Politique de confidentialité

Welcome to www.dainese.com (the “Website”). Please read our Privacy Policy carefully, as it applies both if you simply decide to access and browse the Website and use its services without purchasing any products, and if you purchase the products or services offered for sale on the Website.

This Privacy Policy also applies where data is collected via means other than the Website, unless otherwise specified.

By using the Website, you accept the terms set out in the Privacy Policy and in the notice at the foot of the Privacy Policy. If you do not agree with any of the terms and conditions set out in the Privacy Policy, please do not use the Website.

The processing of the personal data of users and consumers (hereinafter collectively referred to as “Users”) will be carried out in accordance with applicable European legislation (GDPR – EU General Data Protection Regulation 679/2016 and the e-Privacy Regulation) and the Code on the Protection of Personal Data (hereinafter the “Privacy Code”: Legislative Decree No. 196 of 30 June 2003, as amended and supplemented), which governs the processing of personal data carried out i) in the context of the activities of an establishment by a data controller or data processor within the Union, regardless of whether the processing takes place within the Union or not; and (ii) to the processing of personal data of data subjects who are in the Union, carried out by a data controller or data processor not established in the Union, where the processing activities relate to: (a) the offering of goods or the provision of services to those data subjects in the Union, regardless of whether payment by the data subject is required; or b) the monitoring of their behaviour in so far as that behaviour takes place within the Union.

The processing shall be carried out in accordance with the fundamental rights and freedoms, as well as the dignity, of the data subject, with particular regard to privacy, personal identity and the right to the protection of personal data.

Table of contents (you can navigate between the topics by hovering your mouse over the list and clicking on the relevant text):

DAINESE S.p.A. (“DAINESE”), when processing personal data – that is, data which may, directly or indirectly, identify you – adheres to the general principles of strict necessity and proportionality (by designing the Website in such a way that the use of personal data is kept to a minimum and so as to exclude the processing of personal data where the purposes pursued in individual cases can be achieved through the use of anonymous data or by other means, which allow the data subject to be identified only where necessary or at the request of the authorities and police forces, such as, for example, data relating to traffic and time spent on the Website or your IP address), lawfulness, fairness, transparency, integrity and confidentiality, and time limitation, as provided for in EU Regulation 679/2016 (GDPR) and incumbent upon data controllers.

The data we process can be divided into two general categories: (i) data relating to the user’s browsing activity on this website and/or other DAINESE websites; (ii) data actively provided by the data subject.

i) Browsing data

The IT systems and software procedures used to operate the Website acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users connecting to the website, the URI (Uniform Resource Identifier) addresses of the resources requested, the time of the request, the method used to submit the request to the server, the size of the file received in response, the numerical code indicating the status of the response provided by the server (successful, error, etc.), the country of origin, and other parameters relating to the user’s operating system and IT environment (e.g. the characteristics of the browser and operating system used by the visitor, the type of device used to access the internet, the various time-related aspects of the visit (e.g. the time spent on each page, and details regarding the path followed within the pages of the Website, with particular reference to the sequence of pages viewed). This category also includes so-called system logs, i.e. files that record interactions between the user and the Website.

This data is used to manage access to the Website and the services it contains, to obtain anonymous statistical information on the use of the Website, to ensure the technical functionality of the Website, to monitor its correct operation and to ensure the maintenance of the relevant database. In these cases, browsing data does not allow the identification of the users concerned and is deleted immediately after being processed in anonymous form. Browsing data may also be used to establish liability in the event of criminal offences or other unlawful acts committed by the data subject to the detriment of the Website and/or third parties via the Website.

ii) Data provided by the user

DAINESE collects Personal Data and other information directly from Users as part of the processes it manages on the Website (purchasing products on the Website to complete e-commerce transactions / completing User registration forms on the Website for DAINESE’s marketing purposes) or by other means (e.g. a) collection on paper or via IT tools in shops, b) events and gatherings, c) trade fairs, chat services available on the DAINESE website; d) online forms dedicated to specific DAINESE initiatives).

