Purpose and legal basis of processing
We may process personal data to:

• allow you to browse the Site and use its functions, on the basis of the need to provide the services you have requested (Art. 6 (1) (b) GDPR);
• ensure the correct functioning of the Site and monitor its use in aggregate, on the basis of the Controller’s legitimate interest to monitor and improve its services (Art. 6 (1)(f) GDPR);
• comply with legal obligations to which we are subject on the basis of the need to fulfil legal obligations (Art. 6 1(c) GDPR);
• prevent and ascertain cybercrimes, as well as to ascertain, exercise or defend a right in judicial or extra-judicial proceedings, on the basis of the legitimate interest of the Data Controller or of third parties in the protection of their rights and interests (Art. 6 (1)(f) GDPR).

Over time, OVS may make artificial intelligence tools available to facilitate browsing on the Site. These tools will be optional and will only be activated at your initiative by clicking on the relevant icons. Processing may concern content you have entered, and will be carried out for the same purposes and in the same manner as described herein. Further information will be made available directly within the tools themselves.

Categories of processed data
We may process data relating to your connection to and browsing within the Site (IP address, device identifiers, details of the operating systems and features of the device used, preferences concerning cookies and other trackers, dates of access to the Site, language and browsing country).
Additionally, depending on the functions of the Site you choose to use, we may process additional personal data strictly necessary to provide you with the services you have requested.
These data are also collected through cookies and other tracking tools installed on the Site. If you want to find out more about this, please see Cookie Policy.

Optional / Compulsory processing
The provision of data is optional, but necessary. Failure to provide data would make it impossible to browse the Site correctly or to use certain functions.

Data retention
Data will be deleted no more than 14 (fourteen) months from the date of their collection, unless legal provisions, official measures or the existence of a dispute require a longer data retention period. For more details on the duration of individual cookies and trackers, please see our Cookie Policy.

♦ Focus box – Geolocation for 'Find a Store’
While you are browsing the Site, you can decide to authorise the Site to know your location so that OVS can find your nearest store. This function will only be available if you consent to the processing of your location data (Art. 6 (1) (a) GDPR). You are absolutely free to withhold your consent: in this case, you can only search for stores via the search bar. OVS will not store your location details unless you select the 'favourite store' option.

Purpose and legal basis of processing
We may process personal data to:

• manage and respond to your requests for assistance, reports, enquiries, complaints, questions regarding product warranties or the use of our services, based on the need to provide the services you have requested and, where applicable, to perform our contractual obligations (Art. 6 (1) (b) GDPR);
• comply with legal obligations to which we are subject on the basis of the need to fulfil legal obligations (Art. 6 (1)(c) GDPR);
• ascertain, exercise or defend a right in judicial or extra-judicial proceedings, on the basis of the legitimate interest of the Controller or of third parties in the protection of their rights and interests (Art. 6 (1)(f) GDPR).

Categories of processed data
We can only process the data strictly necessary to provide you support (for example, your personal details, contact details and information about an order), as well as the information in your request.

Optional / Compulsory processing
You are absolutely free to choose whether or not to provide us with your data. However, the disclosure of your personal data is necessary to enable us to respond to your request. In the absence of your data, we will not be able to follow up.

Data retention
The data will only be stored for as long as it is necessary to process your request or to provide you with the requested information. This is without prejudice to the possibility of retaining your data for a longer period should it be necessary for legal or judicial protection or in the event of a dispute.

Purpose and legal basis of processing
We may process personal data to:

• allow you to proceed with the purchase of products, including our Gift Cards, and to manage the relevant contractual relationship, based on the necessity to execute the contract or to implement precontractual measures at your request (Art. 6 (1) (b) GDPR),
• comply with legal obligations to which we are subject on the basis of the need to fulfil legal obligations (Art. 6 (1)(c) GDPR);
• prevent and combat fraud, as well as ascertain, exercise or defend a right in judicial or extra-judicial proceedings, on the basis of the legitimate interest of the Controller or of third parties in the protection of their rights and interests (Art. 6 (1)(f) GDPR).

We may also carry out such processing in-store, in the event that the product you want is not available in the store itself and you decide to order it in-store, or if you request a digital receipt..

Categories of processed data
We may process personal data (first and last names), contact details (address, email, telephone number), ecommerce order details, and information on the means of payment used to make the purchase. In the case of digital receipts, only your name and email address will be processed.

Optional / Compulsory processing
You are absolutely free to choose whether or not to provide us with your data. However, in order to proceed with the purchase, it is necessary to complete all fields marked as obligatory (*), without we cannot complete the purchase. Failure to enter the data marked as ‘optional’ will not prevent purchase or have any consequences.

Data retention
Depending on the purpose of data collection and/or processing activities, data will be stored on the basis of the following criteria:

• the time necessary to fulfil the contractual obligations and for the duration of the applicable limitation period (up to 10 (ten) years from the execution of the contract);
• in the case of digital receipts, for 1 (one) year from the issue of the digital receipt;
• the time necessary to fulfil legal and regulatory obligations, including those relating to taxation or accounting (invoicing, bookkeeping and accounting entries);
• in the event of disputes, for the duration of same

♦ Focus box – Save your faves
OVS provides some optional functions that will let you save the items that you are interested in. Each function is only activated by your voluntary action (e.g. a click on the appropriate icon). Specifically:
- the 'Cart’ function lets you collect the items you want to purchase;
- the ‘Wishlist’ function lets you store your favourites on a wishlist so that you can find them again quickly another time.
This processing is required to allow you to use the functions you require (Art. 6 (1) (b) GDPR), compliant with the data retention periods on the Site.

Purpose and legal basis of processing
We may process personal data to:

• - manage your participation in the CROFF loyalty programme based on the need to execute the CROFF loyalty programme(art. 6, par. 1, lett. b) GDPR);
• comply with legal obligations to which we are subject on the basis of the need to fulfil legal obligations (Art. 6 (1)(c) GDPR);
• ascertain, exercise or defend a right in judicial or extra-judicial proceedings, on the basis of the legitimate interest of the Controller or of third parties in the protection of their rights and interests (Art. 6 (1)(f) GDPR).

Categories of processed data
We may process personal and contact details (first and last name, date of birth, postal address, email, telephone no.) as stated in the online registration form or available in “CROFF” stores; data about discounts and points awarded.
To share the benefits of the CROFF loyalty programme with friends and family, we may ask you to enter some of their personal details. In this case, you need to ensure that these people are duly informed of this treatment of their personal details.

Optional / Compulsory processing
You are free to choose whether or not to provide us with your personal data; if you choose to provide us with this information, complete the form by filling out all the mandatory fields (*) which are necessary to register for the loyalty programme.

Data retention
Personal data will be kept for as long as necessary to manage your participation in the loyalty programme, until you decide to unsubscribe from the programme. However, OVS may store the data for a longer period if necessary to fulfil its legal and/or accounting obligations, and, if longer, for the duration of any dispute in which such personal data are relevant.

Purpose and legal basis of processing
We may process your personal details for marketing purposes, based on your consent , if given (Art. 6 (1) (a) GDPR), sending you advertising, commercial and market research material for products, services, initiatives and promotions from OVS, including the different OVS brands (a full, updated list is available from www.ovscorporate.it).
Communication may take place using traditional means of contact (surface mail, telephone call with operator) or automated means (email, text, push notifications, and other electronic communications), and even via social media and other digital channels (including WhatsApp).
You can withdraw your consent at any time, writing to customercare@croff.it, changing the preferences in your account on the Site, using the contact form on the Site or clicking on the unsubscribe link in the footer of the marketing email. In the event you withdraw your consent to marketing activities, this withdrawal shall apply to any mode of contact (whether automated or not), unless you indicate otherwise.

Categories of processed data
We may process your personal details (first and last name), contact details (email address, telephone no.), choices with regard to marketing, purchasing, and products stored in your cart or wishlist.

Optional / Compulsory processing
You are absolutely free to give consent or not: your decision not to consent to marketing activities will have no consequences.

Retention period
Personal data will be stored until you withdraw your consent. In that case, the data will be promptly deleted.

Purpose and legal basis of processing
We may process your personal details for profiling purposes, based on your consent , if given (Art. 6 (1) (a) GDPR), in order to analyse your preferences, habits, interests, and purchasing behaviour. This processing serves to customise our commercial offer, improve the services we offer you and send you promotional communications in line with your interests, for all OVS brands (see www.ovscorporate.it for more details).
In addition, your data will be used to check the impact of online campaigns on in-store purchases and the creation of control groups (users who do not receive communications) for comparative statistical purposes. You can withdraw your consent at any time, writing to: customercare@croff.it, changing the preferences in your account on the Site, using the contact form on the Site. If you revoke your consent to marketing, this will automatically be deemed to extend to profiling processing as well.

Categories of processed data
We may process your personal details (first and last name, sex and age, country of origin), contact details (email, telephone no.), marketing and profiling choices, purchases, interactions with OVS through the Site, the apps and other OVS properties, details concerning participation in the CROFF loyalty programme.

Optional / Compulsory processing
You are absolutely free to give consent or not: your decision not to consent to profiling activities will have no consequences.

Data retention
Personal details will be retained for up to 24 months from their collection, unless you decide to withdraw your consent. In that case, the data will be promptly deleted.

Purpose and legal basis of processing
We may process personal data in order to send you short surveys aimed at measuring your satisfaction in relation to a recent interaction with OVS (such as a purchase or an interaction with Customer Service), on the basis of OVS's legitimate interest in monitoring and improving the efficiency and quality of its services (Art. 6 (1)(f) GDPR).

Categories of processed data
We may process contact details (name, email address) and information concerning a specific transaction or interaction.

Optional / Compulsory processing
You are absolutely free not to provide your data: processing will only take place where you decide to click on the bar/button included in the email. You may, however, object to receiving such communications by clicking on the unsubscribe link in the footer of the communication.

Data retention
Personal data will be stored unencrypted for a maximum period of 12 months after their collection, in order to handle any follow-up on your specific case. Subsequently, the data will be irreversibly anonymised or aggregated for exclusive statistical and historical analysis purposes.

Purpose and legal basis of processing
We may process personal data to allow you to register on the Site by creating a reserved area ('account') and guarantee your access to same, as well as to use the connected functions, based on the need to provide the services you require (Art. 6, (1) (b) GDPR).

Categories of processed data
We may process emails, passwords, purchases, registration of marketing and profiling preferences, as well as other information that you decide to save on your account.
You can also access your account via ‘social login’ using your social media accounts. In this case, your social media accounts will only share the necessary authentication data with OVS.

Optional / Compulsory processing
Data provision is optional, but failure to provide certain data marked as mandatory (*) during registration will mean that the registration cannot be finalised.

Data retention
Your account and the data stored there will be deleted in the event of non-use of the account for more than 5 (five) years from the last access. This is without prejudice, in any case, to the possibility to store some data for longer, in the event that legal provisions, administrative measures, or the existence of a dispute should require a longer retention period.

Purpose and legal basis for processing
We may process your personal details to collect, assess and manage your application through the portal “Careers”, on the basis of the need to execute precontractual measures concerning your request (Art. 6 (1)(b) GDPR and Art. 111-bis Privacy Code).

Categories of processed data
We may process your personal details (first and last name, sex and age), contact details (email address, telephone number), photo, details of previous work experience and any other information you enter in your curriculum, registration details in the “Careers” area. Please do not enter sensitive data, such as information concerning your health or trade union membership.

Optional / Compulsory processing
If you do not wish to provide the personal data required, or if you do not complete fields marked as obligatory (*) in the “Careers” portal, we will not be able to take your application into consideration.

Data retention
Personal data will be retained for up to 12 months from their collection.

Purpose and legal basis of processing
We may process your personal details to analyse your application to become an affiliated OVS partner and franchise candidate when you complete the ‘Franchising’ section, based on the need to execute precontractual measures at your request (Art. 6 (1)(b) GDPR).

Categories of processed data
We may process personal details (first and last name, age), contact details (email address, telephone no.), information on the venue, and other information you decide to share with OVS.

Optional / Compulsory processing
In the event that you do not wish to provide the requested personal data, or fail to complete the fields marked as obligatory (*) within the 'Franchising' section, we will not be able to consider your request.

Data retention
Personal data will be retained for the time strictly necessary to respond to your request.

Purpose and legal basis of processing
We may process personal data in order to allow the performance of any extraordinary corporate transactions (such as mergers, acquisitions, disposals, transfers of assets or business units, reorganisations, restructurings, due diligence) involving OVS, on the basis of the legitimate interest of OVS in the performance of corporate transactions (Art. 6. par. 1(f) GDPR).

Categories of processed data
We may process any information already collected by OVS within the context of other processing described and which may become necessary according to a criteria of proportionality and data minimisation.

Optional / Compulsory processing
Whether or not processing is optional will vary depending on the purpose of the original collection. You may in any event object to processing, subject to the conditions and in the manner set out below.

Data retention
Personal data will be stored throughout the company operation.