Privacy policy

PRIVACY POLICY PURSUANT TO regulation (EU) 2016/679 – articles 13 and 14

Last updated in May 2018

We wish to inform you that, in accordance with Regulation (EU) 2016/679 known as the “General Data Protection Regulation” (GDPR), personal data entered in the website are processed in the manner and for the purposes described below.

In compliance with the provisions included in the new Regulation on the protection of personal data, we communicate the following:

Pursuant to articles 13 and 14 of Regulation (EU) 2016/679, we inform you that VHERNIER S.P.A. with tax code and VAT number 01150040069 is the controller (hereinafter “Controller”) and the registered office is in VIA BORGONUOVO, 24, 20121 MILAN.

Data protection officer
The data protection officer is Marta Garofalo Moruzzi.
According to the specified regulation, processing will be based on the principles of fairness, lawfulness and transparency and the protection of your privacy and rights.

What data are processed
Personal and biographical data (name, surname, city, country, e-mail address, date of birth) collected by us are provided by the user during registration in the newsletter section on the website  In the same way, it is possible to provide the Controller with further biographical data such as name, surname, address, e-mail address and telephone number by sending a contact request when filling in the “Press Request”, “Become a Vhernier retailer”, “Work with us” and “General Enquiries” sections on the above website.  It will also be necessary to provide Vhernier S.p.A. with your biographical and invoicing data to fulfil contractual obligations; this procedure will be managed at the Vhernier boutique by means of specific digital instruments connected to the cashier systems.

Purpose of the processing
Personal data are processed for purposes connected or necessary to Vhernier S.p.A.’s business operations including archiving in its databases.
In particular, without the express consent of the data subject for:
- registration in the newsletter section on the website;
- receipt of a message sent via the “Area Stampa”, “Become a Vhernier retailer”, “Work with us” and “General Enquiries” forms.  Personal data are requested when the relevant form is filled in (name, surname, e-mail address, telephone number), which will be used to subsequently identify the user in order to provide a reply using the contact details given.

The processing of data is managed on the basis of legal “justification” (or legal basis).  In most cases, the processing of personal data is justified on the basis of one of the following criteria:
- processing is necessary for the performance of a contract or to undertake initiatives requested by the user with a view to the conclusion of a contract (e.g. sales contract).
- processing is necessary for the fulfilment, by Vhernier S.p.A., of legal obligations;

- processing is in our legitimate interests as a business activity, over which the interests, rights or fundamental freedoms of the user cannot prevail.  Our legitimate interests can include our interest in using the personal data of customers and users of the Website in order to conduct and develop business activities (including the performance of standard marketing activities) with current and potential customers and users of the Site, and in establishing, exercising or defending rights, or
- processing is carried out on the basis of the user’s specific consent, for example in the case of segmented and personalised marketing activities.

   Users’ personal data are processed for the following purposes:  The processing of users’ personal data is justified on the basis of the following legal bases:
 1 Processing of purchases and provision of the services and information offered through the Website requested by users

Performance of a contract

Verification and execution of financial transactions in connection with payments made by users Performance of a contract

Improvement and customization of our products and services, and our business activities in general, for example by monitoring user product preferences, shopping history and interaction with the Website Our legitimate interest in improving our products and services

Carrying out data analysis and market research

Our legitimate interest in knowing our customers better and improving our services accordingly

Data enrichment, such as analysing user product preferences, shopping history and interaction with the Website along with data collected from third parties, for example data which the user agrees to share with Vhernier S.p.A. on social networks (e.g Facebook, Instagram, etc.) and/or which we could collect from databases accessible to the public
With the prior explicit consent of the user

Communicating with users to respond to requests and/or complaints 
With the prior explicit consent of the user

Sending marketing communications containing news, information and updates on our products and services, offers, promotions and special events and other marketing communications which can be of interest to the user (via SMS, e-mail or telephone), customizing the experience with us according to interests and specific shopping habits and improving our services, in particular through profiling.

With the prior explicit consent of the user and our legitimate interest in maintaining our customers and potential customers up-to-date on our services and products 

Method of processing
The processing of personal data pursuant to the regulations means any operation or set of operations, whether or not by automated means, regarding the collection, recording, organisation, storage, processing, alteration, selection, retrieval, alignment, use, combination, blocking, disclosure, dissemination, erasure and the distribution of data.  The company assures that the processing of data will be carried out through the use of appropriate procedures which avoid the risk of loss, unauthorized access, illegal use and dissemination, in compliance with the limits and conditions set by Regulation (EU) 2016/679.

Data access
The persons who may get to know the user's personal data in their capacity as data processors or persons in charge of the processing (according to Article 13 Paragraph 1 of the GDPR) are:
- the Controller
- the Controller’s staff, in order to carry out the user’s requests (registration on website, Restricted Area registration, replying to an information request)
- we could disclose your personal data to any of our affiliated companies or our suppliers who help to provide our services to process the transactions, reply to information requests, receive and send communications, update marketing lists, analyse data, provide assistance or carry out other activities from time to time.             

