Website Privacy Policy

When consulting the pages of our website, some of your personal data will be collected or, in connection with some services, you will be requested to provide additional personal data.
We will follow the principles of lawfulness, legality, and necessity to collect and use your personal data for the following purposes described in this privacy policy. We will not collect personal data unrelated to the services provided, nor will we refuse you to use the basic functions of the products and/or services because you do not agree to the collection of unnecessary personal data. If we use your personal data for other purposes not specified in this privacy policy or collect and use your personal data for other specific purposes, we will reasonably notify you and obtain your consent again before collection and use.

• 1
• 2
• 1
• 2

Automatically acquired data
Browsing Data - The computer systems and software procedures used to operate the Website acquire, in the course of their normal operation, some data whose transmission is implicit in the use of Internet communication protocols.
Cookies - to find out more, we invite you to read the section "Cookie Policy - Cookie Setting" available at the bottom of every page on our website.
This is data that is not collected in order to be associated with you, but which by its very nature could, through processing and association with data in possession of third parties, allow you to be identified. This category of data includes the IP addresses or domain names of the computers used for navigation and which connect to the Sites, the URI (Uniform Resource Identifier) notation addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and the IT environment. These data are not circulated, but are used only to obtain anonymous statistical data on the use of the Site and to check its correct operation, and are kept for the time periods defined by the relevant legal regulations. The data could, however, be used to ascertain responsibility in the event of hypothetical computer crimes to the detriment of the Site. Except in the latter case, such data are not retained for more than fifteen days. For further information and to manage your preferences, we invite you to view the section "Cookie Policy - Cookie Settings", which can be reached via the link available at the bottom of each page of our website. You can choose whether to authorize us to use the relevant permissions of your device. If you do not authorize us to use relevant permissions, some products/services we provide may be unavailable, but this will not affect your use of basic functional services.
Geo-localisation data - The Site's internal search system collects data, exclusively when used and subject to your confirmation, relating to your geographical location, in order to obtain the appropriate search results (e.g., when searching for the boutique nearest to you via the dedicated functionality).
Learn more about the geo-localization process
In order to recommend nearby shops to you, based on your separate consent, we will request your location permission and collect your location data. If you do not provide this information, it will not affect your normal browsing and use of our products/services. If you do not enable location permission, the information of the store closest to you will not be displayed automatically, but you can still manually enter and view the information of the corresponding store.
Data voluntarily provided by you
In order to enable you to take advantage of the various features offered by our website, you may be requested to provide other personal data, such as:
personal data: first name, surname, date of birth, gender, nationality;
contact details: e-mail address, telephone number, address of residence or domicile; shipping address;
data relating to purchase made: date, quantity and type, product code, sale amount, VAT number where applicable, shipping/billing address, data relating to the payment method you wish to use, data on complaints, returns, guarantee, refunds, and other information relating to the sale of products;
information relating to your interests: services, events, or initiatives of the Tod's Group which you have joined, or expressions of appreciation for products or initiatives of the various Tod's Group brands;
username and password when purchasing our products online, subscribing to one of the services provided through the website or activating a Personal Account on our website;
information about your level of satisfaction if you decide to rate our products or services.
Please note that your payment data, such as your credit card number, will NOT be processed by us.
Personal data collected through social media pages
We may also collect some of your personal data when you interact with our social pages. Some data is submitted directly by you, when you decide to share - through your profile - images published on our social pages, comment on our posts and/or express your approval of one of our products, one of our initiatives or one of our events by selecting the appropriate features, as well as when you decide to write us a message using the private chat or other channels made available on the various social media.
We may also become aware of some data that is indirectly collected as a result of your interaction with our social pages; for example, we may know the time and day when you express your liking to one of our posts or send a request through a mail message.
The knowledge of much of your personal data depends on your chosen social media settings and the content you choose to make public. This data could include your first name, last name, some contact details, and the image associated with your social profile and related data collected through social log-in. We therefore remind you that some of your data may be visible to us should you decide to follow our social pages. For this reason, we invite you to read the privacy policy of the different social media and to check the privacy settings.
Personal data relating to minors
We would like to point out that the protection of the safety and privacy of minors is very important to the Tod's Group. Therefore, we do not intend to collect and do not intend to voluntarily use any personal data of persons under sixteen (16) years of age, or under any other age limit imposed by the laws in force in your country of residence. We therefore request you to refrain from providing us with any of your personal data if you are under the age of sixteen (16) years or under the age of majority in your country of residence.
In the case of collecting personal data from minors, we will only use the data when the law permits, if the guardian expressly consents, or it is necessary to protect the minor.
If you believe that we have unintentionally collected personal data from a child without the consent of the guardian, please inform us immediately and we will try to delete the relevant data as soon as possible.

