The Data Controller of your personal data, which will be processed for the purposes described in the following section, is Tod’s S.p.A. (hereinafter referred to as “Tod’s”, “we”, “us” or “our”), having its registered office in Via Filippo Della Valle, 1, Sant’Elpidio a Mare, (FM) - Italy (EU).

Whenever, concerning specific data processing purposes:
i. we shall act as Joint-Controller with a third party;

ii. third parties shall act as Data Controller;
iii. we shall subject to complementary law requirements or exceeding the Regulation

we shall provide you with all the due information.

When you navigate the Site, your personal data will be collected either automatically or when you are asked to provide them to access certain areas of the Site.

• Data Collected Automatically from the Site

Web Surfing Data – Data acquired by computer systems and software procedures involved in the normal operation of the Site and transmitted as part of the communication protocols of the Internet.



Cookies: to learn more

This refers to information that, although not collected to identify you, by its very nature could lead to your identification if it were to be processed and combined with the data held by third parties. This type of data includes IP addresses or domain names of computers used for browsing and that connect to the Site, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numeric code indicating the status of the response given by the server (success, error, etc.) and other parameters relating to the operating system and IT environment.

This data will not be disseminated but used for the sole purpose of obtaining anonymous and aggregate data on the usage of the Site and to check its correct functioning and will be retained for the time defined by the relevant legal regulation. The data could, however, be used to ascertain liability in case of possible computer crimes against the Site. Except in the latter case, the data will not be kept for more than fifteen days.

For more information and to manage your cookies preference, see our Cookie Policy – Cookie Settings, available through the link in the foot of each page of our Website.

Geolocation Data -Data relating to your physical location that is acquired by the built-in search system of the Site to obtain appropriate search results, such as the location of the nearest boutique. This data is collected only if it is used and if you provide your consent (for example when you are looking for the boutique nearest to you through our dedicated feature).

• Data You Voluntarily Provide

So you can avail of the various services offered by the Site, we will ask you, depending on the service in question, to provide us your personal data, such as your personal data, contact information (telephone numbers, email accounts, home or residence address, etc.), data relating to the payment method, information on purchases and transactions, and others. Providing us your data is entirely voluntary but in some cases failure to do so will prevent us from providing the relevant service.

We shall not handle, in any way, your payment information (i.e. your credit card number).

Children’s personal data: to learn more

We would like to point out that the protection of children's safety and privacy is very important to the Tod's Group. Therefore, we do not intend to collect and voluntarily use the personal data of individuals below the age of sixteen (16), or below any other minimum legal age limits in force in your country of residence. Consequently, we ask that you refrain from providing us with any personal data if you are below 16 years of age or if you are not of legal age in your country of residence.

We will collect and process your personal data, always in compliance with the principles of lawfulness established by the law in force, to enable us to:

a) Pursuant art. 6.1 (b) Regulation, to

i. allow you to successfully purchase products on our E-Store and allow us to fulfil our contractual obligations;
ii. allow you the creation of a Personal account and the allow us to provide the services for account holders-only;
iii. provide you with assistance, when you contact our customer care service;
iv. allow us to provide the services dedicated to our Website visitors.

b) Pursuant art. 6.1 (a) Regulation, to

i. perform marketing activities, if you provide your explicit consent, both via automatic means (text messages, MMSs, messaging platforms, e-mails, push notifications) and not automatic means (mail, phone with operator);

Marketing Purpose: to learn more

Marketing activities can be done by sending newsletters, or through promotions, discounts, incentives, commercial information and other related means, by mail, phone call, direct sales, messaging platforms, email, automatic voice calls, text messages and/or MMSs.

In this context, we might also process your personal data to invite you to shows and events, ask you to participate in market research or to report on special initiatives dedicated to TOD'S Group customers, in the manner and period we believe to be most effective for any of the various initiatives mentioned.

ii. perform customer profiling activities, such as analysing your interests and preferences concerning our products and services, and your shopping habits, in order provide you with services befitting to your needs and expectations;

Profiling Purpose: to learn more

Customer profiling can be conducted by analysing your interests and preferences regarding our products and services, as well as your shopping habits. For example, by understanding the type and frequency of your purchases on our online store when you shop using your personal account or as a "guest,” as well as in our boutiques, we are be able to guarantee a personalized service in your future visits to the TOD'S Group boutiques. If you also have consented to processing your personal data for marketing purposes, we will be able to send you promotional information and/or invitations to initiatives that fit best your profile, preferences and expectations as a shopper.

c) pursuant art. 6.1 (c) of Regulation, to comply with any legal obligations that we may have;

d) pursuant art. 6.1 (f) of Regulation, to pursue any our legitimate interests (i.e. improve our business processes, fraud prevention, exercise and defence of our right, etcetera), in compliance with the conditions and limits set by the legislation currently in force.

We will process your personal data by means of telematic, paper and computer tools, and such processing will be based on the principles of fairness, lawfulness, and transparency to protect your rights and privacy.

In particular, the processing of your data, also for purposes of customer profiling, may be automated, for example through a comparative analysis of your purchases (types, quantities, frequency, timing etc.), and through the analysis of the type and number of your requests for product information within a given timeframe.

We will process your personal data in a manner that will minimize the risk of destruction, loss, and unauthorized access to your data or any unauthorized or non-compliant processing.

We will not disseminate your personal data.

To the extent permitted by law, your personal data may be disclosed, for the purposes described, from time to time, in the Privacy Policy:

i. with our service providers, including other companies of Tod’s Group, performing technical and organizational tasks on our behalf;
ii. to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other shift in all or in any given part of our business, assets or stock (also in connection with bankruptcy or similar outcomes);
iii. in connection with the essential purposes described above (that is to say in order to comply with legal obligations or to execute a lawful request of public authorities).

Whenever we need to transfer your personal data outside the European Economic Area (EEA), we shall take place in accordance with data protection laws in force.

At any rate, we shall transfer your personal information, only if the protection level, guarantee by the privacy laws in force in our countries, is not compromised.

Cross-border transfers: to learn more

In the event that we have to transfer your personal data to entities outside the European Economic Area (EEA), such as to companies of the Tod's Group and/or to third parties that perform technical and organizational tasks on our behalf, again consistent with the purposes for which your data has been collected and processed, we will do so only if it is possible to guarantee the same level of data protection as that in the European Union (EU).

We shall transfer your personal data towards a country outside the European Economic Area (EEA), that does not possess an European Commission's adequacy decision, by means of at least one of the follow cross-border transfer mechanisms, that the Regulation recognizes be able to ensure an adequate protection of the personal data:

i. he personal data recipient is bound to compliance to the “Standard Contractual Clauses”, issued by the European Commission, in order to ensure that the protection level of the personal data processed by our partners outside the EU shall match the Community's data protection level;
ii. the data transfer within a group of undertakings or enterprises is done through binding corporate rules, approved by the competent data protection authority in the UE, pursuant to the consistency mechanism referred to in art. 63 and under the conditions of the art. 47 of Regulation.

