Privacy Policy Marketing

NOTICE ON THE PROCESSING OF PERSONAL DATA
pursuant to Article 13 of Regulation (EU) 2016/679 (“GDPR”)

PURPOSE OF THIS NOTICE

This privacy notice (the “Privacy Notice”), provided pursuant to Article 13 of the GDPR, describes the processing of personal data for marketing purposes in connection with the e-commerce website accessible through the domain www.mm-official.it (the “Website”).

  1. CONTROLLER, DATA PROTECTION OFFICER: COMPANY CONTACT DETAILS

For the purposes of this Privacy Notice and the data processing described herein, Max Mara Fashion Group S.r.l. (hereinafter also “MMFG” or the “Controller”), with its registered office at Via Pietro Giannone, 10 - 10122 Turin, Italy, is the controller (as defined in Article 4(7) of the GDPR) of the personal data collected through the Website for marketing purposes using its CRM system.

The Company has appointed a Data Protection Officer, responsible for handling any questions or claims relating to the processing of personal data for marketing purposes using the CRM system, who can be contacted at the following addresses: Via Pietro Giannone 10, 10122 Turin, email: dpo@mmfg.it.

  1. PERSONAL DATA PROCESSED

2.1 Source of the data

Personal data is collected directly from the user, who may consent to its processing for marketing purposes by selecting the relevant checkbox on the Website.

Specifically, personal data may be collected when the user:

  • consents to marketing when creating or managing their account on the Website;

  • consents to marketing during the purchase process;

  • subscribes to newsletters or other promotional communication services that may be available on the Website;

  • modifies or withdraws previously given consent or updates their marketing communication preferences.

The personal data collected is entered into MMFG’s Customer Relationship Management system (hereinafter, the “CRM”), where it is processed for the marketing purposes specified in this notice.

2.2 Types of data

For the marketing purposes described in this notice, MMFG may process the following categories of personal data:

  1. identification details, such as first name and surname;

  2. contact details, such as email address and, where applicable to the collection channel and the selected contact methods, telephone number;

  3. data relating to consent and privacy preferences, including information on the giving, modification or withdrawal of consent for marketing purposes and any objection to processing.

  1. PURPOSES AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA

Personal data may be entered into MMFG’s centralised CRM system and processed by MMFG to carry out marketing activities, including sending promotional offers and discounts, newsletters and other promotional and commercial communications relating to products, services, events and initiatives associated with the M_M brand. MMFG may use the contact channels expressly specified in the consent wording and selected or made available by the User, such as email, SMS or WhatsApp.

The legal basis for the processing described above is your consent, pursuant to Article 6(1)(a) of the GDPR.

The inclusion of personal data in the CRM system is optional and free of charge (as it is based on consent that the user may choose to give) and may only take place where personal data is provided for marketing purposes. The user may withdraw their consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

In any event, refusal to provide personal data for marketing purposes does not prevent the user from using the Company’s services or making purchases on the Website, but the Company will be unable to inform them of marketing initiatives.

  1. DISCLOSURE OF PERSONAL DATA

MMFG may disclose or make the user’s personal data accessible to the categories of recipients identified below, to the extent strictly necessary to achieve the marketing purposes described in this notice.

Recipients will receive only the personal data necessary to carry out the activities entrusted to them and will process it in accordance with their applicable data protection role and in compliance with personal data protection legislation.

4.1 Processors pursuant to Article 28 of the GDPR

MMFG uses parties that process personal data on its behalf, on the basis of its documented instructions and as Processors pursuant to Article 28 of the GDPR.

In particular, personal data may be processed by:

  1. Calicantus S.r.l. (Tax Code/VAT No. 03757590272), as a provider of services relating to online shop activities;

  2. providers of Customer Relationship Management systems, for the storage, organisation, updating and management of the data and marketing preferences held in MMFG’s CRM;

  3. providers of IT, cloud, hosting, maintenance, technical support and security services for the systems used for marketing activities;

  4. providers of platforms and services for preparing, sending and managing newsletters, emails, SMS messages and other promotional communications through the channels for which the User has given consent.

The above parties may access the data only to the extent necessary to carry out the activities entrusted to them and may not use it for their own purposes or for purposes beyond MMFG’s documented instructions.

An updated list of Processors may be requested from MMFG using the contact details provided in this notice.

