PRIVACY POLICY

Welcome to the www.colmar.com website (hereinafter, the “Website”). This Website is managed by Manifattura Mario Colombo & C. S.p.A. and Digital Boite S.r.l..

In this Privacy Policy Manifattura Mario Colombo & C. S.p.A. and Digital Boite S.r.l. provide information regarding the processing of the personal data that is collected automatically or provided by the user when accessing the Website, browsing it and using its services (hereinafter, the “Services”).

When signing up for services provided by third parties, users are therefore advised to carefully read these third parties’ privacy policies. Manifattura Mario Colombo & C. S.p.A. and Digital Boite S.r.l. are unable to check these third-party policies and cannot be held liable for them.

1. DATA CONTROLLER

The data controllers for their respective areas of responsibility are:

  • Manifattura Mario Colombo & C. S.p.A. (hereinafter “Manifattura”):

  • Digital Boite S.r.l. (hereinafter “Digital Boite”):

(hereinafter jointly “Data Controllers”).

Specifically, Manifattura is the independent controller of the personal data processed for the purposes of:

  • Website navigation;

  • Marketing;

  • Profiling;

  • Loyalty Programme;

  • Personalised assistance;

  • Anti-fraud activities;

  • Selection;

  • Defence;

  • Performance measurement;

  • Deliverability;

  • Campaign Optimisation;

better defined below.

Digital Boite is the independent controller of the personal data processed for the purposes of:

  • Product purchases;

also better defined below.

Lastly, Manifattura and Digital Boite are joint controllers of personal data processed for the purposes of:

  • Customer Care;

  • Soft Spam;

  • Multi-channel services;

  • Defence;

better defined below. In this regard, Manifattura and Digital Boite have signed a specific joint controllership agreement pursuant to Article 26 of EU Regulation No. 2016/679 (hereinafter “Regulation”). Further information regarding its key content can be requested by contacting the respective Controllers at the email addresses infoedatabreach@mmcol.it and privacy@digitalboite.com.

2. DATA PROTECTION OFFICER

Manifattura and Digital Boite have each appointed a Data Protection Officer (hereinafter “DPO”). The DPO appointed by:

3. TYPE OF PERSONAL DATA THAT IS PROCESSED

“Personal data” means any information about the user and any information that refers to the user. Specifically, the processing may concern:

  • Personal data relating to browsing

When users access and browse the Website, Manifattura and Digital Boite collect browsing data – in general and in their respective areas of responsibility – through cookies and other tracking technologies. As part of their standard operation, the IT systems and software used to run this website acquire certain personal browsing data that is transmitted automatically when using the Internet communication protocols. This data relates to electronic traffic and, by its very nature, is not collected to be immediately associated with identified users, but could allow users to be identified through processing and associations with data held by third parties. This category of data includes the IP addresses or domain names of the computers used to connect to the Website, the URIs (Uniform Resource Identifiers) of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file that is sent in response, the numerical code indicating the status of the server’s response (successful, error, etc.) and other parameters regarding the user's operating system and computer environment.

This data allows us to verify the proper functioning of the Website and allows the user to utilise the Services provided therein, to guarantee the user a better browsing experience, to obtain information - in anonymous and aggregate form - about visits and to process statistical analyses and, finally, to create profiles that allow the sending of advertising in line with the preferences expressed by the user, as well as to identify anomalies and/or abuses. For further information on the processing of the aforementioned data through the use of cookies or other tracking systems, we ask that the user read the provisions of paragraph 5) below regarding cookies.

  • Personal data processed through tracking pixels

Tracking pixels are images that are often transparent and very small in size, which are not directly contained in the emails the user receives, but hosted on remote servers. They allow the sender of the email to obtain information relating to the opening and therefore the consultation of the email by that specific user or in a specific context, including any additional information that can be obtained from the IP address of the recipient user, relating to the type of device used, up to the time the email was consulted and the number of subsequent openings of the same email.

Manifattura uses tracking pixels within its communications (loyalty program emails, emails with informational, commercial and promotional content, as well as emails in line with your interests). After tracking pixels are activated, Manifattura processes the following kinds of user data: email opening event (date and time), IP address of the recipient's device (from which geographical indications can be derived, indirectly), user agent (type of email client, operating system, device), browser information, internal subscriber identifier, number of times the same message is opened to measure campaign performance (open rates and engagement), optimise deliverability (ensuring messages are received correctly), evaluate and improve promotional campaigns so as to adapt the content of communications based on whether they are opened.

