PRIVACY POLICY
This privacy policy contains information on the processing of the personal data of users who visit, use the services of and make purchases on the website www.luisaspagnoli.it (hereinafter, the "Website"), pursuant to Articles 13 and 14 of Regulation (EU) 2016/679.
1. DATA CONTROLLER
The data controller for users' personal data is Luisa Spagnoli S.p.A. (hereinafter "Luisa Spagnoli"), with registered office at Strada Santa Lucia 71, 06125, Perugia, Italy; tax code and VAT number: 02742760545, REA: PG no. 238003.
Luisa Spagnoli S.p.A. has appointed its own Data Protection Officer (DPO), who can be reached at the email address dpo@luisaspagnoli.it and at the Company's addresses indicated above.
2. PRINCIPLES OF PROCESSING
In processing users' personal data, Luisa Spagnoli S.p.A. will apply the principles of lawfulness, fairness and transparency. Personal data will be collected for specified, explicit and legitimate purposes (purpose limitation) and will be adequate, relevant and limited to what is necessary in relation to the purposes for which they are processed (data minimisation). They will always be kept accurate and up to date and will be stored for no longer than is necessary for the pursuit of the controller's purposes (storage limitation), after which they will be deleted. Finally, they will be processed by adopting all appropriate security measures to guarantee their integrity and to prevent access by unauthorised third parties (integrity, confidentiality and availability).
3. HOW DATA IS COLLECTED ON THE WEBSITE
Data acquired during browsing
The computer systems and software procedures used to operate the Website of Luisa Spagnoli S.p.A. acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of internet communication protocols. This is information that is not collected in order to be associated with identified users but which, by its very nature, could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the Website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to users' operating system and computer environment.
This data is used solely to obtain anonymous statistical information on the use of the Website and to check that it is working correctly, and is deleted immediately after processing. The data could be used to establish liability in the event of any computer crimes committed against the Website. Except in this eventuality, the data will be deleted when it is no longer needed.
Data voluntarily provided by users
Luisa Spagnoli S.p.A. also collects personal data voluntarily provided by users when they interact with the Website's services, for example as part of the registration process or when placing purchase orders for its products. The same applies when users request the newsletter, take part in initiatives run on the Website, or request information or send communications or requests, including via the chatbot. In the sections of the Website where users' personal data is collected, a link to this Privacy Policy is always present.
If, in the course of using the Website's services, users provide personal data of third parties, they act as independent data controllers and therefore guarantee that they have informed those third parties and, where necessary, obtained their consent to the disclosure of their personal data.
Cookies
Please refer to the Website's specific Cookie Policy for all the necessary information on the types of cookies and similar tracking tools and on how they work.
4. CATEGORIES OF DATA PROCESSED
The Website collects and processes personal details, data relating to users' age, contact information, data relating to sales, invoicing and payments, and details of the purchases they have made.
No special categories of personal data are processed.
5. PURPOSES OF PROCESSING AND LEGAL BASES
Users' personal data is processed for the following purposes:
5.1. Provision of services, sale and delivery of products, administrative, accounting and tax purposes
Purpose: to manage users' interaction with the Website, for example for registration, as well as for purchase transactions and the fulfilment of purchase orders, payments and delivery of products, the handling of returns and other activities necessary for managing orders placed through the Website. The data is also processed for the resulting administrative, tax and accounting purposes.
Legal basis: the need to perform the contract to which users are party or to respond to their specific requests, as well as compliance with legal and regulatory obligations. Users' consent is not required for any of the above purposes of processing.
Nature of the provision of data: for the performance of the above activities, the provision of data is necessary. Failure to provide the data makes it impossible to perform the contract and provide the requested services, as well as to meet the related legal and regulatory obligations.
5.2. Loyalty programme
Purpose: to manage users' participation in the Luisa Spagnoli S.p.A. Discount Card loyalty initiative, which allows them to benefit from special discounts, promotions and other advantages.
Legal basis: the need to perform the contract to which users are party. Consent is not required for these purposes of processing.
Nature of the provision of data: although optional, the provision of data for the issue of the Discount Card, and for subsequently enjoying the related benefits, is necessary if users wish to obtain the card and take part in the loyalty programme.
