PRIVACY POLICY

Information Notice pursuant to and for the purposes of Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR) and Article 130 of the Italian Privacy Code

BBB S.p.A. (hereinafter “BBB”) recognises the importance of maintaining the confidentiality, integrity and security of your non-public Personal Data (hereinafter the “Personal Data”) and hereby informs you that the Personal Data you provide through the website www.boggi.com, (hereinafter the “Website”), as well as any Personal Data you may provide at the points of sale operated by companies controlled by the Sub-Holding or by franchisees (hereinafter the “RSA Group”), which operate retail outlets under the Boggi Milano, Boggi Factory Store and Boggi Milano BM39 trademarks (hereinafter the “Trademarks”), will be processed in compliance with the applicable European privacy legislation, Regulation (EU) 2016/679 (hereinafter the “Regulation”), and with the specific local legislation applicable from time to time to processing activities carried out outside the European Union, as well as with the general principles and rules of conduct set out in the Code of Ethics adopted by BBB.

1. Data Controllers

The entities that jointly determine the purposes and means of the processing as joint controllers are:

• B939 SUB HOLDING S.p.A., with registered office at Via Lancetti No. 28 – 20158 Milan (MI), Italy;
• BBB S.p.A., with registered office at Via Lancetti No. 28 – 20158 Milan (MI), Italy.

Both entities act through their respective legal representatives pro tempore, who may, within the scope of their respective powers, appoint specifically designated data processors or authorised persons. The Data Controllers may be contacted by writing to their operational office or by sending an email to [email protected]. Similarly, the Data Protection Officer (DPO) appointed by the Data Controllers may be contacted at [email protected].

2. Main Definitions

Personal Data

Any information relating to an identified or identifiable natural person (“Data Subject”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

Browsing Data

The IT systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain Personal Data whose transmission is implicit in the use of Internet communication protocols. Such information is not collected for the purpose of associating it with identified natural persons; however, by its very nature, it could, through processing and cross-referencing with data held by third parties, make it possible to identify users.

This category includes IP addresses (Internet Protocol addresses, i.e. numerical labels that uniquely identify a device, known as a host, which may be a computer, handheld device, smartphone, etc., connected to a computer network using the Internet Protocol as its network protocol); the domain names of the computers used by users connecting to the Website; the URI (Uniform Resource Identifier) addresses of the requested resources, i.e. character strings that uniquely identify a generic resource; the date and time of the request; the method used to submit the request to the server (a high-performance computer that provides services to other connected computers, known as clients, within a network); the size of the file received in response, i.e. a digital information container; the numerical code indicating the status of the server’s response (successful completion, error, etc.); the user’s geographical location; and other parameters relating to the user’s operating system and IT environment.

The geographical location is detected on a non-continuous basis when the user gives their consent through the browser settings.

This data is used solely to obtain anonymous statistical information on the use of the Website (frequency of access, duration of visits, and information about products viewed, moved to the shopping cart or added to the wish list) and to check that the Website is functioning correctly.

For further information about the data collected through cookie systems, please refer to our Cookie Policy.

Personal Data Voluntarily Provided (first name, surname, email address, telephone number and any other personal data included in the message or comments)

Depending on the purposes of the processing, the Personal Data collected may include: first name, surname, tax identification number (Codice Fiscale), postal address and country, email address, password chosen by you to access your account, telephone number, Instagram username, date of birth, gender, Bluetooth MAC address (the unique address assigned to network interfaces) of your electronic device (handheld device, telephone, etc.), billing address, one or more shipping addresses, and details relating to one or more credit cards.

Information on the Processing of Personal Data Through Social Media Platforms

With regard to the processing of Personal Data carried out by the operators of the social media platforms used by the Joint Controllers, please refer to the information provided by those operators in their respective privacy policies.

The Joint Controllers process the Personal Data provided by users through the dedicated pages of these social media platforms in order to manage interactions with users (comments, public posts, etc.) and in compliance with applicable legislation.

Cookies and Other Tracking Technologies

For information on cookies and other tracking technologies, please refer to the Cookie Policy available in the footer of the Website.

Email Tracking Pixels

Emails may contain tracking technologies, such as so-called tracking pixels. These are small images embedded in a message and loaded from an external server when the email is opened.

