PRIVACY POLICY

Welcome to the website www.goldengoose.com (the “Website”) that is owned by Golden Goose S.p.A. and is operated with the technical and operational support of Golden Goose USA Inc., a corporation having an address at 11 Broadway 368, New York, State of New York 10004, New York, USA, duly appointed as data processor for this purpose by Golden Goose S.p.A.

Please carefully read this Privacy Policy, which applies to the personal data we collect about users of the Website, purchasers of our products, subscribers to our marketing communications and others who interact or communicate with us. In this Privacy Policy, “personal data” includes “personal data” and “personally identifiable” information as defined under applicable privacy laws.

If you are a California resident, please see below, section 15. Additional information for California residents, for information about the categories of personal data we collect and disclose about you and your rights regarding this personal data under California privacy laws.

1. Data Controller

Pursuant to the European Regulation no. 2016/679 (the “GDPR”) Golden Goose S.p.A., with registered office at Via Privata Ercole Marelli 10, Milan, Italy (“GGDB”) is the data controller with respect to the personal data we collect about Website users, including browsing data, marketing and profiling data and data connected and correlated with sales made through the Website and the relative pre-sale and after sale activities.

2. Personal data collected and legal bases for processing

In general, we collect personal data directly from users, automatically related to users interactions with us or our Websites, and from third parties (such as social networks and advertising partners). The Website collects and processes different types of personal data for different purposes and with different methods. The information we collect includes:

• (a) personal data concerning browsing or use of our Website, processed to allow for the proper functioning of the Website, as well as for marketing purposes. In this regard, please see the Cookie Policy present on the Website;
• (b) personal data provided voluntarily by the user (email address, telephone number, personal details, password provided by completing the registration form) or otherwise provided while using the Website and/or through interaction with the customer care service made available by GGDB and processed to respond to user requests and offer the services, support and information requested concerning the products and the world of GGDB;
• (c) the personal data provided by the user during product purchasing processes on the Website to complete transactions and for activities functional and instrumental to sales, as well as for all necessary pre-sale and after sale assistance;
• (d) personal data, details and contact data, processed by GGDB – with your express consent – for marketing purposes, that is to send the user (through traditional instruments and through electronic instruments such as newsletters, emails, SMSs, MMSs and smart messages) information and updates on products, sales, promotional campaigns, events and other initiatives promoted by GGDB or by its commercial partners;
• (e) personal data regarding purchases and any preferences expressed, processed by GGDB – with your express consent – in order to study consumption habits and choices, so as to bring the products, initiatives and individual commercial offers more into line with the tastes and needs of its customers;
• (f) personal details and contact data communicated by GGDB – with your express consent – to third parties belonging to the Lifestyle and Fashion categories for their own marketing activities.

3. Use of personal data

The purposes for which we may process personal data will vary depending upon the circumstances. In general, we use personal data for the following purposes (legal bases indicated where GDPR applies):

• Operating Website and services & providing support: to provide and operate the Website, communicate about your use, troubleshooting, respond to inquiries, fulfill orders and process payments. (Legal bases: performance of contract; legitimate interests)
• Responding to your requests: to respond to your inquiries. (Legal basis: performance of contract)
• Analyzing and improving the Website, products and business: to understand access and usage, improve services, research and analytics. (Legal basis: legitimate interests)
• Personalizing your experiences: to tailor content, location customization, personalized help. (Legal basis: legitimate interests)
• Advertising and marketing: to promote products on third-party websites, direct marketing, newsletters. Where required by law, we obtain opt-in consent. (Legal basis: legitimate interests / consent)
• Protecting legal rights and preventing misuse: to detect fraud, enforce terms, protect safety or rights. (Legal basis: legitimate interests; compliance with laws)
• Complying with legal obligations: to comply with subpoenas, court orders, lawful requests. (Legal basis: compliance with laws / legitimate interests)
• Related to general business operations: mergers, acquisitions, reorganizations, accounting, legal functions. (Legal basis: legitimate interests; compliance with laws)

Aggregate or Anonymous Data: We also create and use aggregate or anonymous data for business development and analytics. This information is not subject to the restrictions of this Policy provided it does not identify an individual.

4. Profiling

GGDB may collect, use and process personal data to understand preferences, interests and behavior, in order to improve our Website, products, services, offers and marketing. As part of this, GGDB may process data relating to the value, frequency and type of purchases (made through our Website and physical stores), interactions, communications and voluntary information. GGDB may also use automated means such as cookies to offer more relevant products and personalized ads.

5. Mandatory or optional nature of the provision of data

When we collect data directly from you, we identify which data is mandatory. With the exception of browsing data (governed by Cookie Policy), providing data for marketing, consumer habits studies, or third-party communication is optional. However, failure to provide mandatory data (e.g., for purchase completion or account registration) may make it impossible to conclude contracts or respond to requests.

