PRIVACY NOTICE FOR DIGITAL SERVICES
This Privacy Notice (“Policy”) describes which of your personal data are collected by Tristate Digital SA and / or its affiliated entities (collectively, “We”, “Us”, “Our”), for what purposes and how they are processed in relation to:
a) the website https://www.cpcompany.com/ (the “Website”, the “Store”),
b) the physical stores,
c) remote sales service, via messaging apps and e-mail (the “PaybyLink”),
d) the loyalty programme so-called “the Brotherhood” (the “Loyalty Programme”),
e) repair and after-sales services (including “The Longevity Hub”) for the countries in which services under lett. a), b), c) and d) above are applicable.
Below you will also find the information you need to exercise your rights under the applicable data protection regulations, such as the Swiss Data Protection Act (“FADP”), the EU Regulation 679/2016 (“GDPR”), the UK General Data Protection Regulation (“UK GDPR”), and, for residents of the United States, the state privacy laws described in Section 11 below, including the California Consumer Privacy Act, as amended (the “CCPA”) (the “Applicable Data Protection Regulations”).
Depending on the services used, your personal data is processed by:
• Tristate Digital SA (“Tristate Digital”), Via Canova 9, Lugano (Switzerland),
• Tristate US Inc. (“Tristate US”), 257 Park Avenue South, Suite 303, New York, New York 10010 (United States),
• Tristate UK Ltd. (“Tristate UK”) 86 Jermin Street, London, SW1Y 6AW (United Kingdom),
• Tristate’s group companies managing physical stores, whose registered offices and contact details are available at the following link: www.cpcompany.com/tristate-group-companies.html
as Data Controller depending on the processing activity.
Each relevant entity acts as an independent Data Controller with respect to the specific processing activities it carries out, as further specified in Section 4 for each processing purpose and provides this privacy policy pursuant to the Applicable Data Protection Regulations, including, as applicable, Articles 13 and 14 of the GDPR, Articles 13 and 14 of the UK GDPR, Article 19 of the FADP, and additional statements required by certain U.S. laws.
We take the utmost account of the right to the protection of data subjects’ (“Data Subjects” or “You”) personal data who, for any information in relation to this Policy or to exercise the rights guaranteed to them by the law, may contact each Data Controller at any time: (i) by sending a registered letter with return receipt to the operational office of Tristate Digital SA, Via San Martino, n. 16, 6850, Mendrisio (Switzerland), Attn: Privacy Department; and (ii) by sending an email to the address privacy@eu.tristateww.com.
We may process:
a) Contact and identification data: such as your first name, surname, email address, telephone number, whatsapp account identifier, residential address, country of residence, language, date of birth, gender, and, where applicable, identification details and preferred store.
b) Purchase and transactional data: such as information relating to your purchases (including date, amount, products purchased), order details, returns, participation in promotions or contests, as well as information related to your account on the Website and, where applicable, your participation in the Loyalty Programme (e.g., points balance and membership status).
c) Payment and invoicing data: such as billing address and payment details (including credit card information or other payment instruments) necessary to process your orders and manage related administrative and accounting obligations.
d) Browsing and behavioral data: such as information relating to your interaction with our digital services, including IP address, device identifiers, browsing activity, pages visited and interactions, also collected through cookies and similar technologies, including data used for analytics and advertising purposes.
e) Product-related data: such as product codes, description of the product, details relating to purchased or owned products, requests for repair or assistance, description of reported issues, and any information necessary to provide after-sales services, including repair, return and related customer support activities.
f) Device and network usage data: including information collected when you access in-store Wi-Fi networks (e.g. device identifiers, connection logs and usage data for security and service management purposes).
g) Email tracking data: such as information relating to your interaction with our emails, including whether an email has been opened or clicked, the time of such interactions, the device and email client used, and approximate location derived from the IP address.
Moreover, on the Store we may made available to you a “Size recommendation tool” provided by a third party. We do not process or in any manner access to the personal data collected through this tool.
Product pages may give you access, through a dedicated button, to the size recommendation tool provided by Kleep SAS (23 rue Blondel, 75002 Paris, France), which acts as an independent data controller for the information you enter into it. Your use of the tool is optional. Any information you provide in the tool (such as your height, weight and fit preferences) is collected directly by Kleep and processed in accordance with Kleep's privacy notice. If you select the “Remember my size” option in the tool, Kleep stores identifiers on your device for up to 12 months so that your size is remembered on this website; you can withdraw this choice at any time through the “forget my size” control in the tool. To exercise your rights in relation to that information, contact Kleep at dpo@kleep.ai.
