Privacy

BELVEST S.p.A.
Privacy policy
EU Regulation 2016/79
(General Data Protection Regulation)

1. What kind of data do we need?

Our Privacy Policy governs the use and storage of personal data concerning You, Your customers/employees/collaborators/consultants who are individuals in connection with the previous, contextual and subsequent conditions of the “business relationship” entailing the sale of clothing or of fabric/buttons/lining/finished products or the purchase of products/services specified below. Belvest is a Data Controller regarding the data supplied by the data subject. According to the service to be provided and the specific operating situation, Belvest collects all or part of the following categories of personal data:

Category 1 data: name, surname, address, place, city, province, country, ZIP code;
Category 2 data: VAT number, tax code, landline⁄mobile phone number, IBAN
Category 3 data: fax number, Skype account, email address, internet website;
Category 4 data: photocopy of ID document; photographs relating to events and social-marketing activities (exhibitions, fairs, etc.);
Category 5 data: body measurements for the production of tailored clothing, to be subsequently codified in a unique “personal draft” for our files, pictures of the subject;
Category 6 data: data concerning video surveillance systems;
Category 7 data: details of criminal records.

We would like to specify that the collection and subsequent processing of data concerning minor subjects shall always be subject to the explicit consent of the holder of parental responsibility.

2. Why do we need the data, and what do we do with them?

In case of previous, contextual and subsequent conditions of the purchase or sale of goods⁄services and with reference to each category, we need Your data as detailed above, or part of them, for the following purposes:

the “category 1” and “category 2” data are usually necessary to create and develop a business relationship, such as the purchase of a product⁄service or the sale of clothing manufactured by Belvest, or the sale of fabric, buttons, lining, finished products to the factory outlet or in our warehouses. Such data can concern both “legal” persons, such as companies, shops, etc. (“Business to Business” channel, hereinafter, also “B2B”), and individuals, if the sale is made through our e-commerce site (“Business to Consumer” channel, hereinafter, also “B2C”); denial of consent for the processing of these personal data prevents any other subsequent activity;
with particular reference to the e-mail address (“category 3”), provision thereof is mandatory only in the case of sales made through the company e-commerce site; it is not necessary for the commercial management of any other sales⁄purchasing service through other channels, in which cases it is requested simply in order to streamline communications between the parties and inform customers directly on promotional and marketing activities from time to time organised by Belvest S.p.A.; in any case, this address shall be provided to Belvest S.p.A. only with prior explicit consent, which can be revoked at any time by the data subject;
the collection of the identity document (“category 4” data) is necessary in case of purchases from Belvest S.p.A. paid with cheques⁄credit cards by private individuals, in order to check the customer’s solvency; the collection of photos ("category 4" data) during events (exhibitions, fairs, etc.) and social marketing activities may be aimed at publication on "social" channels, but always and in any case with the explicit consent of the data subject;
all or part of the “category 5” data, and all or part of “category 1,2 and 3” data, are clearly necessary if a subject requires the production of “tailored” clothing; consent to the processing of such data must be given explicitly and a denial prevents any further activity;
“category 6” data are necessary to support company security activities, as specified in areas subject to video surveillance;
“category 7” data can be collected through access to business data bases.

In case of reports of possible illegal abuses or violations (ref. European Directive 2019/1937 implemented with Legislative Decree no. 24 of 10/3/2023, hereinafter "Whistleblowing") and regardless of the existence of any commercial relationship in place, Belvest has implemented an "online" channel available at the link https://www.belvest.segnalazioni.net in order to guarantee maximum protection and speed in managing the processing; the personal data potentially collected belong to categories 1,2 and 3; at the choice of the whistleblower, the report can also be accompanied by a natively distorted audio file to protect the identity of the whistleblower.

3. Personal data of natural persons obtained through existing or future business relations with legal entities (customers or suppliers)

If the data to be collected refer to business relationships with legal entities - be they customers or suppliers, existing or developing - we can still obtain all or part of the “category 1,2,3,4,5,6,7” data (some with prior explicit consent as previously noted) concerning:

“category 1,2,3,4,5,6,7”: the processing of Your personal data in the case of “partnerships of one or more subjects (e.g. limited, general and limited liability partnerships, professional firms, etc.);
“category 1,2,3,6”: the processing of personal data concerning Your employees⁄consultants⁄collaborators who are going to interact with our employees⁄consultants⁄collaborators for the execution of the business contract for the existing or developing purchase⁄sale (e.g. email messages concerning order status updates, phone calls, messages, sms, etc.);
“category 5”: management of the personal clothing of “natural persons” who are Customers⁄employees⁄consultants⁄collaborators of Yours, when they request a “tailored” garment.

We suggest you inform your employees⁄collaborators⁄consultants and⁄or final customers that their personal data in the categories mentioned above are liable to be processed as specified below.