The data provided voluntarily by the user and collected via the Website and by other means, for the purposes of the Commercial Purposes, are held in two separate general databases maintained by DAINESE:

- “B2B” (relating to the Company’s retailers, distributors and agents);

- “B2C” (relating to individuals who are end users of the company’s products and services). This refers to:

• information sent by users on an optional and voluntary basis to the addresses indicated on the Website (e.g. email address, subject line of the email, company name or trading name, first name and surname, etc., address of the registered office, place of residence or domicile (postcode, town, county), landline or mobile telephone number, country, contact language, company of affiliation, role within the organisation, etc.);personal data provided by users to make use of services available on the Website (via the order form for the purchase of products and services on the e-commerce site, e.g. personal details, email address, the content of the email and any attachments thereto, postal address, credit card details, bank account details, details of mobile payment methods and codes, telephone number, data relating to purchases made by the data subject, such as product type, date and price of purchase, product model and serial number, retailer from whom the purchase was made)) or to take part in initiatives promoted via the Website or by other means
• personal data provided by users who submit requests, either online or offline, for news, information material or newsletters;
• personal data provided by users who submit job applications (‘curriculum vitae’, etc.) via the ‘Careers’ online form;
• personal data collected via products in the D-Air range, which include a GPS system – necessary for the product’s operation – that records, for a limited period and solely on the product’s microchip, data relating to the product’s geographical location. The data will be processed by Dainese only if a product from the D-Air range is returned to Dainese or an authorised dealer, for the purpose of restoring the D-Air airbag, carrying out repairs, or for product research and development purposes.
• data relating to interactions with the customer service department, including data provided during telephone calls, via email, chat, support tickets or other customer care channels managed by external providers appointed as data processors pursuant to Article 28 of the GDPR. Such data may include identification and contact details, information relating to orders, support requests, complaints, returns or warranty claims, as well as any recordings of communications where permitted and duly notified to the data subject.
• Data collected for the management of product insurance in relation to the promotion, distribution and administrative management of customer relationships, as well as for the fulfilment of regulatory obligations applicable to insurance distributors.

Special categories of data

We never ask you for ‘special category’ personal data via the web forms available on our websites (personal data revealing racial or ethnic origin, religious, philosophical or other beliefs, political opinions, membership of political parties, trade unions, associations or organisations of a religious, philosophical, political or trade union nature, as well as personal data revealing health status and sexual orientation) or ‘criminal’ data (i.e. data relating to criminal records, or concerning the status of a defendant, a person under investigation, or a person convicted of a criminal offence).

Parties processing your personal data

Personal Data will be processed solely by data processors who have been pre-selected and authorised in writing by DAINESE and are supervised by DAINESE, in order to prevent risks to the security of personal data. The authorised parties belong mainly to the administration, marketing, sales, e-commerce, customer care, after-sales and complaints, legal and ICT departments.

Personal Data is also shared with the Supervisory Body designated by DAINESE in relation to the organisational model adopted pursuant to Legislative Decree 231/2001, for the purpose of preventing the risk of certain offences being committed.

Personal Data may be disclosed to third parties who support DAINESE in the conduct of its activities and provide IT, cloud, hosting, system maintenance, e-commerce platform management, marketing, logistics, payment processing, professional consultancy and customer support services, including through dedicated contact centres. These parties act, as appropriate, as data processors within the meaning of Article 28 of the GDPR or as independent data controllers, in compliance with the applicable legislation on the protection of personal data.

Personal Data may also be disclosed to public authorities, judicial authorities, police forces, supervisory bodies, professional advisers, insurance companies and other parties authorised to receive such data pursuant to regulatory or contractual provisions.