1. 1
2. 2
3. 3
4. 4
5. 5

Your personal data will not be disclosed or sold.
For the purposes set out in the Section “3. How We Use Your Personal Data?” of the privacy policy, we may have to share your personal data with the parties as set out below:
Internal Third Parties: other Tod’s Group companies acting on our behalf:
to provide us with technical and organizational services, with the ultimate aim of pursuing the purposes described above;
in order to involve you in local marketing initiatives;
to provide you with a tailored service and a better purchasing experience when you visit Tod’s Group shops.
External Third Parties: our service providers that assist us with a variety of functions including with research, mail and delivery, security, insurance, professional advisory (including legal, accounting and auditing advice), banking, payment processing, fraud checks, data storage, data processing, order tracking, marketing, product reviews, responding to customer queries and complaints or technology services.
Public Authorities, in response to formal and lawful requests from the latter or in execution of regulatory obligations;
Persons authorised by the Company to process personal data necessary to perform activities strictly related to the provision of services, who have committed themselves to confidentiality or have an appropriate legal obligation of confidentiality (e.g., employees of the Company);
We may also share your personal data in the event of a reorganisation, merger, sale, joint venture, assignment, transfer of our business or any part of it (including in connection with any bankruptcy or similar proceedings). In any case, your personal data will be processed for the same purposes set out in this Privacy Policy.
When providing personal data to third parties, as data processors, we will only select partners who have implemented adequate safeguards to prevent personal data from being retained by them longer than necessary for the data processing; and to prevent unauthorized or accidental access, processing, deletion, loss, or use.

Your personal data will be processed for varying periods of time depending on the different purposes of the processing; in any event, only for the period of time strictly necessary to achieve the purposes for which the data were collected and processed. Reached the maximum terms of retention of personal data, based on the deadlines detailed below, these will be deleted or if made anonymous.
For the processing purposes set out below, the processing and storage of your personal data will be as follows:

• Article 1
• Article 2
• Article 3
• Article 4
• Article 5
• Article 6
• Article 7

Purposes of processing based on 'Consent', as referred to in point 3.1 of the privacy policy:
Marketing activities: until consent is revoked;
Profiling activities: 7 years from the date of issue of your consent, with automatic renewal in the event of a new purchase at a Tod's Group shop or website.
Processing purposes based on 'fulfilment of contract obligations or pre-contract measures', referred to in point 3.2 of the privacy policy:
Sale of Tod's Group products: until complete fulfilment of the contract obligations arising from the sale;
Provision of services dedicated to Personal Account holders: until you close your Personal Account or 7 years from your last interaction with your Personal Account, whichever is earlier. With the closure of your personal account, all personal data contained therein will be deleted;
Provision of support services to users of the Web Site: until complete fulfilment of the commitments undertaken following your request for assistance, support, or contact;
Other services available on the Website: until we have fully discharged our obligations in respect of your membership of the chosen service.
Purposes of processing based on 'legal obligations', as referred to in point 3.3 of the privacy policy: the storage of your personal data may be further extended, with respect to the timeframe indicated above, should the storage of your personal data be required by compulsory legal regulations, within the time limits provided for by the latter.
Purposes of processing based on 'legitimate interest', as referred to in paragraph 3.4 of the privacy policy: should the processing activities be conducted on the basis of a legitimate interest, either ours or that of third parties, the retention of your personal data shall be limited to the time strictly necessary to achieve the legitimate interest pursued from time to time.
Should the legitimate interest pursued lie in the exercise and defence of a right of ours in a court of law, the retention of your personal data may extend up to the last instance.

We would like to remind you that you have the right at any time to know what personal data we hold about you and how they are being processed, to request that they be updated or corrected and, in the cases provided for by current legislation, to obtain their deletion, restriction of processing or to object to their processing. If you wish, you may also receive your personal data in electronic format for the purpose of transfer to a third party indicated by you.

