a) Navigation data 

The computer systems and software procedures that are used to operate the Site may, in the course of their standard operation, obtain certain personal data the transmission of which is implicit in the use of Internet communication protocols. This data is not collected in order to be associated with data subjects, but by its very nature could, through processing and association with data held, also by third parties, allow to identify users. This category of data includes the IP addresses or domain names of the devices used by users connecting to the Site, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user's operating system and IT environment.

This data is used for the sole purpose to check its correct functioning, allow the proper provision of the various functions you requested, and ascertain any liability in the event of potential cybercrimes to the detriment of the Site or third parties.

With regard to personal data collected via cookies, we invite you to read our Cookie Policy. 

b) Personal data you provide us with 

We collect the data through the Site, such as anagraphic data, contact data and shipping data you voluntarily provide us with in order to register for or log in to the reserved area (where registration has already taken place), order products and contact Drapers by filling out the form. 

1. Allowing you to browse the Site and ensuring its proper functioning. The legal basis of the processing is the performance of a contract or pre-contractual measures taken at your request. Providing personal data for this purpose is necessary to enable you to navigate the Site and to be able to monitor its proper functioning.
2. Managing and responding to your requests for information received via the "Contact" form on the Site. The legal basis of the processing is the performance of a contract or pre-contractual measures taken at your request. You are not obliged to provide your data for the above-mentioned purpose, however, the consequence, in the event you do not provide such data, is that your requests cannot be fulfilled and/or that the Data Controller would be in the impossibility to fulfil its contractual obligations, and therefore to execute the contract.
3. Allowing you to register on the Site by creating a personal database and then accessing the reserved area by the login. The legal basis of the processing is the performance of a contract or pre-contractual measures taken at your request. You are not obliged to provide your data for the above-mentioned purpose, but the consequence, in the event you do not provide such data, is that you will not be able to register or access the reserved area.
4. Establishing and managing the contractual relationship, including the management of the order of products placed through the Site, of your invoicing, of your payments and of the shipment of your orders. The legal basis of the processing is the performance of a contract or pre-contractual measures taken at your request. You are not obliged to provide your data for the above-mentioned purpose, however, the consequence in the event you do not provide such data is the impossibility for the Data Controller to establish and manage the contractual relationship with you.
5. Compliance with legal obligations to which the Data Controller is subject (e.g. obligations set forth in the Civil Code, as well as tax and accounting obligations). The legal basis of the processing is the fulfillment of legal obligation to which the Data Controller is subject. Providing data for this purpose is necessary to allow the Data Controller to fulfill its legal obligations; failure to provide your personal data entails the impossibility for the Data Controller to fulfill the legal obligations and, therefore, to establish and manage the contractual relationship.
6. Sending marketing communications via e-mail regarding the Data controller’s commercial initiatives and products. The legal basis of the processing is your consent, which can be withdrawn at any time without prejudice to the processing activity carried out prior to withdrawal. You are not obliged to provide your data for the above-mentioned purpose, however, the consequence in the event you do not provide such data is the impossibility for the Data Controller to send you marketing communications. 
7. Exercising or defending a right in court proceedings or out-of-court procedures. The legal basis of the processing is the legitimate interest of the Data Controller in exercising or defending its rights. The Data Controller has considered that this legitimate interest does not prejudice the rights and freedoms of the data subjects.

Browsing data are deleted after 72 hours without prejudice to any need for criminal investigations by judicial authorities.

Personal data processed to handle and answer your inquiry are kept for the time necessary to handle your request and subsequently deleted.

Personal data processed to register on the Site and to access the reserved area via login are retained until the expiry of a period of 24 months from the last order placed and, in any case, no later than the deletion of your account.

Personal data processed to establish and manage the contractual relationship, including the management of the order of products placed through the Site, invoices, payments and shipment of the products requested, are retained for the entire duration of the relationship. In any case, for purposes related to the fulfilment of obligations under laws and regulations, personal data will be retained for no longer than 10 years from the termination of the relationship.

Personal data processed for the purpose of sending marketing communications regarding the Data controller’s commercial initiatives and products are stored for 24 months from the date on which you provided your last consent or until the exercise of the right of withdrawal or to object, whichever is earlier.

In the event that it is necessary to process data for the purpose of legal action or defence, the data is retained for as long as any claims and/or actions may be pursued by the law.

In particular, your data may be communicated or otherwise provided to, exclusively for the purposes specified above, to the following recipients that will process your personal data as data processors or as autonomous data controllers: 

1. collaborators, consultants of the Data Controller;
2. companies providing services in relation to marketing communications; 
3. companies that provide us with IT support services for our systems;
4. companies that provide payments services;
5. companies that provide us with cloud or hosting services;
6. shipping companies;
7. banking and credit institutes;
8. authorities and institutions to which the right of access to data is regulated by laws or regulations (e.g., public security authorities and police forces) and other data controllers, public or private, where there is a legal basis, such as a legal obligation.

The Data Controller stores the data in the European Union, where it has its own servers. If the Data Controller needs to transfer certain data outside the European Union in order to manage an order or for product distribution needs, or for the location of a supplier, the Data Controller undertakes to ensure adequate levels of protection and safeguards, such as contractual safeguards, in accordance with the applicable laws, including the execution of standard contractual clauses pursuant to Art. 46(2)(c) of the GDPR, possibly supplemented by additional technical, legal and organisational measures necessary to ensure that the level of protection of personal data is equivalent to that of the European Union.

For any further information on the transfer of your personal data, please send an e-mail to the following address: privacy@drapersitaly.it.