PRIVACY POLICY

WEBSITE PRIVACY POLICY

The security of your personal data is very important for Etro S.p.A., which is why we pay the utmost attention to the collection and management of the personal data that you provide us with or that we will automatically acquire during your consultation and/or registration and/or visit on the "etro.com" website (hereinafter also referred to as the "Site") and/or use of related services - regardless of the purchase of products - by adopting specific technical and organizational measures to ensure security, confidentiality and integrity, in accordance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the "Regulation") and any specific local regulations applicable to the protection of personal data (hereinafter collectively referred to as the "Relevant Privacy Legislation").

Whenever you are required to provide your personal data in the sections dedicated to the Site’s services, you will be provided with the necessary additional information and your consent will be collected at the same time where these so require, to allow you to assess whether or not to proceed with the communication of your personal data for the processing purposes indicated at any time.

We inform you that this Privacy Policy concerns only the Site and not the other websites that you may consult through other links.

We would also like to point out that the protection of the safety and privacy of minors is very important to Etro S.p.A., therefore we do not intend to voluntarily collect and do not intend to use personal data of persons under sixteen (16) years of age, or under any other limit imposed by the legislation in force in your country of residence.

We therefore ask you to refrain from providing us with any of your personal information if you are under 16 years of age or under the age of majority in your country of residence.

This Privacy Policy can be easily consulted, as it is accessible from the home page of the Site and through links from any other of its pages, where personal data is collected.

1. DATA CONTROLLER

The controller of your personal data collected through the Website is Etro S.p.A. (Tax code and VAT No. 11905330962) with registered office at Via Spartaco No. 3, 20135 Milan; telephone: +39 02 550201, fax: +39 02550208363 and email privacy@etro.com (“Etro” and/or the “Data Controller”).

2. CATEGORY OF PERSONAL DATA PROCESSED

2.1 Data automatically acquired by the Site

When consulting and/or visiting the pages of our Site, your personal data will be automatically acquired and specifically:

(i) Navigation data: the computer systems and software procedures used to operate the Site acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols.

TO LEARN MORE

Navigation Data

This information is not collected to be associated with you, but by its very nature could, through processing and association with data held by third parties, allow your identification. This category of data includes IP addresses or domain names of the computers used for browsing and connecting to the Sites, URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the operating system and computer environment.

These data are not disclosed, but are used only to obtain anonymous statistical information on the use of the Site and to check its correct functioning and are retained for the periods defined by the relevant legislation. The data could, however, be used to assess liability in the event of hypothetical computer crimes against the Site. Except in the latter case, such data shall not last for more than thirty days.

We also invite you to view our Cookie Policy

(ii) Log files of traffic generated on the network by Etro's computer systems (e.g., relating to the registration and management of your personal account, wish list management; purchase history).

(iii) Etro product sales data: purchase method, type, quantity and price of Etro products purchased.

2.2 Data voluntarily provided by you

To allow you to use the various services offered by the Site, we will ask you to provide us with your personal data, such as biographical data, contact details (telephone contacts, e-mail account, home or residence address and password), payment method data, information on purchases and transactions.

2.3 Personal data of third parties

Should Etro process personal data of third parties disclosed directly by you (for example, if you have purchased a product to be delivered to a different person or if the person paying the price for the purchase of the product is different from the person for whom the product is intended, or if you intend to recommend a service on the Site to a friend), you acknowledge that in this case you are the data controller of the personal data of the abovementioned third parties. Therefore, by providing such personal data of third parties to Etro, you guarantee that: (a) the personal data that may be disclosed by you to Etro have been processed by you in compliance with the provisions of the Relevant Privacy Legislation in force and (b) the abovementioned third parties have been previously and duly informed by you of the methods and purposes of processing and have authorised such processing. You will therefore remain the one and only person liable for the communication of information and data relating to third parties without their consent or for their possible incorrect or unlawful use.

3. PURPOSES AND LEGAL BASIS OF THE PROCESSING

Whenever we acquire and process your personal data, this will be done exclusively in accordance with the principles of lawfulness provided for by law, in order to:

i. establish, perform, manage the contractual relationship and/or to provide the services connected to the contractual relationship itself (i.e., issuing invoices and credit notes; management of customer records; processing and shipping of purchase orders; IT assistance on the use of the Site; request to be contacted and after-sales service: management of returns and any complaints; contact with customer service) as well as for the possible assessment of liability in the event of hypothetical computer crimes or to assert a right in court. In this case, the legal basis for the processing of personal data for the abovementioned purposes is the contractual relationship to which you are a party;

ii. allow you to register on the Site and ensure that you navigate the areas of the Site correctly. In this case, the legal basis for the processing of personal data for the abovementioned purposes is the contractual relationship to which you are a party;

iii. conduct marketing activities. In this case the legal basis for the processing is your prior explicit consent;

TO LEARN MORE

Marketing Purposes

Marketing activities can be performed through the sending of newsletters, promotions, discounts, discounts, commercial information and other dedicated services, through paper mail, calls with operators, direct sales, or through e-mail, pre-registered calls and SMS/MMS/smart messages. In this context, we may also process your personal data in order to invite you to participate in events and shows, to involve you in market research or to inform you about special initiatives dedicated to Etro customers, using the methods and periods we deem most effective according to the various initiatives mentioned.

iv. conduct profiling activities. In this case, the legal basis for the processing is Etro's legitimate interest in knowing your preferences to better customise its offers and therefore offer you products and services that better meet your needs and desires. Etro points out that, following the outcome of the balancing test on legitimate interests, it has assessed that its legitimate interest does not outweigh any interest or fundamental rights and freedoms of the data subject. It is understood that you may at any time request information from Etro regarding the balancing test performed, following the procedures indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information";

To learn more

Profiling purposes

Profiling activities can take the form of the creation of profiles by analysing information regarding your interests and preferences concerning our products and services and your consumption choices, for example by identifying the type and frequency of purchases made by you on the Site both through your personal account and in "guest" mode and/or at Etro boutiques, to guarantee you a personalised service for your future purchases.

If you have also given your consent to the processing of your personal data for marketing purposes, this will allow us to send you promotions and/or invitations to initiatives more in line with your profile, your preferences and your expectations.

v. comply with Etro's legal obligations under civil, tax and accounting rules. In this case, the legal basis for the processing is the legal obligation.

4. PROCESSING METHODS

The processing will be conducted with the help of electronic, paper and computerised tools; this processing will be based on the principles of lawfulness, fairness and transparency and protection of your rights and your privacy. Specifically, your data may be processed, for profiling purposes as well, using automated tools, for example through the comparison and comparative analysis of your purchase choices (type, quantity, frequency, etc.), during a given period and/or season and through the analysis of the type and number of your requests for information on products made in a predetermined time horizon. In this regard, user and customer behaviour will be studied in a way that is not invasive of the personal sphere.

Your personal data will be processed specifically through Etro's Customer Relationship Management ("Etro CRM") whose servers are located in the EU. Entering your personal data in the Etro CRM for the marketing purposes referred to in paragraph 3(iii) above is optional and occurs only if you give your consent to the pursuit of this purpose. For the pursuit of further purposes, entering your data in the Etro CRM will be automatic and necessary to allow the Data Controller to correctly manage and perform the contractual relationship to which you are a party as well as to best meet your needs and desires. Once your personal data have been entered in the Etro CRM, they may be read, modified and updated by employees of Etro offices and by employees of Etro stores in Italy and abroad, who have been expressly appointed as data processors.

The data will be processed in such a way as to minimize the risks of destruction, loss, unauthorised access or processing that is not permitted or does not comply with the purposes of collection.

5. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA OF THE DATA SUBJECT - CONSEQUENCES OF ANY REFUSAL

The provision to Etro of your personal data requested through the Site, even on the various occasions of collection, may be necessary to pursue the purposes identified in the specific privacy policy, or optional.

