Customer area
Privacy Policy
-
Privacy Policy
PRIVACY POLICY REGARDING THE PROCESSING OF PERSONAL DATA OF CUSTOMERS AND USERS
A. Data Controllers
Peuterey S.r.l. with registered office in Via Tortona, 31 - 20144 - Milan (MI), privacy@peuterey.it (hereinafter "Peuterey")
and
Digital Boite S.r.l. with registered office in Via Cusani, 5 - 20122 - Milan, privacy@digitalboite.com (hereinafter "DB")
(hereinafter, jointly, the “Data Controllers”) provide you with the following information on the collection, use, disclosure and processing of your personal data carried out via the website www.peuterey.com (hereinafter the “Website”).
In particular:
- Peuterey is the independent controller of the personal data processed for the purposes of browsing and maintaining the Website. Peuterey also acts as an independent controller of the personal data processed for marketing and profiling purposes;
- DB is the independent controller of the personal data processed for the purposes of the sale, invoicing, payment and shipment of products purchased via the Website;
Peuterey and DB are joint controllers (hereinafter "Joint Controllers") of the personal data processed for the performance of commercial activities preparatory to or consequent to the sale, consisting of sales planning (requirements, related logistics, etc.), analysis of commercial results, catalogue management, after-sales assistance, returns management, reporting activities and definition of commercial policies.
The essential content of the joint controller agreement in force between Peuterey and DB is reported in the following table. You may request further information relating to the content of the joint controller agreement below by writing to Peuterey or DB at the addresses stated above, or by contacting the DPO by writing to the email indicated in the following section.
The Joint Controllers will share:
- information relating to purchases made by buyers required to carry out the above-mentioned activities; and
- information relating to consumers who register online, as well as that collected from buyers as part of after-sales activities.
Summary Table
Ownership Purpose Legal basis Data Retention Joint Controllers
Peuterey and Digital BoiteProvision of post-sale activities, such as sales analysis and related reporting Legitimate interest of the Joint Controllers Data relating to sales analysis activities are stored for 3 (three) years Joint Controllers
Peuterey and Digital BoiteProvision of commercial activities preparatory to or consequent to the sale, such as after-sales services (including customer assistance and returns management) Execution of a contract to which the data subject is party Data will be retained until the request is fulfilled and for a further period of 6 (six) months
B. Data Protection Officer (DPO)
Peuterey and DB have each appointed a Data Protection Officer (DPO):
The Peuterey DPO is available at the following email address: dpo@peuterey.it;
The DB DPO is available at the following email address: dpo@digitalboite.com.
C. Categories of Data Processed
According to the intended purposes, the Data controllers may process the following personal data (hereinafter "Data") listed here by way of example and not limited to:
- Personal data: name, surname, date of birth, gender;
- Contact details: telephone number, email address;
- Authentication data: email address, password;
- Shipping information: home address, residential address, any additional addresses needed to deliver the order;
- Information relating to purchases made: item, size and colour, price, date of sale, expense incurred;
- Data relating to the customer profile and preferences: data relating to purchasing habits;
- Geographic location data (“Storelocator” service): IP address;
- Loyalty programme data: points, discounts;
- Browsing data: data collected when you visit and consult the Website, including through cookies or other tracking technologies. For more information on the processing of your data via such technologies, please refer to the Cookie Policy
- Any additional data transmitted in order to make use of specific services offered by Peuterey.