  • Personal data provided voluntarily by the user

The Data Controllers also process personal data that is provided voluntarily by the user when interacting with the Website’s Services. In certain specific sections of the Website where user data is collected (such as the Work With Us, Newsletter subscription and Loyalty Programme subscription sections), specific privacy policies are published pursuant to Article 13 of the Regulation. In all other cases, the content of this document applies. The data provided voluntarily by the user is as follows:

  • first name, surname, nationality, residential address, delivery address, telephone number, email address, data relating to the product that has been chosen and purchased, data concerning the chosen payment method (for example, type of credit/debit card, card number, expiry date, etc.), when purchasing the chosen product or fulfilling the related legal and contractual obligations, as well as making use of the Omnichannel services. In the latter case, the order number and data from a valid identity document of the user and/or a delegate are also processed for the sole purpose of verifying their identity and proceeding with the delivery of the purchased product;

  • first name, surname, email address, telephone number, order number and any additional data provided when filling in the contact form or over the telephone, when requesting support or contacting customer care;

  • name, surname, email address and information relating to previously purchased products for the sending of “soft spam” communications;

  • email address, date of birth and data relating to the user’s biological sex to subscribe to the newsletter and send communications containing informational and promotional content;

  • first name, surname, date of birth, data relating to the user’s biological sex, telephone number, email address, password and any additional data provided when filling in the user’s profile details, when creating a user account;

  • first name, surname, email address, date of birth and any additional data provided when filling in the user’s profile details (for example, residential address, telephone number, favourite sport, number of family members and sex), cumulative total volume of spending, and data concerning any purchases that have been made (for example, product category, colour and size), when signing up to the “Colmar Club Alta Quota” programme and providing personalised assistance and profiling;

  • first name, surname, place and date of birth, address, nationality, telephone number and email address, as well as any additional data included in the user’s CV (for example, educational background, professional experience, personal interests, photos), in their cover letter and/or in their application form, including data that discloses their race or ethnicity or that relates to their health, when submitting a job application;

  • information collected through the use of tracking pixels, such as email opening event (date and time), IP address of the recipient's device (from which geographical indications can be derived, indirectly), user agent (type of email client, operating system, device), browser information, internal subscriber identifier, number of times the same message is opened to measure campaign performance (open rates and engagement), optimise deliverability (ensuring messages are received correctly), antispam and security (identification of anomalous activities), evaluate and improve promotional campaigns so as to adapt the content of communications based on whether they are opened;

  • click-through information (i.e., interactions recorded when a user clicks on a hyperlink within an email): internal subscriber and sender identifier, clicked link (URL and/or name assigned to the link), device IP address and user agent, and total clicks and unique clicks to measure, in anonymous form also, the effectiveness of informational and promotional campaigns and improve the services offered.

Hereinafter jointly the “Data”.

4. PURPOSE AND LEGAL BASIS FOR THE PROCESSING, AND NATURE OF THE PROVISION OF DATA

The Data is processed for the following purposes:

  1. to allow users to browse the Website, to check that the Website is working properly, and to ascertain liability in the event of a computer crime, as well as improving the browsing experience, carrying out statistical analyses of visits to the Website and creating profiles that enable us to send advertising tailored to the user’s stated preferences (hereinafter, “Browsing the Website”). The legal basis for the processing performed by Manifattura lies in the fulfilment of the contract (Article 6(1)(b) of the Regulation) and the legitimate interest of Manifattura (Article 6(1)(f) of the Regulation) and, with reference, to improve the browsing experience, to carry out statistical analyses and to create profiles, subject to the user’s express consent (Article 6(1)(a) of the Regulation);

  2. to process the user’s order of the chosen products, and to fulfil the contract of sale and all of the related legal and contractual obligations, including administrative, accounting and tax obligations (hereinafter, “Purchasing Products”). The legal basis for the processing performed by Digital Boite is the performance of the contract (Article 6(1)(b) of the Regulation) and fulfilling the related obligations (Article 6(1)(c) of the Regulation);

  3. to provide customer care, including responding to any requests and/or complaints and processing returns (hereinafter, “Customer Care”). The legal basis for the processing carried out by the Data Controllers is the pre-contractual measures taken at the user’s request and the performance of the contract (Article 6(1)(b) of the Regulation);

  4. to send marketing and promotional emails about Colmar products and services similar to those purchased, known as soft spam (hereinafter, “Soft Spam”). The processing carried out by the Data Controllers finds its legal basis in the exemption provided for in Article 130(4) of Italian Legislative Decree 196/2003 (hereinafter “Privacy Code”);