We also undertake to carry out, in accordance with laws in force, any possible prior risk assessment concerning the data transfer; adopting, if necessary, any additional security measures, complementary to the safeguards guaranteed by the aforementioned transfer mechanisms.

In the absence of an adequacy decision pursuant to art. 45(3), or of appropriate safeguards pursuant to art. 46 of Regulation, including binding corporate rules, we may transfer your personal data if:

i. you have explicitly consented to the proposed transfer, after having been informed of the possible risks of such transfers due to the absence of an adequacy decision and appropriate safeguards;the transfer is necessary for the performance of a contract in which you are involved, or the implementation of pre-contractual measures taken at your request;
ii. the transfer is necessary for the performance of a contract in which you are involved, or the implementation of pre-contractual measures taken at your request;
iii. the transfer is necessary for the conclusion or performance of a contract, concluded in your interest, between we and another natural or legal person.

Any additional information concerning the possible transfer of your personal data from your country at our headquarter in Italy, will be communicated through specific Privacy Policy. We would like to stress the fact that we will also comply the oversea transfer requirements laid down by the privacy law framework of your country.

You may contact our Data Protection Officer (DPO) at the email addresses below detailed, to receive additional information on the protection of your personal data in the event it is transferred to countries outside the EEA.

In any case, your personal data shall only be processed by parties being duly instructed and able to provide adequate technical and organizational safeguards, as well as bound to the strictest confidentiality by us.

We will process your personal data at different times depending on the purpose. At any event, we will retain your personal data only for the period strictly necessary to achieve the purpose for which it was collected and processed, except when specific provisions of the law require longer retention periods.

Retention period: to learn more

The processing and storing of your personal data will be:

i. for the Tod’s Group products purchase, through our E-Store: until the completely fulfilment of all our obligations arising from the sale contract;
ii. for the providing of the services dedicated to the Personal Account holders: until the closing of the Personal Account, it being understood that your personal data shall be automatically deleted once 7 years have passed since your last interaction with your Personal Account;
iii. for the providing of assistance services: until the complete fulfilment of our commitments concerning and in relation to your assistance request;
iv. for the providing of the services dedicated to visitors of our Website: until the complete fulfilment of our commitments concerning and in relation to the providing of the service requested by you;
v. for marketing purpose: until your consent withdrawal;
vi. for profiling purpose: no more than 7 years since the date of consent, automatically renewed each time you make a purchase at any boutique/point of sale belonging to the Tod’s Group, or at our E-Store;
vii. to comply with legal provisions: within the time frame set by the applicable law;
viii. to pursue our legitimate interest: for the time strictly necessary to the pursuing of the legitimate interest (i.e. if the legitimate interest consists in the exercising or defending of a right in a judicial procedure, the storage of your personal data could be extended until last stage of proceedings - the final judgment.)

You have the right to know which of your personal data we have stored and which ones are being processed, to request to update or correct it, as well as in cases provided for by the law, to delete it, and to restrict or object to the processing even after you have provided your explicit consent. You may also request your personal data to be delivered in electronic format to a third party of your choosing.

Your rights : to learn more

You may at any time email the Data Protection Officer (DPO) at dataprivacyofficer@todsgroup.com to exercise the following rights provided for by the Regulation regarding the specific processing activities we conduct. Specifically, you have the right to:

a) request access to your personal data, as well as receive information about the purposes of the processing, types of data processed, parties or types of parties your data will be disclosed to, the expected retention period, and application, if any, of customer profiling techniques and automated decision-making processes;
b) request to correct your personal data, as well as update any information relating to you, though in some cases you will be asked to verify first the new data that you provided us.
c) request to delete or remove your personal data when its processing is no longer necessary, when you wish to exercise your right to object to its processing and there are no other legal basis to retain said data, if we have violated any laws related to said processing, or if we are required to delete your personal data to comply with a specific regulatory provision. Please note that due to some legal constraints beyond our control, we may be prevented from satisfying your request at all or to its full extent. In those cases, you will be informed promptly of the reasons behind our complete or partial inability to comply with your request.
d) request to object to the processing of your personal data or terminate in any way the processing according to your wishes. We would like to point out that should we accommodate such request, there may or may not be a lawful basis for doing so.

If you had given your explicit consent to the processing, we will comply with your request to terminate the processing within the time frame set by the Regulation.

Further, you may also withdraw your consent to processing for marketing and/or customer profiling purposes by emailing the DPO as indicated above, or even do so directly from your personal account (if activated) on the Site. Withdrawing your consent does not negate the legitimacy of the processing you had previously consented to.

We also would like to highlight that withdrawing your consent could prevent us from providing certain services or products in the Site and in the boutiques of the Tod’s Group. In those cases, we will alert you so you can fully evaluate the effects of withdrawing your consent.

Finally, if the processing is performed based on our legitimate interests or that of third parties, we reserve the right to evaluate the reasons for your request. If the purposes of processing legitimately override your interests, rights, and freedoms, or if it is necessary for us to process such data to file a claim, execute legal actions, or defend ourselves in court, we will have to reject your request and let you know of the reasons for such a decision.

e) request to restrict or suppress the processing of your personal data in the following cases:
i. if you request us to verify the accuracy of your data;
ii. if the data has been unlawfully processed and you prefer to restrict the processing rather than delete your data;
iii. if you want us to retain your data even if we no longer have to so you may establish, exercise, or defend a legal claim;
iv. if you object to the processing but we have to retain your data to ascertain if our legitimate interests override yours.

f) request to receive your personal data or provide them to a third party of your choosing in a structured, commonly used, machine-readable format. This will be carried out only if it is technically possible to do so, if your personal data was processed by automated means, and if the processing was based on your consent or the performance of a contract.

When processing your request, we reserve the right to ask you in ways we deem appropriate for specific information to help us confirm your identity and be reasonably certain that only you can access your personal data and no unauthorized third party can obtain them.

We are committed to accommodating and following up on your request to exercise one or more rights, where possible, within a month of receiving it. Occasionally, but always in compliance with the terms set by the law, we might take longer to process the request if it is particularly complex or if you have submitted several other requests. In those cases, we will let you know and keep you posted.

The processing of your request is free of charge.

However, if your requests are manifestly unfounded, excessive, or repetitive in nature, we reserve the right to:

a) ask you to pay a reasonable fee based on the administrative costs incurred to action your request;
b) refuse to comply with your request.
Finally, you may decide at any time to file a complaint with the Supervisory Authority if you believe that one or more of your rights or any rules of the Regulation have been violated.

You may exercise these rights at any time, by writing to our Data Protection Officer (DPO) to the following addresses:

· by e-mail: dataprivacyofficer@todsgroup.com.
· by post: Data Protection Officer - Tod's S.p.A., Via Filippo Della Valle n. 1, 63811 Sant’Elpidio a Mare (FM) – Italy (EU).

We shall not discriminate against you, neither in service nor in price, if you exercise your privacy rights; any existing relationships with the Tod’s Group shall not be affected.

