This information is provided for the e-commerce website www.pisa1940.com owned and managed by PISA 1940 Srl and not for other third-party websites that may be consulted by the user via links.

The information is intended for those who, at the end of the specific procedure, register on the Site and use the online services provided through it and, in particular, for those who, once registered, make purchases of products through the Site.

This information is provided pursuant to article 13 of EU Regulation 2016/679, General Data Protection Regulation (“ Regulation ”) and, if and to the extent applicable, Legislative Decree no. 196/2003, Code regarding the protection of personal data (“ Privacy Code ”) and subsequent amendments and additions.

Please note that with respect to the processing of personal data collected through this Site but in contexts other than the creation of an account or personal area on the Site and e-commerce activities, the additional information published in the area dedicated to this purpose on the Site itself will apply. .

Please also remember that third-party sites that may be accessed through specific links on this Site are governed by a privacy policy separate from this one and which goes beyond it.

The data controller is the company:

PISA 1940 Srl

Via Montenapoleone n. 9

20121 Milan

tel. 02 76021998

PEC pisa1940@legalmail.it - email compliance@pisa1940.com

(“ PISA 1940 ”, “ Company ” or “ Owner ”)

The Company has appointed its own Data Protection Officer, also known by the acronym DPO, with the task of supervising compliance with the Regulation and, in general, with the legislation on the protection of personal data and with cooperating with the the competent supervisory authority (the Guarantor for the Protection of Personal Data), acting as a point of contact with the data subjects.

The Data Protection Officer can be reached at the following contact details:

• by email to dpo@pisa1940.com;
• by traditional paper mail to the address of the Owner's office as indicated above;
• physically at the office by appointment

In addition to anything else provided in other pages, documents or sections of the Site (in particular with reference to "Cookies"), through the e-commerce Site and the use of the related functions and/or the forwarding of purchase orders through the same the following data can be collected and processed:

- navigation data : these are the data that the server automatically records at each visit to the site, such as the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI ( Uniform Resource Identifier ) notation of the resources requests, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other related parameters to the operating system and the user's computing environment. This category also includes the "Social Buttons" which exclusively allow the connection and viewing of the social profiles of the "Pisa 1940" brand (created on social networks such as, by way of example, Facebook, Instagram, YouTube). These "buttons" allow users who are browsing the Site exclusively to directly reach the "Pisa 1940" social networks with a "click". The interactions that take place within the social network are in any case subject to the rules and privacy settings of the respective social networks;

- personal data provided voluntarily by users/customers : these are data that are provided by users by completing electronic forms for the purpose of registering and creating an account on the Site, to proceed with the forwarding of a purchase order, to formulate a request for information, such as name, surname, date of birth, email, address, telephone number (including mobile) and further data or information contained in messages sent to the addresses indicated on the Site or by completing forms published there and for subscription to specific services, such as the creation of a "wish list" or "whishlist". Data on the order and purchasing process also fall into this category;

- data relating to online payments : in relation to the payment data entered by users, the Company will only process the data received from digital payment companies and credit institutions managing credit card payments which consist of feedback information on the status linked to payment (successful/rejected). All additional information relating to the account (e.g. PayPal), prepaid card or credit card is stored by the entities that manage the relevant service, which are not authorized to use the personal data received through the Site for other purposes.

In addition to the foregoing, in relation to certain categories of products defined as "Second Wrist Products" as better described in the general conditions of sale of the Site, referred to here, the customer may be asked to make available a copy of a current identity document of validity.

For the purposes indicated in this information, the Company does not collect or process personal data attributable to the user which the Regulation qualifies as "particular categories" (such as, by way of example, data capable of revealing racial and ethnic origin, beliefs religious, philosophical or other kinds, political opinions, membership of associations or organizations of a religious, philosophical or trade union nature, as well as personal data suitable for revealing the state of health).

Furthermore, users are invited not to enter in the contact forms and not to communicate, even by telephone, to Customer Service information that may fall within the category of particular categories of personal data as described above.

