Privacy policy

1. DATA CONTROLLER

The Data Controller is ESSEMODA S.r.l. (P.IVA 02558861213, pec: essemoda@pec.it), with registered office at Via Padre Mario Vergara 132 - 80027 - Frattamaggiore (NA) (hereinafter referred to as “Clayton Italia”).

2. DATA PROTECTION OFFICER

Clayton Italia has appointed its Data Protection Officer (DPO - Data Protection Officer) pursuant to Articles 37, 38 e 39 del GDPR. Il DPO may be contacted at the email address: dpo@agilae.it

3. RECIPIENTS OF THIS NOTICE

This notice is addressed to individuals whose personal data are processed by Clayton Italia in connection with the activities described in this Privacy Policy. In particular, the notice applies to users who:

‒         browse the website;

‒         create a personal account;

‒         make online purchases;

‒         request assistance or information;

‒         subscribe to the newsletter;

‒         receive commercial communications;

‒         interact with Clayton Italia’s official social-media profiles;

‒         provide personal data to the Controller through the available channels.

N.B.  The website, e-commerce platform, and services offered by Clayton Italia are intended for a general audience and are not specifically directed at minors. If any pages on this website contain links to other sites, those sites are not bound by this Privacy Policy. We recommend that you carefully read the privacy policies available on those external sites and review their procedures for the collection, use, and disclosure of personal information. 

A)

Navigation and security: to enable navigation; to ensure the security of the site; to prevent unauthorized access, fraudulent, or illegal activities (e.g., through reCAPTCHA)

Technical and browsing data, such as IP addresses, technical logs, and data related to the proper functioning of the website

Legitimate interest – Article 6(1)(f) GDPR

 The collection of browsing data is automatic and necessary for accessing and viewing the website. Failure to provide the necessary technical data may prevent proper navigation of the website

 Technical data retained for up to 12 months

B)

Technical cookies and accessibility: storing technical preferences and accessibility widget settings

Data collected via technical cookies and similar tools, including those related to accessibility preferences

Legitimate interest – Article 6(1)(f) GDPR

 The provision of data is necessary to enable the website and its technical features to function

 For the time strictly necessary for the session or until the cache is cleared

C)

Non-anonymized analytics: statistical measurement of website performance using GA4 in non-anonymous mode

Online identifiers, IP addresses, browsing data, website interaction events

Consent – Article 6(1)(a) GDPR

 Providing consent is optional. Failure to provide consent does not prevent you from browsing the site.

 The data processed will be retained for a period of 24 months from the date consent is obtained or until consent is revoked, whichever comes first.

D)

Marketing e Remarketing: use of Pixel e Enhanced Conversions per targeted advertising and conversion measurement

Online identifiers, IP address, products viewed, searched for, added to the shopping cart, or purchased, preferences expressed via the cookie banner, data collected through pixels, tags, scripts, and similar tools

Consent – Article 6(1)(a) GDPR

 Providing consent is optional. Failure to provide consent does not prevent you from browsing the site.

 The data processed will be retained for a period of 24 months from the date consent is obtained or until consent is revoked, whichever comes first.

E)

Behavioral profiling: analysis of purchasing habits by segment in the CRM

Online identifiers, IP addresses, browsing data, website interaction events, products viewed, searched for, added to the cart, or purchased, preferences expressed, interactions with the brand

Consent – Article 6(1)(a) GDPR

 Providing data is optional. Failure to give consent does not prevent you from browsing the website

 The processed data will be retained for a period of 24 months from the date consent is obtained or until consent is withdrawn, whichever comes first. In the event of user inactivity, the data will be retained for a period of 3–6 months

A)

Creation and management of the personal account: to enable registration, access to the personal area, management of account information, viewing of order history, and use of features reserved for registered users

Ø  Identification and contact information, such as first name, last name, and contact details provided by the User (for example: email address, phone number, home address, shipping address, or billing address)

Ø  Data related to purchases, orders, returns, complaints, and support requests

Performance of a contract – Article 6(1)(b) GDPR

Providing the data necessary to create a user account is optional but required to use the personal account area.