D.Purpose, legal basis for the processing and retention periods of the Data
Ownership Purpose Legal basis Storage period Peuterey Provision of retail services and any further service requested by customers Execution of a contract to which the data subject is party Purchase Data will be stored for the duration necessary for the execution of the contract relating to the services offered to you, and in any case no longer than 10 (ten) years Peuterey Customer assistance and after-sales support services including support relating to payments, shipping, returns and refunds Execution of a contract to which the data subject is party Data processed for the purpose of providing a service requested by you will be retained for the period necessary to carry out the service. With regard to after-sales assistance and returns management, the Data processed in order to respond to your requests will be retained until the matter is resolved and for a further period of 6 (six) months Peuterey To allow the use of the online store and its services, including registration and viewing of the catalogue of products sold therein Execution of a contract to which the data subject is party Data collected for the purpose of registering on the Website will be retained until you decide to withdraw your registration unless closed by Peuterey due to user inactivity exceeding 5 (five) years Peuterey Execution of the administrative, fiscal and accounting activities required by law Fulfilment of a legal obligation to which the data controller is subject The Data processed to fulfil legal obligations will be retained according to the timeframes established by applicable legislation, including the obligation to retain accounting records for ten years Peuterey Operational management of the navigation and security of the Website Legitimate interest of the data controller For data relating to cookies, please refer to the specific Cookie Policy Peuterey Use of the Storelocator servicewhich consists of identifying the nearest physical store based on your current location Free, specific, informed, unambiguous and revocable consent of the data subject Data will be retained until you decide to withdraw your consent Peuterey Prevention of abuse and fraud Legitimate interest of the data controller Data will be retained for the time necessary to prevent and detect fraudulent conduct, and in any case no longer than the limitation periods established by the law for payment fraud crimes, or until the expiry of the terms for contesting transactions established by applicable industry regulations and payment circuit regulations Peuterey Ascertainment, exercise or defence of a right in court and out-of-court debt collection Legitimate interest of the data controller Data will be retained for the full duration of the credit recovery process and, in the case of a legal dispute, for the duration of the same, until the expiry of the period in which complaints may be lodged Peuterey Marketing activities through the sending of commercial communications on products and services (news, new arrivals, exclusives, offers and promotions) using electronic methods – such as newsletters and emails with invitations and commercial communications – and traditional methods, such as paper mail Free, specific, informed, unambiguous and revocable consent of the data subject Data will be retained until you decide to withdraw your consent Peuterey Profiling activitiesof registered users through the use of Data provided by them when using the services (including those relating to purchases) and Browsing Data on the online store for the purpose of sending and/or displaying promotional messages in line with the user’s profile as, well as to improve the experience on the website Free, specific, informed, unambiguous and revocable consent of the data subject Data is stored until consent is revoked, and profiling activities will refer to the details of purchases relating to the last 24 (twenty-four) months Digital Boite Online product sales, order processing, product delivery, receipt of payment and invoicing Execution of a contract to which the data subject is party Fulfilment of a legal obligation to which the data controller is subject Purchase Data will be stored for the duration necessary for the execution of the contract relating to the services offered to you, and in any case no longer than 10 (ten) years. The data processed to fulfil legal obligations will be retained according to the timeframes established by applicable legislation Digital Boite Execution of the administrative, fiscal and accounting activities required by law Fulfilment of a legal obligation to which the data controller is subject The Data processed to fulfil legal obligations will be retained according to the timeframes established by applicable legislation, including the obligation to retain accounting records for ten years Digital Boite Prevention of abuse and fraud Legitimate interest of the data controller Data will be retained for the time necessary to prevent and detect fraudulent conduct, and in any case no longer than the limitation periods established by the law for payment fraud crimes, or until the expiry of the terms for contesting transactions established by applicable industry regulations and payment circuit regulations Digital Boite Ascertainment, exercise or defence of a right in court and out-of-court debt collection Legitimate interest of the data controller Data will be retained for the full duration of the credit recovery process and, in the case of a legal dispute, for the duration of the same, until the expiry of the period in which complaints may be lodged
E. Data Sharing
The disclosure of Data to fulfil these purposes based on the conditions of lawfulness
- execution of a contract to which the data subject is party;
- legitimate interest of the data controller;
- fulfilment of a legal obligation to which the data controller is subject;
they are mandatory for the provision of services; therefore, failure to provide them will prevent their provision.
It is understood that certain data will be collected and/or processed only with the interested party’s prior consent, particularly for marketing and profiling purposes and to use the "Storelocator" service. Failure to provide the aforementioned consent will preclude the pursuit of the relevant marketing, profiling, and "Storelocator" purposes, but will not affect your ability to register on the Website or use the services provided on a contractual basis.
During their normal operation the IT systems and software procedures used to operate the Website acquire some personal data whose transmission is implicit in using Internet communication protocols.
This information is not collected to be associated with identified data subjects, but by their very nature could allow users to be identified through processing and associations with data held by third parties.
The information that may be collected includes IP addresses, browser type or operating system used, addresses in URI form ("Uniform Resource Identifier"), the domain name and the website address from which the Website was accessed or left for (referring/exit pages), the time in which the server request was carried out, the method used and information on the response received, other information on the user’s browsing (please see also the section on cookies) and other parameters relevant to the operating system and computer environment of the user.
