Privacy policy

Security measures

DAINESE adopts appropriate security measures  to minimize the risks of destruction or loss, even accidental, of Personal Data, unauthorized access, or processing that is not permitted or does not comply with the purposes of collection.  

Such measures include, for example, the use of authentication credentials (username, password) by those accessing data on behalf of DAINESE, the configuration of authorization profiles aimed at limiting access to only previously authorized legal entities and individuals, periodic review of such authorization profiles, the use of backup and restore procedures, server- and client-level antivirus software updated daily, firewalls, and intrusion prevention software. The email archive is protected by antivirus and anti-spam software. Furthermore, the Site is based on HTTPS technology, which is a protocol for secure communication across a computer network used on the Internet. HTTPS consists of communication via the HTTP (HyperText Transfer Protocol) protocol within a connection encrypted by Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL). The underlying principle of HTTPS is to achieve: i) authentication of the website visited, ii) protection of privacy, iii) integrity of data exchanged between the communicating parties. The newsletter delivery system is also protected by anti-spam and antivirus software. The data is stored in archives that are backed up daily on media stored in secure locations.

4. Purpose and legal basis of the processing

The  purposes  of the processing are:

Does the data subject's consent to processing for profiling and direct marketing purposes also apply to the disclosure of data to third parties? 

The communication of data by DAINESE to third parties for direct marketing purposes may be intended, depending on the case, to other companies within the Group or to third parties who, within the scope of  the same shared marketing activities  and/or within the scope of the same processing for direct marketing purposes (e.g. in relation to co-branded marketing initiatives), collaborate with DAINESE, or are  contractually delegated to transmit commercial communications to the interested party  and/or  to process the data received  for marketing purposes  on behalf of the Data Controller .

In the aforementioned two cases, the third-party recipients of the data, since they are designated in writing as "external data processors" by DAINESE, may process the data on behalf of DAINESE based on the same specific marketing consent (including the consent to communication to third parties for such purposes) already granted to DAINESE. 

Conversely, consent to data processing for marketing purposes provided by the data subject to DAINESE does not automatically legitimize the  communication or transfer of data by DAINESE to third parties who process them as joint controllers or independent controllers  (i.e., other than as an external data processor)  (as a rule, this only occurs with third-party partners who intend to use the data independently for profiling and/or direct marketing purposes). Therefore, to proceed with such communication to third parties, DAINESE must obtain further  , separate, additional , documented, express, and also optional consent from the data subject.

5. Duration of treatment

Personal Data will be retained in a form that permits the identification of the User for the time strictly necessary for the purpose for which the data was collected and subsequently processed and, in any case, within the limits of the law, as follows. 

Personal browsing data is processed for the time necessary to ensure navigation and technical interaction between the user and the Site; this period coincides with the duration of a  single  browsing session. 

a) in the  pre-contractual phase , for the time necessary to process the interested party's requests received by the Company (e.g., opening a warranty service ticket) and to track and manage the success of the responses sent by the Company to the interested party; this duration is limited to  24 months  from the date of collection of personal data; 

b) in relation to any  contract  stipulated with the interested party, for the entire duration of the same (in particular, as a minimum, for the  2 years  of ordinary guarantee pursuant to the Consumer Code); 

c)  After the termination of the contractual relationship  established with the interested party, personal data will be processed to fulfill all legal obligations related to the terminated contractual relationship and in any case until the expiration of the civil term for the action for compensation for damages to which the interested party is entitled pursuant to art. 2946 of the Italian Civil Code (for  10 years  from the termination of the contract).  

Personal data will be processed for  IT security purposes  (e.g., recording, storing, and analyzing logs of electronic and telematic events triggered by the User through interaction with the Site's features and/or sending emails to DAINESE). Data will be retained for a period of time sufficient to complete appropriate security checks and evaluate their results (18 months from the date of collection), or, in the event of any anomalies detected, for the time necessary to resolve them using appropriate solutions. 

In the event of a  judicial or extrajudicial dispute  with the interested party and/or third parties, the data will be processed for the time strictly necessary to exercise the full protection of the Data Controller's rights (i.e., until a judicial or extrajudicial settlement or a final judgment has exhausted the dispute). 