Loading the pixel may enable the sender to obtain certain information regarding the receipt and use of the message, such as whether and when the email was opened, the number of times it was opened, the device or software used to view it and, in some cases, the IP address.

Tracking pixels may be used for various purposes, including verifying the successful delivery of communications, preventing spam, phishing or other security incidents, providing services requested by the user, or generating statistics on the effectiveness of communications.

Where tracking is used for direct marketing purposes and enables the monitoring of an individual recipient’s behaviour, the processing is carried out on the basis of consent, pursuant to Article 6(1)(a) of the GDPR. Consent to tracking may be obtained together with consent to receive marketing communications, without prejudice to the right to withdraw such consent at any time, including separately where technically feasible.

Consent is not required, however, where the use of tracking pixels falls within the circumstances permitted under applicable legislation, for example where it is necessary to transmit the communication, provide a service requested by the user, or meet specific security, authentication or fraud prevention requirements, or to compile aggregated and anonymous statistics.

In such cases, the processing of Personal Data that may be collected through the pixel will be based on the legal basis applicable to the specific purpose, such as the performance of a contract, the pursuit of a legitimate interest or compliance with a legal obligation.

3. Purposes of Processing, Legal Basis, Data Retention Period, Whether the Provision of Personal Data Is Mandatory or Voluntary, and Source of the Data

Purposes of Processing, Legal Basis, Data Retention Period, Whether the Provision of Personal Data Is Mandatory or Voluntary, and Source of the Data