You can also contact the DPO to request further information or clarification, or to obtain specific information about who is authorized to access your personal data.

From time to time, we may make some changes to this Privacy Policy, for example, to fulfil new requirements set by the applicable legislation, meet technical requirements, or as a result of new services provided on the website or by the Tod’s Group.

We therefore ask that you to visit this page periodically.

Please reference the “LAST UPDATED IN” legend at the top of this page to see when the Privacy Policy herein was last revised.

We may also need to contact you, if legally required, to obtain your consent and allow you to continue to use the services of the Site.

In the event of inconsistencies between the information on the Privacy Policy herein and the other Privacy Policies, provided for you, where we request you to communicate us your personal data, these latter prevail.

“Personal Information and data” as a term generally encompasses any and all information and data identifying you as an individual, and any other information we associate with it.

We collect the identifiers and contact information you choose to provide us with: your name and surname, delivery / invoicing address, e-mail account, and telephone number(s). We shall limit the collection only to the information and data which are essential in order to allow you to successfully purchase products from the E-Store. Should you not provide them, you will not be able to complete the purchase procedure.

Please note that , at any rate, we shall not handle your payment information (your credit card number, for example).

We shall not collect information and data about you from third parties.

We may use your Personal Information and data as permitted by law, for the following business purposes:

• to provide products;
• to communicate with you about, and to process, orders, purchases, returns, delivery, product guarantees and any concerning other communications that may help complete the purchase procedure successfully.

We may also use Personal Information and data as we deem necessary or appropriate for certain essential purposes, including the following:

• complying with the applicable law and legal procedures;
• responding to requests from public and government authorities, including public and government authorities from outside your country of residence;
• detecting, preventing, or investigating potential security incidents or frauds;
• facilitating the functionality of our mobile applications and websites;
• enforcing our terms and conditions;
• protecting our rights, privacy, safety, property or security and/or the rights, privacy, safety property or security of our affiliates, as well as protecting you or other users.

Should you submit any Personal Information and data concerning other people in connection with the E-Store, you represent that you have the authority to do so and to allow us to use the information in accordance with the Privacy Policy herein.

We shall not disseminate your personal information and data.

We shall not sell your personal information and data to third parties.

To the extent permitted by the law and for the purposes described in the Privacy Policy herein, your Personal Information and data may be disclosed to

i. our service providers, included other companies of Tod’s Group, who provide services such as, for example, infrastructure provision, IT services, customer services or logistics and delivery services, email delivery services, electronic payment fraud prevention services (please see https://www.forter.com/service-privacy-policy/), auditing services and other services, in order to enable them to perform their tasks;
ii. our parent company (Tod’s S.p.A.), only if you directly provide it with your explicit consent to do so, for the specific purpose of using your personal information and data (such as a record of your purchases) to provide you with personalised service during your future visits to TOD'S Group shops;
iii. to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any part of our business, assets or stock (including anything related with bankruptcy or similar procedures)
iv. or in connection with the essential purposes described above (e.g., to comply with legal obligations)

We use industry-standard security measures to protect your personal information and data from unauthorised access, public disclosure, use, modification, damage or loss.

We take all reasonable and practicable steps to protect your personal information and data, but unfortunately, no system or network can be guaranteed to be 100% secure. Should you have any reason to believe that your interaction with us is no longer secure, please notify us immediately as per the “Contact Us” section below (please note that notifications by post will increase the time it takes for us to respond to the problem).

We will retain your Personal Information and data for the period necessary to fulfil the purposes outlined in the Privacy Policy herein, unless a longer retention period is required or allowed for legal, auditing, or regulation compliance purposes.

We do not intend to collect personal information from children under the age of 13. If you are a parent or legal guardian and think that your child under 13 has provided us with such information, you can contact us at dataprivacyofficer@todsgroup.com and we will take the appropriate steps. You can also write to us at the address below.

Please identify your inquiries with “COPPA Information Request” as their subject. Parents can learn more about how to protect the privacy of their children online: https://www.consumer.ftc.gov/articles/0031-protecting-your-childs-privacy-online

a. Right to Know: You have the right to request that we disclose certain information to you about our collection of your Personal Information and data during the past 12 months. Once we have received and confirmed your verifiable consumer request, we will disclose to you the following:

• the categories of Personal Information and data we have collected about you;
• the categories of sources for the Personal Information and data we have collected about you;
• our business or commercial purposes for collecting or selling such Personal Information and data;
• the categories of third parties we share such Personal Information and data with;
• the specific Personal Information and data we have collected about you;
• in case we have sold or disclosed your Personal Information and data for business purposes, two separate lists disclosing the specific categories of Personal Information and data:
▪ the sales, and the categories of third parties the information and data were sold to
▪ the disclosures for business purposes, if any, and the category of third parties
▪ the data were disclosed to

We would like to reiterate that we shall not sell your personal information and that we shall not use your personal information and data for marketing purposes and that the sole Personal Information and data we collect are the ones you provided us with.

b. Right To Deletion: You have the right to request that we delete any and all Personal Information and data we collected from you and retained, subject to certain exceptions. Should you ask us to delete or stop using your personal information, we may not be able to comply with such a request, should such information and data be required to process your payments or returns, to fulfil your order, or to comply with fiscal, auditing or regulatory requirements.

c. Right Not To Be Discriminated: You have the right not to be discriminated against in service or price should you exercise your privacy rights, and we will consider you just as much if you do exercise them.

The law also states that the customers have the right to opt out of the sale of their Personal Information and data to third parties, but such a right is not applicable here, as we do not sell your personal information and data.

By the same token, we shall not use your personal information and data for marketing purposes, and that is why you will not find a tool or a button to unsubscribe from marketing emails.

You can exercise such rights through the contact points described in the “Contact us” section of the Privacy Policy herein.

The present section supplements, for the California citizens, what Privacy Policy above describes.

· California “Shine the Light” Law If you are a resident of California, you have the right to ask us once per year for information about the disclosures of personal information and data to third parties for direct marketing purposes during the previous calendar year, if any.

Please, consider that we shall not disclose your personal information and to third parties for their direct marketing purposes.

California Consumer Privacy Act (CCPA) We have explained our privacy practices in full in the other sections of this Privacy Policy. In this section, we provide a list of categories of personal information that have been collected, disclosed for business purposes during the preceding 12 months, as well as certain other kinds of information, as detailed in the CCPA.

We would like to reiterate that we shall not sell your personal information and data and that we shall not use your personal information for marketing purposes.

Identifiers, such as your name, surname, street address, phone number or email address


Category of Personal Information and data

Explanation

Identifiers, such as your name, surname, street address, phone number or email address

We may use such information and data:

- to allow you to successfully purchase products;
- to communicate with you about, and to process, orders, purchases, returns, delivery, product guarantees and for any other communications that may help complete the purchase procedure successfully.