The processing of personal data is aimed exclusively at achieving the following purposes:

(i) to allow registration on the Site (and the creation of an Account) and the correct provision of the services requested via the Site and/or via forms made available therein and, therefore, to manage and execute orders for products submitted through the Site and to fulfill all obligations deriving from contractual and pre-contractual relationships with the user/customer. The administrative-accounting purposes connected and in any case deriving from the contract concluded with the customer must also be understood to be included in this scope, also with regard to the electronic transmission of order confirmations, commercial invoices and communications relating to the fulfillment of the order by the Company, as well as the purposes related to the management of any discounts, promotional sales, promotions. This context also includes the service provided by the Customer Assistance Service and, therefore, the processing of the user/customer's personal data for the management and sending of responses to requests for assistance in relation to one or more of the products available on the Site ( fulfillment of pre-contractual measures or contractual obligations pursuant to art. 6 letter b), Regulation ) ;

(ii) for the fulfillment of obligations deriving from the law or regulations, national and/or community, in force, including in the tax and/or anti-money laundering field, expressly including the obligations deriving from the provisions of Legislative Decree no. 92/2017 as well as by provisions issued by competent authorities and bodies ( fulfillment of legal obligations pursuant to art. 6 letter c), Regulation ) ;

(iii) for the defense in court of a right or interest of the Company before any competent authority or body (including in the field of computer crimes and for the purposes of credit recovery); to allow better use of services and a better browsing environment; to carry out statistical analyzes and market surveys on aggregate data; for sending - via email - to existing customers communications containing information relating to PISA 1940 products or services similar to those previously purchased (so-called soft spamming ) unless the customer objects to such processing. This last case also includes the sending of communications via email aimed at inviting the customer/user to complete a purchase on the Site, in the case of open and not yet closed e-commerce orders (so-called "abandoned cart") ( legitimate interest of the Owner pursuant to art. 6 letter f), Regulation );

(iv) for the transmission, via email, of advertising material relating to the Company's products and/or services and/or brands handled by the Company, as well as for sending invitations to events or meetings organized and managed by the Data Controller, also in collaboration with third parties identified from time to time in the invitations (brochures and/or presentations), for market analyzes or requests to participate in surveys or polls, as well as for the transmission of any other type of information material, identified as being of specific interest, drawn up, edited or published by the Owner, independently or in collaboration with third parties (so-called marketing purposes ). This processing is conducted on the basis of the customer's consent , optional and revocable at any time ( art. 6 letter a), Regulation ) ;

(v) for the communication of personal data (in particular personal, contact and purchase data) to third parties operating in the production and marketing of watches and precious objects and, in particular, to watchmakers for the performance by the latter for their own commercial communication purposes and, therefore, in order to allow the customer to receive communications and/or information and/or invitations to events directly from these subjects (so-called communication to third parties for marketing). This processing is conducted on the basis of the customer's consent , optional and revocable at any time ( art. 6 letter a), Regulation ). In case of consent for this specific processing purpose, the customer may be contacted directly by the aforementioned subjects.

The provision of data for the purposes referred to in points (i) ( fulfillment of pre-contractual measures and contractual obligations ), (ii) ( fulfillment of legal obligations ) is optional. However, since this processing is necessary to allow registration on the Site and the purchase of products through the latter, including the activities of placing an order, failure, partial or incorrect provision of the data in question will make it impossible, for depending on the case, to register on the Site, to manage and process the order and/or to use the services provided online and, in general, to process and process specific user requests.

With regard to point (iii) ( legitimate interest of the Data Controller ), the user's express consent is not necessary but it is always possible to oppose such processing, exercising the rights of the interested party referred to in the following art. 10.

The provision of data and consent for the purposes referred to in points (iv) and (v) above ( direct marketing and communication to third parties ) is optional. However, by not giving consent to the processing of data for the additional purposes listed above, the customer will not be able to take advantage of personalized discounts and dedicated offers, nor receive information of a promotional nature by sending direct communications.

The customer/user may, in any case, revoke the consent, possibly given for marketing purposes and/or for communication to third parties, at any time, according to the methods described in the following article 10.

It is understood that any subsequent revocation of consent does not affect the lawfulness of the data processing carried out in the period preceding such revocation.

The data may be communicated to the following categories of subjects:

• to all those subjects (including Public Authorities) who have access to personal data pursuant to regulatory or administrative provisions;

• to all those subjects, public and/or private, natural and/or legal persons to whom the communication is necessary or functional for the correct fulfillment of a contractual or legal obligation.

In addition to the foregoing, personal data may be disclosed to subjects who also operate on behalf of the Company, such as, by way of example and not limited to:

• to companies, consultants or professionals possibly responsible for the installation, maintenance, updating and, in general, management of the hardware and software infrastructure of the Site;

• to couriers or shippers responsible for delivering products purchased through the Site;

• to companies that deal with the processing and sending of informative or commercial communications;

• to the Company's legal and tax professionals and consultants;

who will treat them as external managers of personal data processing on behalf of the Company or, based on assessments that will be conducted on a case-by-case basis, as independent data controllers.