Purpose of Processing	Legal Basis	Data Retention Period	Nature of the Provision of Personal Data
A) Website Browsing; The data necessary for the use of web services is also processed for the following purposes: Obtaining statistical information on the use of the services (most visited pages, number of visitors by time slot or day, geographical areas of origin, identified through IP addresses, etc.); Determining the user’s location to enable the store locator system to function, in accordance with the user’s browser settings; Monitoring the proper functioning of the services provided. The data may also be used to establish liability in the event of alleged cybercrime affecting the Website.	Article 6(1)(f) of the GDPR and Recital 47 of the GDPR: legitimate interest, for technical cookies. Article 6(1)(a) of the GDPR: consent, for non-technical cookies.	Please refer to the Cookie Policy.	For technical cookies: the provision of data is strictly necessary to enable the Website to function and to provide browsing services. For non-technical cookies: the provision of data is optional. Failure to provide consent will not affect the user’s ability to browse the Website.
B) Handling of Your Request for Information or Contact, including through Live Chat or Traditional Communication Channels	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	1 year	The provision of data is necessary. Failure to provide the required data will make it impossible to contact you and provide you with the requested information.
C) Recruitment and Personnel Selection, processing for the purposes of applying for recruitment processes and conducting personnel search and selection activities with a view to potentially establishing an employment relationship, including consideration for positions other than those for which the Data Subject has spontaneously submitted an application; retaining Personal Data for future recruitment processes; managing applications submitted in response to job vacancies published on our Website; and conducting interviews and, where applicable, video interviews (including the processing of image and audio data). Please refer to the specific privacy notice available in the dedicated section	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	6 months	The provision of data is necessary. Failure to provide the required data will make it impossible to submit an application.
D) Purchase of a Gift Card and fulfilment of related contractual obligations and administrative, accounting and legal requirements. If you have received a gift card, your Personal Data may have been provided to us by the purchaser.	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	Pursuant to Article 2220 of the Italian Civil Code, accounting records must be retained for 10 years from the date of the last entry, without prejudice to any contractual or non-contractual disputes that may arise and to any different statutory retention obligations.	The provision of Personal Data is necessary for contractual purposes. Failure to provide the required Personal Data will make it impossible to establish a contractual relationship with the Data Subjects.
E) Creation of a Personal Account and simultaneous enrolment in the Boggi Privilege Programme If you authorise access through your personal Facebook, Google+ or LinkedIn account, basic information from your profile, as well as your email address, will be collected.	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	Until the Data Subject/User deletes their account, or after 3 years of inactivity, defined as no access to or use of the account and the associated Boggi Privilege programme in which the user is enrolled.	The provision of Personal Data is necessary. Failure to provide the required data will make it impossible to access the restricted area of the Website.
F) Purchase of Products, including through guest checkout, and fulfilment of related contractual obligations and administrative, accounting and legal requirements	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	Pursuant to Article 2220 of the Italian Civil Code, accounting records must be retained for 10 years from the date of the last entry, without prejudice to any contractual or non-contractual disputes that may arise and to any different statutory retention obligations.	The provision of Personal Data is necessary for contractual purposes. Failure to provide the required Personal Data will make it impossible to establish a contractual relationship with the Data Subjects.
G) Returns Management	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	Pursuant to Article 2220 of the Italian Civil Code, accounting records must be retained for 10 years from the date of the last entry, without prejudice to any contractual or non-contractual disputes that may arise and to any different statutory retention obligations.	The provision of Personal Data is necessary for contractual purposes. Failure to provide the required Personal Data will make it impossible to manage return procedures.
H) Order Tracking	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	For the time necessary to fulfil your request.	The provision of Personal Data is necessary for contractual purposes. Failure to provide the required Personal Data will make it impossible to handle your order-tracking requests
I) Management and provision of additional After-Sales Services to Boggi Customers	Processing is necessary for the performance of a contract to which the Data Subject is a party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Recital 44). Article 6(1)(b) of the GDPR.	For the time necessary to schedule and complete the service.	The provision of Personal Data is necessary for contractual purposes. Failure to provide the required Personal Data will make it impossible to manage the activities relating to the service.
K) Direct Marketing Activities, sending commercial and promotional communications, newsletters, messages, advertising materials, catalogues and invitations to events through traditional and automated digital communication channels, including email, telephone calls, chat, WhatsApp and SMS. In order to compare and potentially improve the effectiveness of automated communications, the Joint Controllers use reporting systems, including email tracking pixels. Through tracking pixels, the Joint Controllers may obtain information such as the number of readers, email opens, unique clickers and clicks; the devices and operating systems used to read communications; details of individual users’ activities; and details of emails sent, delivered, undelivered and forwarded. All such data is used to compare and, where appropriate, improve the effectiveness of communications.	Processing is based on the Data Subject’s consent to the processing of Personal Data (Recitals 42 and 43). Article 6(1)(a) of the GDPR.	The data will be retained for as long as you remain actively engaged, which means that you have purchased one or more products at RSA Group points of sale within the last three years or have accessed your Boggi Privilege account during the same period, or until consent is withdrawn, if earlier.	The provision of Personal Data is optional. Failure to provide the required data will make it impossible to receive direct marketing communications.
L) Profiling to create personalised content and offers. Profiling based on information relating to your purchases, with a view to creating personalised content and offers. Personal Data will be entered into the company’s databases, CRM systems and platforms for the purposes of conducting analyses and assessments and grouping Data Subjects according to common characteristics relevant to the company’s business activities, in order to improve service management and send targeted promotional communications.	Processing is based on the Data Subject’s consent to the processing of Personal Data (Recitals 42 and 43). Article 6(1)(a) of the GDPR.	The data will be retained for as long as you remain actively engaged, which means that you have purchased one or more products at RSA Group points of sale within the last three years or have accessed your Boggi Privilege account during the same period, or until consent is withdrawn, if earlier.	The provision of Personal Data is optional. Failure to provide the required data will make it impossible to receive personalised communications and offers.
M) Abandoned Cart Reminders	Processing is based on the Data Subject’s consent to the processing of Personal Data (Recitals 42 and 43). Article 6(1)(a) of the GDPR.	For the time necessary to send you reminder emails regarding your abandoned shopping cart (please refer to the Cookie Policy).	The provision of Personal Data is optional. Failure to provide the required data will make it impossible to receive abandoned cart reminders.
N) Detection of Fraud Relating to Electronic Payments	Article 6(1)(f) of the GDPR and Recital 47 of the GDPR: legitimate interest	The data will be retained for the period prescribed by law. Documents requested during the verification process will not be retained.	The provision of Personal Data is necessary. Failure to provide the required Personal Data will make it impossible to complete the online purchase.
O) Handling of requests concerning the protection of personal data and requests from other data subjects, pursuant to Articles 15 et seq. of the GDPR (rights of the data subject)	The processing is necessary for compliance with a legal obligation to which the joint controllers are subject (R45). Art. 6(1)(c) GDPR.	5 years from the closure of the request, except in the event of disputes	Provision of personal data is mandatory, as it is indispensable for performing legal obligations.
P) Compliance with legal obligations or with provisions issued by competent Authorities (e.g. the Italian Competition and Market Authority – AGCM, the Judicial Authority, the Data Protection Authority, etc.). This includes, by way of example, sending communications or vouchers necessary to comply with decisions or commitments imposed by such Authorities.	The processing is necessary for compliance with a legal obligation or to implement provisions issued by the competent Authorities. Art. 6(1)(c) GDPR.	The data will be retained for the time necessary to comply with the provisions issued by the Authority or to fulfil the obligations imposed and, in any case, for the period provided for by the applicable legislation on limitation periods or judicial disputes.	Provision is mandatory, as it is indispensable for implementing the provisions issued by the Authorities or legal obligations.
Q) Sending of service communications strictly connected with the performance of a contract and therefore necessary for managing the relationship with the data subject.	The processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual measures at the data subject's request (R44). Art. 6(1)(b) GDPR.	The data will be processed for the duration of the contractual relationship and for the time necessary to perform the obligations linked to the contract.	Provision is mandatory, as it is indispensable for the performance of the contract and for implementing the provisions issued by the Authorities or legal obligations.
R) Customer satisfaction after purchase through the sending of satisfaction questionnaires concerning products purchased and/or services provided	The processing is necessary for the pursuit of the legitimate interest of the joint controllers or of third parties, provided that the interests or fundamental rights and freedoms of the data subject which require the protection of personal data do not override such interest (R47-R50). Art. 6(1)(f) GDPR.	A maximum of two years from collection, unless the data subject objects.	Provision of the data is necessary to enable the joint controllers to offer the surveys. Failure to provide the data will prevent the pursuit of the joint controllers' legitimate interest indicated in the purposes of this point.
S) Management of the information flows provided for by the Organisation, Management and Control Model (MOGC) adopted pursuant to Italian Legislative Decree 231/2001 and aimed at preventing the liability of entities for administrative offences resulting from criminal offences. In particular, the data will be collected to enable the Supervisory Body (O.d.V.) to oversee the functioning of and compliance with the MOGC.	The processing is necessary for compliance with a legal obligation to which the controller is subject.	A maximum of 10 years from the end of the O.d.V.'s mandate.	Management of the information flows provided for by the Organisation, Management and Control Model (MOGC) adopted pursuant to Italian Legislative Decree 231/2001 and aimed at preventing the liability of entities for administrative offences resulting from criminal offences. In particular, the data will be collected to enable the Supervisory Body (O.d.V.) to oversee the functioning of and compliance with the MOGC.
U) Performance of contractual obligations entered into through enrolment in Boggi Privilege, to ensure customer recognition through FTF Wi-Fi technology and to apply any discounts provided for by the Boggi loyalty programme.	Contract Art. 6(1)(b) GDPR: the processing is necessary for the performance of a contract to which the data subject is party or in order to take pre-contractual measures at the data subject's request	Until any request for deletion from the Boggi Privilege programme or after 3 years of non-access/non-use of the account and of the related Boggi Privilege programme in which the person is enrolled, or until the electronic device is changed. Article 2220 of the Italian Civil Code, without prejudice to any contractual and non-contractual issues that may arise and to any other legal obligations.	Provision of personal data is necessary for contractual purposes. Failure to provide the necessary personal data makes it impossible to establish a contractual relationship with the data subjects.

