Privacy Policy

Purpose: To enable web browsing; to perform aggregate statistical analysis aimed at measuring the proper functioning of this website and, in case of cybercrimes, to ascertain any responsibilities.

Data processed: IP addresses, domain names, URIs. These data are acquired by the computer systems responsible for the operation of this website.

Legal bases:

• provision of services aimed at enabling users to browse this website;
• legitimate interest in ensuring the proper functioning of computer systems and in investigating possible offenses (also based on the existence of a legal obligation).

Storage period: 30 days following the date of collection, unless otherwise provided by law or measures of Public Authorities that impose a different retention period in relation to investigations related to possible cybercrimes.

Purpose: Processing of online purchase orders and carrying out related activities (dispatch of goods, invoicing, payment management, shipment tracking, delivery of goods, possible activation of the return and refund process, return management, etc.).

Data processed: Contact details (name, surname, email address, phone number) and shipping address. In case of returns, we will also ask you to provide us with your IBAN code, necessary to process the refund for the returned merchandise. Malo will not process data related to the payment method you provided (e.g., payment card number and security code), which will instead be collected exclusively by the payment service provider you have chosen.

Legal basis: Performance of the sales contract.

Retention period: Time necessary to fulfill contractual and regulatory obligations regarding the sale of products (e.g., tax regulations).

Purpose: In order to improve the customer service, we invite you to fill out a questionnaire where you can indicate your satisfaction with the assistance received or share any additional observations.

Data processed: Ticket number assigned to your assistance request, data provided during the questionnaire completion. If the user wishes to be contacted again, contact data will also be processed.

Legal basis: User's specific consent expressed by completing each questionnaire.

Retention period: Up to 1 year from their collection.

Purpose: Sending commercial communications via traditional postal mail, email, SMS, landline and mobile phone, conducting market research, and activities to assess your satisfaction level regarding products related to the Malo brand.

Data processed: Contact information (e.g., name, surname, email address, phone number).

Legal basis: Your consent, which you can revoke at any time by writing to privacy@malo.it or accessing your reserved area.

Retention period: Until your consent is revoked.

Purpose: Verify the correspondence between the buyer and the holder of the selected payment instrument.

Data processed: Your first name, last name, details of e-commerce orders, and information about the type of payment instrument used to make the purchase.

Legal basis: Legitimate interest in fraud prevention and detection.

Retention period: Two years following the collection of the data.

Purpose: Creation of a reserved area ("account") that will allow you to save certain contents (e.g., the "wishlist," which is the list of your favorite products, purchase history, etc.).

Data processed: Personal identification and contact information provided in the online form for registration to the reserved area. Data essential for the use of our services are marked with an asterisk: without providing this information, we will not be able to provide you with the requested service.

Legal basis: Execution of the website registration contract.

Retention period: In case of non-use for more than 3 years, the created accounts and related data will be deleted.

"Purpose: To facilitate the use of your reserved area ('account') by allowing you to save your login credentials and remain logged into your account beyond the end of the browsing session. Data processed: Your login credentials. Legal basis: Your consent expressed through the acceptance of a cookie (also refer to the Cookie Policy). Retention period: The cookie that saves the login credentials will remain active for 12 months. At any time, you can disable cookies by accessing the 'Cookie Settings' section available in the Cookie Policy.

"Purpose: To create statistical reports and behavioral models in order to examine, in aggregate form, the economic effectiveness of commercial initiatives (e.g., launching a new product) by Malo S.p.A. and to direct future commercial and promotional initiatives. Data processed: Information related to your purchases, country of origin, age, gender, information obtained by examining your interaction with us, through email, our website, and through Apps that may be developed by us or by third parties (for more information, please refer to the respective privacy policies). Legal basis: Malo S.p.A.'s legitimate interest in analyzing - in pseudonymized form (thus without directly attributable information to individual customers) - customer data to obtain strategic information regarding customer purchasing behavior, the ways in which customers interact with the company through various communication channels, and the effectiveness of commercial and promotional initiatives, in order to compete with major industry players. Retention period: Data related to your purchases will be retained - in pseudonymized form - for a period of five years. Other personal data will be retained - in pseudonymized form - for a period of two years."