  5. to allow users to subscribe to the newsletter and to send informative, commercial and promotional messages about Colmar products, services and events (hereinafter “Marketing”). The legal basis for the processing performed by Manifattura lies in the consent granted by the user (Article 6(1)(a) of the Regulation);

  6. to analyse the interests, shopping habits and tastes of the user so that the company can customise its range of products and services, and to send future emails that match the user’s interests (hereinafter, “Profiling”). The legal basis for the processing performed by Manifattura lies in the consent granted by the user (Article 6(1)(a) of the Regulation);

  7. to create a personal profile in the “My Account” area and use the services reserved exclusively for registered users (hereinafter, the “User Account”). The legal basis for the processing carried out by Manifattura is the pre-contractual measures taken at the user’s request and the performance of the contract (Article 6(1)(b) of the Regulation);

  8. to sign up to and take part in the “Colmar Club Alta Quota” programme, to create the related profile, to manage any strictly related obligations (for example, awarding discounts, benefits, experiences and special dedicated initiatives) and to fulfil any additional legal and contractual obligations (hereinafter, the “Loyalty Programme”), provided that the user’s place of residence and/or domicile is in one of the territories as defined in the programme regulations. The legal basis for the processing performed by Manifattura lies in the performance of the contract (Article 6(1)(b) of the Regulation) and fulfilling the related obligations to which it is subject (Article 6(1)(c) of the Regulation);

  9. to provide personalised support and advice when purchasing products at stores participating in the “Colmar Club Alta Quota” programme (hereinafter, “Personalised Assistance”). The legal basis for the processing performed by Manifattura lies in the legitimate interest of Manifattura (Article 6(1)(f) of the Regulation);

  10. use of Omnichannel services (such as the “Delivery to Store” service, which allows the user to purchase products online and collect them at the selected store) (hereinafter “Multichannel”). The legal basis for the processing carried out by the Data Controllers is the pre-contractual measures taken at the user’s request and the performance of the contract (Article 6(1)(b) of the Regulation);

  11. to check that the purchaser and the cardholder are the same (hereinafter, “Fraud Prevention Activities”). The legal basis for the processing performed by Manifattura lies in the legitimate interest of Manifattura (Article 6(1)(f) of the Regulation);

  12. to assess the professional profile and to manage any selection process aimed at establishing an employment relationship or a professional collaboration (hereinafter, “Selection”). The legal basis for the processing performed by Manifattura is the implementation of pre-contractual measures (Article 6(1)(b)) of the Regulation and Article 111 of Italian Legislative Decree 196/2003) and, with reference to any special data provided, in the need to fulfil the obligations and exercise the specific rights of the user or Manifattura in matters of employment law and social security and social protection (Article 9(2)(b) of the Regulation);

  13. to exercise and defend the rights of the Data Controllers in any court, including legal and administrative courts, and in arbitration and/or mediation and conciliation processes (hereinafter, “Defence”). The legal basis for the processing performed by the Data Controllers is the legitimate interest of the Data Controllers (Article 6(1)(f) of the Regulation);

  14. measuring campaign performance including through the use of tracking pixels (hereinafter, “ Performance Measurement ”). The legal basis for the processing performed by Manifattura lies in the consent granted by the user (Article 6(1)(a)) of the Regulation and Article 122 of Italian Legislative Decree 196/2003) together with the purpose referred to in letter e) above;

  15. optimise deliverability through the use of tracking pixels (hereinafter, “Deliverability”). The legal basis for the processing performed by Manifattura lies in the consent granted by the user (Article 6(1)(a)) of the Regulation and Article 122 of Italian Legislative Decree 196/2003) together with the purpose referred to in letter e) above;

  16. to evaluate and improve a promotional campaign via the use of tracking pixels in order to modify communications based on email opens (“Campaign Optimisation”). The legal basis for the processing performed by Manifattura lies in the consent granted by the user (Article 6(1)(a)) of the Regulation and Article 122 of Italian Legislative Decree 196/2003) together with the purpose referred to in letter e) above.