4. Methods of processing

Personal Data will be processed using paper-based, IT and telematic tools, according to logic strictly related to the purposes indicated above, in compliance with the principles of necessity and proportionality, avoiding the processing of Personal Data where the operations can be carried out using anonymous data or by other means. All measures deemed necessary and/or appropriate will be put in place so that the data are processed lawfully, fairly and transparently in relation to you, and to prevent their loss, even accidental, as well as unauthorised access.

If you use functions and services that involve the processing of third parties' personal data voluntarily provided by you, as in the case of activating and sending the e-Gift Card or handling the request for it, you are required to inform them of the purposes and methods of the processing of their personal data by us.

5. Recipients

In order to fulfil the processing purposes set out above, your data will be processed by BBB's internal staff duly authorised for this purpose in the course of their assigned duties, designated as persons authorised to process data, and by companies contractually linked to the joint controllers. In particular, they may be disclosed to parties belonging to the following categories: parties providing services for the management of the website, the telecommunications networks and the IT system used by the joint controllers; firms or companies in the context of assistance or consulting relationships; companies managing marketing and communication activities (e.g. service providers, digital agencies); the Holding company and the companies of the RSA Group; competent authorities for the fulfilment of legal obligations and/or provisions of public bodies, upon request; bodies based in Italy provided for by current accounting and tax legislation as recipients of mandatory communications.