The provision of personal data by you to perform and manage the contractual relationship, to register on the Site and for the related navigation as well as to fulfil the legal obligations under paragraphs 3(i) and 3(ii) and 3(v) is optional, however, failure to provide such data will make it impossible to register on the Site, to establish and/or continue the contractual relationship and/or to provide the services related to the abovementioned relationship.

The provision of your personal data for the marketing and profiling purposes referred to in paragraphs 3(iii) and 3(iv) is optional and failure to provide them will have no effect on the possibility of registering on the Site and/or purchasing products and/or receiving services requested, but it will not be possible to inform you about promotional and commercial initiatives and send invitations to events or evaluate your interests and preferences.

It should also be noted that where you have given your consent to authorise the Data Controller to pursue the marketing purposes referred to in paragraph 3(iii) above, you will in any case be free at any time - by sending a clear written communication to the contact details specified in greater detail in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information" below - to withdraw your consent and/or object to the processing of your data for the abovementioned purpose, even if only for the contact methods and, for example, where you wish the processing to be performed solely with traditional contact methods, you may object to the processing of your personal data through automated contact methods.

6. SCOPE OF COMMUNICATION AND TRANSFER OF DATA OUTSIDE THE EU

6.1. Internal and external communication of personal data

Your personal data will not be disclosed.

Your personal data may be disclosed only for the purposes described above.

Your personal data can be accessed, according to the criteria of necessity, by Etro staff duly authorised and instructed in writing (such as CRM, Digital, Retail, IT staff).

Your personal data may be disclosed to third parties such as:

- governmental authorities for tax and financial audits, judicial authorities and/or public bodies for legal and regulatory provisions and/or specific requests by the abovementioned governmental entities;

- providers of services such as technical and IT services, shipping companies, marketing companies, remote electronic payment management providers. In this case, the abovementioned providers - to whom only the data necessary to perform the agreed services will be disclosed - will process the data as data processors and therefore on the basis of the instructions provided in writing by Etro;

- companies of the Etro Group as data processors;

- legal, tax and accounting consultants.

For a complete and updated list of the entities to whom the data are disclosed you can contact us by following the indications given in paragraph 9 below "Contacts for the exercise of the rights of the data subject and for further information".

6.2 Transfer of data outside the EU

Your data will not be transferred outside the European Economic Area. Should your personal data be transferred outside the European Economic Area, this will only be done if the level of protection of your personal data is adequate in accordance with the Relevant Privacy Legislation.

TO LEARN MORE

International Transfers

Should it become necessary to transfer your personal data outside the European Economic Area (EEA), to companies of the Etro Group and/or to third parties that perform, on our behalf, technical and organisational tasks consistent with the pursuit of the purposes for which your data was collected and processed, this will only take place if it is possible to guarantee a level of data protection equivalent to that of the European Community. We ensure, in fact, that your personal data will only be transferred with adequate guarantees, as provided for in the Regulations:

• transfer of your personal data to countries whose level of data protection has been recognised as adequate by the European Commission. For more information please consult the European Commission page: “Adequacy of the protection of personal data in non-EU countries”;

• provision of specific Standard Contractual Clauses (EU-type Clauses), approved by the European Commission, to ensure that the processing carried out outside the European Economic Area (EEA) by our providers and/or companies of the Etro Group, offer guarantees to protect your personal data that comply with those carried out within the territory of the European Union. For more information please consult the European Commission page: "Model contracts for the transfer of personal data to third countries";

• transfer of your personal data to partners based in the United States of America, only if they have joined the "EU-US Privacy Shield", which guarantees levels of protection of personal data that comply with those provided by the European Union.

For further information on the guarantees protecting your personal data, which may be transferred outside the European Economic Area, and to obtain further information on the specific mechanism used for the transfer of personal data outside the European Economic Area, please contact us by following the instructions provided in paragraph 9 below "Contacts for the exercise of the rights of the data subject and for further information".

In any case, your data will be processed only by persons duly instructed and able to provide adequate technical and organisational protection, and bound to the utmost confidentiality by the Data Controller.

7. DURATION OF THE PROCESSING

The Company will process your personal data for variable periods according to the different purposes of processing. We will, in any case, keep your personal data only for the period strictly necessary to achieve the purposes for which the data were collected and processed, without prejudice to the need for further storage in connection with specific legal provisions.

TO LEARN MORE

Data retention

Data collected and processed for marketing purposes: 7 years from the date of your consent and registration in the Etro CRM, after this period of time they will be rendered irreversibly and permanently anonymous.
Data collected and processed for profiling purposes: 7 years from the date of collecting your data and from when they are uploaded in the Etro CRM, after this period of time they will be rendered irreversibly and permanently anonymous.
Data collected and processed to establish, perform, manage the business relationship and/or to provide services related to the contractual relationship: for the entire duration of the contractual relationship and for a period of 10 years after the termination of the business relationship, except in cases where further storage is justified by disputes and/or litigation and/or requests by the competent authorities.
Data, including log files, collected to ensure proper navigation in the areas of the Site: 30 days from when they are generated.
Data collected to ensure your registration on the Site and the management of the technical administration of the Site and your personal account: for the time strictly necessary to perform the service requested and in any case no later than 7 years from your last show of interest for the service in question.

Data collected and processed to comply with your request: your data will be stored and processed for the time strictly necessary to fulfil your contact request and any of our tasks arising from it, after which they will be immediately erased, except in the case of litigation or potential litigation.

Data collected and processed to perform legal obligations: your data will be stored and processed for the time required by the regulations applicable at any time.

8. DATA SUBJECT'S RIGHTS

We remind you that at any time you have the right to know what your personal data is in our possession and the related processing in progress, to request their updating or have them rectified and, in the cases provided for by law, to have them erased and to restrict or to object to their processing. If you wish, you may also receive your personal data in electronic format for the purpose of their transfer to a third party indicated by you. If the processing is based on your explicit consent, you may withdraw this consent at any time.

To learn more

Rights of data subjects

At any time, you may exercise the rights recognised by the Regulations, with reference to the specific processing operations carried out by us:

a) Request to access your personal data as well as to receive information about the purpose of the processing, the categories of data processed, the recipients or categories of recipients to whom your personal data may be disclosed, the storage period envisaged, whether or not profiling mechanisms and automated decision-making processes are applied;

b) Request to rectify your personal data. This right allows you to correct or complete the data concerning you, although in some cases it is necessary to verify the fairness of the new data provided by you in advance;

c) Request to have your personal data erased. This right allows you to request the erasure or deletion of your personal data if one of the conditions set out in Article 17 of the Regulation is met (for example: your personal data is no longer necessary for the purposes for which they were collected, you decide to withdraw your consent to the processing - where this is the legal basis - and there is no other legal basis for the processing itself, you object to the processing and no other legitimate reason of the Data Controller prevails, the personal data are processed unlawfully). Please note that any requests for erasure may not be met or may be met only partially; this is due, for example, to legal, juridical or fiscal constraints, beyond our control, that prevent us from erasing all or part of your personal data. The reasons for our inability, in whole or in part, to carry out your request will be promptly disclosed to you;

d) Request to object to the processing of your personal data. By exercising this right, you may obtain the termination of the processing of your personal data for the purpose(s) indicated by you. Please note that our acceptance of your request to object may or may not be based on the assumption that the processing is lawful. You have the right to object to the processing of your data for marketing purposes at any time (Article 3(iii));

e) Request to withdraw consent. If the processing is carried out with your explicit consent, we will, within the time limits set out in the Regulation, implement your request, ceasing the processing in question without prejudice to the lawfulness of the processing of personal data of the data subject based on consent and carried out before withdrawal.

Please note that the withdrawal of your consent may make it impossible for us to continue to provide certain services or products, provided both by the Site and by Etro boutiques. In this case, we will notify you of this when you withdraw your consent to allow you to fully assess the consequences of withdrawal.