5.3. Marketing and sending of the newsletter
Purpose: marketing, by telephone, traditional mail, email, newsletters, text messages such as SMS and MMS, WhatsApp, chat and social networks. Through these channels, information and promotional material may be conveyed relating to the products of Luisa Spagnoli S.p.A., special initiatives and/or promotions, including any invitations to initiatives and events of Luisa Spagnoli S.p.A. and of the other companies of the group. The emails sent by the Company contain tracking pixels, which are tracking tools that make it possible to know whether the emails sent to Customers are opened, as well as other information used to assess the effectiveness of the Company's marketing activities. The processing of personal data by means of tracking pixels takes place with the consent that the Customer gives to receive marketing emails and newsletters. If the Customer does not wish to be tracked by means of tracking pixels, they should not give their consent to marketing and the newsletter and, if they have already given it, they may withdraw it. In this way, by no longer receiving marketing emails and newsletters from Luisa Spagnoli S.p.A., they will also no longer be tracked by tracking pixels.
Legal basis: users' consent. Users may, in any case, withdraw it at any time, or object to receiving further promotional communications as specified in point 10) below of this notice, or limit their consent to only some communication channels. In email communications, users may also use the "unsubscribe" link that appears in every promotional email sent.
Nature of the provision of data: providing data for marketing purposes is optional and any refusal will have no consequences for users.
5.4. Soft spam
Purpose: email marketing to users who have made purchases, in order to offer them products or services similar to those they have purchased (so-called soft spam).
Legal basis: the legitimate interest of the controller. Carrying out email marketing towards the above users does not require their consent, and they may in any case object at any time to the further sending of such emails in the manner indicated in point 10) below of this privacy policy, or by using the "unsubscribe" link that appears in every email sent.
Nature of the provision of data: the provision of data for this purpose is necessary and follows from having made purchases on the Luisa Spagnoli website or in its stores.
5.5. Analysis of consumer preferences and habits
Purpose: to analyse users' purchasing choices and thereby determine their consumer preferences and create individual and group profiles, in order to send targeted commercial offers consistent with the profiles identified and automated emails based on their purchasing behaviour, or to assist them with their purchases. For example, if users enter their data on the Website but do not complete their order, they may be contacted again by Luisa Spagnoli S.p.A. at the addresses they have provided.
Legal basis: users' consent. Users may, in any case, withdraw it at any time, or object to receiving further targeted communications based on their preferences, as specified in point 10) below of this privacy policy.
Nature of the provision of data: providing data for this purpose is optional and any refusal will not affect the possibility of registering on the Website.
5.6. Protection of the rights and interests of Luisa Spagnoli S.p.A.
Purpose: to assert and defend its own rights and interests against users or third parties, out of court or in any litigation.
Legal basis: the legitimate interest of Luisa Spagnoli S.p.A. in taking legal action or defending itself in judicial and out-of-court proceedings.
Nature of the provision of data: the provision of data is necessary where users have made purchases or used the services of Luisa Spagnoli S.p.A.
6. MEANS OF PROCESSING AND SECURITY MEASURES
Users' personal data is collected and processed by electronic means and, to a more limited extent, also by manual means, and only for the time necessary to achieve the purposes of Luisa Spagnoli S.p.A. The processing logic and procedures are strictly related to the purposes specified in this Privacy Policy.
The data collected on the Website is synchronised with any information obtained by Luisa Spagnoli in its own stores.
No fully automated decision-making processes are used that produce legal effects for users or that significantly affect them in a similar way.
7. RECIPIENTS OF PERSONAL DATA
Where the conditions are met, users' personal data may be disclosed to authorities, public bodies, professionals, collaborators and business partners. Only the data necessary is provided to such third parties.
The recipients to whom the data is disclosed process it as independent controllers or as processors, as the case may be, after entering into appropriate contracts pursuant to Article 28 of Regulation (EU) 2016/679.
Data processed for loyalty, marketing and consumer preference and habit analysis purposes is not disclosed to third parties. For marketing purposes and for certain consumer preference and habit analysis activities, Luisa Spagnoli S.p.A. has appointed external companies as data processors, entering into appropriate contracts as provided for by Article 28 of Regulation (EU) 2016/679. For these same purposes and for the related sales purposes, Luisa Spagnoli S.p.A. has also appointed its own group companies as processors of the personal data of Website users and of the customers of its stores.
Through the social network icons on the Website, some user data may also be transmitted to the social networks. With regard to their processing, which takes place outside this Website, please refer to the social networks' own privacy notices.