Email addresses

The email addresses listed on our websites and any other DAINESE email addresses are not of a personal nature, even when they include the first name and/or surname of a natural person. They belong to the company organisation and their primary purpose is to enable the effective performance of work activities within the companies of the DAINESE Group. This means that messages sent to DAINESE email accounts may be accessed not only by the recipient but also by other authorised members of the organisation, where this is necessary for operational, organisational, security or business continuity purposes, or to comply with legal obligations. By sending communications to the email addresses listed on our websites, you declare that you have read and accepted the terms of processing set out in this Privacy Policy.

Purposes

DAINESE is the data controller of Users’ Personal Data (“Personal Data”) for purposes relating to the management of the commercial relationship, the sale of products and services via the Website, DAINESE’s retail outlets and other sales channels, as well as the management of customer support, after-sales service, warranty and complaints (the “Commercial Purposes”).

DAINESE also processes Personal Data for the purposes of direct marketing and profiling, within the limits permitted by applicable legislation and on the basis of the data subject’s consent or another appropriate legal basis (the “Marketing Purposes”).

In the context of Commercial Purposes, Personal Data may be processed for:

1.   the handling of pre-contractual enquiries and orders;

2.   fulfilling contractual and legal obligations;

3.   managing relationships with customers, users and suppliers;

4.   managing payments and preventing fraud and insolvency;

5.   the management of returns, warranties, complaints and customer support activities;

6.   the protection of DAINESE’s rights and the handling of any disputes;

7.   the management of insurance cover relating to the activities carried out.

Methods of processing

Personal Data is processed primarily in electronic form and, in certain cases, also in paper form.

The logic and organisational methods of processing are closely linked to the individual purposes set out above.

To ensure that Personal Data is always accurate and up to date, and in any case relevant and complete, please notify us of any changes at the following email address: privacy@dainese.com .

The data is processed within DAINESE’s Customer Relationship Management (CRM cloud) IT system, which is dedicated to the management of customers, suppliers and other contacts, as well as on DAINESE’s e-commerce platform and DAINESE’s AX management software.

The data controller also uses a cloud service provided by THRON S.p.A. (“THRON”), which offers an integrated technical solution for digital asset management (“DAM”) (i.e. the management of digital resources).

THRON centrally manages – and therefore more efficiently – DAINESE’s digital resources, which are available and/or published simultaneously across multiple web channels, and collects statistics on users’ use of and access to the resources managed through the system. THRON does not automatically collect personally identifiable data from users visiting the digital resources managed via the software; however, it does automatically collect the following data: the IP address, the operating system and the browser type of the computer or mobile device used, and the URL of the website visited before or after accessing a service in which the THRON solution is integrated. For further information, please consult THRON’s privacy policy, available at the following link.

Security measures

DAINESE implements appropriate security measures to minimise the risks of destruction or loss – including accidental loss – of Personal Data, unauthorised access, or processing that is unauthorised or inconsistent with the purposes for which the data was collected.

Such measures include, for example, the use of authentication credentials (user ID and password) by those who access data on behalf of DAINESE, the configuration of authorisation profiles designed to restrict access solely to pre-authorised legal entities and individuals, periodic review of these authorisation profiles, the use of back-up and recovery procedures, server- and client-level anti-virus software updated daily, firewalls and anti-intrusion software. The email archive is protected by antivirus and antispam software. Furthermore, the Website is based on HTTPS technology, which is a protocol for secure communication over a computer network used on the Internet. HTTPS involves communication via the HTTP (HyperText Transfer Protocol) within a connection encrypted by Transport Layer Security (TLS) or its predecessor, Secure Sockets Layer (SSL). The principle underlying HTTPS is to ensure: i) authentication of the website visited, ii) protection of privacy, iii) integrity of the data exchanged between the communicating parties. The newsletter distribution system is also protected by anti-spam and anti-virus software. The data is stored in archives which are backed up daily onto media kept in secure premises.

