.png?q=80){kind=logo}
Privacy Policy
Information on the processing of personal data in accordance with Art. 13 of EU Regulation 679/2016 (“GDPR”)
1. DATA CONTROLLER AND DATA PROTECTION OFFICER
This privacy policy (“Privacy Policy”) is provided by the Bata Group company, Compar S.p.A., with registered office in Limena, Street A. Volta n. 6 35010, P. Iva 00362520280, (hereinafter also referred to as “Bata”) as the Data Controller (hereinafter referred to as “Data Controller” or “Company”) and applies to users of this website (“Site”).
Some of the services we offer may be subject to specific information notices, in which case we will provide you with all relevant information from time to time.
The Company guarantees the strictest confidentiality in the processing of users' personal data, in accordance with the provisions of the current legislation on the protection of personal data.
The Privacy Policy is intended to provide more details regarding the purposes and methods used to collect and process Users' personal data in accordance with the provisions of the GDPR, The Law No. 58/2019, the relevant decisions and guidelines of the National and European Data Protection Authorities, and applicable national and European legislation (together, “Applicable Legislation”).
The Company has identified the Data Protection Officer (DPO) in accordance with Article 37 of the GDPR; the DPO can be contacted for questions related to the processing of your personal data, at the following contact details:
- e-mail address: it.privacy@bata.com
- registered letter to Compar S.p.A, Street A.Volta,6 – 35010 Limena (PD) at the person of the DPO.
2. CATEGORIES OF DATA PROCESSED, PURPOSES OF PROCESSING, LEGAL BASIS
We will process your personal data, by both manual and automated means, for the purposes and according to the legal basis described below.
|
Purpose |
Legal basis |
Categories of personal data |
|
a) To enable you to use the Site and enjoy the content made available here. |
Execution of pre-contractual measures taken at the request of the data subject and performance of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of personal data is necessary for this purpose. In case of non and/or inaccurate provision, it will not be possible to allow navigation and enjoyment of the content of the Site. |
Details about the web browser used and the IP address and any additional data inherent in browsing. |
|
b) To assess your CV in case of application. |
Execution of pre-contractual measures taken at the request of the data subject (art. 6(1)(b) GDPR). Compliance with legal obligations to which the controller is subject (Art. 6(1)(c) GDPR. The provision of personal data is necessary for this purpose. In case of non and/or inaccurate provision, it will not be possible to proceed with the evaluation of your CV. |
Identification and contact data (i.e., first name, last name, date and place of birth, e-mail address, gender, residential address, telephone number), data on previous work and/or academic experience (e.g., qualification, professional background, course of study, skills and soft skills), and photo. Special categories of personal data (i.e. whether you belong to protected categories). |
|
c) To enable you to purchase our products offered on the Site. |
Execution of pre-contractual measures taken at the request of the data subject and performance of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of personal data is necessary for this purpose. In case of non and/or inaccurate provision, it will not be possible to proceed with the purchase and delivery of our products. |
Identifying and contact data collected in connection with the requested service (i.e., first name, last name, e-mail address, telephone number, gender (optional), date of birth, shipping address, billing address, and payment information). |
|
d) To provide for the exchange or return of a product you purchased. |
Performance of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of personal data is necessary for this purpose. In case of non and/or incorrect provision, it will not be possible to provide the return or exchange of the product. |
Order number and e-mail address. |
|
e) To process and acknowledge any requests made by you through the contact channels indicated on the Site (e.g., the “Contact Us” section, “Check Order,” or provide you with the material or clarification you requested). |
Execution of pre-contractual measures taken at the request of the data subject and performance of a contract to which the data subject is a party (Art. 6(1)(b) GDPR). The provision of personal data is necessary for this purpose. In case of non and/or inaccurate provision, it will not be possible to reply to your requests. |
Personal data collected through our Site, e.g., data that you directly provide or that we collect when you send us an e-mail requesting information (e.g., first and last name, subject of the request, e-mail address and phone number), order number, details about the web browser used, and IP address. |
|
f) To send you newsletters and, in general, e-mail marketing communications regarding our products and services. |
Your free consent - Art. 6(1)(a) GDPR. The provision of personal data is optional for this purpose. If you fail to provide it, there will be no consequences of any kind for you and it will not affect in any way the possibility of being able to take advantage of the Company's services and products. In case you have given your consent, you may withdraw it at any time. |