Commercial information, such as a record of your purchases

We may disclose such information to our parent company (Tod’s S.p.A.) but only after you provide us with your explicit consent to do so. In other sections of the website, Tod's S.p.A. will ask for your explicit consent to use your personal information (such as a record of your purchases) to provide you with personalised service during your future visits to the points of sale of TOD'S Group. We will share your personal information and data with our parent company alone after you have provided your consent.

Information about how you may exercise your rights as a California resident can be found in the “Contact Us” section of the Privacy Policy herein.

We may verify your request by asking you to provide information in order to confirm your identity. Such information may vary according to your relationship with us. Should you choose to use an agent registered with the California Secretary of State to exercise your rights, we may request evidence that you have provided such an agent with a power of attorney or that the agent has valid written authority to submit requests to exercise rights on your behalf in any other way. Subject to the applicable law, you may have a right not to be discriminated against for exercising your rights concerning your personal information and data.

We welcome your questions, comments, and concerns about privacy. Should you have any questions about the Privacy Policy or on our data practices, you can contact us as follows:

· you may email us at: dataprivacyofficer@todsgroup.com
· you may call us at the following phone number: (+1) 855-303-3253 (Mon-Fri 9am-6pm EST - Weekends and Holidays excluded)
· you may write to us at the following address: ItalianTouch Ltd., 450 West 15th Street, New York 10011 NY (USA)

We may periodically update the Privacy Policy herein. Please reference the “LAST UPDATE” caption at the top of the page to see when the Privacy Policy herein was last updated. Any changes to the Privacy Policy herein shall become effective when we will post the revised Privacy Policy on our E-Store. Your use of the E-Store following such changes means that you accept the revised Privacy Policy.

The Data Controller of your personal data, which will be processed for the purposes described in the following section, is Tod’s S.p.A. (hereinafter referred to as “Tod’s”, “we”, “us” or “our”), having its registered office in Via Filippo Della Valle, 1, Sant’Elpidio a Mare, (FM) - Italy (EU).

Unless specified otherwise within the Privacy Policy herein, we collect and process the personal data you provide; we shall not obtain your personal data from any third party. “Personal data” pertains to any information concerning an identified or identifiable natural person (the ‘data subject’).

Your personal data (e.g. your name, surname, nationality, e-mail account, telephone number, delivery address, and the like) in order to allow you to create your Personal Account on our Website and make use of the related dedicated services . The list of the services reserved for the owners of Personal Accounts s may change and/or be integrated over time, at the option of the Data Controller.

Some of the personal data we ask you about during the creation of your Personal Account creation are essential for us to fulfil the obligations; failure to disclose certain personal data could prevent you from completing the Personal Account activation procedure and / or, in some cases, prevent you from fully using specific services.

Tod’s S.p.A. shall also process your personal data (such as your name, surname, e-mail account, gender, and the like), with your explicit and specific consent to do so, in order to:

i. perform marketing activities through newsletters, promotions, discounts, incentives, commercial information, and other related marketing schemes, by means of post, phone calls, direct sales, email, automatic voice calls, messaging platforms or SMS/MMS, messages and to send invitations for shows or events, perform market research and send notifications on special initiatives focused on the customers of TOD’S Group. In addition to the email address, in accordance with the marketing procedure that we will adopt, we may use complementary communication channels and tools (such as telephone, post, and the like), corresponding to the contact information you have provided or will provide to us in the future;
ii. perform customer profiling activities, such as analysing your interests and preferences concerning our products and services, and your shopping habits. Also, by looking into the type and frequency of purchases you make online (via your personal account or as guest) and/or at our boutiques/points of sale, we can better guarantee a personalized service for your future visits to the TOD'S Group boutiques. Should you provide your consent for us to process your personal data for profiling purpose, you consent that we can obtain from our local subsidiaries the information concerning the purchases you made at their points of sale. Likewise, if you have also given your consent to the processing of your personal data for marketing purposes, we will be able to send you promotional information and/or invitations to initiatives that best fit your profile, preferences and expectations as a shopper.

Learn more about how we ask for your consent

We will ask you to provide your explicit consent to the processing of your personal data by ticking the specific boxes concerning marketing purposes and profiling purposes. If you

a. tick the corresponding box, we will process your personal data for the chosen purpose (marketing or profiling);
b. don’t’ tick the corresponding box, we will comply with the situation previously in force:
· if you had previously consented to the processing of your personal data (ex through other on-line forms or by means of the coupons available in our boutiques) for such purposes (i.e., marketing or profiling), we will continue to do so;
· if you never consented to the processing your personal data for such specific purposes (i.e., marketing or profiling), we shall not process your personal data for said purposes (i.e., marketing or profiling).

You have the right to withdraw your consent(s) at any time, (also known as the “right to opt-out”), by following the instructions indicated in the Privacy Policy herein.

The provision of any and all personal data is voluntary. However, failure to disclose certain personal data could prevent you from being fully involved in our marketing and profiling initiatives in some cases.

Providing your consent to any such purposes is entirely optional. Likewise, a refusal to provide your consent shall not affect any existing relationship with Tod’s Group, or your Personal Account creation in any way, or with any undergoing relationship with the Company.

Finally, we may also process your personal data in order to comply with any legal obligations that we may have, or to pursue any our legitimate interests (i.e. improving business processes, preventing frauds, exercising and defending a right of ours or optimising our customer contact strategies), in compliance with the conditions and limits set by the legislation currently in force.

We shall process your personal data both by means of paper- and IT-based tools, and such processing shall be based on the principles of fairness, lawfulness, and transparency, in order to protect your rights and privacy.

In particular, the processing of your data, involving profiling purposes as well, may be automated, for example through a comparative analysis of your purchases (by type, quantity, frequency, timing, and the like), and by analysing the type and number of your requests for product information within a given timeframe.

We make use of industry-standard physical, organizational, contractual and technological security measures to protect your personal data from unauthorized access, public disclosure, use, modification, damage or loss.

We take all reasonable and practicable steps to protect your personal information, but unfortunately, no system or network can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Your Rights” section below (note that physical mail notification will delay the time it takes for us to respond to the problem).

We shall not disseminate your personal data.

We will not sell your personal information to third parties.

To the extent permitted by law and where required with your consent, your Personal information may be disclosed, for the purposes described in the Privacy Policy herein:

i. with our service providers, included other companies belonging to Tod’s Group who perform technical and organizational tasks on our behalf, always in compliance with achieving the purposes described above;
ii. with other belonging to Tod’s Group acting on our behalf:

a. in order to involve you in local marketing initiatives (marketing purpose);
b. to provide you with a tailored service and a better purchasing experience when you visit the Tod’s Group shops;
iii. to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other shift in all or in any given part of our business, assets or stock (also in connection with bankruptcy or similar outcomes);
iv. in connection with the essential purposes described above (that is to say in order to comply with legal obligations or to execute a lawful request of public authorities).

Your personal information shall be transferred from your country to our headquarter in Italy. Please, consider that we are subjects to the Regulation (EU) 2016/679, the data protection law applicable in all the EU Member States; which provides a level of personal information protection comparable to that ensured by the U.S. regulatory framework.