Your personal data is collected through the following methods:
a) Directly from you: for example when you create an account on the Website, make a purchase, subscribe to the Loyalty Programme, request repair or after-sales services, contact customer care, subscribe to newsletters, participate in surveys, contests or promotions, or otherwise provide your data by filling in forms (including digital forms used in physical stores or for repair services).
b) Through the use of digital services: when you interact with our online channels, including the Website and dedicated platforms (such as the repair service platform), we may automatically collect certain information through cookies and similar technologies, including data relating to your browsing activities, device, and interactions with our websites and communications.
c) In physical stores: when you visit our stores, your data may be collected by store personnel through physical store tools or provided directly by you (e.g. for account creation, purchase tracking, personalized assistance or participation in the Loyalty Programme).
d) Through in-store Wi-Fi: when you access Wi-Fi networks made available in our stores.
e) In connection with the services you request: including when you request repair, after-sales or customer support services, by providing information relating to your product and your request (e.g. product details, description of issues, delivery and return information).
f) From third parties indicated by you: for example, when you provide us with personal data of third parties (such as delivery recipients), you acknowledge that you are responsible for ensuring that such data have been collected and shared in compliance with applicable law.
We process your personal data for the following purposes:
a) Website Navigation: to enable You to navigate the Website, as well as to obtain anonymous statistical information on the use of the Website and to ensure its proper functioning. The provision of this data is necessary to allow the Data Subject to access the content of the Website while browsing it. Failure to provide such data will prevent the Data Subject from browsing the Website.
The Data Controller, where your personal data is processed for these purposes through the Website, is Tristate Digital.
The legal basis for the processing is the performance of a contract to which the Data Subject is party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Article 6(1)(b) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
b) Contractual and service-related purposes: to help you create and manage your account, complete your purchases on the Website, in the physical stores, or through the “PaybyLink” service, carrying out organizational, administrative, financial and accounting activities necessary to fulfil our contractual and pre-contractual obligations, receive customer care and after-sales support, take part in the Loyalty Programme (including earning points, benefits and rewards), and access repair or maintenance services (such as product collection, repair and return). For these activities, we process your personal data as necessary to perform a contract with you or to take steps at your request prior to entering into a contract. These purposes also include performing our obligations under the General Terms and Conditions of services, published on the Website and accepted by you upon registration and/or the PaybyLink’s General Termes and Conditions, verifying your identity, including by validating your email address, and handling your specific requests. We may also (i) contact you with service-related communications, including notifications concerning the services you use and updates to the General Terms and Conditions mentioned above and (ii) use your data to keep you updated on things that are relevant to your shopping experience, such as notifying you when a product becomes available, where this is necessary to provide the service you requested, and reminding you about items left in your shopping cart, based on our legitimate interest in facilitating your purchase experience and improving our services.
The Data Controller, where your personal data is processed for these purposes, is the entity acting as the seller. Specifically: (i) for purchases made through the Website, the Data Controller is Tristate Digital, except for purchases made through the UK and US sections of the Website, for which the Data Controllers are Tristate UK and Tristate US, respectively; (ii) for purchases made in physical stores, the Data Controller is the relevant Tristate group company acting as the seller and operating the store where the purchase is made.
Where your personal data is processed for the purposes of the Loyalty Programme and The Longevity Hub services, Tristate Digital is the Data Controller.
The legal basis for the processing is its necessity for the performance of a contract to which the Data Subject is party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Article 6(1)(b) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
The legal basis for this processing, where applicable, is the pursuit of the Data Controller’s legitimate interest in in facilitating your purchase experience and improving its services (Article 6(1)(f) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
c) Administrative, accounting and legal purposes: to comply with obligations arising from applicable laws and regulations or imposed by competent authorities, (including tax, accounting and reporting obligations, as well as responding to requests from Data Subjects to access their personal data), to manage administrative processes connected to our business activities, and to prevent fraud, unlawful conduct or misuse of our services, as well as to protect and enforce our rights. For these purposes, we process your personal data where necessary to comply with a legal obligation to which we are subject.