With the exception of browsing data (collected automatically), the provision of data is:

  • necessary for the purposes referred to in letters a), b), c), d), g), h), i), j), k), l) and m). Therefore, should the user fail to provide the Data marked (*), Manifattura and/or Digital Boite will be unable to fulfil the request (for example, to browse the Website, to process the product purchase order, to fulfil the legal and contractual obligations, to respond to any support requests or complaints, to make use of the “Store Delivery” service or to start the selection process). However, should the user fail to provide the Data not marked (*), Manifattura and/or Digital Boite's ability to fulfil the request, in accordance with the aforementioned purposes, will not be affected;

  • optional for the pursuit of the purposes referred to in letter a) and, specifically, for the processing of statistical analyses regarding visits to the Website, for the improvement of the user's browsing experience and for the creation of profiles that allow the sending of advertising in line with the preferences expressed. Therefore, failure on the part of the user to provide the Data will make it objectively impossible for Manifattura to fulfil the request, without prejudice, however, to the pursuit of the remaining purposes referred to in letter a) above and those set out in letters b), c), d), g), h), i), j), k), l) and m) above;

  • optional for the purposes referred to in letters e) and f). Therefore, should the user fail to provide the Data, the Manifattura will be unable to send the newsletter and communications with informational, commercial and promotional content, as well as to carry out profiling, without prejudice to the pursuit of the purposes referred to in letters a), b), c), d), g), h), i), j), k), l) and m) above;

  • optional for the purposes referred to in letters n), o) and p). Therefore, failure to provide the Data will make it objectively impossible for Manifattura to measure campaign performance, optimise deliverability, and evaluate and improve campaigns. This will not, however, affect the sending of loyalty programme emails or informational, commercial and promotional emails, as well as emails relevant to the user's interests.

5. COOKIES

The Website uses technical, functional, analytical and profiling cookies, including third-party cookies, to enable normal navigation and use of the site, to improve the browsing experience, process statistical analyses and create profiles that allow the sending of advertising in line with the preferences expressed by the user. Further information about the characteristics of the cookies used on the Website can be found in the Cookies Policy.

6. PROCESSING METHOD

For the purposes indicated in Article 4, the Data will be mainly processed using electronic and automated means, as well as on paper, in accordance with the legal provisions concerning personal data processing, and using adequate security measures.

In order to guarantee the appropriate level of security and confidentiality and to avoid the risks of loss and/or destruction and access by unauthorised parties, the Data is processed by in-house staff at Manifattura and Digital Boite (employees, system administrators and any partners) who have been duly authorised, trained and instructed.

7. DISCLOSURE OF DATA

The Data will not be shared. Strictly within the limits of the purposes indicated in Article 4, the Data may be disclosed to:

  • third parties from outside the Data Controllers’ organisations that, as independent data controllers or processors pursuant to Article 28 of the Regulation, are involved in the data processing operations, for example, banks, internet providers, hauliers, marketing companies, IT infrastructure, management and maintenance companies, system security and fraud prevention companies, website management companies, tax advisors, call centre management companies, and companies that manage physical points of sale;

  • eligible parties pursuant to the law or regulations, such as, by way of example and without limitation, public authorities and legal authorities.

The updated list of all data processors can be requested from the Data Controllers by emailing infoedatabreach@mmcol.it and privacy@digitalboite.com.

8. DATA RETENTION PERIOD

The Data Controllers will retain the Data for the period strictly necessary to fulfill the respective purposes for which the Data was collected. Specifically, the Data processed for purposes of

  • Website navigation data: will be retained for no longer than 7 (seven) days from the date of their collection and, with specific reference to Data processed through the use of cookies or other tracking systems, for the period of time expressly indicated in the Cookie Policy;

  • Purchasing Products: will be retained for the duration of the relationship and, in any case, until the end of the limitation period regarding the rights arising from said relationship;

  • Customer Care: will be retained for the period strictly necessary to fulfil the purpose;

  • Soft Spam: will be retained until the user exercises their right to object to their data being processed;

  • Marketing: will be retained for 24 (twenty-four) months from the date on which it is collected;

  • Profiling: will be retained for a maximum of 12 (twelve) months from the date on which it is collected;

  • User Account: will be retained until the user closes the account, which they may request at any time;

  • Loyalty Programme and Personalised Assistance: will be retained for the duration of the user’s participation in the “Colmar Club Alta Quota” programme and, in any case, until the end of the limitation period regarding the rights arising from said participation;

  • Multi-channel services: will be retained for the period strictly necessary to fulfil all the activities connected with providing the service required by the user;

  • Anti-fraud activities: Personal data will be retained for the time necessary to carry out security checks, in accordance with the technical criteria and retention policies of the payment service providers used. In the event of suspected fraud, disputes or requests from the competent authorities, the data may be retained for such further period as is necessary for the related verifications. For further information on the applicable retention periods, you may contact the Data Controller at customercare@colmar.it;

  • Selection: will be retained for a period of 1 (one) year from the date on which the Data is collected;

  • Defence: will be retained for the entire duration of the dispute and until the terms for any appeal and/or for the limitation of the relevant action have expired;

  • Performance measurement: will be retained for a maximum of 6 (six) months from the date on which it is collected;

  • Deliverability: will be retained for a maximum of 6 (six) months from the date on which it is collected;

  • Campaign optimisation: will be retained for a maximum of 6 (six) months from the date on which it is collected.