4. Who processes the collected data?

Your personal data may be processed by all or part of the offices⁄departments¹ of Belvest, by the respective employees⁄consultants⁄collaborators who shall operate in the capacity of processors or persons in charge of processing, established in Italy, Via Corsica 23 Piazzola sul Brenta, CAP 35016, (PD). Moreover, such data may be processed also by other subjects, as:

in the case of clients requesting “tailored” garments, some category 5 data (name, surname, draft code) are shown on a label placed inside the garment and called “CEM” and subsequently processed by the Belvest staff¹ and by the entire production department and by the shipping agent entrusted with their delivery, if the final customer’s name must be shown on the bill of lading and⁄or the invoice;
for all types of purchasing⁄sales agreements, and without prejudice for the communications and notices given in compliance with the law, all or part of the category 1,2,3 data can be communicated, exclusively for the purposes of the execution of the purchasing⁄sales agreement:
- to our sales network (including also category 5 data); to our professional consulting staff²;
- to legal⁄natural persons appointed as “Data Processors”³;
- to other suppliers, for activities such as production control by computerised means, storage, transport, shipping; to insurance companies; to credit institutions; to factoring companies; to credit insurance companies; to collection agencies²;
- to companies providing documents optical filing and⁄or microfilming services; to surveillance and control bodies;
- in case of reports of possible illegal abuses ("Whistleblowing"), specific "Data Processors" have been appointed for the fulfillment of legal obligations relating to the processing of the report and the personal data of the whistleblower.

No other third-party supplier has access to Your data. Data hosting and filing are performed in the Belvest S.p.A. Headquarters concerning customer orders data and the purchase of products⁄services, while some category 1,2,3⁴ data necessary for the creation of a customer profile for e-commerce services and for the delivery of products, are stored also on an Aruba server located in Arezzo, in the “DC1” Data Center. Any personal data collected and relating to reports of offenses ("Whistleblowing") are archived in Italy by the company DigitalPA S.r.l, based in Cagliari which uses servers physically located in Italian territory (Arezzo). Provided explicit consent to email-marketing activities was given, Your data might be transferred abroad, to the USA, on the servers of our e-mail marketing platform supplier, with whom we have executed a “Data Processor Agreement”. Similarly, in order to guarantee the encryption of emails from Belvest, we use a “GDPR compliant” supplier which might entail the transfer the data to the USA. No other instances of data transfer outside the European Economic Area (EEA) are present. Data exchanged through social networks (Facebook, Instagram, ecc.) using the “like” function or posting comments, are neither processed nor stored (except for photos collected with the explicit consent of the interested party during exhibitions, fairs, social marketing events, etc.) and are not subject to profiling activities, except in pseudonymised and aggregated form. Your personal data shall not be disseminated in any way.

5. How long do we store the collected data?

The law requires us to store documents pertaining to our business relationships (orders, bills or lading, invoices, etc.) for 10 years, and this includes any personal data pertaining to said contracts. As for the management of the "Whistleblowing" EU directive, the data will be kept for the time necessary to process the report and in any case no later than five (5) years from the date of communication of the final outcome of the reporting procedure. After those periods all personal data of the subject shall be irretrievably deleted or completely pseudonymised. Your e-mail address and, in general, any data collected subject to consent and used to inform the data subject of promotional or marketing activities shall be retained until the data subject should revoke consent, which can be done at any moment by clicking on the relevant link at the bottom of the received e-mail message or by filling in the form that can be downloaded from www.belvest.com, “Privacy” section. In the case of “category 4” data, the maximum storage period is 5 business days (and in any case not exceeding the creditworthiness check of the subject by the banking institution), except for photos collected with the explicit consent of the interested party on the occasion of exhibitions, fairs and social-marketing events, etc. which are archived for a maximum of one year. Video surveillance data are stored for a maximum of 72 hours.

6. What are the data subject rights in connection with the data processing?

If you believe that the data collected and stored by us and concerning your person are erroneous or incomplete, you can request to see, correct or delete such information. For clarification or complaints regarding the processing of Your data, please contact us at the following e-mail address: gdpr@belvest.com, or you may contact the acting Data Processor Eng. Bruno Stefanutti at the following address: bruno.stefanutti.gdpr@belvest.com. If, our best efforts notwithstanding, you are not satisfied with the way your data are being processed, you can address a complaint to the Data Protection Authority, following the link in the “Privacy”section of the www.belvest.com website.

¹ Sales Department, Styles Office, CAD, Purchasing Department, Administration, Planning Office, Human Resources, IT Systems, Technical Office, Technical Office Secretary Office, Raw Materials Warehouse, Finished products Warehouse, Factory Outlet.

² also category 4 and 7 data, the latter in case of litigation.

³ Data Processors.

⁴ country, email, phone number, address, ZIP code, name, surname