The Data Controller, where your personal data is processed for these purposes, is the entity acting as the seller. Specifically: (i) for purchases made through the Website, the Data Controller is Tristate Digital, except for purchases made through the UK and US sections of the Website, for which the Data Controllers are Tristate UK and Tristate US, respectively; (ii) for purchases made in physical stores, the Data Controller is the relevant Tristate group company acting as the seller and operating the store where the purchase is made.
Where your personal data is processed for the purposes of the Loyalty Programme and The Longevity Hub services, Tristate Digital is the Data Controller.
The legal basis for the processing is its necessity for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
d) Customer care and support purposes: to handle your requests, provide assistance through customer service channels, respond to inquiries (including product availability or service-related requests), and manage interactions related to purchases, services or accounts. For these purposes, we process your personal data as necessary to perform a contract with you or to take steps at your request prior to entering into a contract.
The Data Controller for these purposes is the entity to which your customer care or support request is addressed, where the request relates to the purchase of a product or the management of a purchase falling within that entity’s responsibility. Specifically: (i) for purchases made through the Website, the Data Controller is Tristate Digital, except for purchases made through the UK and US sections of the Website, for which the Data Controllers are Tristate UK and Tristate US, respectively; and (ii) for purchases made in physical stores, the Data Controller is the relevant Tristate Group company acting as the seller and operating the store where the purchase is made.
The legal basis for the processing is the performance of a contract to which the Data Subject is party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Article 6(1)(b) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
e) Marketing purposes: To send you newsletters, promotional communications and information about products, services, initiatives or events offered by us, including offers, promotions and commercial opportunities, through email or other communication channels (in particular, whatsapp and SMS).
The Data Controller, where your personal data is processed for this purpose, is Tristate Digital.
The legal basis is the provision of Data Subject of consent to the processing of his/her personal data for this specific purpose (Article 6(1)(a) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
f) Profiling and personalization purposes: to analyze your preferences and consumption habits, purchase history and interactions with our services in order to better understand your interests, determine your consumer profile and provide you with personalized communications and offers, including through automated processing activities (profiling).
The Data Controller, where your personal data is processed for this purpose, is Tristate Digital.
The legal basis is the provision of Data Subject of consent to the processing of his/her personal data for this specific purpose (Article 6(1)(a) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
g) Soft spam purposes (existing customers): to send you communications relating to products and services similar to those you have previously purchased or requested, using the contact details collected in the context of a sale or negotiations for a sale, in accordance with applicable data protection and electronic communications laws. Such communications will concern our own products and services and will be sent only where you were duly informed of this use at the time of data collection and were given the opportunity to object.
The Data Controller, where your personal data is processed for these purposes, is the entity that has or has had a direct contractual relationship with you as the seller, to the extent permitted by the laws applicable to each group company to the relevant communications. Specifically: (i) for purchases made through the Website, the Data Controller is Tristate Digital, except for purchases made through the UK and US sections of the Website, for which the Data Controllers are Tristate UK and Tristate US, respectively; (ii) for purchases made in physical stores, the Data Controller is the relevant Tristate group company acting as the seller and operating the store where the purchase is made.
For customers of the Store and physical stores in the European Union, this processing is carried out without your prior consent pursuant to the “soft spam” exemption provided for under Article 13(2) of Directive 2002/58/EC, as amended (“ePrivacy Directive”), as implemented by the applicable national legislation and subject to the conditions set out therein. For other jurisdictions, reference is made to the relevant provisions of the Applicable Data Protection Regulations, where applicable.
You may object to the processing at any time (“opt-out”), either to receiving further soft spam emails or only to the use of tracking pixels embedded in those emails, through the methods described in this Policy.
h) Use of tracking pixels in email communications (for non-technical purposes): to use tracking pixel in emails – which are sent to the Data Subject for the marketing, profiling and soft spam purposes as referred to in the above paragraphs e), f), g) - to carry out individual measurement and analysis of the open rate of the emails sent to the Data Subjects. The information collected via tracking pixels will be used, more specifically, to evaluate and improve the performance of marketing campaigns and newsletter communications on the basis of observed behaviour (by changing the subject line of messages in the event of a low open rate or by improving their relevance, readability or appeal; by adjusting the frequency or ceasing to send messages based on the recipient’s expressed interest in the messages received, etc.).