This data could also be used to identify and ascertain responsibilities in the event of any cybercrimes against the Website.
F. Data Recipients
The Data will be processed by:
- employees and collaborators of the Data Controllers authorized to collect and process your Data;
- third parties located within the European Union, which are responsible for processing and are employed by the Data Controllers, in particular, for services for the acquisition of and integration of personal data, shipping services, mailing of promotional materials, market research, surveys on customer satisfaction, and the management and maintenance of informatics systems;
- third parties, autonomous data controllers, in particular freelancers or consulting firms, legal or financial assistance companies, and debit or credit card payment processing services;
- third parties, autonomous data controllers such as supervisory authorities or other public or private bodies, authorised to request your Data.
The complete list of Data recipients can be requested by writing to the addresses indicated above in paragraph A.
G. Transfer of Data Outside of the European Union
In order to provide services, your Data may be transferred to third countries. Should it become necessary to transfer your Personal Data to countries outside the EU, the Data Controllers will ensure that such transfer takes place in compliance with the provisions of applicable European privacy legislation (Chapter V of the GDPR). In particular, adequate security measures and appropriate transfer mechanisms (for example, standard contractual clauses approved by the European Commission) will be adopted to ensure a level of data protection equivalent to that provided within the EEA.
H. Rights of Data Subjects
By contacting the email addresses given above in paragraph A, you may request access to the Data relating to you from the Data Controllers, deletion of said Data, correction of errors in the Data, additions to incomplete Data, and the limitation of processing of the Data in the cases provided for by the applicable privacy law. You may also oppose the processing of your Data in the Data Controller’s legitimate interest for reasons relating to your particular situation.
Where the processing is based on consent or on the contract and is performed by automated tools, you also have the right to receive your Data in a structured, commonly used and machine-readable format, as well as, if technically possible, request that this Data is transmitted to another data controller without prejudice.
You have the right to revoke your consent at any time.
You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you, unless you have previously and explicitly given your consent.
You also have the right to lodge a complaint with the competent controlling authority in the Member State in which you habitually reside or work, or in the State in which the alleged infringement occurred.
Lastly, at any time you may modify or update your personal Data and your consent to the processing of personal data by accessing your personal account or by sending an email to privacy@peuterey.it or alternatively, to privacy@digitalboite.com.
I. If you are a citizen of the Principality of Monaco
If you are a citizen residing in the Principality of Monaco, the Personal Data Protection Act No. 1.565 of 3 December 2024 will apply. In this regard, we inform you that:
- your Data may be transferred to countries outside the Principality of Monaco, in particular Italy which, as a Member State of the European Union, is considered an adequate and safe country with regard to the processing of personal data pursuant to Article 97 of Law no. 1.565 of 3 December 2024. In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects;
- you may exercise, where possible, the rights provided for in Chapter 3 of Law no. 1.565 of 3 December 2024.
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
J. If you are a citizen of Montenegro
If you are a citizen residing in Montenegro, the Personal Data Protection Act 79/08, 70/09, 044/12 and 022/17 will apply. In this regard, we inform you that:
- your Data may be transferred to countries outside Montenegro, in particular Italy which, as a Member State of the European Union, is considered an adequate and safe country with regard to the processing of personal data pursuant to Article 42 of the Protection of Personal Data Act 79/08, 70/09, 044/12 and 022/17. In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects;
- you may exercise, where possible, the rights provided for in Chapter 5 of the Personal Data Protection Act 79/08, 70/09, 044/12 and 022/17.
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
K. If you are a citizen of Türkiye
If you are a Turkish citizen residing in Türkiye, Personal Data Protection Act No. 6698 of 24 March 2016 applies. In this regard, we inform you that:
- your Data may be transferred to countries outside Türkiye, in particular Italy, where EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects. The Data Controllers guarantee that the transfer is carried out in accordance with the provisions of Article 9 of Personal Data Protection Act No. 6698 of 24 March 2016;
- you may exercise, where possible, the rights provided for in Chapter 3 of Personal Data Protection Act No. 6698 of 24 March 2016.