6. Disclosure of personal data

We may disclose or permit processing of personal data by:

• employees and advisors of GGDB (authorised data processors);
• our affiliate and subsidiary companies (Group companies) for services and specific marketing activities;
• vendors and service providers (logistics, IT, customer care, marketing);
• third parties providing fulfilment and payment processing (credit institutions for remote electronic payment).

We may also disclose personal data to comply with the law, judicial proceedings, enforce our Terms and Conditions, investigate fraud, during mergers/acquisitions or similar events, or as evidence in litigation.

7. Cookies and similar technologies

We and our third party service providers use “cookies,” pixels, JavaScript, log files, and other mechanisms. For more detailed information, review our Cookie Policy (found on the Website).

• Cookies: small text files to collect activity information, help navigation, enable faster log-in, track activities. Most browsers allow you to control cookies.
• Clear GIFs, pixel tags: embedded invisibly on web pages to track usage, manage content, compile statistics, and track email response rates.
• Log files: automatically gather IP address, device type, screen resolution, OS version, browser type and version.
• Third-party analytics: such as Google Analytics to evaluate use of our Services and improve user experiences.
• Do-Not-Track signals: The Website does not respond to do-not-track signals; you may disable certain tracking via cookie settings.

8. Interest-based advertising

We work with third party ad networks, analytics companies, measurement services (“third party ad companies”) to manage advertising on third party sites. These companies may use cookies, pixel tags, IP addresses, device IDs and geolocation (with consent) to provide more relevant ads. See our Cookie Policy for opt-out information and use our cookie manager to manage preferences.

9. International transfers of personal data

To the extent we transfer your personal data abroad, we ensure adequate protection and safeguards in compliance with applicable laws. For GDPR purposes, GGDB has entered into Standard Contractual Clauses with subsidiaries and providers located outside the EU.

10. PRIVACY POLICY – YOUR CO-CREATION EXPERIENCE ONLINE

Golden Goose S.p.A. processes your personal data (personal information and email address) to enable the footwear and bag customization service and to provide the customization video (“online sneakers maker service”). The legal basis is the performance of a service you requested. Data is stored as strictly necessary. You may exercise your rights (access, rectification, erasure, restriction, portability, objection) by contacting DPO at privacy@goldengoose.com.

11. Period of retention of data

Personal data collected for sale purposes is stored for a period not exceeding 10 years from purchase (compliance with tax and civil regulations). Data for support/requests is stored for the period needed to respond. Marketing and profiling data is stored for up to 7 years based on business sector and customer interest. For cookie retention, refer to the Cookie Policy. We may retain data longer where required by regulatory or professional indemnity obligations, or to protect legal rights.

12. Your rights and choices

Pursuant to the GDPR, users have the right to:

• confirmation of processing and communication in intelligible form;
• information about origin, purposes, logic, controller, processors, and categories of recipients;
• updating, rectification, integration of data;
• erasure, anonymization or blocking of unlawfully processed data;
• data portability;
• restriction of processing;
• object on legitimate grounds, and revoke consent.

Exercise your rights by writing to privacy@goldengoose.com. You also have the right to lodge a complaint with the Italian Supervisory Authority (Garante per la protezione dei dati personali).

13. Updates to this privacy policy

When changes are made, GGDB will post a new version here. If changes materially affect the way we use or disclose your personal data, we will endeavor to notify you in advance via email or Website notice. Please periodically review this Policy.

14. Contact us

15. Additional information for California residents

This section provides information for California residents as required under the California Consumer Privacy Act (“CCPA”). It does not apply to publicly available information or information subject to CCPA exemptions.

Categories of personal data collected and disclosed

We may collect and disclose for a business purpose the following categories (depending on interactions): Identifiers, Customer records, Protected classifications, Commercial Information, Internet or other electronic network activity information, Geolocation data, Biometric information (where permitted), Audio/video/electronic data, Employment history, Education information, Inferences. In the last 12 months, we have collected and disclosed for business purposes the following categories: Identifiers, Internet or other electronic network activity information, and Inferences.

California Residents’ Rights

• Do-not-sell: You have the right to opt-out of our sale of your personal information. We do not sell personal information of residents under 16. To opt out, please submit a request via the contact details below.
• Notice before collection: We notify California residents at or before collection about categories and purposes.
• Request to delete: You may request deletion of your personal information we have collected, subject to exceptions.
• Request to know: You may request a copy of specific pieces of personal information collected in the prior 12 months, as well as categories of sources, business purposes, categories of third parties, and categories sold or disclosed. You may make up to two Requests to Know every 12 months at no charge.
• Discrimination & financial incentives: The CCPA prohibits discrimination for exercising your rights. We do not currently offer financial incentives.

Submitting Verifiable Requests: You may submit a request to know or delete online at privacy@goldengoose.com or by phone at +1 3322444207. We will respond as required by law.