4.2 Independent Controllers

MMFG may also disclose personal data to parties acting as independent Controllers only:

  1. where disclosure is necessary to comply with an obligation under European Union or national law;

  2. to respond to lawful requests from public authorities, Supervisory Authorities, law enforcement agencies or judicial authorities;

  3. to establish, exercise or defend MMFG’s rights in judicial or out-of-court proceedings;

  4. in the context of corporate transactions, such as mergers, acquisitions, reorganisations or transfers of a business or business unit, to the extent permitted by applicable legislation and subject to the adoption of the necessary safeguards;

  5. where disclosure is necessary to protect the rights, safety or assets of MMFG, Data Subjects or third parties, to the extent permitted by law.

Parties receiving data as independent Controllers independently determine the purposes and means of its processing and are required to provide Data Subjects with the information required by applicable legislation.

Any processing carried out through advertising platforms, cookies or other tracking tools is governed separately by the Cookie Policy and the relevant preference management panel.

  1. TRANSFER OF DATA TO NON-EUROPEAN COUNTRIES

If personal data is transferred to countries outside the European Economic Area, MMFG ensures that the transfer takes place in accordance with Chapter V of the GDPR, on the basis of an adequacy decision or appropriate safeguards, including, where applicable, the standard contractual clauses approved by the European Commission.

The user may obtain further information on the transfers carried out and the applicable safeguards, and request a copy of those safeguards, by contacting MMFG using the contact details provided in this notice.

  1. PROTECTION OF MINORS’ PRIVACY

The processing of personal data for marketing purposes governed by this notice is intended exclusively for individuals aged 18 or over.

MMFG does not intend to knowingly collect personal data from individuals under the age of 18 through the marketing checkbox on the Website. If MMFG becomes aware that such data has been collected, it will take the necessary measures to stop processing and erase the data, subject to any legal obligations.

  1. METHODS OF PROCESSING

Personal data is processed primarily by electronic means and is entered into MMFG’s centralised CRM system for the marketing purposes described in this notice. Access to the data is restricted to duly authorised and instructed MMFG personnel and to Processors appointed by the Company pursuant to Article 28 of the GDPR, to the extent that such access is necessary to carry out the activities entrusted to them. MMFG and its Processors implement appropriate technical and organisational measures to ensure the security, confidentiality, integrity and availability of personal data.

  1. RETENTION OF PERSONAL DATA

Personal data processed for marketing purposes will be retained until consent is withdrawn or an objection to processing is made. Records relating to the giving, modification or withdrawal of consent may be retained for the period necessary to demonstrate compliance of the processing and protect MMFG’s rights, within the applicable limitation periods.

  1. RIGHTS OF DATA SUBJECTS

At any time and free of charge, the user may exercise the following rights:

  1. obtain confirmation as to whether or not personal data concerning them is being processed and, where that is the case, access the personal data and information relating to its processing;

  2. obtain the rectification of inaccurate personal data and the completion of incomplete personal data;

  3. obtain the erasure of personal data, except where its retention is necessary to comply with a legal obligation or for the establishment, exercise or defence of legal claims;

  4. obtain restriction of processing in the cases provided for in Article 18 of the GDPR;

  5. receive, in the cases provided for in Article 20 of the GDPR, the personal data provided to MMFG in a structured, commonly used and machine-readable format and, where technically feasible, have it transmitted directly to another Controller (data portability);

  6. object at any time to the processing of personal data concerning them;

  7. withdraw previously given consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

The rights listed above may be exercised by submitting a request:

  • to the email address customerservice@mm-official.it;

  • by written communication addressed to Max Mara Fashion Group S.r.l., Via Pietro Giannone n. 10, 10122 Turin;

  • to MMFG’s Data Protection Officer at dpo@mmfg.it.

The request must contain the information reasonably necessary to enable MMFG to identify the Data Subject and handle the request properly. MMFG may request additional information if it has reasonable doubts concerning the identity of the person submitting the request.

If the User considers that the processing of their personal data infringes the GDPR, they also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali) or with the competent Supervisory Authority in the Member State of their habitual residence, place of work or place of the alleged infringement, without prejudice to any other administrative or judicial remedy.

10. UPDATES TO THIS NOTICE - COMMUNICATIONS

The Controller may update or amend this Notice to reflect any changes in processing activities, the services offered or applicable legislation. The updated version will be published on the Website, indicating the date of the latest update. Where the changes are significant, the Controller may inform the User through a specific notice on the Website or, where appropriate, through a communication sent using the contact details provided by the User. Where changes concern the purpose of processing, the categories of personal data processed, the communication channels used or other essential elements of the consent previously given, the Controller will, where necessary, request fresh consent from the User before commencing the modified processing. Merely browsing the Website or making a purchase does not constitute acceptance of changes relating to processing based on consent.

LAST UPDATED

This notice takes effect on 15/10/2026.