The parties belonging to the above categories act as Data Processors, or operate in complete autonomy as separate Data Controllers. The list of appointed processors is available upon request by contacting the joint controllers at the email address [email protected] and the Data Protection Officer at the email address [email protected].

Your Personal Data will not be used for third-party promotional purposes or in relation to products, services or initiatives not originating from the RSA Group and will in no case be disseminated to unspecified parties.

6. Transfer of personal data abroad

Personal data will be transferred to non-EEA countries. Such transfer will take place pursuant to Articles 44 et seq. of the GDPR and, in particular, pursuant to Article 45 GDPR and to third countries (Switzerland and the United States) for which the Commission has adopted an adequacy decision.

To obtain information on the safeguards relating to the transfer of data to non-EEA countries, data subjects may write to the contact details indicated above.

7. Your rights

You have the right, at any time, to exercise the following rights against the joint controllers:

1. To obtain, pursuant to Article 15 of the Regulation, confirmation as to whether or not your Personal Data are being processed and, where that is the case, access to them and to the following information: a) the purposes of the processing; b) the categories of Personal Data concerned; c) the recipients or categories of recipients to whom the Personal Data have been or will be disclosed, in particular if recipients in third countries or international organisations; d) the envisaged period for which the Personal Data will be stored or, if that is not possible, the criteria used to determine that period.
2. Where Personal Data are transferred to a third country or to an international organisation, to be informed of the existence of appropriate safeguards pursuant to Article 46 of the Regulation.
3. To obtain a copy of the Personal Data undergoing processing.
4. To obtain, pursuant to Article 16, the rectification of inaccurate Personal Data concerning you without undue delay; taking into account the purposes of the processing, you have the right to have incomplete Personal Data completed, including by means of providing a supplementary statement.
5. To obtain, pursuant to Article 17, the erasure of Personal Data concerning you without undue delay. The joint controllers have the obligation to erase Personal Data without undue delay where one of the grounds set out in paragraph 1 of Article 17 applies.
6. To obtain, pursuant to Article 18, the restriction of processing where one of the cases set out in paragraph 1 of Article 18 applies.
7. To withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
8. To obtain, pursuant to Article 20, data portability, that is, to receive, in a structured, commonly used and machine-readable format, the Personal Data concerning you that you have provided to BBB. You also have the right to transmit those data to another Data Controller without hindrance from BBB, to which you provided them, where the conditions set out in Article 20(1) are met. Finally, you have the right to have the Personal Data transmitted directly from one Data Controller to another, where technically feasible.
9. To object at any time, pursuant to Article 21, to the Processing of Personal Data concerning you.
10. To object at any time, pursuant to Article 21, to the processing of Personal Data where they are processed for direct marketing and profiling purposes, where certain conditions set out in Article 21 of the Regulation are met. More specifically, to object only to marketing activity by automated means, you may send an email to [email protected] with the subject “NO AUTOMATED MARKETING COMMUNICATIONS”; if, on the other hand, you wish to object only to marketing activity by traditional means (paper mail), you may send an email to [email protected] with the subject “NO TRADITIONAL MARKETING COMMUNICATIONS”. If you wish to object to the processing of data for profiling purposes, you may send an email to [email protected] with the subject “NO PROFILING”.
11. To object, pursuant to Article 22, to being subject to a decision based solely on automated processing which produces legal effects concerning you or similarly significantly affects you, under the conditions set out in Article 22 of the Regulation.
12. To lodge a complaint with a Supervisory Authority for the protection of Personal Data if you consider that the processing concerning you infringes the Regulation;
13. To take legal action

8. Contacts

For any request relating to your Personal Data covered by this notice and for the exercise of your rights, you may contact, free of charge, the joint controllers or the Data Protection Officer (DPO), at the addresses indicated in paragraph 1.

9. Changes to this Privacy Notice

The joint controllers reserve the right to amend this Privacy Notice at any time, giving notice on the Site. The version published there is the one currently in force.

Date of update: 26 October 2026

The Joint Controllers