Privacy Policy

Privacy Policy XERJOFF.COM (pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)

Xerjoff Group S.p.A. places particular importance on safeguarding privacy and protecting the personal data of users and customers and is committed to processing such data in compliance with applicable data protection laws and regulations. To this end, the Company implements appropriate technical and organizational measures to ensure the security of personal data and is committed to maintaining the highest level of transparency by providing clear, comprehensive and accessible information regarding the purposes, methods and conditions of personal data processing, as well as the rights afforded to data subjects.

When a user/data subject visits or interacts with the website www.xerjoff.com, its associated landing pages or other services linked to the same domain (hereinafter collectively referred to as the “Website” or the “Platform”), communicates with us, visits our promotional pages, receives or interacts with our newsletters, or engages in other activities described in this Privacy Policy, Xerjoff Group S.p.A. may collect and process personal data, including through their use and, where applicable, disclosure to third parties, in accordance with the purposes, legal bases and processing methods set out in this Privacy Policy. As a company established in Italy, Xerjoff Group S.p.A. processes personal data in compliance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), as well as Italian Legislative Decree No. 196 of 30 June 2003 (Italian Personal Data Protection Code), as subsequently amended and supplemented. In view of its international operations, Xerjoff Group S.p.A. is also committed to complying, where applicable, with the data protection laws and regulations of the countries in which it operates or to which its services are directed, including: a) United Kingdom: The UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Data (Use and Access) Act 2025, which introduced amendments to the UK data protection framework, as well as the Privacy and Electronic Communications Regulation 2003 (PECR), where applicable. b) United States of America: Applicable federal and state data protection and privacy laws, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and similar legislation enacted by other US states. These laws grant data subjects specific rights concerning the collection, use and disclosure of their personal data, within their respective scopes of application. c) United Arab Emirates (UAE): Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data (Personal Data Protection Law – PDPL), together with any applicable implementing regulations and other relevant legislation, including data protection laws applicable to specific economic or financial free zones governed by independent data protection regimes.

Xerjoff Group S.p.A. is committed to ensuring the lawful, fair and transparent processing of personal data by implementing appropriate measures to protect such data and safeguarding the rights granted to data subjects under applicable data protection laws and regulations.

1. DATA CONTROLLER: IDENTITY AND CONTACT DETAILS

The Data Controller is Xerjoff Group S.p.A., in the person of its acting legal representative.

Xerjoff Group S.p.A. (hereinafter referred to as "Xerjoff") is a company with its registered office at Via Tenivelli 29 - 10024 Moncalieri (TO), Italy, REA Number: TO 106649, Tax Code/VAT Number: 09547650011. The company's operational headquarters is located at Via Torino, 15 - 10044 Pianezza (TO), Italy. The Data Controller can be contacted by writing to the following email address: gdpr@xerjoff.com or certified mail pec@pec.xerjoff.com or by contacting the telephone number (+39) 011 4143616.

2. DATA PROTECTION OFFICER: IDENTITY AND CONTACT DETAILS

In compliance with Article 37 of EU Regulation 2016/679, Xerjoff Group has appointed Mr./Dr. Federico Capello as its Data Protection Officer. The data protection officer can be contacted by writing to the e-mail address dpo@xerjoff.com or by contacting the telephone number (+39) 011 5534737.

3. CATEGORIES OF PERSONAL DATA PROCESSED

The website offers numerous services for which it is not necessary to register or provide personal data. In order to be able to offer users/data subjects a wide range of services (e.g. The creation of a user account and e-commerce), we need to collect some personal information. The personal data processed by Xerjoff are collected directly from users/data subjects and provided by them voluntarily and freely.

a) Personal data collected automatically

(1) Navigation data collected automatically by the website: the computer systems and software procedures used to operate the website acquire, during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols. This is information that is not collected to be associated with identified users/data subjects, but which by their very nature could, through processing and association with data held by third parties, allow users to be identified. These data or part of them (IP addresses, device identifiers, location etc.) may be processed by the Data Controller - subject to specific, preventive, free and optional consent of the user/data subject - in order to track your activity on the website (purchasing habits, interest categories), to process market analysis and statistics also to improve Xerjoff products and services and make them more responsive to the needs of the user/data subject, as well as to send more targeted information and offers that may be of greater satisfaction and interest to the user/data subject. Navigation data can also be collected for the purpose of website security and fraud prevention.