The above is without prejudice to the right to withdraw consent for processing on the grounds of this legal basis, the right to object to processing, compliance with the specific retention obligations laid down by the law.

9. RIGHTS OF THE DATA SUBJECT

As indicated in the Regulation and without prejudice to the provisions and limitations of the Privacy Code (Part I - Title I - Chapter III), the user may contact Manifattura and Digital Boite to exercise the following rights regarding the Data:

  • access to the data, in the cases stipulated (Article 15 of the Regulation);

  • rectification of inaccurate data and the completion of incomplete data (Article 16 of the Regulation);

  • erasure of data, in the cases stipulated (Article 17 of the Regulation), for example, where it is no longer necessary for the aforementioned purposes or where it is not being processed in accordance with the Regulation;

  • restriction of processing in the situations provided (Article 18 of the Regulation), such as where the accuracy of the personal data is contested and its accuracy must be verified by the controller;

  • data portability, i.e. the right to receive the data, in the cases stipulate (Article 20 of the Regulation) in a structured, commonly used and machine-readable format and to transmit this data to another controller;

  • the right to object to processing, in the cases stipulated in Article 21 of the Regulation.

The user also has the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects concerning them or that similarly significantly affects them, where they have not explicitly granted their consent in advance (Article 22 of the Regulation). This category includes, but is not limited to, any form of automated data processing aimed at analysing or predicting aspects concerning the user's consumption and purchasing choices, economic situation, interests, reliability and behaviour.

Where the processing is based on the user’s consent, they have the right to withdraw this consent at any time, simply, freely and specifically, without rendering unlawful any processing that took place before the consent was withdrawn.

All of the aforementioned rights may be exercised as follows:

  • For Manifattura, by emailing infoedatabreach@mmcol.it or by sending a registered letter to them at: Via Olimpia no. 3, Monza (MB), 20900, Italy;

  • For Digital Boite, by emailing privacy@digitalboite.com or by sending a registered letter to them at: Via Cusani no. 5, Milan (MI), 20121, Italy.

In both cases, the user should specify their first name, surname, any order number, the details of their request, and their contact details.

Furthermore, to no longer receive newsletters and communications with commercial and promotional content and/or to deactivate tracking pixels, simply click the “Unsubscribe” button at the bottom of every email.

10. COMPLAINTS

If the user believes that the processing breaches the provisions of the Regulation, they may lodge a complaint with the supervisory authority as indicated in Article 77 of the Regulation.

11. TRANSFER OF DATA TO THIRD COUNTRIES

In order to provide the Services, Data may be transferred to third countries. In this case, the Data Controllers undertake to ensure that the transfer of Data to said countries complies with the provisions of the Regulation and, specifically, that adequate safeguards are in place (adequacy decisions, standard contractual clauses approved by the European Commission, etc.). However, more information may be requested by contacting the Data Controllers at infoedatabreach@mmcol.it and privacy@digitalboite.com.

Last updated: October 2026

NEWSLETTER

Policy regarding the processing of personal data, in accordance with Article 13 of European Regulation no. 2016/679

Pursuant to Art. 13 of European Regulation no. 2016/679 (hereinafter "Regulation"), we are providing the following information relating to the processing of personal data that you provide us with for the purposes of sending communications containing information and promotional and/or advertising content about our products, services and events.

1. Data Controller

The Data Controller is Manifattura Mario Colombo & C. S.p.A. (Tax code. 00763670155 and VAT no. 00691110969), with registered office in Monza, Via Olimpia no. 3; email address: infoedatabreach@mmcol.it; PEC email address: amministrazionemmc@legalmail.it (hereinafter referred to as the "Company").

2. Data Protection Officer

The Data Protection Officer appointed by the Company can be contacted by sending an email to dpo@mmcol.it (hereinafter referred to as "DPO").

