Privacy Policy

Belvest S.p.A.
Privacy Policy
EU Regulation 2016/679
(General Data Protection Regulation)

 

1. What data do we need?

Our Personal Data Protection Policy governs the use and storage of personal data belonging to you, to your customers/employees/collaborators/consultants identifiable as “natural persons”, in relation to the conditions (prior, concurrent and subsequent) concerning the establishment of a “commercial relationship” for the sale of garments or of fabric/buttons/lining/finished products, or for the purchase of the products/services specified below. Belvest is a “Controller of Personal Data” that the data subject provides to us. Depending on the service and the specific operational situation, Belvest collects all or part of the following types of personal data:

  • Category 1 personal data: first name, last name, address, locality, city, province, country, postal code;
  • Category 2 personal data: VAT number, tax code, landline/mobile telephone number, IBAN;
  • Category 3 personal data: fax number, Skype account, email address, website address;
  • Category 4 personal data: photocopy of identity document;
  • Category 5 personal data: physical body measurements for the creation of made-to-measure garments, subsequently encoded into a unique “personal sketch” in our archives, photograph of the data subject;
  • Category 6 personal data: data relating to video surveillance systems;
  • Category 7 personal data: judicial data.

We specify that the collection and subsequent processing of personal data of minors will always be subject to obtaining explicit consent from the parent, legal guardian or representative of the minor.

 

2. Why do we need it, that is, what do we do with it?

In the case of conditions prior to, concurrent with or subsequent to the purchase of products/services or the sale of products/services, and with reference to each category, we need your personal data indicated above, all or part of it, for the following purposes:

  • “Category 1” and “Category 2” data are generally necessary for the establishment and performance of a commercial relationship, such as the purchase of a product/service or the sale of a garment, or the sale of fabric, buttons, lining, finished products available at the company outlet or in our warehouses. Such personal data may relate both to so-called “legal” persons such as companies, shops, etc. (“Business to Business” channel, hereinafter “B2B”), and to natural persons in the case of the sale of products through our e-commerce site (“Business to Consumer” channel, hereinafter “B2C”); for the processing of this personal data, withholding consent prevents any subsequent activity;
  • with particular reference to the email address (“Category 3“), it is mandatory only in the case of the sale of products through the company’s e-commerce site; conversely, it is not necessary for the commercial management of a sale/purchase order through other channels, being in these other cases only functional to the establishment of a more streamlined communication relationship between the parties as well as to the management of more direct information on promotional and marketing activities carried out by Belvest S.p.A.; in any case, this data is provided to Belvest S.p.A. only upon explicit consent of the data subject, which may be revoked at any time;
  • the collection of the identity document (Category 4 personal data) is necessary in the case of a purchase by cheque/credit card by a private individual at Belvest S.p.A., for the purpose of verifying the successful completion of the payment; the collection of photographs (Category 4 personal data) during events (exhibitions, trade fairs, etc.) and social-marketing activities may be intended for publication on “social” channels, but always and in any case subject to the explicit consent of the data subject;
  • all or part of the personal data in “Category 5“, in addition to all or part of the data in “Categories 1, 2, 3”, are evidently necessary should a person wish to have a “made-to-measure” garment produced; for this data, consent to processing must be explicit and its withholding prevents any subsequent activity;
  • “Category 6” data are necessary to support corporate security activities, as specified by appropriate notices in the areas covered by the recordings;
  • “Category 7” data may be collected by accessing commercial information databases.

In the case of reports of possible wrongdoing or violations (ref. European Directive 2019/1937 transposed by Legislative Decree no. 24 of 10/3/2023, hereinafter “Whistleblowing”), and regardless of the existence of any current commercial relationship, Belvest has implemented an “online” channel available at the link https://www.belvest.segnalazioni.net, in order to ensure maximum protection and speed in the management of the processing; the personal data potentially collected pertain to Categories 1, 2 and 3; at the reporter’s choice, the report may also be accompanied by a natively distorted audio file in order to protect the reporter’s identity in any case.

 

3. Personal data of natural persons obtained through commercial relationships, existing or future, with legal persons (customers or suppliers)

In the case of the collection of data relating to commercial relationships with legal persons -customers or suppliers- whether current or prospective, we may nonetheless come into possession of all or part of the data in “Categories 1, 2, 3, 4, 5, 6, 7” (some subject to explicit consent as already noted above) with reference to:

  • “Categories 1, 2, 3, 4, 5, 6, 7“: the processing of your personal data in the case of “personal” companies, that is, attributable to one or more individuals (e.g. S.a.s, S.n.c, S.r.l., professional firms, etc.);
  • “Categories 1, 2, 3, 6“: the processing of personal data of your employees/consultants/collaborators who will interact with our employees/consultants/collaborators for the performance of the current or prospective commercial purchase/sale contract (e.g. order status update emails, phone calls, messages, text messages, etc.);
  • “Category 5“: the management of personal garments of “natural persons” who are your customers/employees/consultants/collaborators, where the creation of a “made-to-measure” garment is requested.

We point out to you the opportunity to inform your employees/collaborators/consultants and/or your end customers of the possibility of processing the personal data of the data subjects in the categories set out above and in the manner specified below.