(2) The website uses a technology commonly known as "cookies" to make browsing easier and more intuitive. Cookies are small text files sent by the website to the user’s/data subject’s device (typically to the browser), where they are stored and later transmitted back to the website upon the user’s next visit. By tracking how users navigate the site, cookies provide valuable insights that help enhance the browsing experience, making it more seamless and efficient. Xerjoff utilizes different types of cookies. For more details about the cookies used and how to manage consent for their acceptance or rejection, users/data subjects can refer to the website's Cookie Policy.

b) Personal data provided by the user/data subject:

(3) Registration form (“create an account”): Data to register on the website and be able to make purchases. The data collected on the registration form refers to: name, surname, e-mail address, date of birth.

(4) Website contact forms (“whatsApp / send an email”): the optional, explicit and voluntary sending of e-mails to the addresses indicated on the website entails the subsequent acquisition of the sender's address, needed in order to respond to requests, as well as any other personal data entered in the e-mail. Even the explicit and voluntary sending of the forms that can be filled in on the website containing data of the data subject involves processing to follow up on the pre-contractual obligations or the execution of the services provided for by sending the forms. This information in the forms may contain personal data, contact details, telephone numbers, e-mail addresses of the data subjects and of identified and identifiable third parties having cause with the user of the website.

(5) Newsletter and Mailing List: The email addresses used to send communications are collected through voluntary subscriptions by users/data subjects, who are always sent a confirmation request, or obtained in connection with the sale of the Data Controller’s products or services. Such communications may include newsletters, promotional information, invitations to corporate events, advertising and direct marketing materials. In accordance with Article 130(4) of the Italian Privacy Code (Legislative Decree No. 196/2003), the Data Controller may also use email addresses collected in the context of a previous sale to promote its own similar products or services (so-called soft spam), without requiring prior consent, provided that the data subject has been duly informed and is given the opportunity to object, free of charge, both at the time of data collection and in each subsequent communication. In connection with marketing emails, Xerjoff may use tracking pixels and tracked links to monitor email openings and interactions, in accordance with applicable data protection requirements. Data subjects may withdraw their consent to email tracking at any time, independently of their consent to receive marketing communications. Following such withdrawal, subsequent marketing emails will be sent without individual tracking pixels or tracked links, while the data subject may continue to receive otherwise lawfully authorised marketing communications. You may unsubscribe from our marketing communications or manage your email tracking preferences at any time, independently of one another, by clicking the dedicated link included in each email or by contacting us using the details provided below.

(6) E-Commerce, Creation of a Personal Account, and Purchase of Products or Services from the Data Controller: this category includes the processing of data necessary for managing shopping carts and abandoned carts, orders, and any registered user profiles. The data processed may include personal details, addresses, tax and billing information, payment details (such as PayPal, Klarna, Credit Cards, Sofort, Apple Pay, Google Pay, and Bank Wire), purchase history, reports, and notes.

Personal data may also be processed through third-party service providers (e.g., CRM platforms, administrative and accounting services, delivery companies, or couriers) for the administrative management of orders and purchases, the handling of participation in loyalty programs, the preparation of anonymous statistics to analyze purchasing behavior, and the sending of promotional materials regarding products and offers, which may be communicated via email or telephone messages.

(7) Processing of Customer Orders and Customer Service: this involves handling data necessary for managing customer orders, including email addresses used to send transactional emails with purchase information. Additional data processed includes shipping addresses, selected shipping methods, and tracking numbers. Furthermore, we process data related to abandoned carts, such as items left in the cart and associated customer information, to send reminders and facilitate order completion.

