Privacy Policy

Last updated: 1 August 2026

This Privacy Policy describes how the personal data of users is collected, used, stored and disclosed when they:

• visit www.dotout.com;

• create an account;

• use size-selection or size-recommendation tools;

• add products to the shopping cart;

• make a purchase;

• request information or assistance;

• exercise the right of withdrawal;

• request a return, refund or warranty assistance;

• subscribe to the newsletter;

• participate in Dotout initiatives, events or campaigns;

• interact with forms and services available on the website.

This Privacy Policy is provided pursuant to Regulation (EU) 2016/679, referred to as the “GDPR”, Italian Legislative Decree No. 196/2003, as subsequently amended, and any other applicable provisions concerning the protection of personal data.

1. Data Controllers

The roles of the Data Controllers depend on the service used and the purpose for which the data is collected.

1.1 Lunar Sport S.r.l.

LUNAR SPORT S.R.L.
Registered office: Via Gianfranco Miglio 2, 21045 Gazzada Schianno (VA), Italy
VAT number and Tax Code: 03030530129
Economic and Administrative Register No.: VA-315003
Telephone: +39 0332 816961
E-mail: info@dotout.com
Certified e-mail address, PEC: lunarsport@pec.lunarsport.com

Lunar Sport S.r.l. acts as Data Controller for activities relating to:

• technical and operational management of the e-commerce platform;

• website browsing and security;

• creation and management of customer accounts;

• management of the shopping cart and checkout;

• conclusion and performance of orders;

• payments and fraud prevention;

• invoicing and tax compliance;

• shipping and deliveries;

• order cancellations;

• the right of withdrawal;

• returns and refunds;

• complaints;

• the legal guarantee of conformity;

• after-sales assistance;

• protection of the Seller’s rights;

• commercial communications sent by Lunar Sport where permitted by law or authorised by the data subject.

1.2 DOT WEAR S.r.l.

DOT WEAR S.R.L.
Registered office: Via Enrico Fermi 14, 39100 Bolzano (BZ), Italy
VAT number and Tax Code: 03540620139
Economic and Administrative Register No.: BZ-241153
E-mail: info@dotout.com

DOT WEAR S.r.l. acts as an independent Data Controller for activities relating to:

• technical enquiries concerning Dotout products;

• commercial enquiries concerning the brand;

• information on technologies, fabrics, fit and product characteristics;

• any product registrations;

• any commercial warranties offered by the manufacturer;

• brand initiatives, events, competitions and campaigns;

• Dotout newsletters and promotional communications where the relevant form or consent identifies DOT WEAR as Data Controller;

• management of relationships with athletes, teams, retailers, distributors and commercial partners;

• analysis and development of Dotout products and services, within the limits permitted by law.

Where a request submitted to Lunar Sport concerns exclusively technical characteristics, fit, technologies, fabrics or any commercial warranties relating to a product, the necessary data may be transmitted to DOT WEAR, which will process it as an independent Data Controller in order to respond to the request.

Similarly, DOT WEAR may forward to Lunar Sport a request concerning:

• an order;

• a payment;

• an invoice;

• a shipment;

• a return;

• a refund;

• the right of withdrawal;

• the legal guarantee;

so that it can be handled by the Seller.

Where a specific service is accompanied by a separate privacy notice, that notice will supplement this Policy or, in the event of conflict, prevail over it.

2. Categories of personal data processed

Depending on the service used, the following categories of personal data may be processed.

2.1 Identification and contact data

• first name and surname;

• postal address;

• billing address;

• delivery address;

• e-mail address;

• telephone number;

• country and language;

• company name, where applicable;

• VAT number and Tax Code;

• recipient code or certified e-mail address;

• company contact-person details.

2.2 Account data

• login credentials;

• account identifier;

• order history;

• products saved or added to the shopping cart;

• language and geographical preferences;

• privacy consents and preferences;

• communications linked to the account.

Passwords are managed through technical systems that normally prevent the Controllers’ staff from viewing them in plain text.

2.3 Order and transaction data

• products purchased;

• selected sizes, colours and variants;

• quantities;

• prices;

• discounts;

• currency;

• order date and time;

• order number;

• delivery method;

• order status;

• invoice details;

• information relating to returns, refunds and disputes;

• payment transaction references.

Lunar Sport does not normally retain full payment-card details where these are processed directly by the payment provider.