Account data is retained until the user requests account deletion or, in the event of inactivity, for a maximum period of 24 months from the last significant interaction, unless further retention is necessary to comply with legal obligations, manage orders, returns, or complaints, or protect the rights of the Data Controller

B)

Creation of the “Wishlist”: to allow the user to save products of interest and view them later

User identification data, if registered; data related to products saved in the wishlist; technical data or cookies

Implementation of pre-contractual measures requested by the data subject – Art. 6(1)(b) GDPR.

Providing this data is optional. Failure to provide it prevents the use of the wishlist feature

For the duration of the wishlist or until the user deletes it

C)

Shopping Cart and Online Purchase Management: to enable product selection, shopping cart management, and the conclusion and fulfillment of the sales contract

Ø  Identification and contact information, such as first name, last name, and contact details provided by the User (for example: email address, phone number, home address, shipping address, or billing address)

Ø  Data related to purchases, orders, returns, complaints, and support requests

Ø  Payment data, limited to the information necessary to process the transaction

Performance of a contract – Article 6(1)(b) GDPR

Providing the data necessary to complete the purchase and to manage the order, payment, shipping, returns, complaints, and customer support is mandatory; failure to provide such data prevents the completion or fulfillment of the order and related services

D)

Transactional emails and service communications: sending order confirmations, shipping updates, delivery notifications, and information regarding returns, refunds, complaints, or warranties

Identification and contact information, email address, data related to the order, shipping, returns, and complaints

Performance of the contract – Article 6(1)(b) GDPR

Providing this data is mandatory in order to receive communications necessary for managing the order or the requested service

For the time necessary to manage the contractual relationship and, subsequently, for the period necessary to protect the Data Controller’s rights or to comply with legal obligations

E)

Management of administrative, accounting, and tax obligations: confirming the order, issuing tax and accounting documentation, and complying with legal obligations

Ø  Identification and contact information, such as first name, last name, and contact details provided by the User (for example: email address, phone number, residential address, shipping address, or billing address

Ø  Any tax data and administrative and accounting documentation

Compliance with legal obligations – Article 6(1)(c) GDPR

Providing this data is mandatory for compliance with applicable regulatory obligations

F)

Soft spam: sending commercial communications regarding products or services similar to those already purchased by the user

Ø  Identification and contact information, such as first name, last name, and email address;

Ø  Purchase- related data.

Article 130(4) of the Italian Privacy Code

Providing data for the purpose of sending commercial communications regarding products similar to those already purchased (soft spam) is not mandatory, and the user may object at any time in accordance with the procedures outlined in the “Rights of the Data Subject” section and, where applicable, within each communication received

Data processed for soft spam purposes is retained until the user objects or until the conditions justifying the processing no longer apply

G)

Abandoned shopping cart: to send a reminder regarding the uncompleted shopping cart, in order to help the user complete the purchase they have already started

Ø  Identification and contact information, such as first name, last name, and email address

Ø  Data related to website usage and products viewed or added to the shopping cart

Legitimate interest – Article 6(1)(f) GDPR

Providing data for the purpose of sending communications regarding abandoned shopping carts is not mandatory, and the user may object at any time in accordance with the procedures outlined in the “Data Subject Rights” section and, where applicable, within each communication received

The data processed for sending communications regarding abandoned shopping carts is retained for the time strictly necessary to send the reminder and, in any case, no longer than 7 days from the initiation and failure to complete the purchase process, unless the user objects or further retention is necessary for technical, contractual, or rights protection purposes

A)

Handling Contact Requests: responding to requests for information sent to a dedicated email address

Identifying and contact information, such as first name, last name, email address, and phone number; the content of the request; any additional information voluntarily provided by the user

Legitimate interest – Article 6(1)(f) GDPR

Providing this data is optional, but necessary to allow Clayton Italia to respond to the request

The data is retained for as long as necessary to handle the request and, subsequently, for the period necessary to protect the rights of the Data Controller

A)

Sending marketing communications: to allow users to subscribe to the newsletter, manage the subscriber list, and send informational, commercial, and promotional communications regarding Clayton Italia’s products, news, offers, promotions, events, initiatives and activities, as well as advertising material, invitations to events, commercial initiatives, market research, satisfaction surveys and communications regarding products that may be of interest to the user