The Data Controller for the use of tracking pixels in emails sent for consent-based marketing or profiling purposes is Tristate Digital. For the use of tracking pixels in emails sent for soft spam purposes, the Data Controller is the relevant Group company acting as the seller of the product, as specified in the preceding paragraphs.
For Data Subjects of the Website and physical stores in the European Union, the use of tracking pixels for the purposes described herein is subject to your prior consent pursuant to Article 5(3) of ePrivacy Directive, as implemented by the applicable national legislation and subject to the conditions set out therein.
Based on the guidance provided by the Italian Data Protection Authority (Garante per la protezione dei dati personali), the specific consent you provide for the marketing and profiling purposes described in the preceding paragraphs also covers the use of tracking pixels embedded in the relevant promotional emails, as described in this privacy policy.
According to the French Data Protection Authority (CNIL), a single consent may be obtained for the receipt of promotional emails and the use of tracking pixels embedded in those emails where, as in our case, the two purposes are closely connected because the pixels contribute directly to the personalisation of those communications, including by tailoring their content or adjusting their frequency based on your interactions.
For further information on withdrawing your consent on a granular basis, including only in relation to the use of tracking pixels, or exercising your right to object, please refer to the paragraphs on marketing, profiling and soft spam above and to Section 10 of this Policy.
i) Behavioral advertising and retargeting purposes: to display advertisements relating to our products and services based on your browsing behavior and interactions with our Website, digital platforms and inferred preferences from those activities, including cookies, pixels and similar technologies deployed on the Website and digital platforms, and to deliver targeted advertising across digital channels, subject to your consent, where required.
The Data Controller, where your personal data is processed for these purposes, is Tristate Digital. For further information about the processing activities described in this paragraph, please refer to our Cookie Policy at the following link: https://www.cpcompany.com/cookies.html
j) Customer experience improvement purposes: to enhance your experience both online and in physical stores, including through the use of physical store tools and the analysis of purchase history, in order to provide personalized assistance, recommendations and tailored services. For these purposes, we process your personal data on the basis of our legitimate interest in improving our services and offering you a more personalized and relevant customer experience.
The Data Controller, where your personal data is processed for these purposes, is Tristate Digital.
The legal basis for this processing is the pursuit of the Data Controller’s legitimate interest in improving its services and offering you a more personalized and relevant customer experience, including through tailored assistance, recommendations and services (Article 6(1)(a) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
k) In-store Wi-Fi management purposes: to provide and manage access to Wi-Fi networks in our physical stores, including authentication, network security, prevention of misuse and, where applicable, analysis of aggregated usage data to improve the service and in-store experience. For these purposes, we process your personal data as necessary to perform the service you request when accessing the Wi-Fi network and, where applicable, on the basis of our legitimate interest in ensuring network security, preventing misuse, and improving our services and in-store experience.
The Data Controller for these purposes is the legal entity operating the physical store you visit and whose Wi-Fi network you access.
The legal basis for the processing is its necessity for the performance of a contract to which the Data Subject is party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Article 6(1)(b) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
The legal basis for this processing, where applicable, is the pursuit of the Data Controller’s legitimate interest in ensuring the security of its in-store Wi-Fi networks, preventing misuse and improving the Wi-Fi service and in-store experience (Article 6(1)(f) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
l) Market research and consumer analytics purposes: to carry out statistical analyses, customer satisfaction surveys and market research activities, including the analysis of purchasing behavior, preferences and trends, in order to improve our products, services and commercial strategies, in aggregated form or, where necessary, identifiable form, based on your consent or our legitimate interest, as applicable.
The Data Controller, where your personal data is processed for these purposes, is Tristate Digital.
m) Service quality and feedback purposes: to send you surveys and collect feedback regarding your experience with our products and services (including post-purchase or post-repair feedback or interaction with our customer care), in order to improve our offering. This processing is carried out on the basis of our legitimate interest in monitoring and improving the quality, effectiveness and customer experience of our products and services. You may object at any time, including through the opt-out mechanism provided in each communication or through the procedures set out in section 10 of this Policy. Where you exercise your right to object, we will cease further processing of your personal data for these purposes, unless we demonstrate compelling legitimate grounds for continuing the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.
The Data Controller, where your personal data is processed for this purpose, is Tristate Digital.
The legal basis for this processing is the pursuit of the Data Controller’s legitimate interest in monitoring and improving the quality and effectiveness of its products and services and the associated customer experience (Article 6(1)(f) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).