3. Personal Data

Personal data is any information about you that can be traced back to you. Specifically, the processing will involve the following data: name, surname, email address, DOB, country and biological sex (hereinafter “Data”).

4. Processing Purpose

Your data will only be used for the purposes of sending communications containing information and promotional and/or advertising content about our products, services and events.

5. Legal Basis of Processing

The legal basis for the processing of your data for the purposes indicated in paragraph 4) lies in the express consent you have provided, pursuant to Article 6.1, let. a) of the Regulation, by actively selecting the “Subscribe/Send” button.

6. Processing methods

With regard to the purposes outlined in section 4) above, and in compliance with the principles of lawfulness, correctness, transparency, accuracy and relevance, and without excessive processing, your data will be processed by electronic means, in compliance with legal provisions regarding the processing of personal data, and appropriate security measures shall be adopted. The processing of your data will be carried out by specially trained and instructed personnel to ensure adequate security and confidentiality, and to avoid the risk of loss and / or destruction and access by unauthorised individuals.

7. Disclosure and Sharing of Data

Your data will not be disclosed. Within limits applied strictly to the purpose outlined in section 4) above, your data may be disclosed to specially designated persons within the Company who carry out activities linked to and instrumental to the sending of Company communications containing information and promotional and/or advertising content (for example, sales personnel, staff working in the marketing department, etc.). Where necessary to carry out activities relating to the management and maintenance of computer systems and the website, Data may be processed by the subjects/entities in charge, which have been specifically appointed as Data Processors.

8. Data Retention Period

Your Data will be stored until you revoke your consent. This includes unsubscribing in the manner referred to in section 9) below.

9. Rights of the Data Subject

With regard to your data, you have the right to ask the Company, in the ways specified by the Regulation and without prejudice to the provisions and limitations of Legislative Decree no. 196/2003 (Part I - Title I - Chapter III), to:

  • access it in cases provided for by the Regulation (Art.15);
  • have inaccurate data rectified and incomplete data supplemented (Art. 16 of the Regulation);
  • have data deleted for reasons provided for by the Regulation (Art. 17), such as when they are no longer necessary for the purposes outlined above or are not processed in accordance with the Regulation;
  • limit data processing based on scenarios provided for by the Regulation (Art. 18), such as when the accuracy of the data is contested and needs to be verified;
  • You also have the right to portability, i.e. the right to receive data, in cases provided for by the Regulation (Art. 20), in a structured, commonly used and machine-readable format, and to have said data transmitted to another Data Controller;
  • and to oppose to data being processed in cases provided for by the Regulation (Art. 21).

In relation to the purpose referred to in section 4) above, you also have the right to revoke your consent at any time without prejudice to the lawfulness of processing carried out before withdrawal of consent. You may exercise any of the rights listed above by sending an email to the Company (infoedatabreach@mmcol.it) or by registered letter to the Company's address: Monza, Via Olimpia no. 3. Also, if you no longer wish to receive communications from the Company containing information and promotional and/or advertising content, you can click on the link at the bottom of each communication, or send an e-mail to infoedatabreach@mmcol.it, with "Cancel subscription" in the subject line.

10. Complaints

If you believe that the processing of your data contravenes the provisions set out in the Regulation, you have the right to complain to the Italian Data Protection Authority, in accordance with Art. 77 of the Regulation.

11. Nature of Data Provision

The provision of your personal data is required to enable us to send communications containing information and promotional and/or advertising content about our products, services and events. Failure to provide even certain parts of your data will make it objectively impossible to send these communications.

12. Transferring Data Abroad

Your Data will not be transferred abroad and is stored at the Company's registered office and on servers located within the European Union. The Company also uses cloud services provided by third country companies recognised as adequate in terms of security by the European Commission, in accordance with Art. 45.3 of the Regulation.

Membership of and participation in the “Colmar Club Alta Quota” program in the ways described in the “Regulations of the Loyalty Program - Colmar Club Alta Quota” entails the processing of the personal data of customers by Manifattura Mario Colombo & C. S.p.A.. Pursuant to art. 13 of EU Regulation no. 2016/679, Manifattura Mario Colombo & C. S.p.A. gives the following information on the personal data provided.

1. Data Controller

The Data Controller is Manifattura Mario Colombo & C. S.p.A. (Tax number 00763670155 and VAT Reg. no. 00691110969), registered office Via Olimpia 3,Monza, e-mail infoedatabreach@mmcol.it, Certified email amministrazionemmc@legalmail.it (hereinafter “Company”).