(8) Work with us: The data collected by Xerjoff through the sending of curriculum vitae, professional profile evaluation interviews such as name, surname, place and date of birth, social security number, telephone number, postal address, educational qualification and other elements of personal identification, sent in relation to any open positions or spontaneous application, fall into the category of "personal data" pursuant to Article 4, paragraph 1 of the GDPR and will be subject processing exclusively for the purpose of evaluating the aptitudes and professional skills of the candidates themselves, according to the open position and for which a selection procedure is underway or for future needs to expand the company staff (recruitment or internship).

c) Personal data provided by third parties:

(9) Quick check out: In the case of purchases through the quick check out, the persona, shipping, billing and contact data will be imported directly from PayPal, Apple & Google Pay.

(10) During interaction with the website, certain personal data may be collected through third-party services integrated into the system, including:

Shopify, as the e-commerce platform provider, manages information related to orders, shipping, contact details, and browsing activity, in order to ensure the proper functioning of the website and transactions. Zendesk, used for customer support, receives and uses data voluntarily provided by the user (such as name, email address, and message content) to respond to support requests. Mapp Cloud, used for sending promotional communications and newsletters, processes data such as name, email address, and interactions with messages (e.g., opens, clicks). Individual email-opening and click tracking for marketing communications is carried out only where the applicable consent requirements have been met. All the above providers act as Data Processors and ensure appropriate levels of data protection, including in the case of data transfers to third countries, in accordance with the provisions of the GDPR.

4. PURPOSE AND LAWFULNESS OF DATA PROCESSING

The personal data acquired through the website will be processed by the Data Controller for the following purposes:

(1) Enhancing website navigation and usability, ensuring platform security, and collecting aggregated and anonymous statistical information on website usage by users (e.g., number of visitors, pages visited, time spent, keywords, etc.);

(2) Purposes related to website security and fraud prevention;

(3) Purposes strictly related and instrumental to managing relationships with users/data subjects, such as responding to contact requests and/or information inquiries from the user/data subject;

(4) Purposes directly related to the fulfillment and implementation of services requested by the user/data subject, including the execution of a contract to which the data subject is a party or the adoption of pre-contractual measures at their request;

(5) Purposes connected with obligations established by law, as well as by provisions issued by authorities legitimated by the law;

(6) For the assessment, exercise or defense of a right in and out of court (legitimate interest) of the undersigned organization;

(7) Purposes related to the selection of personnel and evaluation of applications in order to establish an employment relationship;

Furthermore, the Data Controller may process personal data for the following additional purposes, subject to the data subject's specific, freely given and informed consent, where required by applicable law. As an exception, direct marketing communications may also be sent without prior consent where all the conditions set out in Article 130(4) of the Italian Privacy Code (so-called “soft spam”) are met, without prejudice to the data subject’s right to object at any time. Consent to marketing communications, email tracking and profiling may be managed and withdrawn separately, as further described in this Privacy Policy.

(8) Sending commercial and promotional communications, direct marketing purposes, invitations to events, detecting the degree of customer satisfaction, both through traditional contact methods (i.e. paper mail and telephone calls with an operator) and through automated contact methods (i.e. automated telephone calls and similar methods such as fax, e-mail, SMS, MMS, etc.); the sending of commercial and promotional communications may also involve the use of tracking pixels and tracked links to measure message open rates, clicks, and campaign effectiveness. Consent to email tracking may be revoked independently of consent to receive marketing communications.

(9) Profiling purposes of user/data subject, data which involve, in addition to the processing of common data referred to in paragraph 3.b.3. above, also the processing of the user's/data subject’s date of birth. Profiling may also involve analysing preferences, purchasing behaviour and email interactions lawfully collected through tracking pixels or tracked links, in order to provide personalised offers. Profiling requires separate, specific and optional consent, distinct from marketing consent.

(10) Tracking users’/data subjects’ browsing behavior and purchase choices to enhance marketing offerings, commercial promotions, and customer satisfaction analysis. This activity is also carried out through the use of technologies such as cookies (for more details, please refer to the website's "Cookie Policy" section).The tracking of email openings and interactions with links through the Mapp platform is separately addressed under point (8), while any related profiling activities are governed by point (9).