Email address and any identifying information you may have provided (e.g., first name, last name). |
|
g) To carry out profiling activities by analyzing your behavior on the Site and understanding your preferences, habits, interests, purchase history, browsing experiences on the Site, and interactions with our advertisements (including those sent by email), in order to use your interests to personalize marketing communications, making them more interesting to you, as well as to improve the effectiveness of our marketing strategy. |
Your free consent - Art. 6(1)(a) GDPR. The provision of personal data is optional for this purpose. If you do not provide or consent to the processing of your data, it will not be possible to proceed with such processing, subject to the purposes listed above. In case you have given your consent, you may withdraw it at any time. |
Email address and identification information you provide (e.g., first name, last name). Information related to your preferences, habits, previous purchases. Personal data collected through tracking technologies installed in your browser or email (e.g., tracking products you purchased, left in your shopping cart, or products/content you interacted with or showed interest in), which we may also combine with personal data we collect when you register. |
|
h) To comply with legal obligations and respond to requests from competent authorities. |
Compliance with a legal obligation to which we are subject (Art. 6(1)(c) GDPR). The provision of personal data is necessary for this purpose. In case of non and/or inaccurate provision, it will not be possible to use the services and/or products of the Controller. |
Any information that may be required under the law or to comply with requests received from the relevant Public Authority. |
|
i) To protect our rights in and out of court. |
Pursuit of the legitimate interest of the Data Controller (Art. 6(1)(f) GDPR). The provision of personal data is necessary for this purpose. You may at any time object to the processing carried out for this purpose. |
Any information necessary to ensure fulfillment of this purpose. |
|
l) To carry out extraordinary transactions pertaining to the Data Controller (including mergers, acquisitions, divestitures, corporate reorganizations, corporate restructuring). |
Pursuit of the legitimate interest of the Data Controller after appropriate balancing with the fundamental rights and freedoms of the data subjects (Art. 6(1)(f) GDPR). The provision of personal data is necessary for this purpose. You may at any time object to the processing carried out for this purpose. |
The information necessary to ensure fulfillment of this purpose. |
3. MEANS OF PROCESSING
Your personal data will be processed with the support of automated tools suitable for storing, managing or transmitting such data and/or on paper, protected by appropriate security devices to ensure the confidentiality and security of personal data. In particular, the Data Controller will take appropriate administrative, technical and organizational measures to safeguard the data from possible loss, theft and unauthorized use, disclosure or modification of personal data.
4. DATA RETENTION
Your personal data will be retained for a period of time no longer than is strictly necessary to achieve the purposes for which they are collected, as well as for any longer period necessary to fulfill legal obligations and/or for purposes of judicial protection, and in any case no longer than the ordinary prescriptive terms. At the end of the retention period, your personal data will be deleted or anonymized.
Specifically, your personal data, processed for the purposes set forth in Section 2 above, shall be stored in accordance with the terms and criteria specified below:
- Purposes c) e), f) g), l), m) n): personal data collected for these purposes will be kept for the time strictly necessary for the pursuit of these purposes, and in any case no longer than 10 years from the date of termination of the contractual relationship, in order to comply with legal obligations such as those of an administrative - accounting nature, unless it is necessary to preserve them for a longer time to comply with a request from an Authority or to defend a right in or out of court. In such cases, the retention periods stipulated for the performance of judicial and inspection activities shall be observed.
- Purpose (b): Personal data collected for this purpose will be retained for a period of time not exceeding that which is strictly necessary for the pursuit of these purposes and, in any case, not exceeding 6 months from the time of receipt of the CV, unless an extension of this period is necessary for the defense of a right, whether legal or not, of the Company or for the fulfillment of a legal obligation.
- Purpose (f): your personal data will be processed for sending communications of a commercial and promotional nature, until you decide to withdraw the consent given, it being understood that, after five years and in the absence of a new consent from the data subject, your data will be deleted or anonymized.
- Purpose (g): your personal data will be processed for the purpose of carrying out profiling activities until you decide to withdraw the consent given, it being understood that after three years and in the absence of a new consent from the data subject, your data will be deleted or anonymized.