Ø  Identification and contact information, such as first name, last name, and email address

Ø  Data related to interactions with sent communications, such as opening emails, clicking on links, content viewed, any bounces, unsubscriptions, or reports of non-receipt, used for the technical and operational management of the service. Any use of such data for personalization or commercial profiling purposes is subject to the provision of specific consent to profiling as described below)

Ø  Data relating to purchases, orders and returns

Ø  Data related to commercial preferences, consents granted, and interactions with marketing communications

Consent – Article 6(1)(a) GDPR

Providing data for marketing purposes, including newsletter subscription, is optional. Failure to provide consent, revocation of consent, or exercising the right to object will not affect your ability to browse the website, create an account, make purchases, or use the requested services. However, providing an email address is necessary to receive the newsletter.

Consent may be revoked at any time, in accordance with the procedures outlined in the “Rights of the Data Subject” section of this privacy policy and, where applicable, via the unsubscribe link included in the communications you receive.

Data processed for marketing purposes will be retained for a period of 24 months from the date consent is obtained or until consent is revoked, whichever occurs first.

B)

Technical and operational management of campaigns: managing the sending of communications via email marketing platforms, CRM systems, and automated campaign management tools; recording consents, revocations, unsubscriptions, bounces, or reports of non-receipt

Ø  Identifying and contact information, such as first name, last name, and email address

Ø  Data relating to purchases, orders and returns

Ø  Data related to commercial preferences, consents granted, and interactions with marketing communications

Ø  Data related to website usage, products viewed, added to the cart, or purchased, where processed for analytics or personalized marketing purposes

Consent – Article 6(1)(a) GDPR

Providing data for marketing purposes is optional. Failure to grant consent, revoking consent, or exercising the right to object does not affect your ability to browse the website, create an account, make purchases, or use the requested services.

Consent may be revoked at any time, in accordance with the procedures outlined in the “Data Subject Rights” section of this policy and, where applicable, via the unsubscribe link included in the communications you receive

Data processed for marketing purposes will be retained for a period of 24 months from the date consent is obtained or until consent is revoked, whichever occurs first

A)

Analysis of preferences and purchasing habits: to analyze, subject to consent, the user’s shopping preferences, product categories of interest, purchases made, and products viewed, added to the cart, or purchased

Ø  Identification and contact information, such as first name, last name, and email address

Ø  Data relating to purchases, orders and returns

Ø  Data related to commercial preferences and consents granted

Ø  Data related to interactions with communications sent, such as opening emails, clicking on links, content viewed, any bounces, unsubscriptions, or reports of non-receipt

Consent – Article 6(1)(a) GDPR

Providing data for profiling purposes is optional. Failure to provide consent, revocation of consent, or exercising the right to object will not affect your ability to browse the website, create an account, make purchases, or use the requested services. If consent for profiling is not provided, Clayton Italia will not use the User’s data to analyze preferences, behaviors, or purchasing habits in order to personalize communications, offers, or content.

Consent may be revoked at any time, in accordance with the procedures outlined in the “Data Subject Rights” section of this privacy policy and, where applicable, via the unsubscribe link included in the communications you receive.

Data processed for profiling purposes will be retained for a period of 24 months from the date consent is obtained or until consent is revoked, whichever comes first.

B)

CRM Management: organizing and managing, within the CRM systems used by Clayton Italia, information regarding users and customers, consents granted, and marketing preferences

Ø  Identifying and contact information, such as first name, last name, and email address;

Ø  Data regarding consents granted, revocations, objections, preferences expressed, and interactions with Clayton Italia

Legitimate interest – Article 6(1)(f) GDPR

Providing data for profiling purposes is optional. Failure to provide consent, revocation of consent, or exercising the right to object will not affect your ability to browse the website, create an account, make purchases, or use the requested services. If you do not consent to profiling, Clayton Italia will not use your data to analyze preferences, behaviors, or purchasing habits in order to personalize communications, offers, or content.

