Privacy Policy
PRIVACY POLICY – WEBSITE
Information notice pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR)
WHY THIS INFORMATION?
Pursuant to Regulation (EU) 2016/679 (hereinafter, the “GDPR”), this page describes how personal data are processed. This notice is provided in accordance with Article 13 of the GDPR. This notice does not apply to any third-party websites that may be accessed through links available on this website, for which no responsibility is assumed.
Personal Data Processed
• Personal data: any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (Recitals 26, 27 and 30 GDPR).
• Contractor/User data.
• Browsing data: the IT systems and software procedures used to operate this website acquire, during their normal operation, certain personal data whose transmission is inherent in the use of Internet communication protocols. This category includes IP addresses or domain names of the computers and devices used by users, URI/URL (Uniform Resource Identifier/Locator) addresses of requested resources, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical status code indicating the server response (successful, error, etc.), and other parameters relating to the user's operating system and IT environment.
• Data voluntarily provided by users: the optional, explicit and voluntary sending of messages to the contact addresses indicated on this website and/or the completion of data collection forms entails the subsequent acquisition of the sender’s address, necessary to respond to requests, as well as any other personal data provided.
Information on the Processing of Personal Data Through Social Media Platforms
With regard to the processing of personal data carried out by the operators of the social media platforms used by the Data Controller, please refer to the information provided by such operators through their respective privacy policies.
The Data Controller processes personal data provided by users through its dedicated social media pages in order to manage interactions with users (comments, public posts, etc.) in compliance with applicable legislation.
Specific Notices
Specific privacy notices may be available on certain pages of the Website in relation to particular services or processing activities involving personal data.
COOKIES AND OTHER TRACKING TECHNOLOGIES. WHAT ARE THEY? WHAT ARE THEY USED FOR?
For information regarding cookies and other tracking technologies, please refer to the Cookie Policy available in the website footer and at the following link: https://en.polaroideyewear.com/pages/cookie-policy
1. DATA CONTROLLER AND DATA PROTECTION OFFICER
The Data Controller is Safilo S.p.A., with registered office at Settima Strada 15, 35129 Padua, Italy, represented by its Legal Representative, who has appointed a Data Protection Officer (DPO) pursuant to Articles 37, 38 and 39 of the GDPR.
The DPO can be contacted at the registered office of the Data Controller indicated above or by email at: [email protected].
2. PURPOSES OF PROCESSING, LEGAL BASIS, DATA RETENTION PERIOD AND NATURE OF DATA PROVISION
A. Browsing this Website
The data necessary for the use of the web services are also processed for the following purposes:
• obtaining statistical information on the use of the services (most visited pages, number of visitors by time slot or day, geographical areas of origin, etc.);
• monitoring the proper functioning of the services offered.
Legal basis and nature of data provision:
Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, taking into consideration the reasonable expectations of the data subject and activities strictly necessary for the operation of the website and navigation itself (Art. 6(1)(f) and Recital 47 GDPR). Provision of data is necessary for browsing the website.
Data retention period:
Browsing data will be retained for the duration of the browsing session. In any case, such data will not be retained for more than seven days (except where required for the investigation of criminal offences by the Judicial Authority).
B. Use of Cookies and Similar Technologies
The website uses technical cookies to enable safe, fast and efficient browsing and to provide users with the requested services. The installation of such cookies does not require the user's prior consent.
For non-technical cookies and equivalent technologies requiring consent, processing is based on the data subject's consent to the processing of personal data (Art. 6(1)(a) and Recitals 42 and 43 GDPR). Consent is provided through the website's cookie banner and cookie policy. Please refer to the cookie policy for further information regarding the retention period.
C. Management of Contact Requests or Information Submitted by the User through the Specific Form Available on the Website or through the Data Controller's Contact Details
Legal basis and nature of data provision:
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) and Recital 44 GDPR). Provision of data is necessary. Failure to provide the required data will make it impossible for us to contact you and provide the requested information.
Data retention period:
Personal data will be deleted 24 months after the response provided to the User, unless further retention is strictly necessary in connection with the specific request.