2.4 Payment and fraud-prevention data

The following may be processed:

• payment outcome;

• transaction identifier;

• amount and currency;

• final digits or type of payment instrument, where available;

• IP address;

• device data;

• risk indicators;

• inconsistencies between billing, payment and delivery information;

• information received from payment providers and fraud-prevention services.

2.5 Shipping and delivery data

• recipient’s name;

• delivery address;

• telephone number and e-mail address;

• tracking number;

• shipment status;

• proof of delivery;

• any delivery instructions;

• information concerning failed delivery, storage, refusal, loss or damage.

2.6 Return, withdrawal and warranty data

• order number;

• product concerned;

• size, colour and variant;

• reason for the return or request;

• withdrawal communication;

• photographs and videos of the product;

• description of the defect;

• product code, SKU or serial number;

• proof of purchase;

• return-shipment details;

• inspection outcome;

• information relating to replacement, repair or refund;

• information concerning washing, maintenance or use of the product where necessary to assess the issue.

2.7 Data used for size selection or recommendation

When the user uses a size-assistance tool, the following may be processed depending on the information requested:

• selected gender or fit;

• height;

• weight;

• age or age group;

• body measurements;

• fit preferences;

• size normally worn;

• information relating to other brands or products;

• product viewed;

• recommended size;

• technical device and session data.

Providing this information is optional.

The information is used to provide a non-binding recommendation and does not guarantee that the suggested size will be suitable in every case.

Users may complete a purchase without using the size-recommendation tool.

2.8 Data provided in communications

When users contact Lunar Sport or DOT WEAR, the following may be processed:

• the content of e-mails or messages;

• attachments;

• data entered in forms;

• records of requests and responses;

• any technical information required to handle the request.

Users are invited not to include unnecessary special-category data in forms or communications, including information relating to:

• health;

• ethnic origin;

• political opinions;

• religious beliefs;

• trade-union membership;

• biometric data;

• sex life or sexual orientation.

Where users voluntarily provide information concerning their body or health in order to request a size or technical recommendation, such information will be used only to the extent necessary to respond and will not be used to make medical diagnoses or assessments.

2.9 Browsing and technical data

IT systems may automatically collect:

• IP address;

• date and time of access;

• pages visited;

• products viewed or searched;

• selected sizes and variants;

• shopping-cart activity;

• referring URL;

• technical identifiers;

• browser type;

• operating system;

• device type;

• language;

• approximate country;

• error information;

• security data and information concerning interaction with the website.

2.10 Marketing data

• e-mail address;

• commercial preferences;

• consents;

• date, time and method by which consent was obtained;

• opening of and interaction with communications, where permitted;

• previous purchases;

• products viewed;

• sizes, categories or commercial interests;

• audience segments;

• objections, withdrawals and unsubscribe requests.

2.11 Review and user-content data

Where the website allows users to publish reviews or other content, the following may be processed:

• name or nickname;

• e-mail address;

• rating;

• review text;

• photographs or videos;

• product reviewed;

• verified-purchase indication;

• publication date;

• technical and antifraud data required to verify the authenticity of the review.

3. Sources of the data

Data may be collected:

• directly from the data subject;

• while browsing the website;

• during account creation;

• while using size-recommendation tools;

• during checkout;

• through the returns portal;

• through contact or subscription forms;

• by e-mail or telephone;

• from payment providers;

• from carriers and logistics operators;

• from fraud-prevention services;

• from Shopify and applications connected to the store;

• from DOT WEAR or Lunar Sport where a request must be forwarded to the other party;

• from authorised retailers or distributors where necessary for assistance or warranties;

• from social-media platforms only where the data subject voluntarily interacts with the relevant profiles or services.

4. Purposes and legal bases of processing

4.1 Website browsing and operation

Technical data is processed to:

• display the website correctly;

• maintain the session;

• manage language, country, currency and shopping cart;

• allow access to the account;

• ensure checkout operation;

• identify and correct errors.

The legal basis is the performance of measures requested by the user, performance of the contract and the Controller’s legitimate interest in ensuring proper operation of the website.

4.2 Security and prevention of abuse and fraud

Data is processed to:

• protect accounts and transactions;

• prevent unauthorised access;

• combat spam, bots and abusive automated use;

• verify suspicious transactions;

• prevent fraud;

• protect the website, users and the Controllers.

The legal basis is the legitimate interest in security, fraud prevention and protection of company and user assets.