The legal basis that legitimizes the processing are:
- the legitimate interest of the data controller (par.4.1, 4.5, 4.6);
- the fulfilment of legal obligations to which the data controller is subject (par. 4.4);
- the execution of a contract of which the user/data subject is the execution of pre-contractual measures adopted at the request of the same (par. 4.2 and 4.3);
- the consent of the data subject (par. 4.7, 4.8, 4.9, 4.10).

The data subject may modify or withdraw, at any time, the consents previously given to the Data Controller by accessing the reserved area of the website www.xerjoff.com, through the website preferences panel, for website tracking technologies, by using the dedicated link found at the bottom of each email communication, or by directly contacting the Data Controller or the Data Protection Officer (DPO) using the contact details provided in this policy. Withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Consent to receive marketing emails, consent to track email openings and clicks, and consent to profiling can be managed independently through the preference-management link in the footer of our emails or by contacting the Data Controller. Withdrawing consent to email tracking alone does not prevent the continued receipt of otherwise lawful marketing communications: subsequent emails will not contain individual opening- or click-tracking tools. Withdrawal of profiling consent does not automatically withdraw marketing consent. Should the Data Controller intend to process personal data for a purpose other than that for which it was originally collected, the user/data subject will be informed in advance about the new purpose and any other relevant information, in accordance with Article 13(3) of the GDPR.

5. NATURE OF DATA PROCESSING

The provision of personal data is mandatory only for the processing necessary for the provision of services (execution of pre-contractual or contractual measures or processing based on the fulfilment of legal obligations to which the Data Controller is subject). Any refusal for the purpose of providing the service makes it impossible to finalize the purchase of online services in addition to registering and accessing some reserved areas of the website, compromising the completion of contractual agreements or pre-contractual measures requested by the data subject. For all other types of personal data, providing information is optional, and any refusal by the data subject will not have any negative consequences on the provision of services offered through the website.

6. CATEGORIES OF RECIPIENTS

The personal data of users/data subjects will not be disclosed but may be communicated and processed:

a) Within the company, among staff, specifically employees and collaborators involved in activities related to data processing and who have been duly authorized to process such data.

b) By third parties that provide services essential to fulfilling the requests of the user/data subject or to enhance our service delivery. These third parties include, but are not limited to:
1. Hosting platforms: Providers that host our website and manage its functionality, such as Shopify, ensuring accessibility, performance, and security;
2. Financial institutions or credit card issuers: Entities that manage payments for our services;
3. Companies providing tools for order accounting management and electronic invoicing: Service providers that support the recording, accounting processing, and issuance of invoices in compliance with applicable tax regulations;
4. Customer relationship management (CRM) services: Platforms like HubSpot that help us manage interactions with users/data subjects;
5. Marketing service providers: Companies that assist in delivering marketing campaigns and activities;
6. Email and SMS platform providers: Services such as Mapp marketing cloud that facilitate the delivery of marketing communications and interaction with the user;
7. Social media messaging tools: Platforms that enable communication through social media channels;
8. Shipping companies, couriers, logistics firms, and local distributors: Entities responsible for the delivery, distribution, and logistics of products purchased by users/data subjects;
9. Internet service providers and cloud computing companies: Organizations that offer infrastructure and cloud services to support our operations;
10. Zendesk, Inc.: Provider of customer support and service management solutions, used exclusively for handling customer inquiries, assistance requests, and communication management through the website;
11. WhatsApp (Meta Platforms, Inc.): A messaging platform used to enable users to contact customer service and receive assistance quickly and directly;
12. Professional advisors and parties responsible for legal or fiscal audits: These may include, by way of example, accountants, legal advisors, auditing firms, or other external consultants who operate on our behalf in compliance with applicable regulations;
13. Customs agencies, border authorities, and international and local regulatory authorities;
14. Any other recipient whose involvement is necessary for the fulfillment of the requested service or for compliance with legal obligations.

Personal data may also be communicated to entities when necessary to comply with legal obligations or regulations. Where required by law, these parties will be designated as independent Data Controllers (if essential for contract performance) or as Data Processors. Users/data subjects may request a complete list of Data Processors by writing to gdpr@xerjoff.com.

