consequently, obtain access to your personal data and information about its processing. If you wish, you will be provided with a copy of your personal data;
• right to rectification of your personal data: you can obtain the correction, modification or updating of any inaccurate or out-of-date information, as well as obtaining the supplementation of incomplete personal data, including by providing an additional statement;
• right to withdraw your consent: you may at any time withdraw your consent to the processing of your personal data in connection with any activity for marketing purposes, including profiling. In this regard, please note that sending commercial and promotional communications, carrying out market research and surveys to measure satisfaction and tailoring commercial offers to your interests are considered marketing activities. On receipt of your request, the processing of your personal data based on such consent will cease, while different processing operations or processing based on other grounds will continue to be carried out in full compliance with applicable laws;
• right to the deletion of your personal data (right to be forgotten) when your personal data, in particular, (i) is no longer necessary for the purposes for which it was collected or processed, or (ii) has been processed unlawfully, or (iii) must be deleted in order to comply with a legal obligation, or, lastly, (iv) you have objected to its processing (see "right of objection" below) and there is no overriding legitimate reason that would allow Moncler to process your personal data in any way. Once we have received and reviewed your request, if it is lawful, your personal data will be deleted;
• right to limit the processing of your personal data: you may request that the processing of your data be limited, i.e. that your personal data be stored but not used (with the exception of your requests and exceptions provided for by law):
  • when you challenge the accuracy of your personal data for the period necessary for Moncler to verify the accuracy of such data;
  • when the processing is unlawful, but you object to the deletion of your data;
  • when, although your data is no longer needed by Moncler for processing purposes, you need it to ascertain, exercise or defend your rights in legal proceedings;
  • when you object to the processing, pending verification of whether Moncler has legitimate grounds to continue processing the data;
• right to data portability: you may request to receive data that is processed based on your consent or on a contract entered into with you, in a structured format and readable by an automated device. If you wish, where this is not excessive and technically possible, we may, at your request, transfer your data directly to a third party indicated by you.
• right of objection:you may at any time object to the processing of your personal data carried out based on a legitimate interest, explaining the reasons supporting your request. Unless there are reasons to prevent acceptance of the same as provided by law, we will cease the processing to which you have objected. You have the right to object at any time to the processing of your data for marketing and/or profiling purposes, as long as it is related to that purpose, without the need to specify the reason for your objection. In this case, the processing of your data will cease immediately;
• right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

National laws may provide for additional data subjects rights. For additional information you can contact us at the contact details indicated below.

To exercise the rights described above, you can:

• call the Customer Service at the freephone number 080-311-0000 from Monday to Friday from 9.30 a.m. to 6.30 p.m., excluding public holidays; or
• write to Customer Services by selecting the "privacy" topic in the relevant form in the "Contact us" section of the Website; or
• contact the Data Protection Officer at the address indicated in paragraph 2 above.

If you believe that your personal data has not been processed correctly, you may lodge a complaint with the local supervisory authority.

To obtain the list of our external data processors, of the third parties with whom Moncler Companies share your personal data please contact the controllers through the modalities set forth above.