4.3 Account creation and management

Data is processed to:

• create the account;

• authenticate the user;

• display orders and associated information;

• simplify future purchases;

• manage preferences and requests.

The legal basis is the performance of pre-contractual or contractual measures requested by the user.

4.4 Order management

Data is processed to:

• receive and verify the order;

• conclude the contract;

• process payment;

• prepare and ship the products;

• send confirmations and updates;

• manage delivery;

• provide assistance.

The legal basis is performance of the contract and pre-contractual measures requested by the data subject.

4.5 Payments

The necessary data is disclosed to the payment provider selected by the Customer.

The legal basis is performance of the contract.

Payment providers may process certain data as independent Data Controllers in order to:

• comply with legal obligations;

• prevent fraud;

• perform checks;

• authorise or reject transactions;

• manage disputes.

In such cases, their respective privacy notices also apply.

4.6 Invoicing and administrative obligations

Data is processed for:

• issuing invoices and tax documents;

• bookkeeping;

• tax compliance;

• administrative checks;

• communications to competent authorities.

The legal basis is compliance with legal obligations.

4.7 Shipping and deliveries

Data is processed and disclosed to carriers in order to:

• organise shipment;

• deliver the parcel;

• provide tracking;

• manage storage and delivery issues;

• manage damage, loss or disputes.

The legal basis is performance of the contract.

4.8 Withdrawal, returns, refunds and legal guarantee

Data is processed to:

• receive and document the withdrawal communication;

• manage the return;

• inspect products;

• issue the refund;

• manage complaints and lack of conformity;

• repair or replace products;

• comply with obligations under the Italian Consumer Code.

The legal basis is performance of the contract and compliance with legal obligations.

4.9 Assistance and contact requests

Data is processed to respond to:

• pre-contractual enquiries;

• questions concerning orders;

• technical requests;

• questions concerning fit and size;

• commercial enquiries;

• complaints;

• after-sales requests.

The legal basis is performance of pre-contractual or contractual measures or the legitimate interest in providing assistance and properly managing relationships with users.

4.10 Size recommendation

Data entered into the recommendation tool may be used to:

• estimate the potentially most suitable size;

• compare the information entered with product characteristics;

• improve the accuracy of recommendations;

• reduce purchasing errors and returns;

• produce aggregate analyses concerning use of the tool.

The legal basis is performance of the service requested by the user.

Consent is requested where required by law for any additional analytics, personalisation or tracking activities that are not strictly necessary.

The recommendation is generated automatically on the basis of the information entered, but does not produce legal effects or similarly significant effects on the data subject.

4.11 Newsletter and marketing based on consent

Where consent is requested, data may be used to send:

• newsletters;

• product news;

• promotions;

• event invitations;

• surveys;

• brand initiatives;

• personalised content.

The legal basis is the data subject’s consent.

Consent is optional and may be withdrawn at any time using the unsubscribe link in the communications or by contacting the relevant Controller.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

4.12 Communications concerning similar products — soft spam

Within the limits permitted by Italian law, Lunar Sport may use the e-mail address provided in connection with a completed sale to offer its own products or services similar to those previously purchased.

The data subject may object free of charge:

• when the data is collected;

• in each communication received;

• by contacting Lunar Sport.

Following an objection, the address will no longer be used for this purpose.

4.13 Profiling and personalisation

With the data subject’s consent, data relating to:

• browsing;

• purchases;

• products viewed;

• sizes and categories of interest;

• preferences;

• interactions with communications;

may be analysed to:

• understand interests and habits;

• create audience segments;

• personalise content and promotions;

• measure campaign effectiveness;

• display more relevant communications.

The legal basis is consent.

Failure to provide consent does not prevent use of the website or purchases.

4.14 Statistical analysis and service improvement

Data may be used in aggregate or, where possible, anonymous form to:

• analyse website performance;

• improve browsing;

• assess interest in products and content;

• improve size guides;

• reduce returns and purchasing errors;

• improve product range and services.

Where the analysis uses non-essential cookies or tracking tools, processing is carried out only after consent has been obtained.

4.15 Reviews

Data may be processed to:

• collect and publish reviews;

• verify that a review is linked to a genuine experience;

• prevent false or abusive reviews;

• moderate unlawful or irrelevant content;

• respond to the review;

• display any verified-purchase indication.

The legal basis is performance of the service requested by the user and the legitimate interest in ensuring authenticity, fairness and security of the review system.