Furthermore, the employees and collaborators of the Company, in particular of the commercial and administrative offices, as well as the staff of the boutiques who have been specifically authorized for this purpose by the Data Controller and who have undertaken to confidentiality or are bound by an appropriate legal obligation of confidentiality.

If, for the pursuit of the purposes indicated above, personal data are transferred outside the territory of the European Union or the European Economic Area, the transfer will take place to third countries that guarantee an adequate level of protection of personal data, as established by specific decisions of the European Commission (including the so-called “EU-US Data Privacy Framework”). The transfer of personal data to countries that do not belong to the European Union and which do not ensure adequate levels of protection will be carried out only after the conclusion of specific agreements, which incorporate the so-called "standard contractual clauses", in the version approved by the European Commission and, from time to time, in force and applicable and in any case in compliance with the requirements and conditions of the Regulation.

Personal data will be kept for the entire duration of the contractual relationship or in any case for as much as necessary to process, process and manage any requests from users and, subsequently, for the maximum time established by the applicable legal provisions regarding the limitation of rights and/or or forfeiture of the action (also in the administrative-fiscal field) and, in general, for the exercise/defence of the Data Controller's rights in disputes brought by public authorities, public entities/bodies and private entities.

For processing subject to consent, the data will be processed and stored until consent is revoked.

For processing based on the legitimate interest of the Data Controller, the data will be retained as long as such interest exists and in any case on the condition that there is an active relationship with the interested party, without prejudice to the latter being able to oppose similar processing at any time for reasons related to your particular situation.

Purchases of products via the e-commerce site and thus the related contents are intended for adults of age and capacity to act. Minors must not provide information or personal data without the consent of those exercising parental responsibility over them. All users who are not at least 18 years of age are therefore invited not to communicate their personal data under any circumstances without the prior authorization of a parent or the person exercising parental responsibility. If the Company becomes aware of the fact that the personal data has been provided by a minor person (under the age of 18), the Company itself will arrange for the immediate destruction of the same or request the transmission of specific consent from the parents (or of the operator with parental responsibility), also reserving the right to inhibit access to the services available on the Site to any user who has concealed his/her minor age or who has in any case communicated his/her personal data without the consent of his/her parents (or parental responsibility).

As a data subject, the user/customer has the right to ask the Data Controller to exercise the following rights:

Right of access

You may request to obtain confirmation regarding the existence or otherwise of processing of your personal data and, if so, to access such data and specific information on the processing, such as, by way of example, the purposes, categories of data being processed, the existence of the other rights indicated below. You may also request a copy of your data.

Right of rectification

You have the right to request and obtain rectification of personal data concerning you and/or the integration of incomplete personal data.

Right of cancellation

You may obtain the deletion of your data, without unjustified delay, among other things, if (i) such data are no longer necessary for the purposes for which they were collected, (ii) you object to the processing of your data (as below indicated) and there is no other overriding legitimate reason for the processing, (iii) the data are processed unlawfully, (iv) the data must be deleted pursuant to a legal obligation, (v) personal data of a minor of 16 years in relation to the provision of information society services. This right does not apply if the processing of data is necessary, inter alia, for the fulfillment of a legal obligation or for the establishment, exercise or defense of a right in court.

Right of limitation

You have the right to obtain the limitation of the processing of your personal data, which means that the data processing will be suspended for a certain period of time. Circumstances that may give rise to this right include situations where the accuracy of the personal data has been contested, but some time is required to verify its (im)accuracy. This right does not prevent us from continuing to process your personal data.

Right to portability

In case of automated processing based on consent or on the execution of contractual obligations, you have the right to receive personal data in a structured, commonly used and machine-readable format and to transmit it to another data controller.

You also have the right to obtain direct transmission of data from one owner to another, where technically feasible.

The possibility of obtaining the deletion of the data remains unaffected, as indicated above.

Right of opposition

You have the right to object at any time, for reasons relating to your particular situation, to processing based on a legitimate interest of the Data Controller, unless the latter demonstrates compelling legitimate reasons for proceeding with processing which prevail over the interests, rights and fundamental freedoms of the interested party or for the establishment, exercise or defense of a right in court. You also have the right to object to processing for marketing purposes.

Finally, you have the right to lodge a complaint with the Supervisory Authority ( http://www.garanteprivacy.it/ ) if you believe that the processing of data violates the provisions of the Regulation; as well as to revoke consent where previously given.

Exercise of rights

The above rights may be exercised through specific functions present in the reserved area created on the Site or with a request addressed without formalities to PISA 1940 at the office indicated above or by communication to the DPO at the addresses indicated above.