7. DATA TRANSFER

The website is hosted on Shopify (hosting provider), all personal data from customers in the European Economic Area (EEA) is initially processed by Shopify International Limited (Ireland). Personal data will also be stored in electronic format on adequately protected magnetic media stored at the offices of Xerjoff. If for technical and/or operational reasons it is necessary to make use of subjects or companies (e.g. cloud provider or cloud services) located outside the European Union, we inform as of now that these subjects will be appointed as Data Processors pursuant to and for the effects of art. 28 of the Regulation and the transfer of Personal Data to these subjects, limited to the performance of specific activities of Processing, and will be regulated in accordance with the provisions of Chapter V of the Regulations. All necessary precautions will therefore be taken in order to ensure the most complete protection of the personal data of the user / data subject. The Company also uses cloud services provided by third-country companies recognized as adequate in terms of confidentiality, integrity and availability of data.

8. DATA PROFILING

The Data Controller carries out profiling activities aimed at analyzing users’ and data subjects’ purchasing habits, interests and preferences, primarily through the processing of personal data provided when creating user profiles on the website. Subject to the data subject’s specific consent, such information may be used to create individual profiles, conduct market research and statistical analyses, improve the relevance of products and services, and provide personalized offers and marketing communications. Profiling activities may also include the analysis of email openings, interactions with tracked links and other engagement data lawfully collected through the Mapp platform, in order to better understand individual interests and preferences and deliver more relevant and personalized marketing communications. The use of email engagement data for profiling purposes is subject to specific consent to profiling, which is separate from consent to receiving marketing communications. Withdrawal of profiling consent does not automatically affect the receipt of marketing communications or any other processing activities based on a valid legal basis. Data subjects may modify or withdraw their consent to profiling at any time using the preference management tools available on the website, where applicable, or by contacting the Data Controller at gdpr@xerjoff.com.

9. DATA RETENTION

The processing of personal data is carried out mainly using electronic procedures and supports (DB, CRM platforms, etc.) for the time strictly necessary to achieve the purposes for which the data were collected and, in any case, in compliance with the principles of lawfulness, fairness, non-excess and pertinence provided for by current privacy legislation and in particular:
- Personal data provided by sending emails to the website’s email address or using the website’s communication systems will be retained for the time necessary to provide a response and for an additional 24 months for customer support purposes;
- The personal data necessary to manage and fulfill orders will be retained for the entire duration of the contractual relationship. Once the relationship has ended, the data will be stored for the period required by tax and civil law. Specifically, fiscal and accounting documents will be kept for 10 years from the date of the last entry, as required by law;
- The data acquired for analysis and profiling purposes will be kept for a maximum of 12 months. The user/data subject has the possibility to revoke his/her consent to the processing for profiling purposes by accessing, at any time, his/her reserved area of the website in the appropriate "permission" section of the website, or by sending an email to gdpr@xerjoff.com.
- Personal data processed for consent-based marketing communications are retained until consent is withdrawn, subject to periodic reviews of their continued relevance and necessity; - Personal data relating to interactions with email communications, collected through tracking technologies, will be retained for a maximum of 24 months from the date of collection and, in any event, only until the withdrawal of consent or the exercise of the right to object to such tracking, whichever occurs first. - Data collected through Zendesk and the WhatsApp module for customer support will be retained for a maximum period of 24 months from the closure of the support request, unless legal protection needs of the Data Controller arise from the management of the ticket or conversation;- The personal data collected for recruitment purposes, including CVs, unsolicited applications, and cover letters, will be processed for the time necessary to achieve the stated purposes and, in any case, for no longer than 2 years from the date of collection.