Should the processing be carried out based on a legitimate interest, either ours or that of third parties, we reserve the right to assess the reasons for your request.

e) Request to restrict the processing of personal data. This right allows you to request the suspension of the processing of your personal data in the following cases:

if the data subject disputes the fairness of your data,
if the processing is unlawful and you do not wish to have your data erased,
if Etro no longer needs them for the purposes of processing but you wish you wish to have your data stored to establish, exercise or defend a legally protected right,
if you have objected to the use of your data in order to assess whether the Data Controller's legitimate grounds override yours.

f) Request the portability of your personal data to transmit to a third party. We will provide you or a third party that you have indicated with your personal data in a structured, commonly used and machine-readable format. This will be done, if technically feasible, only for personal data whose processing is carried out by automated means and where the processing is based on consent or on a contract.

Any rectification or erasure of personal data or restriction of processing carried out at your request will be communicated by Etro - unless this proves impossible or involves a disproportionate effort - to each of the recipients to whom your personal data may have been disclosed in accordance with this privacy policy.

When exercising the above rights, we reserve the right to ask you, in any way we deem appropriate, for specific information to help us confirm your identity, in order to be reasonably certain that only you can dispose of your personal data and that they will not be disclosed to third parties not entitled to receive them.

We undertake to respond and comply with your request, where justified, within one month of receiving your request to exercise one or more rights. Occasionally, and always within the time allowed by law, we may take longer if your request is particularly complex or if you have submitted numerous requests. In such a case, we will communicate this to you and keep you informed.

The exercise of your rights is completely free of charge.

However, if your requests are manifestly unfounded or excessive, specifically due to their repetitive nature, we reserve:

a) the right to charge you a reasonable fee based on the administrative costs incurred in providing the information or communication or taking the action requested;

b) the right to refuse to comply with your request.

Finally, we remind you that you may decide to lodge a complaint with the Supervisory Authority at any time in the event of an infringement of personal data protection regulations and/or if you believe that one or more of your rights have been breached.

These rights may be exercised by sending a written notice to the addresses indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information".

TO LEARN MORE

Withdrawal of Consent

You may exercise your right to withdraw the consent given to us for the processing of your personal data for marketing purposes by writing, among other things, to the e-mail address: privacy@etro.com. We would also like to inform you that each of our newsletters contains a web link through which you can deactivate the newsletter service or withdraw your consent to the processing of your data for marketing purposes.

In this case, all our advertising and/or promotional communications will cease and any active newsletter service will be automatically deactivated.

Furthermore, you may withdraw (or provide) your consent to the processing of your personal data for marketing purposes at any time by accessing your personal account, if you have activated one, on our Site.

If the processing is based on your consent, you may withdraw this consent at any time without prejudice to the lawfulness of the processing carried out before the withdrawal.

9. CONTACTS FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT AND FOR FURTHER INFORMATION

To exercise your rights and/or to obtain any kind of information about this privacy policy, you may send a written communication to: Etro S.p.A. (Italian Tax Code and VAT No. 11905330962), with registered office at Via Spartaco No. 3 - 20135 Milan or an email to: privacy@etro.com or a fax to the number: +39 02550208363.

10. CHANGES TO THIS PRIVACY POLICY

From time to time, we may make changes to this Privacy Policy, for example to comply with new requirements imposed by applicable law or to meet technical requirements or in connection with new services provided by the Site or Etro.

The updated Privacy Policy will be published on this Site.

We may also need to contact you to obtain your consent to allow you to continue to use the Site's services, should this be necessary due to changes in applicable law.

We invite you, therefore, to consult this page periodically.

CHECK OUT PRIVACY POLICY

We wish to inform you that we will process your personal data in accordance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the "Regulation") and any specific local regulations applicable to the protection of personal data (hereinafter collectively referred to as the "Relevant Privacy Legislation").

Below you will find all the information regarding the personal data we will process to allow you to purchase Etro products on our website "etro.com" (hereinafter also referred to as the "Site")

This privacy policy supplements the Website Privacy Policy, to which we refer for anything not detailed herein.

1. DATA CONTROLLER

THE CONTROLLER OF YOUR PERSONAL DATA COLLECTED THROUGH THE WEBSITE IS ETRO S.P.A. (ITALIAN TAX CODE AND VAT NO. 11905330962) WITH REGISTERED OFFICE AT VIA SPARTACO NO. 3, 20135 MILAN; TELEPHONE: +39 02 550201, FAX: +39 02550208363 AND EMAIL PRIVACY@ETRO.COM (“ETRO” AND/OR THE “DATA CONTROLLER”).

TO LEARN MORE ABOUT HOW THE STORE WORKS

You are purchasing an Etro S.p.A. product through the Site managed - on behalf of Etro S.p.A. - by Arnaboldi S.r.l., which markets Etro products on-line, given that it is the data processor of your personal data for the management of sales and transactions carried out in the context of the Site (for example: order management, sale and delivery of products, management of returns and guarantees and other activities accompanying the sale of products).

2. CATEGORY OF PERSONAL DATA PROCESSED

2.1. Personal data provided voluntarily by the data subject

In the context of business relations with Etro, the personal data provided by you directly when registering on the Site and/or filling in the purchase order form will be processed: name, surname, address, telephone numbers, e-mail addresses, tax code, VAT number, credit card, bank details, date of birth, password.

2.2 Personal data collected by Etro S.p.A. through company computer systems and applications

As part of the business relationship, Etro may process the following personal data, collected through IT tools and company application services used by the company:

log files of traffic generated on the network by Etro's computer systems (e.g., registration and management of your personal account, wish list management; purchase history);
Etro product sales data: purchase method and type, quantity and price of Etro products purchased.

2.3 Personal data of third parties

You acknowledge that the disclosure of personal data and contact details of any other person other than you in the context of managing the commercial relationship with Etro (for example, if you have purchased a product to be delivered to a different person or if the person paying the price for the purchase of the product is different from the person for whom the product is intended, or if you intend to recommend a service on the Site to a friend) represents the processing of personal data for which you are the data controller of the abovementioned persons. Therefore, by providing such data to Etro you will ensure that: (a) the personal data that you have disclosed to Etro have been processed by you in compliance with the provisions of the Relevant Privacy Legislation in force and (b) the abovementioned third parties have been duly informed by you in advance of the methods and purposes of processing and have authorised such processing. You will therefore remain the one and only person liable for the disclosure of information and data relating to third parties without their consent or for their possible incorrect or unlawful use.

3. PURPOSES AND LEGAL BASIS OF THE PROCESSING

Your personal data will be processed to:

i. perform and manage the contractual relationship and to allow you to complete your purchase on the Site and to provide you with the services related to the contractual relationship.

In this case, the legal basis for the processing of personal data for the abovementioned purposes is the contractual relationship to which you are a party.

ii. fulfil the legal, fiscal and administrative obligations, also to comply with the conditions and constraints provided for by current legislation. In this case, the legal basis for the processing is the legal obligation.

iii. conduct marketing activities. In this case, the legal basis for the processing is your prior explicit consent.

TO LEARN MORE

Marketing Purposes

To learn more

Profiling purposes

4. PROCESSING METHODS

The data will be processed in such a way as to minimize the risks of destruction, loss, unauthorised access or processing that is not permitted or does not comply with the purposes of collection.

Specifically, your data may be processed, for profiling purposes as well, using automated processes, for example through the comparison and comparative analysis of your purchase choices (type, quantity, frequency, etc.), during a given period and/or season and through the analysis of the type and number of your requests for information on products made in a predetermined time horizon. It should be noted in this regard that the study of user behaviour will be conducted in that is not invasive of the personal sphere.

Your personal data will be processed specifically through Etro's Customer Relationship Management ("Etro CRM") whose servers are located in the EU. Entering your personal data in the Etro CRM for the marketing and profiling purposes referred to in paragraph 3(iii) above is optional and occurs only if you give your consent to the pursuit of this purpose. For the pursuit of further purposes, your data will be automatically entered in the Etro CRM so that the Data Controller can correctly manage and perform the contractual relationship to which you are a party and best meet your needs and desires. Once your personal data have been entered in the Etro CRM, they may be read, modified and updated by employees of Etro offices and by employees of Etro stores in Italy and abroad, who have been expressly appointed as data processors.

5. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA OF THE DATA SUBJECT - CONSEQUENCES OF ANY REFUSAL

The provision of your personal data for purposes related to the performance and management of the contractual relationship and relating to the fulfilment of legal obligations (paragraphs 3(i) and 3(ii) above) is optional, however, failure to provide such data will make it impossible to establish and/or continue the contractual relationship relating to the sale and/or to provide the services connected with the sale.

The provision of your personal data for the marketing and profiling purposes referred to in paragraphs 3(iii) and 3(iv) is optional and failure to provide them will have no effect on the possibility of purchasing products and/or receiving related services, but it will not be possible to inform you about promotional and commercial initiatives and send invitations to events or evaluate your interests and preferences.

It should also be noted that where you have given your consent to authorise the Data Controller to pursue the marketing purposes referred to in paragraph 3(iii) above, you will in any case be free at any time - by sending a clear written communication to the contact details specified in greater detail in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information" below - to withdraw your consent and/or object to the processing of your data for the abovementioned purpose, even if only in relation to the contact methods and, for example, where you wish the processing to be performed solely with traditional contact methods, you may object to the processing of your personal data through automated contact methods.

6. SCOPE OF COMMUNICATION AND TRANSFER OF DATA OUTSIDE THE EU

6.1. Internal and external communication of personal data

Your personal data will not be disclosed.

Your personal data may be disclosed only for the purposes described above.

Your personal data can be accessed, according to the criteria of necessity, by Etro personnel duly authorised and instructed in writing (such as CRM, Digital, Retail, IT personnel).

Your personal data may be disclosed to third parties such as:

- governmental authorities in the case of tax and financial audits, judicial authorities and/or public bodies for legal and regulatory provisions and/or specific requests by the abovementioned governmental entities;

- companies of the Etro Group as data processors;

- legal, tax and accounting consultants.

6.2 Transfer of data outside the EU

Your personal data will not be transferred outside the European Economic Area. Should your personal data be transferred outside the European Economic Area, this will only be done if the level of protection of your personal data is adequate in accordance with the Relevant Privacy Legislation.

TO LEARN MORE

International Transfers

• transfer of your personal data to countries whose level of data protection has been recognised as adequate by the European Commission. For more information, please consult the European Commission page: "Adequacy of the protection of personal data in non-EU countries”.

• provision of specific Standard Contractual Clauses (EU-type clauses), approved by the European Commission, to ensure that the processing carried out outside the European Economic Area (EEA) by our providers offer guarantees to protect your personal data that comply with those carried out within the territory of the European Union. For more information, please consult the European Commission page: "Model contracts for the transfer of personal data to third countries".

For further information on the guarantees for the protection of your personal data, which may be transferred outside the European Economic Area, and to obtain further information on the specific mechanism used for the transfer of personal data outside the European Economic Area, please contact us by following the instructions provided in paragraph 9 below "Contacts for the exercise of the rights of the data subject and for further information".

In any case, your data will be processed only by persons duly instructed and able to provide adequate technical and organisational protection, and bound to the utmost confidentiality.

7. DURATION OF THE PROCESSING

Your personal data will be processed for variable periods according to the different purposes of the processing. We will, in any case, keep your personal data only for the period strictly necessary to achieve the purposes for which the data were collected and processed, without prejudice to the need for further storage in connection with specific legal provisions.

Specifically, your personal data, processed to:

- allow you to complete, manage your purchase through the Site and related services, will be retained for the entire duration of the contract and in any case for a period of 10 years after the termination of the business relationship, except in cases where further retention is justified by disputes and/or litigation and/or requests by the competent authorities;

- pursue the marketing purpose, will be retained t for 7 years from the date of your consent and registration in the Etro CRM, after which time they will be rendered irreversibly and permanently anonymous;

- pursue the profiling purposes, will be processed for 7 years from the date of collecting your data and at the same time they are uploaded in the Etro CRM, after this period of time they will rendered irreversibly and permanently anonymous;

- comply with specific provisions of tax, accounting and administrative law, the data will be retained for the time required by the regulations applicable at any time.

The data, including the log files, collected to ensure correct navigation in the areas of the Site will be retained for 30 days from when they are generated

The data collected to ensure your registration on the Site and the management of the technical administration of the Site and your personal account will be retained for the time strictly necessary to perform the service requested and in any case no later than 7 years from your last show of interest for the service in question.

8. DATA SUBJECT'S RIGHTS

We remind you that you have the right to know what your personal data is in our possession and the related processing in progress, to request their updating or have them rectified and, in the cases provided for by law, to have them erased and to restrict or to object to their processing. If you wish, you may also receive your personal data in electronic format for the purpose of their transfer to a third party indicated by you. If the processing is based on your explicit consent, you may withdraw this consent at any time.

To learn more

Rights of data subjects

At any time, you may exercise the rights recognised by the Regulations, with reference to the specific processing operations carried out by us:

c) Request to have your personal data erased. This right allows you to request the erasure or deletion of your personal data if one of the conditions set out in Article 17 of the Regulation is met (for example: your personal data is no longer necessary for the purposes for which they were collected, you decide to withdraw your consent to the processing - where this is the legal basis - and there is no other legal basis for the processing itself, you object to the processing and no other legitimate reason of the Data Controller prevails, the personal data are processed unlawfully). Please note that any requests for erasure may not be met or may be met only partially; this is due, for example, to legal, juridical or fiscal constraints, which do not depend on us, that prevent us from erasing all or part of your personal data. The reasons for our inability to carry out your request, in whole or in part, will be promptly disclosed to you.

d) Request to object to the processing of your personal data. By exercising this right, you may obtain the termination of the processing of your personal data in relation to the purpose(s) indicated by you. Please note that our acceptance of your request to object may or may not be based on the assumption that the processing is lawful. You have the right to object at any time to the processing of your data for marketing purposes (Article 3(iii)) and/or for profiling purposes.

e) Request to withdraw consent. If the processing is carried out with your explicit consent, we will proceed, within the time limits set out in the Regulations, to carry out your request, ceasing the processing in question without prejudice to the lawfulness of the processing of personal data of the data subject based on the consent and carried out before the withdrawal.

Please note that the withdrawal of your consent may make it impossible for us to continue to provide certain services or products provided both by the Site and by Etro boutiques. In this case, we will notify you of this when you withdraw your consent to allow you to fully assess the consequences of withdrawal.

Should the processing be conducted based on a legitimate interest, either ours or that of third parties, we reserve the right to assess the reasons for your request.

e) Request to restrict the processing of personal data. This right allows you to request the suspension of the processing of your personal data in the following cases:

if the data subject disputes the fairness of your data,
if the processing is unlawful and you do not wish to have your data erased,
if Etro no longer needs them for the purposes of processing but you wish you wish to have your data stored to establish, exercise or defend a legally protected right,
if you have objected to the use of your data in order to assess whether the Data Controller's legitimate grounds override yours.

f) Request the portability of your personal data to transmit to a third party. We will provide you or a third party that you have indicated with your personal data in a structured, commonly used and machine-readable format. This will be done, if technically feasible, only for personal data whose processing is conducted using automated means and where the processing is based on consent or on a contract.

The exercise of your rights is completely free of charge.

However, if your requests are manifestly unfounded or excessive, specifically due to their repetitive nature, we reserve:

a) the right to charge you a reasonable fee based on the administrative costs incurred in providing the information or communication or taking the action requested;

b) the right to refuse to comply with your request.

These rights may be exercised by sending a written notice to the addresses indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information".

To learn more

Withdrawal of Consent

You may exercise your right to withdraw the consent given to us to process your personal data for marketing purposes by writing, among other things, to the following e-mail address: privacy@etro.com. Each of our newsletters provides a web link through which you can:

i. proceed with your deactivation from the newsletter service.

ii. withdraw the consent to the processing of your data for marketing purposes.

