1. Personal Data Collected

We collect different types of personal data depending on your interactions with our services:

1.1 Data provided directly by the user

• Identification data: name, surname, tax code (if required for invoicing).
• Contact details: email address, landline and/or mobile phone number, WhatsApp number.
• Shipping data: delivery address, any instructions for the courier.
• Billing data: billing address, VAT number (for business purchases), SDI/PEC code.
• Payment data: managed directly by PCI-DSS certified payment processors (Stripe, PayPal, Klarna). We do not store full card details.
• Communication content: emails, WhatsApp messages, chats, call recordings (with prior notice).
• Preferences: preferred sizes, preferred brands, communication preferences.

1.2 Data collected automatically

• Browsing data: IP address, browser type and version, operating system, pages visited, time spent, browsing path.
• Device data: device type, unique identifiers (device ID), screen resolution, system language.
• Geolocation data: country, region, and city (derived from IP address); precise location only with your explicit consent.
• Interaction data: products viewed, added to cart, purchased; clicks on email/SMS; notification opening.
• Cookies and similar technologies: see section 9.

1.3 Data from third parties

• Social login: if you log in via Facebook, Google, or Apple, we receive your name, email, and profile picture (according to your privacy settings on these platforms).
• Advertising platforms: conversion data from Meta Ads, Google Ads, TikTok Ads to measure campaign effectiveness.
• Commercial partners: for "Partner Products", the partner may share data related to order fulfillment.

2. Purposes of Processing

3. Legal Basis for Processing

Pursuant to Art. 6 of the GDPR, we process your personal data on the basis of the following lawful conditions:

3.1 Performance of a contract (Art. 6.1.b)

When processing is necessary for:

• Processing and delivering your orders.
• Managing returns and refunds.
• Sending transactional communications (confirmations, tracking, alerts).
• Providing customer support related to your purchases.

3.2 Consent (Art. 6.1.a)

When you have given explicit consent for specific purposes. Consent is:

• Free: it does not condition the purchase or access to services.
• Specific: required separately for each purpose and channel.
• Informed: based on clear and understandable information.
• Revocable: you can withdraw it at any time.

3.3 Legitimate interest (Art. 6.1.f)

When processing is necessary for our legitimate interests, balanced with your rights:

• Fraud prevention and website security.
• Aggregated and anonymized statistical analysis.
• Service improvement.
• Soft spam (see section 4.6).

3.4 Legal obligation (Art. 6.1.c)

When processing is necessary to comply with legal obligations (e.g., retaining tax documents for 10 years).

4. Commercial and Transactional Communications

We use various channels to communicate with you. It is important to distinguish between transactional communications (necessary for the service) and commercial/marketing communications (which require your consent).

4.1 Transactional Communications (without consent)

The following communications are necessary for the performance of the contract and do not require marketing consent:

These communications may be sent via email, SMS, WhatsApp, or phone depending on the most appropriate channel for the situation.

4.2 Email Marketing

With your explicit consent, we may send you:

• Newsletters with news and trends.
• Promotional offers and discount codes.
• Alerts about sales and special promotions.
• Personalized suggestions based on your interests.
• Invitations to events and exclusive previews.

Frequency: maximum 4-6 promotional emails per month.

Opt-out: each email contains an unsubscribe link with one click.

4.3 SMS Marketing

With your specific consent, we may send you promotional SMS with:

• Flash sales and limited-time offers.
• Exclusive discount codes.
• Alerts about products back in stock.
• Personalized promotions.

Frequency: maximum 4 promotional SMS per month.

Opt-out: reply STOP to unsubscribe, or manage preferences from your account.

4.4 WhatsApp Marketing

With your specific consent, we may contact you on WhatsApp for:

• Exclusive offers for channel subscribers.
• News and new arrivals.
• Exclusive content (behind the scenes, previews).
• Personalized assistance upon request.

Frequency: maximum 2-4 promotional messages per month.

Opt-out: type "CANCEL" or block the number to stop receiving promotional messages.

4.5 Telemarketing

With your specific consent, we may contact you by phone for:

• Presentation of exclusive offers.
• Satisfaction surveys (with a potential offer).
• Invitations to special events.

Frequency: maximum 1 promotional call per month.

Hours: only on weekdays, from 9:00 AM to 8:00 PM.

Opt-out: inform the operator of your wish not to receive further calls, or manage preferences from your account.

4.6 Soft Spam (Marketing to Existing Customers)

Pursuant to Art. 130, paragraph 4, of Legislative Decree 196/2003, we may send you promotional communications via email relating to products or services similar to those already purchased, without the need for prior consent, provided that:

• You are already our customer.
• You provided your email address during a purchase.
• The communications concern similar products/services.
• You have not objected to such use at the time of collection or subsequently.

5. Artificial Intelligence, Profiling, and Automated Decisions

We use artificial intelligence technologies and automated systems to enhance your experience. This section describes how and why.

5.1 Artificial Intelligence Systems Used

5.2 Profiling

Profiling consists of the automated analysis of your personal data to evaluate personal aspects, specifically to analyze or predict preferences, interests, and purchasing behaviors.

How it works:

• We analyze the products you view, add to your cart, and purchase.
• We consider your interactions with emails, SMS, and notifications.
• We create an "interest profile" to suggest relevant products to you.
• We personalize communications based on your preferences.