Consent may be revoked at any time, in accordance with the procedures outlined in the “Data Subject Rights” section of this privacy policy and, where applicable, via the unsubscribe link included in the communications you receive.

Data processed for profiling purposes will be retained for a period of 24 months from the date consent is obtained or until consent is revoked, whichever occurs first.

A)

Management of official social media profiles: managing Clayton Italia’s official pages, profiles, and accounts on social media; managing comments, reactions, messages, and other interactions made available by social media platforms

Identifying and contact information, such as first name, last name, username, nickname, profile ID, profile picture, and other data publicly available on the user’s social media profile

Legitimate interest – Article 6(1)(f) GDPR

Providing data via social media is optional and depends on the user’s free choice to interact with Clayton Italia’s social media profiles or to send communications through these channels

Data processed in connection with interactions via social media is retained for as long as necessary to manage the request, interaction, or activity for which it was collected.

Content posted directly by the user on social media platforms remains subject to the retention and deletion rules established by the respective platforms

B)

Promotion of brand content and initiatives: publishing and promoting content, campaigns, events, commercial initiatives, or communications related to the brand through official social media profiles

Identifying and contact information, such as first name, last name, username, nickname, profile ID, profile picture, and other publicly available data on the user’s social media profile

Legitimate interest – Article 6(1)(f) GDPR

Providing data via social media is optional and depends on the user’s free choice to interact with Clayton Italia’s social media profiles or to send communications through these channels

Data processed in the context of social media interactions is retained for as long as necessary to manage the request, interaction, or activity for which it was collected.

Content posted directly by the user on social media platforms remains subject to the retention and deletion rules established by the respective platforms

5. DISCLOSURE OF DATA TO RECIPIENTS

Your personal data may be disclosed to internal parties who work under the direct supervision of the Data Controller and who, for this reason, have been designated by the Data Controller as authorized to process the data (pursuant to Article 29 of EU Regulation 2016/679) and have been duly instructed. The data may also be disclosed to external parties, identified in writing as Data Processors (pursuant to Article 28 of EU Regulation 2016/679) by the Data Controller. Certain third parties may process personal data as independent data controllers, such as payment providers, social media platforms, advertising platforms, or other entities that independently determine the purposes and means of processing. In such cases, the processing will also be governed by their respective privacy policies. The updated list of Data Processors is available by writing to privacy@claytonitalia.it

6. DATA TRANSFERS

Personal data may also be processed by service providers established outside the European Economic Area or by service providers that use infrastructure, subcontractors, or services located in third countries.

In such cases, the transfer of personal data will take place in accordance with Articles 44 et seq. of the GDPR, based on an adequacy decision by the European Commission, the recipient’s adherence to recognized mechanisms such as the EU-U.S. Data Privacy Framework (where applicable), the signing of standard contractual clauses approved by the European Commission, or other safeguards provided for by applicable law.

Further information on the safeguards applied to transfers may be requested by writing to the following email address: privacy@claytonitalia.it

7. METHODS OF PROCESSING

Your data is processed electronically, including through the use of electronic means, either directly and/or through authorized third parties. The data controller has identified all parties who will process your personal data and has duly designated them as authorized processors, in accordance with Article 29 of EU Regulation 2016/679, providing them with specific processing instructions. The authorized data processors will act under the direct supervision of the Data Controller, in compliance with the principles of lawfulness, fairness, and confidentiality, as well as the provisions of Article 32 of EU Regulation 2016/679 regarding security measures. 

8. RIGHTS OF DATA SUBJECTS

Pursuant to Articles 15 through 22 of EU Regulation 2016/679, ESSEMODA S.r.l. hereby informs you that you have the right to request, by sending an email to privacy@claytonitalia.it, access to your personal data, the rectification or erasure of such data, or the restriction of processing concerning you, or to object to the processing of your personal data, in the cases provided for by law. You may also exercise your rights by sending an email to the Data Protection Officer at the following email address: dpo@agilae.it.  Furthermore, if you believe that the processing of your personal data violates the provisions of EU Regulation 2016/679, you may always file a complaint with the Data Protection Authority using the form and procedure indicated on the website www.garanteprivacy.it.