The provision of your personal data is:
a) Necessary for the provision of core services: such as the creation and management of your account, the purchase of products on the Store, participation in the Loyalty Programme, access to customer care and after-sales services (including repair services), and the fulfillment of related administrative, accounting and legal obligations. Failure to provide such data may result in the impossibility of accessing or using this service.
b) Optional for marketing, profiling and service quality purposes: such as receiving promotional communications, where applicable containing tracking pixels, newsletters, personalized offers, and participating in surveys or feedback activities. Refusal to provide such data or to give your consent will not affect your ability to access core services. You may withdraw your consent and/or object to the processing at any time, without affecting the lawfulness of processing carried out prior to such withdrawal/object.
Your personal data will be retained for periods that are proportionate to the purposes for which they are processed and in accordance with applicable data protection laws. In particular:
a) Website Navigation: the browsing data processed to enable the Data Subject to browse the Website are not retained only for as long as necessary for that purpose.
b) Account and service-related data are retained for the entire duration of your account and, in any case, may be deactivated after a defined period of inactivity (e.g. 24 months from your last interaction), as well as for the time necessary to provide you with the requested services (including purchases, customer care, Loyalty Programme participation and repair or after-sales services).
c) Loyalty Programme data are retained for the duration of your participation in the Loyalty Programme and for as long as your account remains active, unless you request deletion, and subject to any applicable legal retention obligations.
d) Marketing data (e.g. for sending newsletters and promotional communications) are retained for a period of up to 24 months from their collection, unless you withdraw your consent earlier.
e) Profiling, personalization data and behavioral advertising are retained for a period of up to 12 months from their collection, unless you withdraw your consent earlier.
f) Soft spam data (existing customers) are retained for a period of up to 24 months from the last purchase, unless you object to this processing.
g) Use of tracking pixels in email communications (for non-technical purposes): Personal data collected via tracking pixels used by the Data Controller in emails, subject to the Data Subject’s prior consent for marketing, profiling and soft spam purposes (and without prejudice to any granular withdrawal made by the Data Subject), will be processed for as long as necessary to that purpose.
h) Wi-Fi data are retained for the time necessary to ensure network security and service provision.
i) Data processed for administrative, accounting and legal purposes may be retained for longer periods, where required by applicable laws and regulations (e.g. tax and accounting obligations).
j) Data related to repair and after-sales services are retained for the time strictly necessary to provide the requested service and to manage any related requests, as well as for any additional period necessary to protect our rights in case of disputes.
k) Service quality and feedback purposes: the association between the responses provided through the survey and the identity of the relevant individual will be retained for the period strictly necessary to identify any issues and areas for improvement, and improve the quality, effectiveness and overall customer experience associated with our products and services. With regard to surveys sent following the provision of Fix & Repair services, the responses are anonymized and are therefore not retained in association with the identity of the relevant individual.
At the end of the applicable retention period, your personal data will be deleted or anonymised, unless further retention is necessary for other lawful purposes, including compliance with legal obligations or the establishment, exercise or defence of legal claims. Where anonymisation is carried out, your personal data will be processed to produce anonymous information, in accordance with the purposes, legal bases and retention periods specified in this Policy for the relevant processing activity. Once effectively anonymised, the resulting information will no longer constitute personal data and will therefore fall outside the scope of the GDPR.
Your personal data may be processed and stored at the premises and IT systems of the Data Controllers and their service providers, located within the European Union, Switzerland, UK and, where applicable, in countries outside these jurisdictions.
In particular:
a) Personal data are primarily processed within the EU and Switzerland, where the Data Controllers and their main service providers are established.
b) In certain cases, your data may be transferred to and processed in countries outside the EU/Switzerland, including the United Kingdom and the United States, where our service providers, IT infrastructure providers, logistics partners or other entities involved in the provision of our services (including e-commerce, customer care, physical store activities and repair services) are located.
c) Any such transfers will be carried out in compliance with the Applicable Data Protection Regulations and will rely to appropriate safeguards, as applicable, including:
• adequacy decisions, regulations or determinations issued by the competent authorities (e.g. the European Commission, the UK Secretary of State, the Swiss Federal Council, as applicable), or
• appropriate safeguards recognised under the applicable legal framework such as the European Commission’s standard contractual clauses, binding corporate rules, the UK International Data Transfer Agreement (IDTA), the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses, or other mechanisms provided for under the Applicable Data Protection Regulations.