5. DISCLOSURE OF PERSONAL DATA
Your personal data may be made accessible, for the purposes indicated above, to the following entities:
- Personnel of the Data Controller authorized to process it in accordance with Article 29 of the GDPR;
- Electronic payment service providers, in order to process payments related to your orders. In connection with such processing, electronic payment service providers will process your personal data as autonomous data controllers, in accordance with the GDPR and, in general, the Applicable Legislation.
- Independent authorities, law enforcement and/or judicial and administrative authorities for their institutional purposes to the extent required by law.
- Third parties, such as companies of the Group of which the Data Controller is part and/or to third parties who carry out outsourcing activities on behalf of the Data Controller (by way of example: professional firms, consultants and/or external system administrators for the time strictly necessary for the optimal execution of such service), who will process the data as Data Processors pursuant to Article 28 of the GDPR duly appointed by means of a dedicated act of appointment, indicating the processing methods and security measures that they will have to adopt for the management and storage of the personal data of which the Company is the Data Controller.
- Third parties involved in an extraordinary corporate transaction, such as, for example, a merger or the sale of a business unit, including parties advising them as part of the transaction.
A complete list of the parties to whom your personal data have been or may be disclosed is available to you upon your request to be made by e-mail to it.privacy@bata.com.
6. TRANSFER OF DATA OUTSIDE THE EEA
The management and storage of personal data will take place on servers, located within the European Economic Area (“EEA”), of the Data Controller and/or of third-party companies contracted and duly appointed as Data Processors.
The data is not currently being transferred outside the EEA. It is understood in any case that the Controller, should it become necessary, will have the right to move the location of the servers within the EEA and/or to countries outside the EEA.
Whenever your personal data are to be transferred outside the EEA and, in particular, to states that do not benefit from an adequacy decision of the European Commission, we will adopt one of the safeguards for this purpose provided for in the applicable Legislation, for example, by signing the standard contractual clauses adopted by the European Commission, taking care to keep them up to date, and we will take any additional technical, organizational and/or contractual measures that are appropriate to guarantee a level of protection of personal data that is adequate and, in any case, essentially equivalent to that guaranteed within the EEA.
7. DATA SUBJECTS RIGHTS
The individuals to whom the personal data refer may exercise at any time the rights set forth in Articles 15 to 22 of the GDPR. In particular, the data subject has the possibility to obtain from the Data Controller confirmation of the existence or non-existence of personal data concerning him/her, and in this case, access to the following information:
· Purposes of processing;
· Categories of personal data processed;
· Recipients or categories of recipients to whom the personal data have been or will be disclosed, particularly if recipients in third countries or international organizations;
· Data Retention period of personal data or, if this is not possible, the criteria used to determine this period;
· If the data are not collected from the data subject, all available information about their origin;
· The existence of automated decision-making and, in such cases, meaningful information about the logic used, as well as the importance and expected consequences of such processing for the data subject;
· The existence of adequate safeguards under Article 46 relating to transfer to third countries or international organizations.
In addition, the data subject has the right to:
· Obtain the updating, rectification or integration of your data, the deletion, within the terms allowed by the regulations, or request that they be anonymized, the restriction of processing, and you have the right to object, in whole or in part, on legitimate grounds, to the processing of personal data concerning you;
· Obtain portability of electronically processed data provided on the basis of consent or contract;
· To withdraw your consent, if any, without affecting the lawfulness of the processing based on the consent before withdrawal;
· Propose a complaint to a Supervisory Authority. The competent authority in Portugal is the Portuguese Data Protection Authority (“CNPD”). More information on how to file complaints is available on the CNPD's website at https://www.cnpd.pt/.
The data subject may at any time exercise his or her rights in the following ways:
- sending a registered letter with return receipt to Compar S.p.A, Street A. Volta n. 6 35010 Limena (PD) at the person of the DPO;
- sending an e-mail to: it.privacy@bata.com.
The Data Controller shall provide information regarding the action taken regarding the request under Articles 15 to 22 without undue delay and, in any case, no later than one month after receipt of the request. This deadline may be extended by two months, if necessary, taking into account the complexity and number of requests. The data controller shall inform the data subject of such extension, and of the reasons for the delay, within one month of receipt of the request.
8. CHANGES TO THIS POLICY
This document may be subject to change. Should we make substantial changes, we will inform you by appropriate notice sent before it actually comes into effect.
Current Version: January2025