Data transfers toward countries outside the European Economic Area (EEA): We guarantee that we shall transfer your personal data towards a country outside the European Economic Area (EEA) not having an Adequacy Decision by the European Commission (EC), only after the adoption of at least one of the cross-border transfer mechanisms the Regulation recognizes as being able to ensure an adequate protection of the personal data being transferred:

i. specific “Standard Contractual Clauses” are to be drafted, issued by the European Commission, in order to ensure that the protection level of the personal data processed by our partners outside the EU shall comply with the EU's data protection level;

ii. adoption of Company Binding Rules, approved by the competent Public Authorities, in compliance with the data transfer within a group of undertakings or enterprises is done through binding corporate rules, approved by the competent data protection authority in the UE, pursuant to the consistency mechanism referred to in art. 63 and to the conditions detailed under art. 47 of the Regulation.

We also undertake to carry out, in accordance with laws in force, any possible prior risk assessment concerning the data transfer; adopting, if necessary, any additional security measures, complementary to the safeguards guaranteed by the aforementioned transfer mechanisms.

At any rate, we shall transfer your personal information, only if the protection level, guarantee by the privacy laws in force in our countries, is not compromised.

Your personal data shall only be processed by parties being duly instructed and able to provide adequate technical and organizational safeguards, as well as bound to the strictest confidentiality by us.

We shall process your personal data at different times depending on the purpose.

Your personal data, processed for the creation of your Personal Account and for the usage of services reserved to the owners of company accounts, shall be retained and processed until you delete your Personal Account. We would like to inform you that your personal data shall be automatically erased (or anonymised) once 7 years have passed since your last interaction with your Personal Account (i.e. when you log in to or update your personal data, place new purchases, and the like).

To learn more about the automatic expiration of your Personal Account

To protect you further, near the end of the 7-year time frame as mentioned above, we will notify you that your account is soon to expire. If you wish to keep your personal account active, you need only to interact with it.

Should you consent to the processing your personal data for marketing purposes, said processing will be performed until your consent withdrawal.

Should you provide your consent to the processing of your personal data for profiling purposes, said processing shall be performed for no longer than 7 years since the date when you provided your consent, and be automatically renewed each time you make a purchase at any boutique/point of sale belonging to Tod’s Group, or at our E-Store.

We would also like to inform you that we are further required to store your personal data in order to comply with specific law provisions, in the manner and within the timeframe established by said regulations.

Should the processing of your personal data be based on any legitimate interest, be it ours or belonging to third parties, the processing of your personal data shall be strictly limited to the time required to achieve the legitimate interest, on a case-by-case basis.

You have the right, as detailed within the law in force, to access your personal data, to correct or update it, to delete or to obtain a copy or the transmission in a structured format to any third party thereof. You may also request to limit or object to such processing.

Concerning the processing of personal data for marketing and/or customer profiling purposes, we would like to stress the fact that you may exercise your right to withdraw the consent you have provided us with at any time.

You may oppose the reception of direct marketing communications (also known as an opt-out) both via automatic means (text messages, MMS, messaging platforms, e-mail messages and push notifications) and traditional means (such as post, phone calls by operators) without prejudice to your possibility of exercising this right only in part, i.e. by opposing only to receive promotional communications via automatic tools at any time.

You may exercise these rights at any time, by writing to our Data Protection Officer (DPO) to the following addresses:

· by e-mail: dataprivacyofficer@todsgroup.com.
· by post: Data Protection Officer - Via Filippo Della Valle n. 1, 63811 Sant’Elpidio a Mare (FM) – Italy (EU).

To learn more about how you can manage your consents (also known as opt-out)

Without prejudice to your right to withdraw (also known as an opt-out) the consent to the processing of your personal data for marketing and/or profiling activities by writing to the aforementioned addresses, please note that each marketing communication contains tools that you can use to:

i. inhibit the contact-channel (e.g., e-mail and SMS messages) by means of the which our marketing communications are sent;
ii. withdraw your consent (also known as an opt-out) to the processing of your personal data for marketing purposes. In such cases, we shall not send advertising and/or promotional communication to you anymore and any and all newsletters related to any brand of the Tod's Group shall be automatically disabled;
iii. withdraw your consent to the profiling activities.

Moreover, every newsletter of ours features a tool by means of which you can unsubscribe from it. In so doing, you shall no longer receive the periodical newsletter, but you will keep receiving our other marketing updates.

We would like to point out that we shall not discriminate against you, should you exercise one or more privacy rights acknowledged within the legislation; any existing relationships with the Tod’s Group, or your Personal Account creation, or the usage of the services thereof, shall not be affected.

We will make sure to comply with your request to exercise your rights, always within the terms of the law.

We shall retain the right to ask you, in the ways we deem appropriate, for specific information to help us confirm your identity and be reasonably certain that only you can access your personal data and no unauthorized third party can seize, change or delete them. The processing of your request is free of charge. However, should your requests be manifestly unfounded, excessive, or repetitive in nature, we shall retain the right to refuse to comply with them or to request suitable economic contributions for them.

We would like to stress the fact that we do not sale your personal information, for this reason is not available a feature by means of the which to inhibit the sale of your personal information.

Remember that you can file a complaint with the Supervisory Authority if you believe that we have violated any rules concerning the protection of personal data.

We may periodically update the Privacy Policy herein. Please reference the “LAST UPDATED IN” legend at the top of this page to see when the Privacy Policy herein was last revised.

“Personal Information and data” as a term generally encompasses any and all information and data identifying you as an individual, and any other information we associate with it.

We collect the identifiers and contact information you choose to provide us with: your name and surname, delivery / invoicing address, e-mail account, and telephone number(s). We shall limit the collection only to the information and data which are essential in order to allow you to successfully purchase products from the E-Store. Should you not provide them, you will not be able to complete the purchase procedure.

Please note that , at any rate, we shall not handle your payment information (your credit card number, for example).

We shall not collect information and data about you from third parties .

We may use your Personal Information and data as permitted by law, for the following business purposes:

• to provide products;
• to communicate with you about, and to process, orders, purchases, returns, delivery, product guarantees and any concerning other communications that may help complete the purchase procedure successfully.

We may also use Personal Information and data as we deem necessary or appropriate for certain essential purposes, including the following:

• complying with the applicable law and legal procedures;
• responding to requests from public and government authorities, including public and government authorities from outside your country of residence;
• detecting, preventing, or investigating potential security incidents or frauds;
• facilitating the functionality of our mobile applications and websites;
• enforcing our terms and conditions;
• protecting our rights, privacy, safety, property or security and/or the rights, privacy, safety property or security of our affiliates, as well as protecting you or other users.

Should you submit any Personal Information and data concerning other people in connection with the E-Store, you represent that you have the authority to do so and to allow us to use the information in accordance with the Privacy Policy herein.

We shall not disseminate your personal information and data.

We shall not sell your personal information and data to third parties.