The purposes of the processing are:

a) to meet pre-contractual requirements (e.g. preparing our quotations or your orders, processing your requests, including the sending of information materials, price lists, etc.) and/or to fulfil contractual obligations (the supply or purchase of goods and/or services, including the management of delivery obligations and the logistics and transport required for this purpose); the legal basis for the processing is the need to perform a contract to which the data subject is a party or to take pre-contractual measures at the data subject’s request (in the legitimate interest of DAINESE, which overrides the interests or rights of the data subject, to finalise the contract for the sale of products and services). This legitimate interest also includes the interest in exchanging information with the User, at the User’s request, for the purposes of concluding the aforementioned contract (e.g. regarding the type and/or characteristics of the products);

b) compliance with legal obligations (e.g. bookkeeping; tax formalities; administrative and accounting management, etc.); the legal basis for the processing is therefore the need to comply with the aforementioned legal obligations;

c) customer and supplier management in respect of matters other than those referred to in points 1 and 2 (internal organisation of activities relating to the supply and procurement of products and/or services, e.g.: credit checks, credit limit management and risk control – fraud, insolvency, etc. – dispute resolution and debt assignment, management of financial and insurance services instrumental to supplier management and the management of electronic payment instruments, production management, telephone directory management, and the compilation of statistics); the legal basis for the processing is our legitimate interest in processing the Data in order to manage our relationships with our customers and/or suppliers effectively and efficiently, and to manage the related internal and external organisational processes; exclusively in relation to products in the D-Air category:

• provision of after-sales technical support services (replacement of the airbag or repairs carried out by Dainese or authorised third parties, product firmware updates): as part of these activities, data (including geolocation data) may be downloaded and analysed, and such data may also be used – following anonymisation – for research and development purposes; the legal basis for the processing is the performance of a contract to which the data subject is a party and, for research and development activities, Dainese’s legitimate interest in carrying out research and development to improve its products;
• provision of services for the use of the dedicated D-Air app: data is collected for the purposes of user registration and device activation; the legal basis for the processing is the performance of a contract to which the data subject is a party.

d)   direct marketing, i.e. the sending of commercial and promotional communications and/or the direct offering of goods and services via email, text messages, telephone calls, social media, and/or market research; By law, it will not be necessary to obtain consent for the sending of promotional emails regarding products and services similar to those already purchased on the Website or in Dainese shops, as in such cases the legal basis for processing is our legitimate interest in promoting our business to those who already know us; where the emails do not concern similar products or services, the legal basis for processing is the data subject’s consent;

e)   profiling; for the purposes of profiling you, we analyse the data you provide when you use individual services we offer (e.g. first name and surname, address, country of origin, preferred language, landline and mobile phone numbers, email address, entered when you subscribe to the newsletter or make purchases of our products and services, or when you register for the members’ area of our website), including by linking this information to data relating to your browsing activity on the Dainese website and/or your use of the services provided by the site (e.g. cookies) or to data collected via other communication channels (e.g. social media platforms with which you interact, linked from our site).

We aggregate, compare and process data to analyse it – including for predictive purposes – and/or to create groups of individuals categorised by market segment based on a minimum set of criteria (e.g. age, gender, country and/or geographical area of origin, contact language, choices relating to the purchase of our products and, in particular, items, dates and aggregated and average amounts of purchases, as well as any instances where our products added to the shopping basket on our websites were not purchased, as recorded via the website’s functionality; N.B.: the type of products analysed relates to the limited product sector of clothing and accessories for motorcyclists; user responses to direct email marketing (DEM) or instant messaging campaigns (opening our email and/or instant messaging messages, opening links contained in email and/or instant messaging messages, clicking on the call to action proposed via email and/or instant messaging used for email and/or instant messaging campaigns addressed to individuals we have identified by name, and for Google and Facebook advertising campaigns addressed to people we have not identified by name, preferences regarding our product categories; in such cases, we refer collectively to ‘Basic’ profiling), right up to more advanced profiles based on online behaviour (other than failure to purchase our products, e.g. pages pages visited or content clicked on our website and the duration or frequency of such visits or clicks; websites or other online channels from which visitors arrive; the types of devices and browsers used to access our website; products viewed on our website and the duration and frequency of such views; and advertising cookies (in such cases, we refer to ‘Advanced’ profiling).