In this case, all our advertising and/or promotional communications will cease and any active newsletter service will be automatically deactivated.

If the processing is based on your consent, you may withdraw this consent at any time without prejudice to the lawfulness of the processing carried out before the withdrawal.

9. CONTACTS FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT AND FOR FURTHER INFORMATION

CONSENT FORM FOR THE PROCESSING OF PERSONAL DATA

I declare that I have read and understood the above privacy policy

□ I consent / □ I do not consent

to the processing of personal data for the marketing purposes better described in the abovementioned policy.

ACCOUNT CREATION PRIVACY POLICY

Below you will find all the information relating to the personal data we will process to allow you to create your own personal page and to use the services reserved for account holders on our website "etro.com" (hereinafter also referred to as the "Site").

This privacy policy supplements the Website Privacy Policy, to which we refer for anything not detailed herein.

1. DATA CONTROLLER

The controller of your personal data collected through the Website is Etro S.p.A. (Italian Tax Code and VAT No. 11905330962) with registered office at Via Spartaco No. 3, 20135 Milan; telephone: +39 02 550201, fax: +39 02550208363 and email privacy@etro.com (“Etro” and/or the “Data Controller”).

2. CATEGORY OF PERSONAL DATA PROCESSED

In order to allow you to create your personal account, the following personal data provided by you directly will be processed: name, surname, address, telephone numbers, e-mail addresses, date of birth and password.

Etro may, however, process the following data collected through IT tools and company application services used by the company traffic log files generated on the network by Etro's IT systems (for example: registration and management of your personal account).

3. PURPOSE OF THE PROCESSING AND LEGAL BASIS OF THE PROCESSING

Your personal data will be processed to:

i. comply with your request to create your personal account and your use of the services connected to it. In this case, the legal basis for the processing of personal data for the abovementioned purposes is the contractual relationship to which you are a party;

ii. fulfil any legal, fiscal and administrative obligations, also to comply with the conditions and constraints provided for by current legislation. In this case, the legal basis for the processing is the legal obligation;

iii. conduct marketing activities. In this case, the legal basis for the processing is your prior explicit consent;

To learn more

Marketing Purposes

Marketing activities can be performed by through newsletters, promotions, discounts, commercial information and other dedicated services, through paper mail, calls with operators, direct sales, or through e-mail, pre-registered calls and SMS/MMS/smart messages. In this context, we may also process your personal data in order to invite you to participate in events and shows, to involve you in market research or to inform you about special initiatives dedicated to Etro customers, using the methods and periods we deem most effective according to the various initiatives mentioned.

To learn more

Profiling purposes

Profiling activities can take the form of the creation of profiles by analysing information regarding your interests and preferences concerning our products and services and your consumption choices, for example by identifying the type and frequency of purchases made by you both through your personal account and in "guest" mode and/or at Etro boutiques, to guarantee you a personalised service for your future purchases.

3. PROCESSING METHODS

The processing will be conducted using electronic, paper and computerised tools; this processing will be based on the principles of lawfulness, fairness and transparency and protection of your rights and your privacy. Specifically, your data may be processed, for profiling purposes as well, using automated processes, for example through the comparison and comparative analysis of your purchase choices (types, quantities, etc.), during a given period and/or season and through the analysis of the type and number of your requests for information on products made in a predetermined time horizon. It should be noted in this regard that the study of user and customer behaviour will be conducted in a way that is not invasive of the personal sphere.

The data will be processed in such a way as to minimize the risks of destruction, loss, unauthorised access or processing that is not permitted or does not comply with the purposes of collection.

Your personal data will be processed specifically through Etro's Customer Relationship Management ("Etro CRM") whose servers are located in the EU. Entering your personal data in the Etro CRM for the marketing purposes referred to in paragraph 3(iii) above is optional and occurs only if you give your consent to the pursuit of this purpose. For the pursuit of further purposes, entering your data in the Etro CRM will be automatic and is necessary to allow the Data Controller to correctly manage and perform the contractual relationship to which you are a party. Once your personal data have been entered in the Etro CRM, they may be read, modified and updated by employees of Etro offices and by employees of Etro stores in Italy and abroad, who have been expressly appointed as data processors.

5. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA OF THE DATA SUBJECT - CONSEQUENCES OF ANY REFUSAL

The provision of your data for purposes related to the creation of your account and to fulfil legal obligations (paragraphs 3(i) and 3(ii) above) is optional, however, failure to provide them will make it impossible to create your account and/or provide services related to the owner of an account.

The provision of your personal data for the marketing and profiling purposes referred to in paragraphs 3(iii) and 3(iv) is optional and failure to provide them will have no effect on the possibility of purchasing products and/or receiving related services, but it will not be possible to inform you about promotional and commercial initiatives and send invitations to events or evaluate your interests and preferences.

It should also be noted that where you have given your consent to authorise the Data Controller to pursue the marketing purposes referred to in paragraph 3(iii) above, you will in any case be free at any time - by sending a clear written communication to the contact details specified in more detail in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information" below - to withdraw your consent and/or object to the processing of your data for the abovementioned purposes, even if only for the contact methods and, for example, where you wish the processing to be performed solely with traditional contact methods, you may object to the processing of your personal data through automated contact methods.

6. SCOPE OF COMMUNICATION AND TRANSFER OF DATA OUTSIDE THE EU

6.1. Internal and external communication of personal data

Your personal data will not be disclosed.

Your personal data may be disclosed only for the purposes described above.

Your personal data can be accessed, according to the criteria of necessity, by Etro personnel duly authorised and instructed in writing (such as CRM, Digital, Retail, IT personnel).

Your personal data may be disclosed to third parties such as:

- companies of the Etro Group as data processors;

- legal, tax and accounting consultants.

6.2 Transfer of data outside the EU

TO LEARN MORE

International Transfers

7. DURATION OF THE PROCESSING

The Company will process your personal data for variable periods according to the different purposes of processing. We will, in any case, keep your personal data only for the time strictly necessary to achieve the purposes for which the data were collected and processed, without prejudice to the need for further storage in connection with specific legal provisions.

Specifically, your personal data, processed to:

- create and manage your personal account and to use the services dedicated to the owners of a personal account, will be retained and processed until your personal account is closed. Please note specifically that your personal data will be automatically erased (or made anonymous) after 7 years from your last interaction with your personal account (for example: access, update of your data, entry of new orders, etc.).

TO LEARN MORE ABOUT AUTOMATICALLY DELETING YOUR PERSONAL ACCOUNT

For your greater protection, we will send you a service notice near the seven-year expiry mentioned above in which we will communicate the imminent closure of your account to you. If you feel that you would like to keep your personal account active, you only need to interact with your personal account.

8. DATA SUBJECT'S RIGHTS

To learn more

Rights of data subjects

At any time, you may exercise the rights recognised by the Regulations, with reference to the specific processing operations carried out by us:

a) Request to have access to your personal data as well as to receive information about the purpose of the processing, the categories of data processed, the recipients or categories of recipients to whom your personal data may be disclosed, the storage period envisaged, whether or not profiling mechanisms and automated decision-making processes are applied;

c) Request to have your personal data erased. This right allows you to request the erasure or deletion of your personal data if one of the conditions set out in Article 17 of the Regulation is met (for example: your personal data is no longer necessary for the purposes for which they were collected, you decide to withdraw your consent to the processing - where this is the legal basis - and there is no other legal basis for the processing itself, you object to the processing and no other legitimate reason of the Data Controller prevails, the personal data are processed unlawfully). Please note that any requests for erasure may not be met or may be met only partially; this is due, for example, to legal, juridical or fiscal constraints, beyond our control, that prevent us from erasing all or part of your personal data. The reasons for our inability to carry out your request, in whole or in part, will be promptly disclosed to you.

d) Request to object to the processing of your personal data. By exercising this right, you may obtain the termination of the processing of your personal data in relation to the purpose(s) indicated by you. Please note that our acceptance of your request to object may or may not be based on the assumption that the processing is lawful. You have the right to object to the processing of your data for marketing purposes at any time (Article 3(iii)).