1. 1
2. 2
3. 3
4. 4
5. 5
6. 6
7. 7

Request to access your personal data as well as receive information on the purpose of the processing, the categories of data processed, the recipients or categories of recipients to whom your personal data may be disclosed, the planned retention period, the application or non-application of profiling mechanisms and automated decision-making processes.
Request to rectify your personal data. This right allows you to correct or complete the data concerning you, although in some cases a prior verification of the correctness of the new data provided by you is necessary.
Request to delete your personal data. This right allows you to request the deletion or removal of your personal data if there are no valid reasons for continuing the processing. You also have the right to request the deletion or removal of your personal data if you have exercised your right to object to the processing and there is no other legal basis for us to keep it, or if we have processed your data in violation of the law or if we are obliged to delete your personal data in order to comply with a specific legal provision. Please note that we may not be able to comply with your request for deletion or may only be able to comply with it partially; for example, because of legal, juridical, or fiscal constraints beyond our control that prevent us from deleting all or part of your personal data. The reasons for our total or partial impossibility of fulfilling your request will be submitted to you promptly.
Please note that when we decide to execute your deletion request, we will delete your data from the server as soon as possible, but due to applicable technological, legal and security restrictions, we may not be able to delete the corresponding data from the system. backup right away. In such cases, we will hold your personal data securely and isolate it from any further processing until the backup is deleted or anonymised.
Request for restriction of personal data processing. Said right enables you to request the suspension of the processing of your personal data in the following cases:
if you request us to determine the correctness of your data.
if you do not wish your data to be deleted, despite the fact that the use of the data by us is in breach of a regulation.
if you wish your data to be retained even if the reasons for their retention by us have ceased to exist, because you wish to ascertain, exercise, or defend a legally protected right.
if you have objected to the use of your data but it is necessary for us to ascertain the existence of legal grounds for their use.
You have the right to restrict our processing of your personal data under certain circumstances, and the right to object us to use your personal data for automated decision-making, profiling, or the right to object us to process your publicly available personal data, or to opt-out the share of your personal data with third parties if required by applicable law.
Request to object to the processing of your personal data. By exercising such right, you may obtain the cessation of the processing of your personal data in relation to the purpose(s) indicated by you. We would like to point out that our granting of your request for objection may or may not take place on the basis of the lawfulness of the processing itself.
Request for portability of your personal data. You have the right to obtain a copy of your personal data. Without prejudice to the limits defined by the applicable legislation, upon your request, we will send a copy of your personal data to a third party indicated by you, in the manner prescribed by current legislation / governmental authorities.
Revocation of consent. If the processing is carried out against your explicit consent, we will, within the timeframe provided for by the law, execute your request for revocation and cease the processing in question. For personal data obtained by us based on your consent, you have the right to change the scope of your consent or withdraw your consent by disabling device functions, setting privacy Settings, cancelling corporate customer identity authentication, or cancelling your account. Please understand that after you withdraw your consent, we will no longer process the personal data obtained based on your consent, which will affect the products or services provided to you corresponding to this part of personal data. However, your decision to withdraw your consent or authorization will not affect the prior processing of personal data based on your consent before.
With regard to revoking your consent to the processing of your personal data for marketing and/or profiling purposes, without prejudice to the possibility of exercising this right by writing to the e-mail address dataprivacyofficer@todsgroup.com, we would like to point out that in each of our communications, by e-mail or SMS, of a promotional nature, there is a function through which you may autonomously

proceed to block one or more of the communication channels used by us to contact you;
withdraw consent to the processing of your data for marketing purposes. In this case, any communication from us of an advertising and/or promotional nature will cease, and any active newsletter service (relating to any Tod's Group brand) will be automatically deactivated;
withdraw consent for profiling purposes.
The same functions are available within your Personal Account, if you have activated one.
In addition, a functionality is available in each of our newsletters through which you can unsubscribe from the newsletter service.
Please note that you will not be discriminated against in any way for having exercised one or more of the rights recognised by the legislation, nor will such exercise have any repercussions on any existing relationship with the Company.
We would like to remind you that you may at any time decide to lodge a complaint with the Supervisory Authority, or appeal before the Judicial Authority, in the event of a breach of the rules on the protection of personal data and/or if you consider that one or more of your rights have been violated.