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
L. If you are a citizen of Albania
If you are a citizen residing in Albania, Personal Data Protection Law No. 124/2024 of 19 December 2024, applies. In this regard, we inform you that
- your Data may be transferred to countries outside Albania, in particular Italy, which, as a Member State of the European Union, is considered an adequate and safe country with regard to the processing of personal data pursuant to Decision No. 01 of 30.04.2025 of the Commissioner for the Right to Information and the Protection of Personal Data (IDP). In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects;
- you may exercise, where applicable, the rights provided for in Chapter 2 of Personal Data Protection Law No. 124/2024 of 19 December 2024
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
M. If you are a citizen of Canada
If you are a citizen residing in Canada, the Personal Information Protection and Electronic Documents Act ("PIPEDA") applies. In this regard, we inform you that:
- your Data may be transferred to countries outside Canada, in particular Italy, where EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects. The Data Controllers guarantee that the transfer is carried out ensuring an adequate level of data security pursuant to PIPEDA
- you may exercise, where applicable, the rights provided for by PIPEDA and the opinions published by the Office of the Privacy Commissioner of Canada ('OPC").
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
N. If you are a citizen of Switzerland
If you are a citizen residing in Switzerland, the Swiss Federal Act on Data Protection ("FADP") will apply. In this regard, we inform you that:
- your Data may be transferred to countries outside of Switzerland, in particular Italy which, as a Member State of the European Union, is considered an adequate and safe country with regard to the processing of personal data pursuant to Swiss Data Protection Ordinance ("OPDa") of 31 August 2022. In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects
- you will be able to exercise, where possible, the rights provided for in Chapters 3, 4 and 5 of the FADP
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
O. If you are a citizen of Chile
If you are a citizen residing in Chile, Law No. 21,719, which regulates the protection and processing of personal data and establishes the Personal Data Protection Agency ("Law No. 21,719") and which reforms Law No. 19,628, will apply. In this regard, we inform you that:
- your Data may be transferred to countries outside Chile, in particular Italy, where EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects. The Data Controllers guarantee that the transfer is carried out ensuring an adequate level of data security;
- you may exercise, where possible, the rights provided for by Law no. 19,628 and Title 1 of Law no. 21,719.
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
P. If you are a UK citizen
If you are a citizen residing in the UK, the Data Protection Act 2018 and the United Kingdom General Data Protection Regulation ("UK GDPR") apply. In this regard, we inform you that:
- your Data may be transferred to countries outside the United Kingdom, in particular Italy which, as a Member State of the European Union, is considered an adequate and safe country with regard to the processing of personal data pursuant to the specific Guidelines published by the Information Commissioner’s Office ("ICO"). In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects
- you will be able to exercise, where applicable, the rights provided for in Chapter 3 of the UK GDPR
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
Q. If you are a citizen of Serbia
If you are a citizen residing in Serbia, the Personal Data Protection Act No. 87/2018 applies. In this regard, we inform you that:
- your Data may be transferred to countries outside of Serbia, in particular Italy which, as a Member State of the Convention for the Protection of Individuals with regard to Automatic Processing of Personal Data ("Convention 108"), is considered an adequate and safe country with regard to the processing of personal data pursuant to Government Decision 55/2019. In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects;
- you may exercise, where applicable, the rights provided for in Chapter 3 of the Personal Data Protection Act No. 87/2018
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
R. If you are a citizen of Ukraine
If you are a citizen residing in Ukraine, the Law of 1 June 2010 No. 2297-VI on the Protection of Personal Data (as amended) will apply. In this regard, we inform you that
- your Data may be transferred to countries outside Ukraine, in particular Italy which, as a Member State of the European Union, is considered an adequate and safe country with regard to the processing of personal data pursuant to Article 29 of Law no. 2297-VI of 1 June 2010 on the Protection of Personal Data (as amended). In Italy, EU Regulation 679/2016 ("GDPR") applies, which guarantees adequate guarantees and protections for the rights and freedoms of data subjects;
- you may exercise, where possible, the rights provided for in Article 8 of Law No. 2297-VI of 1 June 2010 on the Protection of Personal Data (as amended).
For further information on any transfers of your Data and to exercise your rights, you can send an email to privacy@peuterey or, alternatively, to privacy@digitalboite.com.
Last updated: March 2026