Should the processing be conducted based on a legitimate interest, either ours or that of third parties, we reserve the right to assess the reasons for your request.

e) Request to restrict the processing of personal data. This right allows you to request the suspension of the processing of your personal data in the following cases:

if the data subject disputes the fairness of your data,
if the processing is unlawful and you do not wish to have your data erased,
if Etro no longer needs them for the purposes of processing but you wish you wish to have your data stored to establish, exercise or defend a legally protected right,
if you have objected to the use of your data in order to assess whether the Data Controller's legitimate grounds override yours.

f) Request the portability of your personal data to transmit to a third party. We will provide you or a third party that you have indicated with your personal data in a structured, commonly used and machine-readable format. This will be done, if technically feasible, only for personal data whose processing conducted using automated means and where the processing is based on consent or on a contract.

The exercise of your rights is completely free of charge.

However, if your requests are manifestly unfounded or excessive, specifically due to their repetitive nature, we reserve:

a) the right to charge you a reasonable fee based on the administrative costs incurred in providing the information or communication or taking the action requested;

b) the right to refuse to comply with your request.

These rights may be exercised by sending a written notice to the addresses indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information".

To learn more

Withdrawal of Consent

You may exercise your right to withdraw the consent given to us to process your personal data for marketing and/or profiling purposes by writing to the following e-mail address: privacy@etro.com. We would also like to point out that each of our newsletters includes a web link through which you can:

i. proceed with your deactivation from the newsletter service.

ii. withdraw the consent to the processing of your data for marketing purposes.

In this case, all our advertising and/or promotional communications will cease and any active newsletter service will be automatically deactivated.

If the processing is based on your consent, you may withdraw this consent at any time without prejudice to the lawfulness of the processing carried out before the withdrawal.

9. CONTACTS FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT AND FOR FURTHER INFORMATION

CONSENT FORM FOR THE PROCESSING OF PERSONAL DATA

I declare that I have read and understood the above privacy policy

□ I consent / □ I do not consent

to the processing of personal data for the marketing purposes better described in the abovementioned privacy policy.

NEWSLETTER PRIVACY POLICY

We wish to inform you that Etro S.p.A. will process your personal data in compliance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (hereinafter also referred to as the "Regulation") and any specific local regulations applicable to the protection of personal data (hereinafter collectively referred to as the "Relevant Privacy Legislation").

Below you will find all the information regarding the personal data we will process to provide the newsletter service to which you are subscribing.

This privacy policy supplements the Website Privacy Policy, to which we refer for anything not detailed herein.

1. DATA CONTROLLER

2. CATEGORY OF PERSONAL DATA PROCESSED

Etro will process the personal data provided by you directly when you subscribe to the newsletter: e-mail address.

3. PURPOSE OF THE PROCESSING AND LEGAL BASIS

Your personal data will be processed only with your explicit and specific consent to the processing of your personal data, to proceed with the subscription to the newsletter so that Etro can send you periodic newsletters and commercial and/or promotional information communications via the e-mail you have provided.

4. PROCESSING METHODS

The processing will conducted using electronic, paper and computerised tools; this processing will be based on the principles of lawfulness, fairness and transparency and protection of your rights and your privacy.

The data will be processed in such a way as to minimize the risks of destruction, loss, unauthorised access or processing that is not permitted or does not comply with the purposes of collection.

Your personal data will be processed specifically through Etro's Customer Relationship Management ("Etro CRM") whose servers are located in the EU. Entering your personal data in the Etro CRM to subscribe to the newsletter is optional and occurs only if you give your consent to the pursuit of this purpose. Once your personal data have been entered in the Etro CRM, they may be read, modified and updated by employees of Etro offices and by employees of Etro stores in Italy and abroad, who have been expressly appointed as data processors.

5. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA OF THE DATA SUBJECT - CONSEQUENCES OF ANY REFUSAL

Failure to provide your personal data is optional; however, failure to do so will prevent you from subscribing to the newsletter.

It is understood that at any time you may withdraw your consent and/or object to the processing of your data concerning your subscription to the newsletter easily and free of charge by clicking on "Unsubscribe" or by following the procedures indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information".

6. SCOPE OF COMMUNICATION AND TRANSFER OF PERSONAL DATA OUTSIDE THE EU

6.1. Internal and external communication of personal data

Your personal data will not be disclosed.

Your personal data may be disclosed only for the purposes described above.

Your personal data can be accessed, according to the criteria of necessity, by Etro personnel duly authorised and instructed in writing (such as CRM, Digital, Retail, IT personnel).

Your personal data may be disclosed to third parties such as:

- companies of the Etro Group as data processors;

- legal, tax and accounting consultants.

6.2 Transfer of data outside the EU

TO LEARN MORE

International Transfers

7. DURATION OF THE PROCESSING

Your personal data processed for sending the newsletter will be processed for 7 years from the date of your consent and simultaneous registration in the Etro CRM, after this period of time they will be made anonymous in an irreversible and permanent manner. Close to the expiry of the validity of your consent and to allow you to continue to use the newsletter service, we will send a communication to your e-mail address inviting you to renew your consent if you wish to continue to receive our newsletters. If you do not respond to this communication, the newsletter service and any other type of promotional and/or commercial communication by the Data Controller will merely cease at the end of the seventh year.

8. DATA SUBJECT'S RIGHTS

To learn more

Rights of data subjects

At any time, you may exercise the rights recognised by the Regulations, with reference to the specific processing operations carried out by us:

d) Request to object to the processing of your personal data. By exercising this right at any time, you may obtain the termination of the processing of your personal data for the abovementioned purpose. Please note that our acceptance of your request to object may or may not be based on the assumption that the processing is lawful;

Should the processing be carried out based on a legitimate interest, either ours or that of third parties, we reserve the right to assess the reasons for your request.

e) Request to restrict the processing of personal data. This right allows you to request the suspension of the processing of your personal data in the following cases:

if the data subject disputes the fairness of your data,
if the processing is unlawful and you do not wish to have your data erased,
if Etro no longer needs them for the purposes of processing but you wish you wish to have your data stored to establish, exercise or defend a legally protected right,
if you have objected to the use of your data in order to assess whether the Data Controller's legitimate grounds override yours.

f) Request the portability of your personal data to transmit to a third party. We will provide you or a third party that you have indicated with your personal data in a structured, commonly used and machine-readable format. This will be done, if technically feasible, only for personal data whose processing is conducted using automated means and where the processing is based on consent or on a contract.

The exercise of your rights is completely free of charge.

However, if your requests are manifestly unfounded or excessive, specifically due to their repetitive nature, we reserve:

a) the right to charge you a reasonable fee based on the administrative costs incurred in providing the information or communication or taking the action requested;

b) the right to refuse to comply with your request.

These rights may be exercised by sending a written notice to the addresses indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information".

To learn more

Withdrawal of Consent

You may exercise your right to withdraw the consent given to us for the processing of your personal data for marketing and/or profiling purposes by writing to the following e-mail address privacy@etro.com Please note that each of our newsletters includes a web link through which you can:

proceed with your deactivation from the newsletter service.

In this case, all our advertising and/or promotional communications will cease and any active newsletter service will be automatically deactivated.

If the processing is based on your consent, you may withdraw this consent at any time without prejudice to the lawfulness of the processing carried out before the withdrawal.

9. CONTACTS FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT AND FOR FURTHER INFORMATION

CONSENT FORM FOR THE PROCESSING OF PERSONAL DATA

I declare that I have read and understood the above privacy policy

□ I consent / □ I do not consent

to the processing of personal data for the marketing purposes better described in the abovementioned information and specifically for the receipt of the newsletter by e-mail.

CONTACT REQUEST FORM PRIVACY POLICY

We wish to inform you that we will process your personal data in compliance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (hereinafter also referred to as the "Regulation" and any specific local regulations applicable to the protection of personal data (hereinafter collectively referred to as the "Relevant Privacy Legislation").