4.16 Dispute management and protection of rights

Data may be processed to:

• prevent and manage disputes;

• recover debts;

• respond to requests from authorities;

• protect the Controllers’ rights;

• bring or defend judicial or administrative proceedings.

The legal basis is the legitimate interest in protecting rights and, where applicable, compliance with legal obligations.

5. Mandatory or optional provision of data

Providing the data necessary to:

• create an account;

• conclude an order;

• process payment;

• issue an invoice;

• ship products;

• manage withdrawal;

• issue a refund;

• provide warranty assistance;

is necessary to provide the requested service.

Failure to provide such data may make it impossible to:

• create the account;

• conclude the order;

• perform the order;

• complete delivery;

• handle the request.

Providing data for:

• size recommendation;

• marketing;

• newsletters;

• profiling;

is optional.

Refusal of consent does not prevent browsing, purchases or customer assistance.

6. Processing methods and security

Data is processed using electronic tools and, where necessary, paper-based systems.

The Controllers adopt technical and organisational measures appropriate to the level of risk, designed to:

• prevent unauthorised access;

• protect the confidentiality, integrity and availability of data;

• prevent loss, destruction or alteration;

• restrict access to authorised personnel;

• ensure backup and recovery procedures;

• manage any personal-data breaches;

• periodically review security measures.

However, no IT system can guarantee absolute security.

7. Recipients of the data

Data may be disclosed, to the extent necessary, to the following categories of recipients:

• authorised personnel of Lunar Sport and DOT WEAR;

• providers of the e-commerce platform and IT infrastructure;

• Shopify and its suppliers and subprocessors;

• developers, website-maintenance providers and Shopify application providers;

• providers of size-recommendation tools;

• payment providers, banks and financial institutions;

• fraud-prevention service providers;

• carriers, freight forwarders, couriers and logistics operators;

• providers of returns-management and customer-service services;

• e-mail, newsletter and CRM providers;

• providers of review and user-content tools;

• statistical, advertising and marketing providers, subject to consent where required;

• security and anti-bot protection providers;

• legal, tax, accounting and insurance advisers;

• debt-recovery service providers;

• manufacturers, technicians or service centres involved in warranty cases;

• public authorities, police forces and judicial authorities where required by law.

Providers processing data on behalf of a Controller are appointed as Data Processors under Article 28 GDPR where applicable.

Certain parties, including payment providers, banks, carriers, authorities and providers of their own services, may act as independent Data Controllers.

The current list of Data Processors may be requested from the competent Controller.

8. Shopify platform

The website uses the Shopify e-commerce platform.

Shopify processes personal data to provide:

• hosting and infrastructure;

• store management;

• customer accounts;

• shopping cart;

• checkout;

• order management;

• security;

• technical support;

• services connected with the platform.

For users in the European Economic Area, data is initially processed through Shopify’s European entity.

Shopify may use affiliated companies and subprocessors located outside the European Economic Area.

Where Shopify processes data on behalf of the merchant, it normally acts as Data Processor.

For certain services of its own, such as Shop or Shop Pay, Shopify may also process data as an independent Data Controller under its own privacy notice.

9. Size-selection tools

The website may use external applications to provide size guides and recommendations.

These tools may process:

• data voluntarily entered by the user;

• declared physical characteristics;

• fit preferences;

• product viewed;

• recommendation provided;

• technical identifiers;

• device and session data.

The provider may process this information on behalf of Lunar Sport or, for certain functions of its own, under its own privacy notice.

Users are invited not to enter information beyond what is necessary to obtain the recommendation.

Use of the tool is optional and the recommendation is for guidance only.

10. Anti-bot protection and form security

The website may use anti-bot protection tools to verify that certain operations, such as submitting forms, accessing an account or completing checkout, are carried out by a person rather than an abusive automated system.

Such services may analyse information including:

• IP address;

• device and browser type;

• duration of the visit;

• movements and interactions with the page;

• technical data required to assess the risk of abuse.

The purpose is to protect the website against:

• spam;

• fraud;

• attacks;

• unauthorised access;

• unlawful automated use.

The legal basis is the legitimate interest in website security and, where the check is necessary to provide a requested service, performance of pre-contractual or contractual measures.

11. International transfers

Some providers may process personal data outside the European Economic Area.

Depending on the circumstances, transfers are carried out on the basis of:

• adequacy decisions adopted by the European Commission;

• Standard Contractual Clauses approved by the European Commission;

• the Data Privacy Framework, where applicable;

• Binding Corporate Rules;

• other safeguards under Articles 44 et seq. GDPR;

• derogations permitted by law in specific cases.