In the case of processing for  Marketing Purposes , the duration is as follows: 

a) in the case of basic profiling, the processing, being based on DAINESE's legitimate interest in using the results to plan, implement and verify the effectiveness of direct marketing campaigns based on the same, will last until the interested party objects; 

in the case of advanced profiling, based on the prior specific consent of the interested party, the processing will take place for the shorter of 3 years and the date of any early revocation of consent by the interested party;  

- for direct marketing purposes  , processing will last for different periods depending on whether it is based on DAINESE's legitimate interest (so-called soft spam towards customers) or on the data subject's consent; in the former case, it will last until the data subject objects, while in the latter case, it will last until the previous consent is revoked.  

In the event that DAINESE collects and records logs derived from actions through which the user of the DAINESE website expresses his or her consent or refusal to the processing of data for direct marketing purposes and any advanced profiling (e.g., clicking on online fields, filling in flags, continuing browsing after viewing a cookie banner, and the like), the relevant retention will continue for the time necessary to demonstrate to the supervisory authorities the content of the relevant declaration of intent. 

After the aforementioned period, DAINESE undertakes to permanently delete the Personal Data from its electronic archives. Alternatively, they reserve the right to anonymize the data at any time, in which case the privacy regulations will no longer apply.

6. What happens if you do not provide DAINESE with your personal data?

From time to time, during your interaction with DAINESE, we will inform you whether providing Personal Data to DAINESE is mandatory or optional. Providing Personal Data to DAINESE for the respective Commercial Purposes (in particular, your personal details, your email or postal address, your credit/debit card and bank details, and your telephone number) is necessary for the pursuit of the same.

Any refusal to provide DAINESE with certain Personal Data necessary for these purposes may therefore make it impossible to respond to pre-contractual requests for information on our products and services, enter into and/or execute the purchase contract for products and services on the Site, or correctly fulfill the related legal and regulatory obligations. 

 Providing additional Personal Data, other than the mandatory ones, is optional and does not entail any obligation, disadvantage, or consequence for the User relating to the purchase of products or services on the Site. 

Providing Personal Data for Marketing Purposes, or the data subject's consent where required by law for the lawfulness of processing, is always optional and—except as otherwise specifically indicated in our  Cookie Policy  regarding DANIESE's use of cookies and other similar identifiers such as pixels or tags—is generally connected to the User's registration process on the Site. Failure to provide such data, or failure to consent to processing for Marketing Purposes, will not have any detrimental consequences on the purchasing process, which will therefore continue as normal. It will merely make it impossible to complete the respective registration and therefore benefit from DAINESE services such as newsletters, general or personalized commercial offers, and/or access to reserved promotional areas, where direct marketing activities take place from time to time.

7. To whom we disclose Personal Data

Personal Data may be made available to third-party companies that perform specific services on behalf of DAINESE, acting as Data Processors, or disclosed to other third parties who process the data independently, solely to allow the conclusion and/or execution of the purchase contract for products on the Site and only when such purpose is not incompatible with the purposes for which the Personal Data was collected and subsequently processed and, in any case, in compliance with the law. 

Specifically, DAINESE uses suppliers who provide after-sales service, as further described in the Site's Terms of Sale, which can be found at the following  link . DAINESE also uses carriers and couriers (UPS, DHL, etc.) or logistics service providers to carry out shipping, who will process Users' personal data solely for the purpose of completing the service entrusted to them. 

The data may also be communicated to: 1) banks, electronic money institutions, or other entities authorized to perform remote electronic payment services, via credit/debit card or through features made available via mobile devices; 2) insurance companies (for transportation insurance coverage; 3) other companies, entities, and/or individuals who perform activities that are instrumental, supportive, or functional to the execution of the contracts or services requested by you (e.g., companies responsible for managing the Website, companies that provide maintenance and assistance in relation to the Data Controllers' databases).  

Personal Data is communicated to accountants, lawyers and law firms, auditing firms and/or auditors, who carry out, in various capacities, based on the directives previously issued by DAINESE, the activities necessary to ensure compliance with legal obligations relating to the sale of goods and services through the Site.  

Personal Data may be disclosed to the police or judicial authorities, in accordance with the law and upon formal request by such entities, for example, in the context of anti-fraud services, or even in the absence of a specific request, for compliance with tax obligations (e.g., the Italian Revenue Agency). For Marketing Purposes, DAINESE also discloses Personal Data to third-party companies that are external data processors: marketing and advertising agencies, hosting service providers, website development and management companies, web marketing companies, electronic communications and ICT service providers; and third-party commercial partners—even those operating in production sectors not included in the e-shop, such as those in the automotive sector—with whom DAINESE engages in co-marketing or event management activities.  

In the event of accidents involving DAINESE's product liability, personal data may be disclosed to third parties responsible for managing the related claim (e.g., law firms, but also technicians, insurance companies that provide the relevant insurance policy activated in relation to the claim itself). 

In the event of a sale to a third party of the company or business unit to which the Site belongs, the user's personal data will automatically be transferred to the buyer. In the event of a sale to a third party of a controlling interest in DAINESE's share capital, the personal data may be disclosed to the buyer(s). 

Personal Data  will not be disseminated, i.e. made available to an uncontrolled number of third parties.

8. Social network features and joint data controllership

Our website may use social media features, such as the Facebook "Like" button, the "Tweet" button, and other sharing widgets ("Social Media Features"). Social Media Features may allow you to post information about your activities on the DAINESE website on external platforms and social media. Social Media Features may also allow you to "like" or highlight information we've posted on the DAINESE website or on DAINESE's official social media pages.  

Social Network Features are hosted by each respective social media platform or directly on our website. To the extent that Social Network Features are hosted by the platforms themselves and you click on them from our website, the platform may receive information indicating that you have visited our sites.  

If you are logged in to your social media account, the respective social network may be able to link your visit to our website to your social media profile. DAINESE acts as joint data controller pursuant to Art. 26 of the GDPR, solely with respect to the collection on our website and the automatic transmission to social media platforms of personal data of users of our website, whether registered with those social media platforms or not. 

 With regard to its Facebook pages https://www.facebook.com/dainese and Instagram https://www.instgram.com/dainese, DAINESE is joint controller of the statistical data together with Facebook Ireland Limited (“Facebook Ireland”). 

 DAINESE may also share certain data (name, surname, email) with third-party social media platforms (e.g., Facebook, Google), which use it for the sole purpose of identifying other people similar to the user who may be interested in DAINESE services and/or products, in order to advertise them through social media platforms. Further information on DAINESE's remarketing policies (so-called behavioral advertising) can be found in our Cookie Policy. 

Your interactions with the Social Network Features are governed both by this information notice (limited to the processing as above in joint ownership) and by the functionality (for any aspect of the processing of personal data not included in the aforementioned joint ownership regime).

• SHOPIFY Inc. , located at 151 O'Connor Street, Ground floor, Ottawa, ON K2P 2L8, Canada, provides e-commerce services for TCX branded products and services. For Salesforce Inc.'s privacy policy, see  https://shopify.com/legal/privacy .
• Shopify Inc. is a company registered with the competent American body under the EU-US “Privacy Shield” convention. 
• SALESFORCE Inc. , located at The Landmark @ One Market Street, Suite 300, San Francisco, California 94105, USA, provider of the e-commerce service called SALSERFORCE COMMERCE relating to DAINESE branded products and services. For Salesforce Inc.'s privacy policy, see the URL:  https://www.salesforce.com/it/company/privacy/ .
• Salesforce is a company registered with the competent American body under the EU-US convention called “Privacy Shield”. 
• SugarCRM Inc. , located at  10050 N Wolfe Road, SW2-130 Cupertino, 95014 CA – California (USA), is a CRM (“customer relationship management”) service provider. For SugarCRM Inc.'s privacy policy, see the URL:  https://www.sugarcrm.com/legal/privacy-policy . 
• SugarCRM Inc. is a company registered with the competent American body under the EU-US convention called “Privacy Shield”.
• HubSpot Inc. , headquartered in Cambridge, Massachusetts, USA, provides CRM (customer relationship management), DEM (sending promotional emails and newsletters), lead acquisition/web forms, and landing pages. For HubSpot Inc.'s privacy and cookie policy, see https://legal.hubspot.com/product-privacy-policy  and  https://knowledge.hubspot.com/articles/kcs_article/account/hubspot-cookie-security-and-privacy  . HubSpot Inc. is registered with the competent American body under the EU-US Privacy Shield agreement; 
• Aircall SAS , located at 11-15, rue Saint Georges, 75009 Paris, provides the VoIP telephony service used by customer services. Aircall transfers data to the USA. For the privacy policy, see the URL  https://aircall.io/privacy/  
• YotPO  , located at 400 Lafayette St, New York, NY, USA, is the provider of the review collection service. For the privacy policy, see the URL  https://www.yotpo.com/yotpo-privacy-guide/  
• OneTrust,  headquartered in London (co-headquarters) at Dixon House, 1 Lloyd's Avenue, London, EC3N 3DQ, United Kingdom, provides the review collection service. For the privacy policy, see  https://www.onetrust.com/privacy/  
• Facelift,  located at Gerhofstr. 19, 20354 Hamburg, serves as a service provider for optimizing social media management. Facelift transfers data to the USA. For the privacy policy, see the URL  https://facelift-bbt.com/en/data-privacy-policy  
• Microsoft Corporation  with headquarters at 1 Microsoft Way, Redmond, WA – Washington 98052, USA, as provider of the individual productivity cloud application service “Microsoft 365” and/or Microsoft TEAMS video conferencing used in the management of the pre-contractual or contractual relationship with the interested party.
• In particular, as indicated in Annex 1 to the Online Services Terms of Use, with reference to the 365 Service, Microsoft undertakes to store the inactive Company Data processed by DAINESE as follows: “ if the Company provisions its tenant (…) in the European Union, Microsoft will store the following Inactive Company Data only within that Geographic Area: (1) the content of the Exchange Online mailbox (email body, calendar entries and content of email attachments), (2) the content of the SharePoint Online site and the files stored on that site and (3) the files uploaded to OneDrive for Business .” Therefore, for such data, no transfer to the USA takes place or the transfer is purely occasional. See Microsoft’s policy at URL:  https://docs.microsoft.com/en-us/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide , and Microsoft’s privacy policy at URL:  https://privacy.microsoft.com/en-us/privacystatement .
• However, it is possible that other inactive data processed by DAINESE, in particular different from that indicated above, may be transferred from the EU to the USA for the service in question and that their transfer may be non-occasional.