 

4. Who processes the data collected?

Your personal data may be processed by all or part of the offices/departments1 of Belvest through the relevant employees/consultants/collaborators acting as persons in charge of/responsible for processing, based in Italy, Via Corsica 23 Piazzola sul Brenta, postal code 35016, (PD). Furthermore, such data may also be processed by other parties; in fact:

  • in the case of “made-to-measure” garment customers, some Category 5 personal data (first name, last name, sketch code) are reported on an internal label of the garment called “CEM” and processed by the staff belonging to Belvest’s offices/departments1 as well as by the entire production line and by the courier in charge of delivery, should it be requested that the end customer’s name also be reported on the delivery note and/or invoice;
  • for all types of sale and purchase contracts, without prejudice to the communications and disclosures made in fulfilment of legal obligations, all or part of the Category 1, 2, 34 data collected may be communicated, solely for purposes related to the performance of the sale/purchase contract:
    • to our network of agents (including Category 5 data); our professionals and consultants2
    • natural/legal persons appointed as “Data Processor”3
    • other suppliers for activities such as production control through IT tools, warehousing, transport, shipping; insurance companies; credit institutions; factoring companies; credit insurance companies; debt collection companies2;
    • companies in charge of optical archiving and/or microfilming of documents; supervisory and control bodies;
    • in the case of reports of possible wrongdoing in the workplace (“Whistleblowing”), specific “Data Processors”3 have been appointed for the fulfilment of the legal obligations relating to the processing of the report and of the reporter’s personal data;
  • Whether or not specific purchase and sale contracts are in place, Category 4 data may be collected – such as, for example, photographs of the user during exhibitions, trade fairs, social-marketing events, etc.) – directly by Belvest or through specific natural/legal persons appointed as “Data Processor” and always with the explicit consent of the data subjects, for subsequent publication on Belvest’s social channels.

No other third-party supplier has access to your data. The hosting and storage of data take place at the premises of Belvest S.p.A. for data relating to customer orders and purchases of products/services, while some Category 1, 2, 34 data necessary both for the creation of the user’s access profile for e-commerce services and for the shipment of products are also stored on an Aruba server located in Arezzo at the “DC1” Data Center. Any personal data collected relating to reports of wrongdoing (“Whistleblowing”) are stored in Italy by the company DigitalPA S.r.l, based in Cagliari, which uses servers physically located within Italian territory (Arezzo). Where explicit consent to email-marketing activities has been provided, your data may be transferred to the USA on the servers of our email marketing platform supplier, with whom a “Data Processor Agreement” exists. Likewise, to ensure the encryption of email sent from Belvest, we rely on a “GDPR compliant” supplier which may involve the transfer of data to the USA. There are no other cases of data transfer outside the European Economic Area (EEA). Personal data exchanged via social networks (Facebook, Instagram, etc.) using “likes” or comments are not processed or stored in any way (with the exception of photographs possibly collected with the explicit consent of the data subject during exhibitions, trade fairs, social-marketing events, etc.) and are not subject to end-user profiling except in anonymous and aggregated form. Finally, your personal data will in no way be disclosed without your explicit consent.

 

5. How long do we keep the data collected?

In accordance with the law, we are required to keep documents relating to commercial relationships (orders, delivery notes, invoices, etc.) for 10 years, including the personal data pertaining to such contracts. With regard to the management of the EU “Whistleblowing” directive, the data will be kept for the time necessary to process the report and in any case no longer than five (5) years from the date of communication of the final outcome of the reporting procedure. After this period, all personal data pertaining to the data subject will be irreversibly destroyed or completely anonymised. Your email address and, in general, any personal data whose collection is subject to consent and used to inform you about promotional or marketing activities, will be kept until you revoke your consent, which may be done at any time via the dedicated link at the bottom of the email received or via the dedicated form downloadable at www.belvest.com, “Privacy” section. In the case of the collection of “Category 4” data, the maximum retention period is five working days (and in any case not exceeding the verification of the subject’s solvency by the banking institution), with the exception of photographs collected with the explicit consent of the data subject during exhibitions, trade fairs, social-marketing events, etc., which are archived for a maximum of one year. Data relating to video surveillance are archived for a maximum of 72 hours.

 

6. What are the rights of the data subject in the processing described?

If you believe that any of your personal data held by us is incorrect or incomplete, you can request to see, correct or delete such information. For clarifications or complaints regarding the processing of your personal data, please contact us at the email address gdpr@belvest.com, or contact directly the acting Data Protection Officer, Ing. Bruno Stefanutti, at the address bruno.stefanutti.gdpr@belvest.com. If, despite our efforts, you are not satisfied with the way your personal data is processed, you can lodge a complaint with the Italian Data Protection Authority by following the dedicated link in the “Privacy” section of the website www.belvest.com.

 

 

1 Sales Office, Patterns Office, CAD Office, Purchasing Office, Administration Office, Planning Office, Human Resources Office, Information Systems Office, Technical Management, Technical Management Secretariat, Raw Materials Warehouse, Finished Garments Warehouse, Company Outlet.

2 including Category 4 and 7 data, the latter in the case of litigation.

3 Data Processors.

4 country, email, telephone number, address, postal code, first name, last name

 

 

Useful Links:

 

Scroll to Top