Shopify may transfer data from its European entity to affiliated companies, including its Canadian parent company, and to international subprocessors.

The data subject may request information concerning the safeguards used by contacting the competent Controller.

12. Cookies and tracking tools

The website uses cookies and similar technologies.

Strictly necessary technical cookies may be used without consent to:

• enable browsing;

• maintain the session;

• manage the shopping cart and checkout;

• store language, country and currency;

• ensure security and authentication;

• save the user’s technical preferences.

Analytics cookies that cannot be treated as technical cookies, together with profiling, marketing and advertising cookies, are used only after consent has been obtained where required.

Users may:

• accept all cookies;

• reject non-essential cookies;

• select individual categories;

• change or withdraw their preferences through the “Cookie Settings” function.

For detailed information on cookies, providers, purposes and duration, users are invited to consult the website’s Cookie Policy.

13. Retention periods

Data is retained for as long as necessary for the purposes for which it was collected and subsequently for the periods required or permitted by law.

Unless specific circumstances require otherwise, the following periods apply.

Browsing and security data

Technical and security logs are normally retained for a maximum of 6 months.

They may be retained for longer where necessary to:

• investigate incidents;

• prevent fraud;

• respond to requests from authorities;

• protect rights in legal proceedings.

Customer accounts

Account data is retained until a deletion request is made or, in the absence of use, normally for a maximum of 24 months from the last significant activity.

Data relating to orders, invoices and legal obligations will in any event be retained for the relevant statutory periods after account closure.

Shopping cart

Data relating to a shopping cart that does not result in an order is retained for the period technically necessary for the function and normally no longer than 30 days, unless linked to an account or a different period is necessary for security or service management.

Orders, invoices and payments

Administrative, accounting, tax and contractual data is retained for at least 10 years from registration or conclusion of the relationship, without prejudice to longer periods required for audits, disputes or proceedings.

Shipping

Shipping data is retained together with order data for the period necessary to comply with contractual and tax obligations and protect rights, normally up to 10 years.

Withdrawal, returns, refunds, complaints and legal guarantee

Data is retained for the time necessary to handle the case and subsequently normally for up to 10 years from closure, unless disputes or obligations require longer retention.

Information and assistance requests

Requests that do not lead to a contractual relationship are normally retained for a maximum of 24 months from closure of the request.

Size recommendations

Identifiable data used to provide a recommendation is retained for the time necessary to provide the service and, where linked to an account or order, for the period necessary to manage the customer experience and any disputes.

Aggregated or anonymised data may be retained for longer periods in order to improve size guides and the service.

Reviews

Data relating to reviews is retained for the period during which the review remains published and subsequently for the period necessary to manage disputes, removal requests or legal obligations.

Marketing and newsletters

Data processed for sending newsletters and promotional communications on the basis of consent is retained until:

• the data subject withdraws consent;

• the data subject objects to processing;

• the service or relevant promotional purpose ends;

• the data is no longer necessary, relevant or up to date.

The Controller periodically reviews whether the grounds justifying processing continue to apply and deletes or anonymises data that is no longer necessary.

Information strictly necessary to document consent, its withdrawal or an objection may be retained separately for the period necessary to:

• comply with legal obligations;

• demonstrate compliance;

• protect the Controller’s rights.

Such information will not be used to send further promotional communications.

Profiling

Data processed for profiling purposes on the basis of consent is retained until consent is withdrawn and, in any event, only for as long as it remains necessary, relevant and proportionate to the stated purposes.

The Controller periodically reviews:

• whether the data is current;

• the relevance of the information;

• whether the purpose remains valid;

• whether retaining the data in identifiable form remains necessary.

Data that is no longer necessary is deleted, anonymised or excluded from profiling processes.

Communications concerning similar products — soft spam

The e-mail address used for communications concerning products or services similar to those already purchased is retained and used until:

• the data subject objects;

• the commercial relationship or promotional purpose ends;

• the address is no longer valid;

• the data is no longer necessary or relevant.

After an objection, the address may be retained on an exclusion list, limited to the information necessary to prevent further unwanted communications.

Cookies

The duration of cookies and tracking tools is indicated in the Cookie Policy and in the preference-management panel.

At the end of the applicable retention periods, data is deleted, anonymised or retained exclusively where necessary to comply with legal obligations or protect rights.