To the extent permitted by the law and for the purposes described in the Privacy Policy herein, your Personal Information and data may be disclosed to

i. our service providers, included other companies of Tod’s Group, who provide services such as, for example, infrastructure provision, IT services, customer services or logistics and delivery services, email delivery services, electronic payment fraud prevention services (please see https://www.forter.com/service-privacy-policy/), auditing services and other services, in order to enable them to perform their tasks;
ii. our parent company (Tod’s S.p.A.), only if you directly provide it with your explicit consent to do so, for the specific purpose of using your personal information and data (such as a record of your purchases) to provide you with personalised service during your future visits to TOD'S Group shops;
iii. to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other disposition of all or any part of our business, assets or stock (including anything related with bankruptcy or similar procedures)
iv. or in connection with the essential purposes described above (e.g., to comply with legal obligations)

We use industry-standard security measures to protect your personal information and data from unauthorised access, public disclosure, use, modification, damage or loss. We take all reasonable and practicable steps to protect your personal information and data, but unfortunately, no system or network can be guaranteed to be 100% secure. Should you have any reason to believe that your interaction with us is no longer secure, please notify us immediately as per the “Contact Us” section below (please note that notifications by post will increase the time it takes for us to respond to the problem).

We will retain your Personal Information and data for the period necessary to fulfil the purposes outlined in the Privacy Policy herein, unless a longer retention period is required or allowed for legal, auditing, or regulation compliance purposes.

We do not intend to collect personal information from children under the age of 13. If you are a parent or legal guardian and think that your child under 13 has provided us with such information, you can contact us at dataprivacyofficer@todsgroup.com and we will take the appropriate steps. You can also write to us at the address below.

Please identify your inquiries with “COPPA Information Request” as their subject. Parents can learn more about how to protect the privacy of their children online: https://www.consumer.ftc.gov/articles/0031-protecting-your-childs-privacy-online

a. Right to Know: You have the right to request that we disclose certain information to you about our collection of your Personal Information and data during the past 12 months. Once we have received and confirmed your verifiable consumer request, we will disclose to you the following:

• the categories of Personal Information and data we have collected about you;
• the categories of sources for the Personal Information and data we have collected about you;
• our business or commercial purposes for collecting or selling such Personal Information and data;
• the categories of third parties we share such Personal Information and data with;
• the specific Personal Information and data we have collected about you;
• in case we have sold or disclosed your Personal Information and data for business purposes, two separate lists disclosing the specific categories of Personal Information and data:
▪ the sales, and the categories of third parties the information and data were sold to
▪ the disclosures for business purposes, if any, and the category of third parties
▪ the data were disclosed to

We would like to reiterate that we shall not sell your personal information and that we shall not use your personal information and data for marketing purposes and that the sole Personal Information and data we collect are the ones you provided us with.

b. Right To Deletion: You have the right to request that we delete any and all Personal Information and data we collected from you and retained, subject to certain exceptions. Should you ask us to delete or stop using your personal information, we may not be able to comply with such a request, should such information and data be required to process your payments or returns, to fulfil your order, or to comply with fiscal, auditing or regulatory requirements.

c. Right Not To Be Discriminated: You have the right not to be discriminated against in service or price should you exercise your privacy rights, and we will consider you just as much if you do exercise them.

The law also states that the customers have the right to opt out of the sale of their Personal Information and data to third parties, but such a right is not applicable here, as we do not sell your personal information and data.

By the same token, we shall not use your personal information and data for marketing purposes, and that is why you will not find a tool or a button to unsubscribe from marketing emails.

You can exercise such rights through the contact points described in the “Contact us” section of the Privacy Policy herein.

The present section supplements, for the California citizens, what Privacy Policy above describes.

· California “Shine the Light” Law If you are a resident of California, you have the right to ask us once per year for information about the disclosures of personal information and data to third parties for direct marketing purposes during the previous calendar year, if any.

Please, consider that we shall not disclose your personal information and to third parties for their direct marketing purposes.

California Consumer Privacy Act (CCPA) We have explained our privacy practices in full in the other sections of this Privacy Policy. In this section, we provide a list of categories of personal information that have been collected, disclosed for business purposes during the preceding 12 months, as well as certain other kinds of information, as detailed in the CCPA.

We would like to reiterate that we shall not sell your personal information and data and that we shall not use your personal information for marketing purposes.

Identifiers, such as your name, surname, street address, phone number or email address


Category of Personal Information and data

Explanation

Identifiers, such as your name, surname, street address, phone number or email address

We may use such information and data:

- to allow you to successfully purchase products;
- to communicate with you about, and to process, orders, purchases, returns, delivery, product guarantees and for any other communications that may help complete the purchase procedure successfully.

Commercial information, such as a record of your purchases

We may disclose such information to our parent company (Tod’s S.p.A.) but only after you provide us with your explicit consent to do so. In other sections of the website, Tod's S.p.A. will ask for your explicit consent to use your personal information (such as a record of your purchases) to provide you with personalised service during your future visits to the points of sale of TOD'S Group. We will share your personal information and data with our parent company alone after you have provided your consent.

Information about how you may exercise your rights as a California resident can be found in the “Contact Us” section of the Privacy Policy herein.

We may verify your request by asking you to provide information in order to confirm your identity. Such information may vary according to your relationship with us. Should you choose to use an agent registered with the California Secretary of State to exercise your rights, we may request evidence that you have provided such an agent with a power of attorney or that the agent has valid written authority to submit requests to exercise rights on your behalf in any other way. Subject to the applicable law, you may have a right not to be discriminated against for exercising your rights concerning your personal information and data.

The Data Controller of your personal data, which will be processed for the purposes described in the following section, is Tod’s S.p.A. (hereinafter referred to as “Tod’s”, “we”, “us” or “our”), having its registered office in Via Filippo Della Valle, 1, Sant’Elpidio a Mare, (FM) - Italy (EU).

Unless specified otherwise within the Privacy Policy herein, we collect and process the personal data you provide; we shall not obtain your personal data from any third party. “Personal data” pertains to any information concerning an identified or identifiable natural person (the ‘data subject’).

Your personal data and information (e.g. your name, surname, e-mail address, telephone number, and the like), shall be processed in order to provide you with feedback to your contact request and provide you with the support you need.

Any and all personal data and information we require when you fill in the online form and/or which will be requested by our operators are essential to the processing of your request; therefore, your failure to communicate such information may prevent us from going through with your request for support.

Finally, we reserve the right process your personal data in order to comply with any legal obligations we may be subject, or to pursue any legitimate interest, be it ours or belonging to third parties (i.e. optimising the customer care service, preventing frauds, exercising and defending a right of ours or improving the business processes), in compliance with the conditions and limits set by the legislation currently in force.

We shall process your personal data both by means of paper- and IT-based tools, and such processing shall be based on the principles of fairness, lawfulness, and transparency, in order to protect your rights and privacy.

We make use of industry-standard physical, organizational, contractual and technological security measures to protect your personal data from unauthorized access, public disclosure, use, modification, damage or loss.

We take all reasonable and practicable steps to protect your personal information, but unfortunately, no system or network can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Your Rights” section below (note that physical mail notification will delay the time it takes for us to respond to the problem).