This activity serves a dual purpose: to better understand our current and potential customers, both as groups and as individuals, and to analyse the effectiveness of marketing channels and content in order to develop and update products, services and offers in line with the preferences and behaviours of our target audiences, and to utilise the most appropriate promotional channels.

Profiling therefore aims to align the goods and services we offer with current and potential demand, measure the results of specific promotions, take corrective action to improve business performance (e.g. by reducing the risk of investing resources in areas of little relevance to the target audience) and the effectiveness of commercial processes (e.g. by ascertaining how many promotional messages and content we have sent you via email or instant messaging you have viewed and clicked on), and to limit the sending of promotional communications that are not relevant to your likely expectations and needs or via channels you do not prefer. This means that we do not send the same offers to everyone, and we will be able to send you advertising communications that are as closely aligned as possible with your tastes, interests or preferences, or via your preferred contact methods, thereby enhancing your shopping experience, which is also to your own advantage.

Furthermore, if you consent to Advanced profiling, or even without your consent in the case of Basic profiling, we use the data derived from the relevant analysis to develop criteria for advertising retargeting, which we share with social media platforms to advertise services and products on social media: i) to other individuals with a profile similar to yours and who may therefore be most interested in what is on offer (we do not know the names of these individuals), or ii) to named data subjects.

Profiling does not result in your exclusion from specific benefits or from the ability to freely exercise your rights in relation to the personal data we process; in particular, it does not affect the data subject’s ability to use our standard services (e.g. online pre-registration, purchasing services).

The legal basis for profiling is, as regards BASIC profiling, our legitimate interest in having a basic profile to tailor marketing activities to the topics of greatest interest to the user, as well as to display the user’s shopping basket again in the event that no purchase is made; as regards Advanced profiling, the legal basis is the prior consent provided to Dainese by the data subject (or by third parties where they are the ones to obtain consent from the data subject).

Does the data subject’s consent to processing for profiling and direct marketing purposes also apply to the disclosure of data to third parties?

The disclosure of data by DAINESE to third parties for direct marketing purposes may be directed, as the case may be, to other companies within the Group or to third parties who, as part of the same shared marketing activities and/or as part of the same processing for direct marketing purposes (e.g. in relation to co-branded marketing initiatives), collaborate with DAINESE, or are contractually authorised to send commercial communications to the data subject and/or to process the data received on behalf of the Data Controller for marketing purposes.

In the two cases mentioned above, as the third parties to whom the data are disclosed are designated in writing by DAINESE as ‘external data processors’, they may process the data on behalf of DAINESE on the basis of the same specific marketing consent (including consent to the disclosure of data to third parties for such purposes) already given to DAINESE.

Conversely, the consent to processing for marketing purposes given by the data subject to DAINESE does not automatically authorise the disclosure or transfer of data by DAINESE to third parties who process it in the capacity of joint controllers or independent controllers (i.e. other than as external data processors) (as a rule, this only occurs with third-party partners who intend to use the data independently for profiling and/or direct marketing purposes): therefore, in order to proceed with such disclosure to third parties, DAINESE must obtain from the data subject further, separate, additional, documented, express and, likewise, optional consent.

Personal Data will be retained in a form that allows the User to be identified for the time strictly necessary for the purposes for which the data were collected and subsequently processed and, in any event, within the limits laid down by law, as follows.

Browsing data is processed for the time necessary to ensure navigation and technical interaction between the User and the Website; this period coincides with the duration of the individual browsing session.

a) during the pre-contractual phase, for the time necessary to process requests from the data subject received by the Company (e.g. opening a technical support ticket under warranty) and to track and manage the successful resolution of the responses sent by the Company to the data subject; this period is limited to 24 months from the date of collection of the personal data;

b) in relation to any contract entered into with the data subject, for the entire duration of the contract (in particular, for at least the 2-year standard warranty period under the Consumer Code);

c)  following the termination of the contractual relationship with the data subject, personal data will be processed to fulfil all legal obligations relating to the terminated contractual relationship and, in any event, until the expiry of the civil law limitation period for claims for damages to which the data subject is entitled pursuant to Article 2946 of the Italian Civil Code (for 10 years from the termination of the contract).