2. Data Protection Officer

The Data Protection Officer appointed by the Company may be contacted by sending an email to the address dpo@mmcol.it (hereinafter “DPO”).

3. Personal Data

Personal data means any information that can be referred to the customer. Specifically, the processing will concern the following data:

  • - First name, surname, email address, date of birth and any further information provided through filling in the personal profile (such as, for example, address, telephone number, favourite sport, number of members of the household and gender);
  • - Total amount progressively spent, as well as the information related to the purchases made by the customer (such as, for example, the category of goods of the product purchased, the colour and the size);

4. Purposes of the processing

Your data will only be used for the purposes of sending communications containing information and promotional and/or advertising content about our products, services and events.

  • a. Membership of and participation in the “Colmar Club Alta Quota” program and creation of the personal profile;
  • b. Management of the obligations closely connected with the membership of and participation in the “Colmar Club Alta Quota” program, such as the attribution of discounts, advantages, experiences and special dedicated initiatives;
  • c. Fulfilment of the legal and contractual obligations connected with participation in the “Colmar Club Alta Quota” program, also including those of an administrative character;
  • d. Inclusion and/or updating of the names of the customers of the “Colmar Club Alta Quota” program;
  • e. Sending communications with informative content and closely connected with the “Colmar Club Alta Quota” program (such as, by way of example and not exhaustively, the welcome letter, notification of reaching and going past the levels, etc.);
  • f. Registration for the Company’s newsletter and sending communications with informative and promotional content on the products of the Colmar brand, services and events;
  • g. Analysis of the interests, of the purchasing habits and tastes of the customer to allow the Company to personalize the offer of its products and services, as well as to send further communications in line with the customer’s interests;
  • h. Assistance and personalized advice during the purchase of products in the stores belonging to the “Colmar Club Alta Quota” program;
  • i. Exercise and defence of the Company’s rights in every seat, including judicial and administrative, in arbitration and/or mediation and reconciliation procedures.

5. Lawfulness of the processing

The processing of the Data for the purposes shown in point 4) above is lawful:

  • - As for letters a), b), c) and e) in the execution of the contract (art. 6.1 b) Regulation), as well as in the compliance with obligations connected with it to which the Company is subject (art. 6.1 c) Regulation);
  • - As for letters d), h) and i) in the legitimate interest of the Company (art. 6.1 f) Regulation);
  • - As for letters f) and g) in the consent expressed by the customer (art. 6.1 a) Regulation).

6. Methods of processing

As part of the purposes shown in point 4) above, the processing of the Data will take place using electronic and automated instruments, in the respect of the legislation on the processing of personal data, adopting the appropriate safety measures. The processing of the Data will be carried out by personnel who perform activities that are connected with and instrumental to the management of the “Colmar Club Alta Quota” program (such as, for example, the sales assistants in the stores, the administrative personnel, the personnel of the marketing department and the IT department), who are specially authorized, trained and instructed, in order to guarantee the appropriate security and confidentiality, as well as in order to avoid risks of loss and/or destruction and access by unauthorized subjects.

7. Communication and diffusion of the Data

The Data will not be diffused. Within the limits strictly pertinent to the purposes shown in point 4) above, the Data may be communicated to :

  • - subjects legitimates pursuant to law or regulation, such as by way of example the competent public authorities and the judicial authority;
  • - subjects specifically appointed Data processing managers (natural persons or companies that process data on the documented instruction of the Company such as, by way of example, the subject that manages and maintains the IT systems, as well as the website and the CRM - Customer Relationship Management - system, companies which manage the points of sale where the “Colmar Club Alta Quota” program is active). The updated list of names of the Processing Managers can be requested from the Company, by sending an email to infoedatabreach@mmcol.it.

8. Period of storage of the Data

The Data will be stored for the period of time strictly necessary for the pursuit of the purposes for which the aforementioned Data have been collected. Specifically, the Data processed:

  • - For the purposes as per point 4) letters a), b), c), d), e) and i) above, will be kept for the entire duration of the participation in the “Colmar Club Alta Quota” program and, in any case, until the rights deriving from the relationship reach the limitation period. Cancellation of the “Colmar Club Alta Quota” program will allow the customer, in any case, to keep their personal profile active until its closure is explicitly requested;
  • - For the purposes as per point 4) letter f) above, the data will be kept until the revocation of consent;
  • - For the purposes as per point 4) letter g) above, they will be kept for a maximum period of 12 (twelve) months from the date on which they were collected;
  • - For the purposes as per point 4) letter h) above, they will be kept for a maximum period of 12 (twelve) months from the date on which they were collected.