We shall not disseminate your personal data.

We will not sell your personal information to third parties.

To the extent permitted by law and where required with your consent, your Personal information may be disclosed, for the purposes described in the Privacy Policy herein:

i. to our service providers, including other companies of Tod’s Group, performing technical and organizational tasks on our behalf (i.e. IT support services , delivery and logistics services, customer support, processing, or hosting services, etcetera);
ii. to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other shift in all or in any given part of our business, assets or stock (also in connection with bankruptcy or similar outcomes);
iii. in connection with the essential purposes described above (that is to say in order to comply with legal obligations or to execute a lawful request of public authorities).

Your personal information shall be transferred from your country to our headquarter in Italy. Please, consider that we are subjects to the Regulation (EU) 2016/679, the data protection law applicable in all the EU Member States; which provides a level of personal information protection comparable to that ensured by the U.S. regulatory framework.

Data transfers toward countries outside the European Economic Area (EEA): We guarantee that we shall transfer your personal data towards a country outside the European Economic Area (EEA) not having an Adequacy Decision by the European Commission (EC), only after the adoption of at least one of the cross-border transfer mechanisms the Regulation recognizes as being able to ensure an adequate protection of the personal data being transferred:

i. specific “Standard Contractual Clauses” are to be drafted, issued by the European Commission, in order to ensure that the protection level of the personal data processed by our partners outside the EU shall comply with the EU's data protection level;
ii. adoption of Company Binding Rules, approved by the competent Public Authorities, in compliance with the data transfer within a group of undertakings or enterprises is done through binding corporate rules, approved by the competent data protection authority in the UE, pursuant to the consistency mechanism referred to in art. 63 and to the conditions detailed under art. 47 of the Regulation.

We also undertake to carry out, in accordance with laws in force, any possible prior risk assessment concerning the data transfer; adopting, if necessary, any additional security measures, complementary to the safeguards guaranteed by the aforementioned transfer mechanisms.

At any rate, we shall transfer your personal information, only if the protection level, guarantee by the privacy laws in force in our countries, is not compromised.

Your personal data shall only be processed by parties being duly instructed and able to provide adequate technical and organizational safeguards, as well as bound to the strictest confidentiality by us.

We shall process your personal data at different times depending on the purpose.

We will process your personal data for the period strictly necessary to follow through with your support request and to perform any task and operation arising from your request.

We would also like to inform you that we are further required to store your personal data in order to comply with specific law provisions, in the manner and within the timeframe established by said regulations.

Should the processing of your personal data be based on any legitimate interest, be it ours or belonging to third parties, the processing of your personal data shall be strictly limited to the time required to achieve the legitimate interest, on a case-by-case basis.

You have the right, as detailed within the law in force, to access your personal data, to correct or update it, to delete or to obtain a copy or the transmission in a structured format to any third party thereof. You may also request to limit or object to such processing.

You may exercise these rights at any time, by writing to our Data Protection Officer (DPO) to the following addresses:

· by e-mail: dataprivacyofficer@todsgroup.com.
· by post: Data Protection Officer - Tod's S.p.A., Via Filippo Della Valle n. 1, 63811 Sant’Elpidio a Mare (FM) – Italy (EU).

We would like to point out that, should you exercise one or more of the privacy rights acknowledged by the relevant legislation we shall not discriminate against you, and such activities shall have no impact on the support services given, nor on any relationship of yours with Tod’s Group. We will make sure to comply with your request to exercise your rights, always within the terms of the law. We shall retain the right to ask you, in the ways we deem appropriate, for specific information to help us confirm your identity and be reasonably certain that only you can access your personal data and no unauthorized third party can seize, change or delete them. The processing of your request is free of charge. However, should your requests be manifestly unfounded, excessive, or repetitive in nature, we shall retain the right to refuse to comply with them or to request suitable economic contributions for them. We would like to stress the fact that we do not sale your personal information, for this reason is not available a feature by means of the which to inhibit the sale of your personal information.

Remember that you can file a complaint with the Supervisory Authority if you believe that we have violated any rules concerning the protection of personal data.

We may periodically update the Privacy Policy herein. Please reference the “LAST UPDATED IN” legend at the top of this page to see when the Privacy Policy herein was last revised.

The Data Controller of your personal data, which will be processed for the purposes described in the following section, is Tod’s S.p.A. (hereinafter referred to as “Tod’s”, “we”, “us” or “our”), having its registered office in Via Filippo Della Valle, 1, Sant’Elpidio a Mare, (FM) - Italy (EU).

Unless specified otherwise within the Privacy Policy herein, we collect and process the personal data you provide; we shall not obtain your personal data from any third party. “Personal data” pertains to any information concerning an identified or identifiable natural person (the ‘data subject’).

We shall process your personal data (i.e. your name, surname, e-mail address, telephone number, and the like) to fulfil our commitments and to allow you the usage of the Services you requested. We would like to point out that the services available on our Website may change based on the individual Country.

The provision of any personal data is voluntary. However, failure to disclose certain personal data could prevent you from partially or fully using Service.

Any and all further processing of your personal data, performed by the point of sale you selected, both preparatory and related to the purchase of Tod’s Group products shall be carried out by each retail company of Tod's Group, which, in its role as the Data Controller will provide you with, the necessary information concerning your privacy and the processing of your personal data.

Whenever, a service is provided through the use of communication channels such as messaging APPS (such as WhatsApp, WeChat, Telegram, and the like), we kindly invite you to read the privacy policy of the messaging platform in use as well.

Finally, we reserve the right to process your personal data in order to comply with any legal obligations that we may be subject to, or to pursue any legitimate interest be it ours or belonging to third parties, (i.e. improving the services-providing process, preventing frauds, exercising and defending a right of ours or improving the interactions with our customers), in compliance with the conditions and limits set by the legislation currently in force.

We shall process your personal data both by means of paper- and IT-based tools, and such processing shall be based on the principles of fairness, lawfulness, and transparency, in order to protect your rights and privacy.

We make use of industry-standard physical, organizational, contractual and technological security measures to protect your personal data from unauthorized access, public disclosure, use, modification, damage or loss.

We take all reasonable and practicable steps to protect your personal information, but unfortunately, no system or network can be guaranteed to be 100% secure. If you have reason to believe that your interaction with us is no longer secure, please immediately notify us in accordance with the “Your Rights” section below (note that physical mail notification will delay the time it takes for us to respond to the problem).

We shall not disseminate your personal data.

We will not sell your personal information to third parties.

To the extent permitted by law and where required with your consent, your Personal information may be disclosed, for the purposes described in the Privacy Policy herein:

i. to our service providers, including other companies of Tod’s Group, performing technical and organizational tasks on our behalf (i.e. IT support services , delivery and logistics services, customer support, processing, or hosting services, etcetera);
ii. local retailer companies belonging to Tod's group, who carry out, on our behalf, one or more steps of the Service you have subscribed to;
iii. to a third party in the event of any reorganization, merger, sale, joint venture, assignment, transfer or other shift in all or in any given part of our business, assets or stock (also in connection with bankruptcy or similar outcomes);
iv. in connection with the essential purposes described above (that is to say in order to comply with legal obligations or to execute a lawful request of public authorities).