In particular, we disclose your personal data to Dune S.r.l., with registered office in via Anfiteatro, 5 – 20121, Milan, Italy, which provides us with services for the management of marketing campaigns in its capacity as Processor of Personal Data.
For the avoidance of doubt, we will ask for your explicit consent (opt-in) before sharing your personal data with any third-party company other than Vhernier S.p.A. for marketing purposes.          

Your personal data will be accessible to Vhernier S.p.A. authorized personnel and to suppliers of services which operate in our name, if necessary.  The transfer of your personal data may be necessary from your Country of residence to third Countries where we operate; some of these Countries are subject to a decision of the European Commission on the adequacy of data protection, while others, such as the USA, are not.  To ensure that the protection of your personal data is compliant to applicable laws, such a transfer outside your Country of residence or the European Economic Area (EEA) shall be carried out in compliance with EU Model Clauses, the EU-US or CH-US Privacy Shield Frameworks, binding Clauses for companies belonging to the same Group or other applicable legal mechanisms of which you may request a copy at

Furthermore, we could also share your personal data with third parties in connection to the potential or actual sale or restructuring of our company or any of our assets, or any company in the same group, in which case our customers’ personal data in our possession could be among the assets transferred.       

We will respond to requests to disclose personal data when required to do so by law or when we believe disclosure is necessary to protect our rights and/or comply with a legal procedure, a court order, requests from the legislator or other legal procedures to which we are subject.

We attach great importance to the security of all personal data associated with our users.  For this reason, we have adopted security measures to protect your personal data against accidental or unlawful destruction, accidental loss, alteration, unauthorised disclosure or access.  For the best possible protection of your personal data beyond the limits of control exercised by Vhernier S.p.A., your device should be protected (for example, with an updated antivirus system) and your Internet provider should adopt suitable measures for secure data transmission over the network (such as firewalls and antispam filters).     

While we take reasonable protective measures, we cannot guarantee that your personal information will be 100% secure or that no data breaches will occur.         
By using this Website, you accept the inherent security implications of online transactions and you will not hold Vhernier S.p.A. or their data processors responsible for any data breaches that are not due to negligence.

Storage of personal data
In general, we store your personal data only for the time necessary to achieve the purposes for which they were collected. We generally retain your personal data for three years after the end of our relationship or since the last contact, unless otherwise required by local law. However, under certain circumstances, we may retain personal data for a longer period, for example if we are required to do so in accordance with legal, fiscal and financial requirements.

Furthermore, in specific circumstances, we may retain your personal data for longer periods, complying with applicable statute of limitations, in order to have an accurate record of your transactions with us in the event of complaints or appeals.

Your rights
You have the following rights regarding your personal data:

-        Right to withdraw consent: where applicable, you have the right to withdraw your consent to the processing of data at any time.  For example, if you wish to stop receiving electronic marketing notifications, you can send a communication via e-mail to, or contact the Vhernier offices directly and we will stop ending further notifications.
-        Right of access, rectification and erasure: you have the right to request access and to receive copy of all your personal data in our possession, to request rectification of any inaccurate personal data and request the erasure of your personal data in certain situations.  You can consult and update most of these data online or by contacting us directly at
-        Right to data portability: in certain situations, you have the right to receive all your personal data in a structured, commonly used and machine-readable format, as well as request the transmission to another controller, when technically feasible.
-        Right to restriction of processing: you have the right to restrict the processing of your personal data if:       
- you contest the accuracy of the personal data until we take sufficient steps to correct or check the accuracy of the personal data;          
- the processing is unlawful but you do not wish the data to be erased;     
- we no longer need the personal data for the purposes of the processing, but you require such data for the establishment, execution and defence of legal claims; or            
- you have objected to processing, on the basis of legitimate interests (see below) pending verification whether our legitimate interests prevail and override for the continuation of processing.       
If personal data are subject to limitations in this regard, we will process them only with the consent of the user for the establishment, execution or defence of legal claims.
-      Right to object to processing, based on legitimate interests: where processing of personal data is based on legitimate interests, you have the right to object to such processing.  In event of objection, it is our duty to stop processing unless we can demonstrate the existence of overriding interests which outweigh the interests, rights and freedoms of the user or   we must process the data for the establishment, exercise or defence of legal claims. In cases where we rely on legitimate interests as a justification for processing, we believe that we can demonstrate such overriding legitimate interests, but we will consider each case on its own merits.
-      Right to object to processing for marketing purposes: where we process personal data for marketing purposes, you will have the right to object to such processing at any time.

Furthermore, if you consider that the processing of your personal data violates the current legislation, you have the right to lodge a complaint with a supervisory authority.          

For further information regarding your rights, or the exercise of these rights, or in case of complaints or questions in relation to the processing of personal data, please contact us at  

Please note: we may require proof of your identity and reserve the right to charge fees when permitted by law, for example if the claim is clearly unfounded or excessive.  We are committed to responding to requests as soon as possible and, in any event, within the applicable time frame.

Changes to this policy
We may make changes to this Policy from time to time, for example, to comply with new requirements in applicable legislation or technical requirements.  The updated Policy will be published on the Website.  We may also notify users of material changes and request renewal of consent to such changes where required by applicable law. We therefore invite users to periodically visit this page.