All of the above parties are required to use the information received only for the processing purposes indicated above, and to keep it confidential, intact and unavailable to unauthorised third parties.
Users' data is not disseminated.
8. RETENTION OF PERSONAL DATA
Users' personal data will be processed for the time necessary to manage their interaction with the Website and to ensure they can use the related services, as well as to enable them to carry out all purchase transactions and the fulfilment of their orders. Users' data relating to the loyalty programme is processed for the time strictly necessary to manage their participation in the Luisa Spagnoli S.p.A. Discount Card loyalty initiative.
Once these purposes have been fulfilled, the data will be retained for the ten-year period prescribed by law, for administrative, accounting and tax purposes and to assert any rights of a contractual nature.
For marketing purposes, users' data is processed until consent is withdrawn or the user objects to the processing, in accordance with the most recent measures of the Italian Data Protection Authority.
For the purposes of analysing consumer preferences and habits, users' data is processed until consent is withdrawn or the user objects to the processing. In any case, data older than seven years from the date of its registration will be deleted, so that users' profiles and purchasing behaviour are always up to date.
Once the retention periods have elapsed, and in the case of users who have been inactive for more than five years (unless they have previously requested the deletion of their data), the data will be deleted or irreversibly anonymised and retained solely for statistical purposes and for strategic and market analysis.
9. DATA TRANSFERS
Users' data may be transferred outside the European Union, for example if the servers of the parties with which Luisa Spagnoli S.p.A. has entered into appropriate contracts are located there, or if the data is disclosed to Luisa Spagnoli group companies based outside Europe. In such cases, Luisa Spagnoli S.p.A. will adopt adequate safeguards, as required by Regulation (EU) 2016/679, to protect users' personal data.
10. THE RIGHT OF ACCESS AND OTHER RIGHTS
Articles 15 to 22 of Regulation (EU) 2016/679 grant users, as data subjects, the right to exercise specific rights.
Article 15 of Regulation (EU) 2016/679 recognises users' right to access their personal data and to obtain a copy of it. The right to obtain a copy of the data must not adversely affect the rights and freedoms of others.
With an access request, users have the right to obtain from Luisa Spagnoli confirmation as to whether or not their personal data is being processed, and to know the purposes and categories of data processed, the third parties to whom the data is disclosed, and whether the data is transferred to a non-European country with adequate safeguards. Users also have the right to know the retention period of their personal data in relation to the purposes indicated above.
Other rights.
With regard to their personal data, users have the right to request the rectification of inaccurate data and the completion of incomplete data, erasure (the "right to be forgotten") under the conditions set out in Article 17 of Regulation (EU) 2016/679, restriction of processing, and data portability.
Users also have the right to withdraw their consent or to object, at any time, to the processing of their data for marketing and soft spam purposes, including the analysis of consumer preferences and habits to the extent that it is connected to marketing activities.
In every promotional email, users will find instructions on how to withdraw their consent or object to receiving further communications, and they may at any time choose all or only some of those options. In email communications, users may also use the "unsubscribe" link that appears in every promotional email sent.
The controller will also confirm to users that the operations resulting from the above requests have been communicated to those to whom the data may have been disclosed, except where this proves impossible or involves a disproportionate effort in relation to the rights protected.
To exercise the above rights, users must contact Luisa Spagnoli S.p.A. at the email address of its Data Protection Officer (DPO), dpo@luisaspagnoli.it, or by post at the address of its registered office.
In order to respond, it may be necessary to identify users by asking them to provide a copy of their identity document.
The controller will provide a written response without undue delay and, in any case, no later than one month from receipt of the request.
11. COMPLAINT TO THE DATA PROTECTION AUTHORITY
Users who consider that the processing of their personal data infringes the provisions of Regulation (EU) 2016/679 or the national data protection legislation have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali), based in Rome, pursuant to Article 77 of Regulation (EU) 2016/679, as well as to take action before the judicial authorities.
12. CHANGES AND UPDATES TO THE WEBSITE'S PRIVACY POLICY
Luisa Spagnoli S.p.A. reserves the right to amend the content of this Privacy Policy, in whole or in part. Any changes will be published on the Website and, where appropriate, notified to users by email. Users are invited to read the Privacy Policy to check for any changes.
Version 0.3 – October 2026