Your personal information shall be transferred from your country to our headquarter in Italy. Please, consider that we are subjects to the Regulation (EU) 2016/679, the data protection law applicable in all the EU Member States; which provides a level of personal information protection comparable to that ensured by the U.S. regulatory framework.

Data transfers toward countries outside the European Economic Area (EEA): We guarantee that we shall transfer your personal data towards a country outside the European Economic Area (EEA) not having an Adequacy Decision by the European Commission (EC), only after the adoption of at least one of the cross-border transfer mechanisms the Regulation recognizes as being able to ensure an adequate protection of the personal data being transferred:

i. specific “Standard Contractual Clauses” are to be drafted, issued by the European Commission, in order to ensure that the protection level of the personal data processed by our partners outside the EU shall comply with the EU's data protection level;
ii. adoption of Company Binding Rules, approved by the competent Public Authorities, in compliance with the data transfer within a group of undertakings or enterprises is done through binding corporate rules, approved by the competent data protection authority in the UE, pursuant to the consistency mechanism referred to in art. 63 and to the conditions detailed under art. 47 of the Regulation.

We also undertake to carry out, in accordance with laws in force, any possible prior risk assessment concerning the data transfer; adopting, if necessary, any additional security measures, complementary to the safeguards guaranteed by the aforementioned transfer mechanisms.

At any rate, we shall transfer your personal information, only if the protection level, guarantee by the privacy laws in force in our countries, is not compromised.

Your personal data shall only be processed by parties being duly instructed and able to provide adequate technical and organizational safeguards, as well as bound to the strictest confidentiality by us.

The Company shall process your personal data for different lengths of time depending on different purposes of the processing and on the kind of Service you have subscribed to.

We shall process your personal information and data only for the period being strictly necessary to fulfil the commitments we have taken as you have subscribed to the Service.

We would also like to inform you that we are further required to store your personal data in order to comply with specific law provisions, in the manner and within the timeframe established by said regulations.

Should the processing of your personal data be based on any legitimate interest, be it ours or belonging to third parties, the processing of your personal data shall be strictly limited to the time required to achieve the legitimate interest, on a case-by-case basis.

You have the right, as detailed within the law in force, to access your personal data, to correct or update it, to delete or to obtain a copy or the transmission in a structured format to any third party thereof. You may also request to limit or object to such processing.

You may exercise these rights at any time, by writing to our Data Protection Officer (DPO) to the following addresses:

· by e-mail: dataprivacyofficer@todsgroup.com.
· by post: Data Protection Officer - Tod's S.p.A., Via Filippo Della Valle n. 1, 63811 Sant’Elpidio a Mare (FM) – Italy (EU).

We would like to point out that, should you exercise one or more of the privacy rights acknowledged by the relevant legislation we shall not discriminate against you, and such activities shall have no impact on the services provided, nor on any relationship of yours with Tod’s Group.

We will make sure to comply with your request to exercise your rights, always within the terms of the law.

We shall retain the right to ask you, in the ways we deem appropriate, for specific information to help us confirm your identity and be reasonably certain that only you can access your personal data and no unauthorized third party can seize, change or delete them. The processing of your request is free of charge. However, should your requests be manifestly unfounded, excessive, or repetitive in nature, we shall retain the right to refuse to comply with them or to request suitable economic contributions for them.

We would like to stress the fact that we do not sale your personal information, for this reason is not available a feature by means of the which to inhibit the sale of your personal information.

Remember that you can file a complaint with the Supervisory Authority if you believe that we have violated any rules concerning the protection of personal data.

We may periodically update the Privacy Policy herein. Please reference the “LAST UPDATED IN” legend at the top of this page to see when the Privacy Policy herein was last revised.

The Data Controller is Tod’s S.p.A., with registered office at Via Filippo Della Valle, 1 - 63811 Sant’Elpidio a Mare (FM) – Italy (EU).

The personal data you are communicating to us (email address) will be processed only for the purpose of providing the Service for which you are registering, which, if you saved one or more products in your “virtual cart” in our e-store without completing the checkout process, includes sending 2 communications in the following 30 days to the email address you provided to remind you to complete the purchasing process you began whenever you find it convenient.

Your personal information will not be sold or transferred to third parties.

Your personal information will not be distributed or sold to third parties.

We may share your personal data, within the limits of the purposes described above, with other companies in the Tod’s Group, based in the United States and in Europe.

Your personal information may be communicated to companies, entities or consortia that perform technical and organizational tasks we assign to them consistent with and aimed at the provision of the Service.

Every transfer of your personal information outside the United States or outside the European Economic Area (EEA) will take place only if the degree of protection guaranteed by this privacy policy will not be compromised.

Your personal information will not be distributed or sold to third parties.

We may share your personal data, within the limits of the purposes described above, with other companies in the Tod’s Group, based in the United States and in Europe.

Your personal information may be communicated to companies, entities or consortia that perform technical and organizational tasks we assign to them consistent with and aimed at the provision of the Service.

Every transfer of your personal information outside the United States or outside the European Economic Area (EEA) will take place only if the degree of protection guaranteed by this privacy policy will not be compromised.

Processing will take place using data transmission and computer equipment; this processing will be conducted according to the principles of fairness, legality, transparency and protection of your rights and your privacy. Your personal data will be processed in such a way as to reduce to a minimum risks of destruction, loss, unauthorized access or processing not allowed or inconsistent with the purposes for which it was collected.

You have the right to access your personal information and to have it corrected, supplemented or deleted; you can limit its processing or entirely withdraw your consent for processing.

You may exercise these rights at any time by writing to our Data Protection Officer (DPO) at the following email address: dataprivacyofficer@todsgroup.com.

Finally, we remind you that you can submit a complaint to the supervisory authorities when you believe that there has been a violation of privacy laws on our part.

California Consumer Privacy Act (CCPA)

If you are a citizen living in California, the processing of your personal information is subject to the CCPA, which grants you the following rights:

· Access/Right to Know. You have the right to obtain the following information:

The types and specific personal information we collected regarding you in the last 12 months.

- The types of sources from which we are collecting your personal information,

- The purposes of this collection, the use of your personal information and whether it has been sold to third parties;

- The types of third parties with which we are sharing your personal information,

- The types of personal information we have disclosed for commercial purposes.

· Right to Delete. You have the right to ask us to delete your personal information. In some circumstances, we may not be able to honor your request for deletion - for example, if we must keep your information to protect the security and functionality of our operations, or if we must comply with legal obligations;

· Right to Opt-Out from Sales. These are not applicable as your personal information will not be sold or transferred to third parties.

You have the right to designate your representative to exercise the rights indicated above. We will not deny services, charge different prices, offer a different quality of service or otherwise discriminate against a user for exercising the rights provided by the CCPA.