14. Commercial communications and right to object

The data subject may withdraw consent or object to marketing at any time by:

• using the unsubscribe link in e-mails;

• changing account preferences, where available;

• writing to info@dotout.com.

Objection to direct marketing does not require a reason and is free of charge.

Following an objection, data will no longer be used for direct-marketing purposes, but may be retained on an exclusion list to prevent further unwanted communications.

15. Automated decision-making and profiling

The website may use automated systems to:

• detect unusual transactions;

• assign risk indicators;

• prevent fraud;

• recommend a size;

• segment users;

• personalise content and communications, subject to consent where required.

Unless otherwise stated in a specific notice, Lunar Sport and DOT WEAR do not make decisions based solely on automated processing that produce legal effects or similarly significantly affect the data subject.

Orders flagged by fraud-prevention systems may be subject to human review.

Payment providers may make independent decisions concerning transaction authorisation under their own terms and privacy notices.

16. Children’s data

The website and sales services are not specifically intended for minors.

Users under the age of 18 should use the services with the involvement of a parent or person exercising parental responsibility.

In Italy, where an information-society service is offered directly to a child and processing is based on consent, a child who has reached the age of 14 may independently provide consent within the limits provided by law.

For children under the age of 14, consent must be given or authorised by the person exercising parental responsibility.

Where it is established that a child’s data has been collected in breach of applicable law, the data will be deleted or processed in accordance with the instructions of the person exercising parental responsibility.

17. Links and third-party services

The website may contain links to:

• social networks;

• maps;

• videos;

• partner websites;

• payment providers;

• Shopify services;

• size-selection tools;

• review platforms;

• other external services.

When users access an external service, the relevant provider may collect data as an independent Data Controller.

This Policy does not govern processing carried out independently by third-party websites and services.

Users are invited to consult the relevant privacy notices.

18. Rights of the data subject

Where applicable, the data subject may exercise the following rights:

• obtain confirmation as to whether personal data is being processed;

• access their personal data;

• obtain rectification of inaccurate data;

• complete incomplete data;

• obtain erasure;

• obtain restriction of processing;

• receive the data in a structured, commonly used and machine-readable format;

• transmit the data to another Controller where technically feasible;

• object to processing based on legitimate interest;

• object at any time to direct marketing;

• withdraw consent;

• not be subject, in the cases provided by law, to a decision based solely on automated processing;

• lodge a complaint with a supervisory authority.

The right to erasure is not absolute.

Certain data may be retained where necessary to:

• comply with legal obligations;

• perform a contract;

• establish, exercise or defend a legal claim;

• manage a dispute;

• ensure service security.

19. How to exercise rights

For processing relating to:

• e-commerce;

• customer accounts;

• orders;

• payments;

• invoices;

• shipping;

• returns;

• refunds;

• the legal guarantee;

the data subject may contact:

LUNAR SPORT S.R.L.
E-mail: info@dotout.com
Certified e-mail address, PEC: lunarsport@pec.lunarsport.com
Address: Via Gianfranco Miglio 2, 21045 Gazzada Schianno (VA), Italy

For processing relating to:

• technical enquiries;

• Dotout products and technologies;

• brand initiatives;

• any commercial warranties;

• brand newsletters and communications;

the data subject may contact:

DOT WEAR S.R.L.
E-mail: info@dotout.com
Address: Via Enrico Fermi 14, 39100 Bolzano (BZ), Italy

The request must contain sufficient information to identify the data subject and understand the right being exercised.

Where necessary to protect the data, the Controller may request additional information to verify the identity of the applicant.

The Controller normally responds within one month.

The period may be extended in the cases provided by the GDPR, with the data subject being informed of the reasons for the delay.

Exercise of rights is free of charge, except in the case of manifestly unfounded or excessive requests.

20. Complaint to the supervisory authority

The data subject has the right to lodge a complaint with:

Garante per la protezione dei dati personali

or with the competent supervisory authority in the European country where the data subject:

• resides;

• works;

• believes the infringement occurred.

The right to bring proceedings before the courts remains unaffected.

21. Amendments to this Privacy Policy

This Privacy Policy may be updated as a result of:

• changes in applicable law;

• changes to services;

• introduction or removal of providers;

• changes to the purposes or methods of processing;

• technical and organisational developments;

• changes to the e-commerce platform;

• introduction of new analytics, marketing or size-assistance tools.

The updated version will be published on the website together with the date of the latest update.