10. COOKIES AND SIMILAR TECHNOLOGIES

The IT systems and software procedures used to operate this website collect, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified individuals, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. In addition, this website uses cookies and similar technologies for marketing and profiling purposes, including analysis of browsing behaviour, tracking user activity, and displaying personalised content or advertisements. Where required by applicable law, these technologies are activated only with the user's prior consent, which can be managed or withdrawn at any time through the cookie settings panel. Strictly necessary cookies do not require consent. Separately from website cookies, Xerjoff Group S.p.A. may use tracking pixels and tracked links in marketing emails sent through the Mapp platform to monitor email openings and interactions with the messages, subject to the user's consent. Consent to email tracking may be withdrawn independently of consent to receive marketing communications, through the preference management link included in each email. The data may also be used to ascertain responsibility in the event of potential cybercrimes against the website. For further details on website cookies, please refer to the Cookie Policy available on this website. Information on email tracking and the related processing of personal data is provided in the relevant sections of this Privacy Policy.

11. LINKS TO OTHER WEBSITES AND SOCIAL MEDIA

The website Our website includes links to official company pages on social media platforms such as Facebook, YouTube, Spotify, Instagram, LinkedIn, and TikTok. By clicking on these icons or links, users are redirected to our company profiles on the respective platforms, which operate as independent data controllers. We encourage users to review the privacy policies of each platform to understand how their personal data may be processed:

Facebook – Meta Platforms, Inc.
YouTube – Google LLC
Spotify AB
Instagram – Meta Platforms, Inc.
LinkedIn – Microsoft Corp.
TikTok Technology Limited

Please note that interaction with these platforms occurs outside of our website, and no personal data is shared with these third parties merely by clicking the access links. For details regarding the purposes, types, and methods of personal data collection, processing, use, and storage by the social network platforms, as well as information on how to exercise your rights, please refer to the privacy policy of each respective social network or external platform. The website also integrates the services of Zendesk, provided by Zendesk, Inc., and WhatsApp Web, used exclusively for managing support requests received through the "Contact Us" button available on the site. The WhatsApp module allows users to initiate direct conversations with the Data Controller’s customer service. Through these tools, we may collect data such as name, surname, email address, phone number, and the content of communications sent. Such data is processed solely for pre-sales and post-sales support purposes. For more information on the data processing carried out by Zendesk, you can consult their privacy policy at the following link: Zendesk Privacy Policy. For more details on WhatsApp's data processing practices, please refer to their privacy policy here: WhatsApp Privacy Policy.

12. USER/DATA SUBJECT RIGHTS ON DATA PROCESSING

The user/data subject may exercise at any time the rights established by the applicable Personal Data protection laws, including the right to:
- receive confirmation of the existence of their Personal Data and access their content (access rights);
- update, modify and/or correct their Personal Data (right of rectification);
- request the cancellation or limitation of the processing of data processed in violation of the law, including those that do not need to be kept for the purposes for which the data were collected or otherwise processed (right to be forgotten and right to limitation); - oppose the processing based on legitimate interest (right of opposition);
- withdraw consent at any time, without affecting the lawfulness of processing carried out based on consent before its withdrawal; in particular, withdrawing consent to email tracking does not prevent data subjects from continuing to receive marketing communications where these remain lawfully authorised. Subsequent marketing emails will be sent without individual tracking pixels or tracked links.
- lodge a complaint with the Supervisory Authority in the event of a violation of the Personal Data Protection Regulations;
- receive a copy of the data in electronic format concerning the user/data subject and request that such data be transmitted to another data controller (right to data portability). To exercise these rights, you may at any time make a specific request to the Data Controller, by writing to Xerjoff Group S.p.A., Via Torino, 15 - 10044 Pianezza (TO), Italy. The Data Controller can also be contacted by email at gdpr@xerjoff.com, via certified email at pec@pec.xerjoff.com, or by phone at (+39) 011 4143616 (Italy). The user/data subject is encouraged to complete the appropriate application form to exercise their rights before submitting it to the Data Controller and the Data Protection Officer.

13. CHANGES TO THIS PRIVACY POLICY

As our services continually evolve, the nature and scope of personal data processing may change accordingly. Therefore, this Privacy Policy may be updated or modified from time to time to reflect new regulatory requirements or changes to our services. We encourage you to periodically review this Privacy Policy. Whenever possible, we will promptly inform you of any changes made and their implications.

Last updated: October, 28 2026