Purpose: In case the product you desire is not available, you can order it at our stores and have it delivered to your home or pick it up at our stores. We will then collect your personal data for processing your purchase order and performing related activities (such as shipping, invoicing, payment management, shipment tracking, product delivery, possible activation of the return and refund process, return management, etc.). Data processed: Personal and contact information (name, surname, shipping address, email address, phone number), information regarding the purchased product (e.g., size). In case you wish to return the purchased products, to proceed with the refund of the paid amount, we will ask you to provide us with your IBAN code. Legal basis: Execution of the sales contract. Retention period: The time necessary to fulfill contractual and regulatory obligations related to the sale of products (e.g., tax regulations). Data controller: Malo S.p.A. To exercise your rights regarding this specific purpose, you can contact us by writing to privacy@malo.it.

Purpose: Provide a product customization service. Data processed: Information (e.g., size, color, model) related to purchases made by you in the previous 12 months. Legal basis: Legitimate interest in providing the best customer service at our stores, in line with customer needs. Retention period: 12 months from the date of collection.

Purpose: Sending the fiscal receipt via email for a purchase made at a "Malo" retail store. Data processed: Email address. Legal basis: Compliance with tax regulatory obligations. Fulfillment of contractual obligations.

Purpose: Sending a notification to the email address you provided regarding the new availability of a product (so-called back in stock). Data processed: Email address. Legal basis: Execution of pre-contractual measures adopted based on your request. Retention period: Your email address will be deleted immediately after informing you of the new availability of the requested product, and in any case, within one month from the request.

Purpose: In our stores, there is a video surveillance system to protect the security of our stores, staff, and customers who access them. The purpose of the processing is therefore to protect against concrete situations of danger such as fires, thefts, robberies, acts of vandalism, and unauthorized access. The collected images may also be used for defense purposes, verification, and exercise of our own claims and rights. Data processed: Your image. Legal basis: Legitimate interest of the data controller in protecting its corporate assets and the safety of its employees and customers. Retention period: The images will be retained for a period of 72 hours. In case of a request from the judicial authority or law enforcement or, in any case, in the event of the use of the images in a judicial proceeding, the retention period may be extended until the definition of the proceeding itself.

The Data Controller will process the personal data of users/customers using both manual and computerized tools, with logic strictly related to the purposes themselves and, in any case, in a way that ensures the security and confidentiality of the data. The data provided voluntarily is collected electronically directly by the Data Controller or through subjects appointed as "Authorized to Process" or through third parties expressly appointed as Data Processors, also through Customer Relationship Management (CRM) computer systems. The CRM is used by the Data Controller both to improve the management of customer data from an administrative and computer perspective and to offer higher-quality services, and, if you give your consent, for direct and profiled marketing purposes.

On our website, you may also find social buttons/widgets, which are specific "buttons" featuring icons of social networks (such as Facebook and Instagram) and interactive social walls (displaying content from social networks). These "buttons" allow users browsing our website to interact with a single click directly with the social network, which collects data related to your visit. In some areas of the site, there is also the so-called social login, which allows you to access your reserved area through the social network account. When you perform the social login, you agree to the terms, conditions of use, and privacy policy of the social network itself.

The personal data collected may be transferred outside the European Union. In such a case, the transfer will comply with the provisions of Regulation (EU) 2016/679 ("GDPR") (in particular, the data will be transferred only upon the signature of Standard Contractual Clauses approved by the EU Commission with Decision No. 2021/914/EU or to countries capable of ensuring an adequate level of protection of personal data and therefore recipients of an Adequacy Decision adopted by the EU Commission).