Without prejudice, however, to the right of opposition to processing, the right of revocation of the consent for those types of processing which are lawful, to be exercised according to the methods better described in point 9) below, as well as compliance with specific obligations of storage according to law and the exercise of the right of defence of the Company in the event of dispute.

9. Rights of the data subject

With reference to the Data, the data subject has the right to ask the Company with the ways shown by the Regulation and without prejudice to the provisions and limitations as per Legislative Decree no. 196/2003 (Part I - Chapter I -Section III):

  • Access, in the cases foreseen (art. 15 Regulation);
  • The correction of inexact Data and the completion of incomplete Data (art. 16 Regulation
  • The cancellation of the Data for the reasons considered (art. 17 Regulation) such as for example whey they are no longer necessary with respect to the purposes shown above or are not processed in the respect of the Regulation;
  • The limitation of treatment for the hypotheses considered (art. 18 Regulation), as in the case in which the exactness of the Data is contested and their correctness has to be checked;
  • Portability, i.e. the right to receive the Data, in the cases foreseen (art. 20 Regulation), in a structured form of common use and legible by an automatic device and to transmit the aforementioned Data to another Data Controller;
  • Opposition to the processing, in the cases foreseen (art. 21 Regulation).

In relation to the purposes as per point 4) letters f) and g) above, the right is also recognized to revoke consent, at any time whatsoever and without prejudicing the lawfulness of the processing done before being revoked. All the rights listed above may be exercised by sending to the Company an email to the address infoedatabreach@mmcol.it or by registered letter to the address of the Company: Via Olimpia n. 3, Monza. In addition, in order to no longer receive communications from the Company with an informative and promotional content on products with the Colmar brand, services and events, it will be possible to cancel registration by clicking on the appropriate link at the bottom of each communication.

10. Complaint

In the case that the processing of the Data infringes the provisions in the Regulation, there is the right to file a complaint with the Supervisory Authority for the protection of personal data according to the provisions of art. 77 of the Regulation.

11. Provision of personal data

Provision of the Data is compulsory and is strictly necessary for the pursuit of the purposes shown in point 4) letters a), b), c), d), e) and i) above. Therefore, failure to provide, including only partially, the Data entails the objective impossibility of participating in the program and satisfying what is requested. The provision of the Data shown as optional in the personal profile (such as, for example, address, telephone number etc.) as well as of the Data for the pursuit of the purposes as per point 4) letters f), g) and h) above, is, on the other hand, optional. However, failure to provide, including only partially, the Data entails the objective impossibility for the Company to proceed with registration for the newsletter, with the analysis of interests, habits and tastes, as well as the activity of personalized advice and assistance, but without prejudicing the participation in the “Colmar Club Alta Quota” program.

12. Transfer of Data abroad

The Data are stored at the registered office of the Company and on servers located in the European Union. In the event that the Data have to be transferred to countries not belonging to the European Union, the Company undertakes to ensure that this transfer takes place in the respect of the adequate guarantees for the protection of the Data, according to the provisions of articles 46 and 47 of the Regulation.

In the event of a breach of personal data, Manifattura Mario Colombo & C. has set up a crisis team and provided for specific intervention procedures, in order to swiftly resolve the problem and alert the user so that he or she can adopt suitable precautions to reduce to a minimum the potential damage that may caused by the breach.


The information provided to users in the event of a breach will specifically indicate:

  • the name and contact data of the Data Protection Officer, or any other contact that can provide information;
  • the measures adopted or proposed by the Legal Representative to remedy the breach of personal data and, if appropriate, to limit the possible negative effects.

Manifattura Mario Colombo & C. will issue a public communication, or take similar measures, and will not be obliged to inform the user if adequate technical and organisational measures are implemented to protect the data affected by the breach, if measures are subsequently adopted to prevent the user’s rights being placed at high risk again, or when the communication would require a disproportionate effort. In any case, Manifattura Mario Colombo & C. will consider whether it is opportune - even if it is not strictly compulsory - to keep the user informed.

Where necessary, Manifattura Mario Colombo & C. will also inform the Data Protection Authority of the breach within 72 hours.

For this reason, if a breach comes to the attention of a Data Processor, or another processor appointed thereby, he or she must notify the violation, within 12 and 24 hours respectively of discovery.

Any breaches of personal data may be notified by writing to infoedatabreach@mmcol.it.