Where required under the Applicable Data Protection Regulations, we will assess the level of protection afforded to the transferred personal data and implement supplementary measures as necessary.
d) You may request further information on transfer mechanisms and obtain a copy of the safeguards adopted by contacting us (i) by sending a registered letter with return receipt to the operational office of the Tristate Digital SA, Via San Martino, n. 16, 6850, Mendrisio (Switzerland), Attn: Privacy Department; and (ii) by sending us an email to the address privacy@eu.tristateww.com
Your personal data may be shared with the following categories of recipients, in accordance with applicable data protection laws:
a) Service providers: such as IT service providers, hosting providers, platforms managing the Store and digital services, customer care providers, marketing and profiling service providers, as well as consultants (e.g. legal, tax and accounting), who process personal data on our behalf as data processors under appropriate contractual arrangements including advertising networks, analytics providers and Wi-Fi service providers.
b) Advertising networks and platforms: third-party providers that support the delivery, management and measurement of advertising campaigns across digital channels (e.g. social media platforms, search engines and advertising networks). These entities may process personal data such as online identifiers, browsing data and interaction data, collected through cookies, pixels and similar technologies, in order to display targeted advertisements, perform retargeting activities and measure the effectiveness of advertising campaigns, in accordance with your preferences and the choices expressed through our consent management tools.
c) Wi-Fi service providers: third-party providers supporting the provision and management of Wi-Fi connectivity services in our physical stores, including network infrastructure operators and technical service providers responsible for user authentication, network access management, security monitoring and prevention of misuse. These entities may process limited technical and device-related data (such as device identifiers, connection logs and usage data) strictly necessary to ensure the proper functioning, security and optimization of the Wi-Fi service.
d) Group companies and commercial partners: including companies belonging to Tristate’s group, operating in the fashion and retail sectors, and selected distributors or partners, which may process your data in order to provide you with integrated services and a consistent customer experience across online and offline channels (e.g. account management, physical store activities purchase history sharing). Where such group companies and / or selected distributors or partners, process your personal data on behalf of the Data Controllers, they will be appointed as Data Processors in accordance with the Applicable Data Protection Regulations and will act on the documented instructions of the relevant Data Controller.
e) Repair service providers and logistics partners: including entities involved in the provision of after-sales and repair services (such as product repair centers, couriers and logistics providers responsible for product pickup, shipment and return), who process the data necessary to perform the requested services.
f) Payment service providers and banking institutions: for the management of payments, transactions and related financial operations, where applicable.
g) Public authorities and third parties if required by law: including administrative authorities, judicial authorities or other entities, where disclosure is necessary to comply with legal obligations, prevent unlawful activities, or protect and enforce our rights or the rights of third parties.
h) Other recipients in the context of corporate transactions: such as legal advisors or consultants, in case of extraordinary transactions (e.g. mergers, acquisitions or reorganizations), in compliance with applicable law.
Our services, including the Store, physical store activities), Loyalty Programme and repair or after-sales services, are not intended for individuals under 18 years of age, but rather for adults. We do not knowingly collect personal data from anyone under 16 years of age, and we do not knowingly sell or share (as those terms are defined under the CCPA) the personal data of consumers under 16 years of age.
If you are a parent or legal guardian and you believe that a minor has provided us with personal data, you may contact us at any time using the contact details indicated in this Privacy Policy. We will take appropriate steps to verify the situation and, where necessary, promptly delete such data in accordance with Applicable Data Protection Laws.
You may at any time exercise your rights under the Applicable Data Protection Regulations, including the right to obtain confirmation as to whether or not your personal data are being processed and, where that is the case, to access such data and verify their origin and accuracy.