D. Performance of the Sales Contract to Which You Are a Party, Whether as a Registered or Non-Registered User of the Website
Data will be processed to manage all stages of the contractual relationship (including, in particular, the fulfilment of contractual obligations and related administrative, accounting and legal purposes connected with the establishment, performance and termination of the contractual relationship), including after-sales services, returns/withdrawals and compliance with administrative and accounting obligations.
Legal basis and nature of data provision:
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) and Recital 44 GDPR). Provision of data is necessary to manage your purchases and provide services related to the sale. Failure to provide the required data will make it impossible to complete the sale and provide the related services.
Data retention period:
For the entire duration of the contractual relationship and, after its termination, for a maximum period of 10 years for administrative and accounting purposes (pursuant to Art. 2220 of the Italian Civil Code).
E. Direct Marketing Activities
For the sending of advertising materials or direct sales communications, conducting market research and sending commercial and promotional communications and newsletters through automated means (email).
Communications may contain promotional activities and/or logos of third-party partners and companies belonging to the Group. Personal data will not be disclosed to such third parties.
For the complete list of Group companies and partners, data subjects may contact the Data Controller using the contact details provided above.
Legal basis and nature of data provision:
Processing is based on the data subject's consent to the processing of personal data (Art. 6(1)(a) GDPR and Recitals 42 and 43). Provision of data is optional. Failure to provide the required data will make it impossible to receive direct marketing communications.
Data retention period:
Your Data will be processed for 24 months from the date consent was given, unless consent is withdrawn beforehand. This period may be extended if the data subject renews consent for this purpose.
F. Management of Your Requests and Requests from Other Data Subjects Pursuant to Articles 15 et seq. of the GDPR (Data Subject Rights)
Legal basis and nature of data provision:
Processing is necessary for compliance with a legal obligation to which the Data Controller is subject (Art. 6(1)(c) and Recital 45 GDPR). Provision of personal data is mandatory as it is necessary to comply with legal obligations.
Data retention period:
5 years from the closure of the request, unless litigation arises.
G. Non-Automated Profiling
Personal data will be entered into corporate databases/CRM systems/platforms in order to carry out analyses and assessments and to classify data subjects into homogeneous groups according to specific business-related characteristics, for better service management and the delivery of targeted promotional communications.
Legal basis and nature of data provision:
Processing is based on the data subject's consent to the processing of personal data (Art. 6(1)(a) GDPR and Recitals 42 and 43). Provision of data is optional. Failure to provide the required data will make it impossible to conduct analyses and send targeted communications.
Data retention period:
Data will be retained for 12 months from the date consent was given, unless consent is withdrawn earlier. This period may be extended through renewal of consent by the User.
H. Creation and Management of an Account – Restricted Area
Data will be processed to allow the user to create and manage an account and to access the related services.
Legal basis and nature of data provision:
Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract (Art. 6(1)(b) and Recital 44 GDPR). Provision of data is necessary. Failure to provide the required data will make it impossible to create an account and access the restricted area of the website.
Data retention period:
Until termination of the contractual relationship or deletion of the account, subject in any case to the technical time required to deactivate credentials.
I. Abandoned Cart Reminder
Legal basis and nature of data provision:
Processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data (Art. 6(1)(f) and Recitals 47-50 GDPR). Provision of data is necessary. Failure to provide the required data will make it impossible to activate the reminder service.
Data retention period:
For the time required to send reminder emails relating to the abandoned cart (maximum 48 hours).
3. TO WHOM WILL PERSONAL DATA BE DISCLOSED? DATA RECIPIENTS
Personal data will be disclosed to parties that process the data either as independent Data Controllers or as Data Processors (Art. 28 GDPR), and will be processed by natural persons (Art. 29 GDPR) acting under the authority of the Data Controller and the Data Processors on the basis of specific instructions regarding the purposes and methods of processing.
Data may be disclosed to recipients belonging to the following categories:
• Group Companies and Partners;
• Third parties providing IT and telematic services (e.g. hosting services, website management and development services, payment tools);
• Parties with whom the Data Controller has entered into agreements and, where required, subject to prior consent;
• For direct marketing purposes, subject to consent, parties engaged in the management of direct marketing activities;
• For profiling purposes, subject to consent, parties engaged in the management of profiling activities;
• Competent authorities for compliance with legal obligations and/or requests from public authorities.