Below you will find all the information regarding the processing we will carry out on the personal data that you will communicate to us by filling out this contact form.

This privacy policy supplements the Website Privacy Policy, to which we refer for anything not detailed herein.

1. DATA CONTROLLER

2. CATEGORY OF PERSONAL DATA PROCESSED

Etro will process the personal data you provide directly when filling out the contact form: name, surname, e-mail address, telephone number.

3. PURPOSE AND LEGAL BASIS OF THE PROCESSING

Your personal data will be processed in order to respond to your requests by filling in the contact form, subject to your specific consent.

4. PROCESSING METHODS

The processing will be conducted using electronic, paper and computerised tools; this processing will be based on the principles of lawfulness, fairness and transparency and protection of your rights and your privacy. The data will be processed in such a way as to minimize the risks of destruction, loss, unauthorised access or processing that is not permitted or does not comply with the purposes of collection.

Your personal data will be processed specifically through Etro's Customer Relationship Management ("Etro CRM") whose servers are located in the EU. Your personal data will be automatically entered in the Etro CRM only after you have given your consent for the abovementioned purpose, which is necessary to allow the Data Controller to correctly manage and carry out your request. Once your personal data have been entered in the Etro CRM, they may be read, modified and updated by employees of Etro offices and by employees of Etro stores in Italy and abroad, who have been expressly appointed as data processors.

5. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA OF THE DATA SUBJECT - CONSEQUENCES OF ANY REFUSAL

The provision of your data to pursue the purpose described above, i.e., to be contacted by Etro following your request and/or to manage your request, is necessary, failing which Etro will not be able to contact you and/or comply with your request.

6. SCOPE OF COMMUNICATION AND PROCESSING OF PERSONAL DATA OUTSIDE THE EU

6.1. Internal and external communication of personal data

Your personal data will not be disclosed.

Your personal data may be disclosed only for the purposes described above.

Your personal data can be accessed, according to the criteria of necessity, by Etro personnel duly authorised and instructed in writing (such as CRM, Digital, Retail, IT personnel).

Your personal data may be disclosed to third parties such as:

- companies of the Etro Group as data processors;

- legal, tax and accounting consultants.

6.2 Transfer of data outside the EU

TO LEARN MORE

International Transfers

• provision of specific Standard Contractual Clauses (EU-type clauses), approved by the European Commission, to ensure that the processing carried out outside the European Economic Area (EEA) by our providers offer guarantees to protect your personal data that comply with those carried out within the territory of the European Union. For more information please consult the European Commission page: "Model contracts for the transfer of personal data to third countries";

7. DURATION OF THE PROCESSING

Your personal data will be processed for the period strictly necessary to comply with your contact request and to perform any tasks and operations arising from the subject matter of your request. Therefore, once your request has been processed, your data will be erased, unless further storage is justified by disputes and/or litigation and/or requests by the competent authorities.

8. DATA SUBJECT'S RIGHTS

To learn more

Rights of data subjects

At any time, you may exercise the rights recognised by the Regulations, with reference to the specific processing operations carried out by us:

c) Request to have your personal data erased. This right allows you to request the erasure or deletion of your personal data if one of the conditions set out in Article 17 of the Regulation is met (for example: your personal data is no longer necessary concerning the purposes for which they were collected, you decide to withdraw your consent to the processing - where this is the legal basis - and there is no other legal basis for the processing itself, you object to the processing and no other legitimate reason of the Data Controller prevails, the personal data are processed unlawfully). Please note that any requests for erasure may not be met or may be met only partially; this is due, for example, to legal, juridical or fiscal constraints, beyond our control, that prevent us from erasing all or part of your personal data. The reasons for our inability, in whole or in part, to carry out your request will be promptly disclosed to you;

d) Request to object to the processing of your personal data. By exercising this right at any time, you may obtain the termination of the processing of your personal data for the purpose(s) indicated by you. Please note that our acceptance of your request to object may or may not be based on the assumption that the processing is lawful;

e) Request to withdraw consent. If the processing is carried out with your explicit consent, we will, within the time limits set out in the Regulations, implement your request, ceasing the processing in question without prejudice to the lawfulness of the processing of personal data of the data subject based on consent and carried out before withdrawal;

Should the processing be carried out based on a legitimate interest, either ours or that of third parties, we reserve the right to assess the reasons for your request.

e) Request to restrict the processing of personal data. This right allows you to request the suspension of the processing of your personal data in the following cases:

if the data subject disputes the fairness of your data,
if the processing is unlawful and you do not wish to have your data erased,
if Etro no longer needs them for the purposes of processing but you wish you wish to have your data stored to establish, exercise or defend a legally protected right,
if you have objected to the use of your data in order to assess whether the Data Controller's legitimate grounds override yours.

f) Request the portability of your personal data to transmit to a third party. We will provide you or a third party that you have indicated with your personal data in a structured, commonly used and machine-readable format. This will be done, if technically feasible, only for personal data whose processing is conducted using automated means and where the processing is based on consent or on a contract.

The exercise of your rights is completely free of charge.

However, if your requests are manifestly unfounded or excessive, specifically due to their repetitive nature, we reserve:

a) the right to charge you a reasonable fee based on the administrative costs incurred in providing the information or communication or taking the action requested;

b) the right to refuse to comply with your request.

These rights may be exercised by sending a written notice to the addresses indicated in paragraph 9 "Contacts for the exercise of the rights of the data subject and for further information".

9. CONTACTS FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT AND FOR FURTHER INFORMATION

CONSENT FORM FOR THE PROCESSING OF PERSONAL DATA

I declare that I have read and understood the above privacy policy

□ I consent / □ I do not consent

to the processing of personal data to be contacted by Etro in order to comply with my request.

"IN STORE APPOINTMENT" SERVICE PRIVACY POLICY

We wish to inform you that we will process your personal data in compliance with the provisions of Regulation (EU) 2016/679 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, (hereinafter also referred to as the "Regulation") and any specific local regulations applicable to the protection of personal data (hereinafter collectively referred to as the "Relevant Privacy Legislation").

Below you will find all the information regarding the personal data we will process to provide you with the "In Store Appointment" service to allow you to book an appointment at the Etro boutiques and/or pick up the products reserved on the website www.etro.com (hereinafter collectively referred to as the "Services").

This privacy policy supplements the Website Privacy Policy, to which we refer for anything not detailed herein.

1. DATA CONTROLLER

2. CATEGORY OF PERSONAL DATA PROCESSED

To book an appointment at the Etro boutiques and/or to collect Etro products purchased and/or reserved through the Etro website, Etro will ask you for the following information: name, surname and e-mail.

3. PURPOSE OF THE PROCESSING AND LEGAL BASIS

Your personal data will be processed in order to provide you with the Services with your specific consent.

4. PROCESSING METHODS

The processing will be conducted using electronic, paper and computerised tools; this processing will be based on the principles of lawfulness, fairness and transparency and protection of your rights and your privacy. The data will be processed in such a way as to minimize the risks of destruction, loss, unauthorised access or processing that is not permitted or does not comply with the purposes of collection.

Your personal data will be processed specifically through Etro's Customer Relationship Management ("Etro CRM") whose servers are located in the EU. Your personal data will be automatically entered in the Etro CRM only after you have given your consent for the abovementioned purpose, which is necessary to allow the Data Controller to correctly provide the Services. Once your personal data have been entered in the Etro CRM, they may be read, modified and updated by employees of Etro offices and by employees of Etro stores in Italy and abroad, who have been expressly appointed as data processors.

5. MANDATORY OR OPTIONAL NATURE OF THE PROVISION OF PERSONAL DATA OF THE DATA SUBJECT - CONSEQUENCES OF ANY REFUSAL

The provision of your data to obtain the Services is optional, failing which you will not be able to book any appointments at the Etro boutiques nor will you be able to collect the products reserved on the Etro website.