In particular, in accordance with applicable law, we hereby inform the Data Subjects that they have:
- the right to withdraw consent (in cases where processing is based on consent), without this affecting the lawfulness of processing based on consent prior to withdrawal. In particular, the Data Subject who has consented to the processing of personal data for purposes referred to in the preceding paragraphs e) and f) (consent which also includes the use of tracking pixels for non-technical purposes, which the Data Controller includes in such communications) may, at any time, withdraw the choices made, including on a granular basis. In other words, the Data Subject may: i) withdraw the consent given, thereby preventing the future receipt of further communications for marketing purposes; or ii) choose to withdraw consent only partially, with regard solely to the receipt of tracking pixels within such communications. Data Subject may withdraw their consent by contacting Us at the addresses provided in this paragraph and/or by clicking on the link provided in each communication. Furthermore, with regard to marketing communications sent for the purpose described in paragraph 4 (e), Data Subjects may choose the types of communications they wish to receive through the preference management centre on the Website, which Data Subjects can also access via the links included in those emails. Specifically, Data Subjects may select either “Receive all our marketing communications” (including offers, products, services, events, news and sales) or “Receive sales updates only” (limited to announcements of the start of sales periods). Data Subjects may change their preferences or withdraw their consent at any time. If Data Subjects disable all marketing options, they will no longer receive any marketing communications;
- the right to access their personal data;
- the right to data portability (the right to receive all personal data provided knowingly and actively by the Data Subject, as well as personal data collected directly from the Data Subject using the Website or his/her device, in a structured, commonly used, and machine-readable format);
- when one of the cases provided for by law occurs, the right to limitation of the processing of personal data;
- the right to rectification (obtain from the Controller the rectification of inaccurate personal data concerning the Data Subject);
- the right to have incomplete personal data completed (including by providing a supplementary statement);
- the right to erasure of personal data concerning Data Subjects when one of the reasons provided for by law applies;
- the right to object to processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. For soft spam emails, Data Subjects may likewise object to receiving further emails or only to the use of tracking pixels, using the same methods described above. Following the exercise of the right to object to the sending of promotional communications by email, it is possible that, for technical and operational reasons (i.e., the formation of contact lists already completed shortly before the receipt by the Controller of the request for objection) the Data Subject will continue to receive some further promotional messages. If you continue to receive promotional messages after 24 hours of exercising your right to object, please report the problem to the Controller.
- if they believe that the processing that concerns them violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State where Data Subjects habitually reside, where they work, or where the alleged violation occurred). The list of the Supervisory Authorities located in the Member States can be found on the website of the European Data Protection Board, at the following link. In the United Kingdom the Authority is the Information Commissioner’s Office (ICO) which can be contacted through the following link. In Switzerland the Authority is the Federal Data Protection and Information Commissioner (FDPIC) which can be contacted through the following link.
To exercise your rights or request further information, you may contact us (i) by sending a registered letter with return receipt to the operational office of the Tristate Digital SA, Via San Martino, n. 16, 6850, Mendrisio (Switzerland), Attn: Privacy Department; and (ii) by sending us an email to the address privacy@eu.tristateww.com
If you are a resident of the United States, please also see Section 11 (United States State Privacy Rights) below, which describes additional rights that may apply to you and how to exercise them.
This Section applies to residents of California and of other US states whose privacy laws provide the rights described below, and supplements the rest of this Privacy Notice. For purposes of those laws, the entities identified in Section 1 are the “business” or “controller” responsible for the personal data described in this Privacy Notice. If this Section conflicts with any other part of this Privacy Notice, this Section controls for US residents to the extent of the conflict.
The descriptions below summarize rights available under US state privacy laws currently in effect. These rights are subject to conditions and exceptions and may not apply to all data or to all of our processing activities.
a) Categories of personal information: in the last 12 months, we have collected the categories of personal data described in Section 2, which correspond to the following categories under the CCPA: identifiers (such as name, email address, telephone number, and postal address); customer records and commercial information (such as purchases, orders, returns, and Loyalty Programme activity, and the contents of communications you exchange with us, including through customer service channels); payment information (collected and processed through our payment service providers); internet or other electronic network activity information (such as browsing activity and interactions with the Store, collected through cookies and similar technologies); approximate geolocation inferred from IP address; and inferences drawn from the foregoing to reflect preferences. We collect this information from the sources described in Section 3, use it for the purposes described in Section 4, and retain it as described in Section 6. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CCPA.
b) Disclosure, “sale,” and “sharing”: we disclose personal data to the categories of recipients described in Section 8 for business purposes. We do not sell personal data in exchange for money. However, our use of advertising cookies, pixels, and similar technologies, as described in Sections 4 and 8, may constitute “sharing” of personal information for cross-context behavioral advertising, and in some states “selling” or processing for targeted advertising, under applicable law. The categories involved are identifiers and internet or other electronic network activity information, and the recipients are advertising networks and analytics providers.