The list of Data Processors pursuant to Art. 28 GDPR is available by contacting the Data Controller using the contact details provided above.
4. WILL DATA BE TRANSFERRED TO NON-EEA COUNTRIES?
Personal data may be processed both within and outside the European Economic Area (EEA). In the latter case, transfers will take place in compliance with Articles 44 et seq. of the GDPR.
In particular, the Data Controller uses service providers (specifically Microsoft Corporation and, for hosting services, Cloudflare Inc.) located in the United States/Canada, which provide appropriate safeguards through adherence to the EU-U.S. Data Privacy Framework, an adequacy decision that enables the secure transfer of data from the European Economic Area to participating U.S. companies without the need for additional safeguards for data protection (Art. 45 GDPR).
Furthermore, data may be transferred to Shopify Inc., with registered office at 151 O'Connor Street, Ground Floor, Ottawa, Ontario, K2P 2L8, Canada. Such transfer is based on the adequacy decision of the European Commission pursuant to Art. 45 GDPR - Commission Decision of 20 December 2001 pursuant to Directive 95/46/EC of the European Parliament and of the Council on the adequate protection of personal data provided by the Canadian Personal Information Protection and Electronic Documents Act (PIPEDA) [notified under document number C(2001) 4539] (2002/2/EC).
To obtain information concerning the safeguards relating to data transfers outside the EEA, data subjects may contact the Data Controller using the contact details provided above.
5. IS THERE AN AUTOMATED DECISION-MAKING PROCESS?
Personal data will be processed manually, electronically and by automated means.
Please note that no fully automated decision-making processes are carried out.
With regard to profiling activities, where performed on the basis of the data subject’s explicit consent as indicated among the processing purposes, profiling will be carried out with human intervention.
An operator will create the data subject’s profile and analyse habits and purchasing preferences in order to improve the Data Controller’s commercial offering and services (non-automated profiling).
6. WHAT ARE YOUR RIGHTS? HOW CAN YOU EXERCISE THEM?
Data subjects may exercise their rights under Articles 15 et seq. of the GDPR by contacting the DPO at:
The Data Controller guarantees data subjects the right to request, at any time:
• access to their personal data (Art. 15 GDPR);
• rectification of inaccurate data (Art. 16 GDPR);
• erasure of personal data (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR).
Pursuant to Art. 19 GDPR, the Data Controller shall communicate any rectification, erasure or restriction of processing to each recipient to whom the personal data have been disclosed, unless this proves impossible or involves disproportionate effort. Upon request, the Data Controller shall inform the data subjects about such recipients.
The Data Controller also guarantees the right to data portability (Art. 20 GDPR) and, upon request under Art. 20, will provide the data in a structured, commonly used and machine-readable format.
Data subjects have the right to object (Art. 21 GDPR), at any time, to the processing of personal data based on legitimate interests by writing to the contacts indicated above with the subject line "Objection".
To stop receiving automated direct marketing communications (email), data subjects may:
• send an email to [email protected] with the subject line "Unsubscribe from Automated Communications";
• use the automatic opt-out mechanisms available;
• or manage their preferences through the preference center available in the emails.
At any time, data subjects may withdraw their consent to profiling (non-automated profiling) by sending an email to [email protected] with the subject line "No Profiling", or by using the preference center available in the emails.
Should data subjects believe that the processing of their personal data carried out by the Data Controller infringes Regulation (EU) 2016/679, they have the right to lodge a complaint with the competent supervisory authority, in particular in the Member State of their habitual residence, place of work or place of the alleged infringement, or to seek judicial remedy before the competent courts.
7. CHANGES TO THIS PRIVACY NOTICE
The Data Controller may change, modify, add or remove any part of this Privacy Notice at any time.
To facilitate the review of any changes, this Privacy Notice will indicate the date on which it was last updated.
Last updated: 26/10/2026