Effects of profiling:

• You will receive more relevant product suggestions.
• Emails will contain offers tailored to your interests.
• The homepage might display personalized products.

Regular size: If you have previously purchased from us, we can deduce your regular size or measurement from your order history to suggest the correct size when you log in to your account and, if you are subscribed to our communications, to offer you products available in your size via email. This is not an automated decision with legal effects: it is a suggestion you can ignore. You can request its rectification or deletion at any time using the contact details provided in this policy.

5.3 Automated Decisions (Art. 22 GDPR)

Some processes include decisions made entirely automatically, without human intervention:

5.4 Transparency on AI

We commit to:

• Informing you when you interact with an automated system (e.g., chatbot).
• Always ensuring the possibility to speak with a human operator.
• Not using AI for discriminatory decisions.
• Subjecting our systems to periodic checks to avoid bias.
• Retaining records of AI interactions for a maximum of 12 months.

6. Recipients of Data

Your personal data may be disclosed to the following categories of recipients, who act as data processors pursuant to Art. 28 GDPR:

6.1 Technology Service Providers

6.2 Logistics Partners

6.3 Other Recipients

• Commercial partners: for "Partner Products," the data necessary for order fulfillment are shared with the relevant partner.
• Consultants and professionals: accountants, lawyers, tax consultants (bound by professional confidentiality obligations).
• Public authorities: when required by law (Tax Agency, Financial Police, Judicial Authority).

7. Transfer of Data Outside the EU

Some of our service providers are located outside the European Economic Area (EEA), particularly in the United States. In such cases, the transfer occurs in compliance with Chapter V of the GDPR, through:

• Adequacy decisions (Art. 45): to countries recognized by the European Commission.
• EU-US Data Privacy Framework: for transfers to certified US companies (e.g., Google, Meta).
• Standard Contractual Clauses (Art. 46.2.c): approved by the European Commission with Decision 2021/914.
• Binding Corporate Rules (Art. 47): for multinational groups.

You can request a copy of the adopted safeguards by contacting privacy@gagliottacalzature.com.

8. Retention Period

We retain your personal data for the time strictly necessary for the purposes for which they were collected:

Upon expiry of the indicated periods, the data will be deleted or irreversibly anonymized.

9. Cookies and Similar Technologies

Our site uses cookies and similar technologies. For complete information, please refer to our Cookie Policy accessible from the cookie banner or the website footer.

9.1 Summary of Cookies Used

9.2 Managing Cookie Preferences

You can manage your preferences at any time:

• Via the cookie banner (click on the preferences icon in the footer).
• From your browser settings.
• Through opt-out tools: Google Analytics Opt-out, Meta Ads Settings.

10. Your Rights

Pursuant to Arts. 15-22 of the GDPR, you have the following rights:

10.1 How to Exercise Your Rights

You can exercise your rights by contacting us:

• Email: privacy@gagliottacalzature.com.
• Mail: GC Corporation S.r.l. - Privacy Office - Via Emanuele Gianturco 92, 80146 Napoli (NA), Italy.

We will respond within 30 days (extendable by 60 days for complex requests). We may ask you to verify your identity.

10.2 Complaint to the Supervisory Authority

If you believe that the processing violates the GDPR, you have the right to lodge a complaint with the:

11. Consent Management

We request separate consents for each purpose and communication channel, in accordance with the GDPR's principle of specificity.

11.1 Required Consents

11.2 How to Change Consents

You can change your preferences at any time:

• Account Area: log in to your profile → Privacy/Marketing Preferences.
• Link in every communication: every email/SMS contains a link to manage preferences.
• Reply to messages: reply STOP to SMS, write UNSUBSCRIBE on WhatsApp.
• By contacting us: write to privacy@gagliottacalzature.com.

11.3 Consequences of Withdrawal

Withdrawal of consent:

• Does not affect the lawfulness of processing carried out before withdrawal.
• Does not prevent transactional communications related to your orders.
• Takes effect within 48 business hours of the request.

12. Data Security

We adopt appropriate technical and organizational measures to protect your data:

Technical Measures

• Encryption: HTTPS/TLS connections across the entire site.
• Secure payments: processed by PCI-DSS Level 1 certified providers.
• Secure hosting: ISO 27001 certified data centers.
• Backups: daily encrypted backups.
• Firewall and WAF: protection against cyberattacks.
• Monitoring: 24/7 intrusion detection systems.

Organizational Measures

• Limited access: only authorized and trained personnel.
• Training: Periodic data protection training.
• Internal Policies: Procedures for data and incident management.
• Audits: Periodic security checks.

13. Minors

Our website and services are not intended for individuals under 18 years of age.

We do not knowingly collect personal data from minors. If you are a parent or guardian and believe your child has provided us with personal data, please contact us immediately at privacy@gagliottacalzature.com. We will promptly delete it.

14. Changes to the Policy

We reserve the right to update this Policy. In case of substantial changes:

• We will publish a prominent notice on the website.
• We will inform you via email (if you have an account).
• We will update the "Last Updated" date at the top.
• For changes requiring new consent, we will explicitly request it.

We encourage you to periodically review this page.

15. Contacts

For questions, requests, or clarifications regarding privacy: