Legal Area

Who are the Data Controllers?

The Data Controllers are:

• KARL LAGERFELD B.V. (Besloten vennootschap) (Besloten vennootschap) with headquarters at ​Herengracht 182, 1016 BR, The Netherlands, Amsterdam, Tax Code and VAT no. NL 850960678B01 (KARL LAGERFELD),

and


• YOOX NET-A-PORTER GROUP S.p.A., company subject to the management and coordination of Compagnie Financière Richemont S.A., with registered office at via Morimondo 17, 20143– Milano (MI), Italia ("YNAP").

The categories of personal data that we collect and process when you browse or purchase on www.karl.com, are as follows:

1. the personal data necessary to conclude and execute your purchase or to use the Omni-Channel Services on www.karl.com such as name and surname, email address, shipping address, billing address, telephone and payment details;
2. your email address when you sign up for our newsletter service;
3. the personal data you provide when you contact our Customer Care to provide the assistance requested or when you send your résumé to KARL LAGERFELD;
4. with your consent, your personal data for commercial communications;
5. for the registration of your My Account, your name and surname, your email address, password and your date of birth. If you are a registered user, we collect information about your access to the reserved area of the site. By express consent, through the analysis of your personal data, we can process information regarding your interests and preferences with respect to our products and services, in order to present proposals and offers in line with your tastes.
6. information about your browsing on www.karl.com, such as the pages you visit and how you interact with the single page. We save this information on our servers. We inform you that we do not process personal data relating to minors. If you access www.karl.com and use the services offered by us you declare that you are of legal age.

We collect and process your personal data for the following purposes:

1. To conclude and execute the purchase agreement for the products offered on www.karl.com. When you complete your purchase, we ask you for the personal data necessary for the execution of the agreement, such as payment, anti-fraud checks if you choose to pay by credit or debit card, billing, shipping of the product and possible management of the return.
2. Registration on the site and use of the services offered to registered users. Registration on the site is possible through the inclusion of some personal information, necessary to ensure your identification and the performance of the services offered to registered users.
3. Provision of services offered on www.karl.com. For this purpose, we need to collect the personal data necessary to perform the specific service requested by you in relation to each service and its characteristics.
4. Management of requests to Customer Care, which uses the personal data you provide to meet your requests for information and requests for assistance.
5. Sending résumés. If you send your résumé to be considered for an open job position, KARL LAGERFELD will use the information in your résumé exclusively for this purpose. The personal data relating to your application may be transferred to third-party providers of recruiting and application software. In case of an open application, your résumé will be kept for a maximum period of six months. Otherwise, your résumé will be kept for a maximum of 4 weeks after closing of the application procedure, after which it will be deleted: You can, of course, send KARL LAGERFELD a new, updated version if you desire.
6. statistical analysis and surveys. We use some information about your use of the site, your browsing and use of the related services to perform analysis and statistical surveys in order to improve our offer and our services.
7. Sending commercial communications following the purchase of one of our products, so-called soft spam. Following the purchase of one of our products on the site, KARL LAGERFELD will send you communications containing commercial proposals on products and related services to the email address you provided during the conclusion of the order.
8. Subject to your express consent, KARL LAGERFELD may use the contact details you have provided for commercial communications on products and services, in order to update you on news, new arrivals, exclusive products, offers and promotions. In addition, always with your consent, KARL LAGERFELD will be able to use your contacts as part of market research and surveys for the detection of satisfaction in order to improve services and the relationship with users.
9. Only with your consent, KARL LAGERFELD can personalize your experience as a registered user on www.karl.com, proposing previews and offers in line with your tastes and sending you commercial communications tailored to your interests. The personalization will be done by analyzing your previous purchases and other information described in the previous paragraph 'What personal data do we collect?'. For more information on this data and on the activity that allows it to be processed, please refer to the paragraph 'My Account'.

When creating your My Account we offer you the opportunity to use the following services:

1. My profile: Manage your personal data and your consent
2. My orders: Follow the shipment and check the history of your orders
3. My cards: Save your credit card details to quickly complete your purchases
4. Address Book: Save all your addresses to quickly complete your purchases
5. Wish List: Create your wish list: You can save up to 50 items, be notified of their availability and add them to the Shopping Bag at any time.

We only process your personal data in the presence of one of the legal requirements established by current legislation, and specifically:

1. For the conclusion and execution of an agreement of which you are a part or in order to take steps at your request prior to entering into a contract. This basis legitimizes the processing of personal data that takes place in the following activities:
   • Conclusion and execution of a purchase agreement for the products offered on www.karl.com. When we process your data for the conclusion of the purchase agreement of which you are a part, we ensure that we only use the minimum information necessary for the execution of this;
   • Registration on the site and use of services reserved for registered users;
   • Provision of services offered on www.karl.com (e.g. Omni-Channel Services);
   • Management of your résumé;
   • Management of your requests by our Customer Care.
   
   
   The provision of your personal data for these activities is a contractual obligation. You are free to communicate your data or not, but in the absence of the requested data, it will not be possible to conclude or execute the agreement and your requests. This means that you will not be able to purchase products and you will not be able to use our services and that we will not be able to handle your requests.



2. To comply with a legal obligation.
   In the event of the conclusion of an agreement for the purchase of goods on www.karl.com, the processing of the user's data will take place in order to fulfill the legal obligations with which we comply. You are free to decide whether to conclude an agreement and whether or not to disclose your data, but if you conclude it, your data will be necessary and will be processed to effect the aforementioned legal obligations.



3. for our legitimate interest.
   If you purchase products on www.karl.com by credit or debit card, some of your personal data may be processed to carry out anti-fraud activities: We have a legitimate interest in carrying out this activity to prevent and pursue any fraudulent activity. For internal administrative purposes, data may be processed by companies belonging to the business group to which KARL LAGERFELD or YNAP belongs.



4. Based on your consent.
   KARL LAGERFELD will carry out the following processing only if you have given us your express consent:
   
   
   • Carrying out marketing activities and opinion polls and market research;
   • Analysis of your browsing and consumption habits in the use of your My Account profile, in order to personalize your experience on www.karl.com.
   
   Providing your consent for these activities is optional. You are free to give your consent or not, but without it, it will not be possible for KARL LAGERFELD to carry out marketing activities, opinion polls and market research, and to analyze your habits.

Your personal data will be processed by KARL LAGERFELD and YNAP internal staff who are specifically trained and authorized to process it. In carrying out the processing, the data may also be transmitted to companies belonging to the business group to which KARL LAGERFELD or YNAP belongs.
Your personal data will also be transmitted to third parties that we use to provide our services at www.karl.com; these subjects have been adequately selected and offer a guarantee of compliance with the rules on the processing of personal data. These subjects have been designated as responsible for the processing and carry out their activities according to the instructions given by KARL LAGERFELD or YNAP and under its control.
The third parties in question belong to the following categories: Banking operators, Internet providers, companies specialized in IT and telematic services, couriers, agencies that carry out marketing activities, companies specialized in market research and data processing.
In particular, KARL LAGERFELD use a third party called CrossEngage. The purpose of the data processing is provision of services in connection with the CrossEngage platform to activate customers, prevent churn and increase loyalty. The nature and extent of the data processing is that CrossEngage GmbH provides a SaaS platform for user-specific cross-channel marketing campaigns. Personal and non-personal data are collected by online tracking solutions on karl.com to create customer profiles, carry out dynamic segmentation based on your device, your preferred channel, your customer journey, socio-demographic and historical purchase data, and cross-channel campaign management. The types of personal data involved are Master Data (name and address), Communication data (telephone, e-mail), Contract master data (contractual relationship, product or contract interest), Customer history, User-related click-stream data and Contract accounting data. The categories of data subjects are customers, prospects, subscribers and employees. The personal data will be deleted upon completion of the processing operations by Cross Engage. In the event that KARL LAGERFELD receives personal data from CrossEngage, the personal data shall be deleted after 2 years after the last contact moment between you and KARL LAGERFELD’s websites or stores, unless there is an obligation to store personal data under European Union (EU) or Member State law.
Lastly, your data may be transmitted to police and judicial and administrative authorities, in accordance with the law, for the detection and prosecution of crimes, the prevention and protection from threats to public security, to allow KARL LAGERFELD and YNAP to ascertain, exercise or defend a right in court, as well as for other reasons related to the protection of the rights and freedoms of others.

Some of the third parties listed in the previous paragraph no. 6 'Who will process your data?' may be located in countries outside the European Union that nevertheless offer an adequate level of data protection, as established by specific decisions of the European Commission (http://www.garanteprivacy.it/home/provvedimenti-normativa/normativa/normativa-comunitaria-e-intenazionale/trasferimento-dei-dati-verso-paesi-terzi#1).

The transfer of your personal data to countries that do not belong to the European Union (EU) or European Economic Area (EEA) and that do not ensure adequate levels of protection will be performed only after conclusion with said subjects of specific agreements, containing safeguard clauses and appropriate guarantees for the protection of your personal data, the so-called 'standard contractual clauses', also approved by the European Commission, or if the transfer is necessary for the conclusion and execution of an agreement between you and us (for the purchase of goods offered on our website, for registration on the website or use of services on the website) or for the management of your requests.

We keep your personal data for a limited period of time, which differs depending on the type of activity that involves the processing of your personal data. After this period, your data will be permanently erased or otherwise rendered anonymous in an irreversible way.
Your personal data is stored in compliance with the terms and criteria specified below:

1. Data collected to conclude and execute agreements for the purchase of goods on www.karl.com: Until the completion of administrative and accounting formalities. The billing data will be kept for ten years from the billing date;
2. Data of the registered user: The data will be stored until you request cancellation of your My Account;
3. Data relating to payments: Up to the certification of the payment and the conclusion of the related administrative and accounting formalities resulting from the expiration of the right of withdrawal and the terms applied for the contestation of the payment;
4. Data collected in the context of the use of services offered on www.karl.com (e.g. Omni-Channel Services): This data is retained until the termination of service or the request for cancellation of the subscription to the service by the user;
5. Data related to user requests to our Customer Care: The data useful to assist you will be kept until your request is met;
6. Résumé: For six months from receipt by KARL LAGERFELD;
7. Data used for commercial communication to users who purchase products on www.karl.com (soft spam): This data is retained until the termination of service or until the user exercises opposition by unsubscribing from the service;
8. Data used to personalize the site and to show customized commercial offers: As long as the user does not request the termination of the activity and in any case within two years from the last interaction of any kind of user with KARL LAGERFELD;

KARL LAfxGERFELD and YNAP do not sell products or services for purchase by children, but by adults. If you are under 18, you may use the Site only with the involvement of a parent or guardian. In accordance with the Federal Children's Online Privacy Protection Act of 1998 (COPPA), the US site www.karl.com does not knowingly collect, solicit or use personal data of children under the age of 13 provided without parental consent. Therefore, if you are not 18 years or older, you are not authorized to use our US Site.

Pursuant to California Civil Code Sec. 1789.3, California resident users are entitled to know that they may file grievances and complaints with the California Department of Consumer Affairs, 400 R Street, STE 1080, Sacramento, CA 95814. For more information about protecting your privacy, you may wish to visit: www.ftc.gov.

If you are a resident of California, you may request that KARL LAGERFELD not share your information with certain affiliates or third parties providers for marketing purposes, and/or you may inquire as to how KARL LAGERFELD has shared your information with third parties providers for marketing purposes. In connection with such request, KARL LAGERFELD will identify the types of information shared and provide you with the names and addresses of the third parties with whom the information was shared. Please contact our Customer care through the appropriate form selecting “Privacy” as the topic on our contact form.

You can exercise your rights with reference to the specific processing of your personal data at any time. Find below their general description and how to exercise them.

1. Access your data and modify it: You have the right to access your personal data and to request that it be corrected, modified or integrated with other information. If you wish, we will provide you with a copy of your data in our possession.
2. Revoke your consent: You can revoke a consent you have given for the processing of your personal data in relation to any activity for marketing purposes at any time. In this regard, we remind you that marketing activities are considered the sending of commercial and promotional communications, and the conduct of opinion polls and market research, in order to detect your degree of satisfaction and improve the services offered. Once KARL LAGERFELD receive your request, it will be their duty to promptly cease to process your personal data based on this consent, while different processing or that which is based on other assumptions will continue to be carried out in full compliance with the provisions in force.
3. Opposition to the processing of your data: You have the right to object at any time to the processing of your personal data made on the basis of our legitimate interest, explaining the reasons that justify your request; before accepting it, we will have to evaluate the reasons for your request.
4. Delete your data: You may request the cancellation of your personal data in the cases provided for by current legislation. Once your request has been received and examined and if it is legitimate, it will be our duty, in a timely manner, to cease to process your personal data and to delete it.
5. Request that the processing of your personal data be temporarily limited: In this case, we will continue to keep your personal data but will not process it, unless it is subject to a different request by you and the exceptions established by law. Processing of your personal data can be limited when you dispute the accuracy of your personal data, when the processing is illegal but you oppose the cancellation of your data, when we no longer need your personal data but you need to exercise your right in court and when you oppose your processing, in the period in which we evaluate the reasons for your request.
6. Request your data or transfer it to a party other than us (right to data portability). You can ask to receive your data that we process based on your consent or on the basis of an agreement with you in a standard format. If you wish, where technically possible and at your request, we may transfer your data directly to a third party that you indicate.

We protect your personal data with specific technical and organizational security measures, aimed at preventing your personal data from being used illegitimately or fraudulently. In particular, we use security measures that guarantee: The pseudonymization or encryption of your data; the confidentiality, integrity, and availability of your data as well as the resilience of the systems and services that process them; the ability to restore data in the event of a data breach. In addition, we agree to test, verify and regularly evaluate the effectiveness of our technical and organizational measures in order to guarantee continuous improvement in the security of processing.

If you believe that the processing of your personal data has been carried out unlawfully, you can file a complaint with one of the competent control authorities for compliance with the rules on personal data protection. In Italy, the complaint can be presented to the Guarantor for the Protection of Personal Data. More information on how to present them is available on the website of the Guarantor, at http://www.garanteprivacy.it/.

The constant development of our services may lead to changes in the characteristics of the processing of your personal data described up to now. Consequently, this privacy policy may be subject to changes and additions over time, which may also be necessary with regard to new regulatory measures regarding the protection of personal data.
Therefore, we invite you to periodically check the contents: Where possible, we will try to inform you promptly on the changes made and their consequences. In any case, the updated version of the privacy statement will be published on this page, with an indication of the date of its last update.

The processing of your personal data is carried out in full compliance with the regulations on the matter pursuant to General Data Protection Regulation (EU) 2016/679, the rules on the processing of Italian personal data and the provisions of the Italian Supervisory Authority (http://www.garanteprivacy.it/) and, where applicable, the competent foreign control authorities.