6. SCOPE OF COMMUNICATION AND TRANSFER OF DATA OUTSIDE THE EU

6.1. Internal and external communication of personal data

Your personal data will not be disclosed. Your personal data may be disclosed only for the purposes described above.

Your personal data can be accessed, according to the criteria of necessity, by Etro personnel duly authorised and instructed in writing (such as CRM, Digital, Retail, IT personnel).

Your personal data may be disclosed to third parties such as:

- service providers such as technical and IT services, shipping, marketing, payment management companies. In this case, the abovementioned providers - to whom only the data necessary to perform the agreed services will be disclosed - will process the data as data processors and therefore on the basis of the instructions provided in writing by Etro;

- companies of the Etro Group as data processors;

- legal, tax and accounting consultants.

6.2 Transfer of data outside the EU

TO LEARN MORE

International Transfers

• provision of specific Standard Contractual Clauses (EU-type clauses), approved by the European Commission, to ensure that the processing carried out outside the European Economic Area (EEA) by our providers offer guarantees to protect your personal data that comply with those carried out within the territory of the European Union. For more information please consult the European Commission page: "Model contracts for the transfer of personal data to third countries";

7. DURATION OF THE PROCESSING

Your personal data processed to allow you to use the "In Store Appointment" service will be processed for the period strictly necessary to provide you with the abovementioned service, therefore, once the data have been processed, it will be erased.

Your personal data collected to allow you to collect the Etro products reserved through the Etro website will be retained for 10 years after the products purchased have been collected.

8. DATA SUBJECT'S RIGHTS

To learn more

Rights of data subjects

At any time, you may exercise the rights recognised by the Regulations, with reference to the specific processing operations carried out by us:

d) Request to object to the processing of your personal data. By exercising this right at any time, you may obtain the termination of the processing of your personal data for the purpose indicated by you. Please note that our acceptance of your request to object may or may not be based on the assumption that the processing is lawful;

Should the processing be conducted based on a legitimate interest, either ours or that of third parties, we reserve the right to assess the reasons for your request.

e) Request to restrict the processing of personal data. This right allows you to request the suspension of the processing of your personal data in the following cases:

if the data subject disputes the fairness of your data,
if the processing is unlawful and you do not wish to have your data erased,
if Etro no longer needs them for the purposes of processing but you wish you wish to have your data stored to establish, exercise or defend a legally protected right,
if you have objected to the use of your data in order to assess whether the Data Controller's legitimate grounds override yours.

f) Request the portability of your personal data to transmit to a third party. We will provide you or a third party that you have indicated with your personal data in a structured, commonly used and machine-readable format. This will be done, if technically feasible, only for personal data whose processing is conducted using automated means and where the processing is based on consent or on a contract.

The exercise of your rights is completely free of charge.

However, if your requests are manifestly unfounded or excessive, specifically due to their repetitive nature, we reserve:

a) the right to charge you a reasonable fee based on the administrative costs incurred in providing the information or communication or taking the action requested;

b) the right to refuse to comply with your request.

These rights may be exercised by sending a written notice to the contact details indicated at

9. CONTACTS FOR THE EXERCISE OF THE RIGHTS OF THE DATA SUBJECT AND FOR FURTHER INFORMATION

CONSENT FORM FOR THE PROCESSING OF PERSONAL DATA

I declare that I have read and understood the above privacy policy

□ I consent / □ I do not consent

to the processing of personal data in order to use the Services offered by Etro and better described in this privacy policy.

PRIVACY NOTICE PURSUANT TO ARTICLE 14 OF REGULATION (EU) 679/2016

Data controller

Etro S.p.A. (hereinafter, “Etro” or “Data Controller”), is an Italian company located at Via Spartaco, 3, 20135 - Milan, VAT Code 11905330962, as Data Controller will process your personal data in compliance with the Regulation (EU) 679/2016 (“GDPR”) and Legislative Decree No. 196/2003 as subsequently amended (“Italian Data Protection Code”) (together referred to as “Data Protection Law”).

Source of the data and categories of personal data

Etro collects personal data from third parties, such as other companies having a contractual relationship with Etro (“Partners”). Etro will process personal data you have provided to its Partners in compliance with the applicable data protection laws in your Country and only to the extent you consented to the transfer of your personal data to third parties and/or such transfer is allowed under the applicable law.

Etro may collect and process the following categories of personal data:

· Identification data (e.g. name, surname, gender, birthdate) and contact details (e.g. telephone number, e-mail address, address);

· ID and/or passport;

· Data related to preferences (e.g. kind of products, number of purchased products).

Purposes of the processing and legal basis

Etro will process your personal data only for specific purposes and to the extent that a proper legal basis exists, according to the Data Protection Law. In particular, the Controller will process your personal data as described in the table below.

Table US

In case the legal basis is the compliance with the law or the execution of a contract between you and the Controller, providing your personal data is necessary. In case of denial proving your personal data, you cannot access Etro’s services, nor purchase Etro’s products.

In the other cases, providing your personal data is not mandatory and your denial to provide such data will not affect the possibility to access Etro’s services or purchase Etro’s products.

Modalities of the processing

Your personal data will be processed by means of manual, computerized, telematic as well as paper-based tools and according to adequate security measures in order to ensure the protection of your personal data. Your personal data will be processed through the Etro’s Customer Relationship Management (“CRM Etro”) and the servers are located both within the EU and outside the EU.

Data communications

The Controller may share your personal data with the following categories of recipients:

· the employees and collaborators of the Controller, duly authorized and instructed to process personal data;

· third-parties services providers, which have been appointed as data processors;

· banks and external consultants;

· the competent authorities.

Data retention

Your personal data will be retained for a reasonable period of time as long as this is necessary for the purposes aforementioned or to comply with a legal obligation provided by the applicable law, and specifically for 10 years from the termination of the contractual relationship.

In any case, personal data processed for marketing purposes will be retained until you withdraw your consent, while personal data processed for profiling will be retained for 2 years since the last interaction between you and Etro.

After the data retention period expires, your personal data will be permanently anonymized and will be processed only in an aggregate manner.

Data transfers

Your Personal Data will be transferred outside the European Union. Etro will ensure that your personal data will be transferred in compliance with the Data Protection Law and, specifically, to the extent that the European Commission considered that there adequate the safeguards for personal data applicable in the receiving country or one of the other measures listed under Articles 46 ff. GDPR has been implemented. In any case, you are entitled to contact Etro, by sending an e-mail to the address below, in order to have further information about such transfer as well as obtain copy of the safeguards enforced to protect your personal data.

Your rights

At any point while we are in possession of or processing your personal data, you have the right to:

· Access and request a copy;

· Request the rectification;

· Request the erasure;

· Obtain restriction of processing;

· Object to the processing (including for soft spam based on the legitimate interest;

· Receive it in a structured, commonly used and machine-readable format and to transmit such data without hindrance to another data controller, where technically feasible and where the processing is based on consent;

You have also the right to withdraw your consent at any time, without prejudice to the processing of personal data carried our prior the withdrawal.

Contact

For the exercise of your rights, to withdraw your consent and to get further information on your personal data, you may contact Etro by sending a written communication via mail to Etro S.p.A. (C.F. N. e P.IVA 11905330962), to the address in Via Spartaco 3 – 20135 Milan, or by sending an e-mail to privacy@etro.com or via fax to: + 39 02550208363.

You also have the right to lodge a complaint to a supervisory authority, namely the Garante per la Protezione dei Dati Personali located in Piazza Venezia n. 11 00187 ROME, Fax: (+39) 06.69677.3785, Phone: (+39) 06.696771, Email: garante@gpdp.it.

BAGS

CLOTHING

ACCESSORIES

SMALL LEATHER GOODS

SHOES

CLOTHING

ACCESSORIES

SMALL LEATHER GOODS

BAGS

SHOES

NEWBORN

BABY GIRL 1-36 MONTHS

GIRL 4-10 YEARS

ETRO FRAGRANCES

ETRO GIFT GUIDE

PRIVACY POLICY