c) California: if you are a California resident, you have the right to: (i) know and access the personal information we have collected about you, including the categories of personal information, the categories of sources, the business or commercial purposes for collecting, “selling,” or “sharing” it, the categories of third parties to whom it is disclosed, and the specific pieces of personal information collected, including in a portable format; (ii) correct inaccurate personal information; (iii) delete personal information, subject to legal exceptions; (iv) opt out of the “sale” or “sharing” of personal information; and (v) not receive discriminatory treatment for exercising these rights. This Privacy Notice, including this Section, is our notice at collection for California residents.
d) Virginia, Indiana, Kentucky, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, and Texas: if you are a resident of one of these states, you have the following rights: confirm whether we process your personal data and access it; correct inaccuracies; delete personal data, subject to exceptions; obtain a portable copy of personal data you provided; opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects; and appeal our decision on a request, as described in paragraph n) below.
e) Colorado: Colorado residents have the rights described in paragraph d) above. Colorado also requires recognition of certain opt-out preference signals, which we honor as described in paragraph n) below.
f) Connecticut: Connecticut residents have the rights described in paragraph d) above. Connecticut also requires recognition of certain opt-out preference signals, which we honor as described in paragraph n) below.
g) Delaware: Delaware residents have the rights described in paragraph d) above. Delaware also requires recognition of a universal opt-out mechanism, which we honor as described in paragraph n) below.
h) Florida: Florida residents have rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. Florida law also provides additional opt-out rights related to certain sensitive data and certain collection through voice recognition or facial recognition features.
i) Iowa: Iowa residents have rights to access and delete personal data, to obtain a portable copy of personal data they provided, and to opt out of the sale of personal data and of targeted advertising, and may appeal our decision on a request.
j) Maryland: Maryland residents have the rights described in paragraph d) above. Maryland law also provides a right to obtain a list of the categories of third parties to which we have disclosed personal data.
k) Minnesota: Minnesota residents have the rights described in paragraph d) above. Minnesota law also provides additional rights relating to certain profiling decisions, including the right to question the result of certain profiling and obtain an explanation.
l) Oregon: Oregon residents have the rights described in paragraph d) above. Oregon law also provides a right to obtain a list of the specific third parties to which we have disclosed personal data.
m) Utah: Utah residents have rights to access and delete personal data, to obtain a copy of personal data they provided, to correct inaccuracies, and to opt out of targeted advertising and the sale of personal data.
n) How to exercise your rights: you may submit access, correction, and deletion requests by emailing us at privacy@eu.tristateww.com or by using the Contact form on the Website. You may opt out of “sale,” “sharing,” and targeted advertising through the “Do Not Sell or Share My Personal Information” link on the Website and by managing your preferences through our cookie consent tool, and we honor opt-out preference signals, such as the Global Privacy Control, as required by applicable law. We will verify your request using information associated with your account or orders and may ask for additional information where necessary to verify your identity. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and verification of your identity. We will respond to verifiable requests within 45 days, and we may extend that period by an additional 45 days where reasonably necessary, with notice to you. If we decline to act on your request, you may appeal by replying to our response, and we will respond to appeals within 45 days, or as otherwise required by applicable law. If your appeal is denied, we will provide information about how to contact your state Attorney General or other relevant regulatory authority.
o) Data minimization: we limit our collection of personal data to what is reasonably necessary and proportionate to the purposes described in this Privacy Notice. Where required by applicable law, we conduct data protection assessments for processing activities that present heightened risks to consumer privacy, including targeted advertising, the sale of personal data, the processing of sensitive data, and the use of certain automated decision-making technologies.
p) Loyalty Programme: where the Loyalty Programme is offered to US customers, the benefits described at enrollment (such as points, rewards, and member offers) are provided in exchange for participation and are reasonably related to the value of the personal data processed to operate the programme. Participation is voluntary; you may join or withdraw at any time as described in the programme terms, and withdrawing will not affect your other rights under this Privacy Notice.
We may update this Policy from time to time in order to reflect changes in applicable laws or regulations, as well as to consider modifications to our services, processing activities or internal organizational structure.
In case of material changes, we will provide appropriate notice for you, where required by applicable law, for example through our website or other communication channels. The updated version of the Policy will be made available on our digital platforms and will indicate the date of the latest revision.
We encourage you to periodically review this Policy to stay informed about how we process your personal data.
Last update of the current Privacy Notice on 28-10-2026