• ask the Data Controller to confirm whether or not personal data concerning him or her is being processed, and, where that is the case, to obtain access to  the personal data;
• Obtain  clear and concise information  regarding the following: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organizations; d) where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period; e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject, or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the personal data are not collected from the data subject, any available information as to their source; h) the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject. 
• where personal data are  transferred  to a third country or to an international organisation, the data subject shall have the right to be informed of the existence of  appropriate safeguards  relating to the transfer; 
• request, and obtain without undue delay, the  rectification  of inaccurate data; taking into account the purposes of the processing, the integration  of incomplete personal data, including by providing a supplementary statement; 
• Request the  erasure  of your data if: a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; b) the data subject withdraws consent on which the processing is based and there is no other legal basis for the processing; c) the data subject objects to the processing and there are no overriding legitimate grounds for the processing, or the data subject objects to processing for direct marketing purposes (including profiling for such direct marketing); d) the personal data have been unlawfully processed; e) the personal data must be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject; f) the personal data were collected in relation to the offer of information society services. Deletion from the DAINESE database
• Request  restriction  of processing concerning the data subject where one of the following applies: a) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; c) the controller no longer needs the personal data for the purposes of the processing, but the data subject requires the personal data for the establishment, exercise or defense of legal claims; d) the data subject has objected to processing for direct marketing purposes, pending the verification whether the legitimate grounds of the controller override those of the data subject. 
• obtain from the data controller, upon request,  communication of the third-party recipients  to whom the personal data have been transmitted;
• Revoke your consent at any time  to the processing of your personal data, if previously provided, for one or more specific purposes. It is understood that this will not affect the lawfulness of processing based on consent given before its revocation.
• In particular,  to revoke the consent previously given to DAINESE, the interested party can send a specific request in one of the following ways: i) by following the cancellation instructions indicated at the bottom of each email message, or ii) by sending an email to privacy@dainese.com containing the request.
• receive the personal data concerning the data subject, which he or she has provided to the Data Controller, in a structured, commonly used, and machine-readable format and, if technically feasible, to have that data transmitted directly to another data controller without hindrance from the Data Controller to whom the personal data were provided, if the following (cumulative) condition applies: a) the processing is based on the data subject's consent for one or more specific purposes, or on a contract to which the data subject is party and for whose performance the processing is necessary; and b) the processing is carried out by automated means (software) (collective right to " portability "). The exercise of the right to portability is without prejudice to the right to erasure provided above;
• The data subject has the right  not to be subject to a decision based solely on automated processing , including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her. Automated decision-making does not currently occur on our websites or services.
• The interested party may also lodge a complaint at any time   with the competent supervisory authority under the GDPR (that of his or her place of residence or domicile).