Personal data is processed for IT security purposes (e.g. recording, storing and analysing logs relating to electronic and telecommunications events triggered by the User through interaction with the Website’s features and/or the sending of emails to DAINESE), storage will take place for a period sufficient to allow the completion of appropriate security checks relating thereto and to assess their outcomes (18 months from the time of collection), or, in the event of any anomalies detected, for the time necessary to resolve them through appropriate measures.

In the event of an out-of-court or court dispute arising with the data subject and/or third parties, the data will be processed for as long as is strictly necessary to ensure the full protection of the Data Controller’s rights (i.e. until a court settlement, an out-of-court settlement or a final and binding judgement has resolved the dispute).

In the case of processing for marketing purposes, the duration is as follows:

a) in the case of basic profiling, as the processing is based on DAINESE’s legitimate interest in using the results to plan, implement and assess the effectiveness of direct marketing campaigns based on such profiling, it will continue until the data subject objects;

in the case of advanced profiling, which is instead based on the data subject’s prior specific consent, processing will take place for the shorter of either a period of 3 years or the date of any early withdrawal of consent by the data subject;

- for direct marketing purposes, the duration of processing will vary depending on whether it is based on DAINESE’s legitimate interest (so-called ‘soft spam’ to customers) or on the data subject’s consent; in the former case, it will last until the data subject objects, whilst in the latter case, it will last until such prior consent is withdrawn.

In the event that DAINESE collects and records logs derived from the actions through which the user of the DAINESE website expresses their declaration of intent regarding consent or non-consent to processing for direct marketing purposes and any advanced profiling (e.g. clicks on online fields, ticking boxes, continuing to browse after a cookie banner has been displayed, and similar actions), such data will be retained for the time necessary to demonstrate the content of the relevant declaration of intent to the supervisory authorities.

Once the respective retention periods set out above have elapsed, DAINESE undertakes to permanently delete the personal data from its electronic records. Alternatively, it reserves the right to anonymise such data at any time, in which case the data protection legislation will no longer apply to it.

From time to time, during your interaction with DAINESE, we will inform you whether the provision of Personal Data to DAINESE is mandatory or optional. The provision of Personal Data to DAINESE for the relevant Commercial Purposes (in particular, personal details, your email address or postal address, your credit/debit card and bank account details, and telephone number) is necessary for the fulfilment of those purposes.

Any refusal to provide DAINESE with certain Personal Data necessary for these purposes may therefore make it impossible to respond to pre-contractual requests for information about our products and services, to enter into and/or perform the contract for the purchase of products and services on the Website, or to comply correctly with the relevant legal and regulatory obligations.

The provision of additional Personal Data, other than the mandatory details, is, however, optional and does not entail any obligation, disadvantage or consequence for the User in relation to the purchase of products or services on the Website.

The provision of Personal Data for Marketing Purposes, or the data subject’s consent in cases where the law requires this for the lawfulness of the processing, is always optional and – subject to what is separately set out in our Cookie Policy regarding the use of cookies and other similar identifiers such as pixels or tags by DAINESE – is generally linked to the User’s registration process on the Website. Failure to provide such data, as well as failure to give consent to processing for Marketing Purposes, does not entail any adverse consequences for the purchasing process, which will therefore proceed as normal; rather, it simply means that it will not be possible to complete the relevant registration and thus to make use of DAINESE’s services, such as newsletters, general or personalised commercial offers and/or access to restricted promotional areas, where direct marketing activities take place from time to time.

Personal Data may be made available to third-party companies that provide specific services on behalf of DAINESE, in their capacity as Data Processors, or disclosed to other third parties who process the data independently, solely to enable the conclusion and/or performance of the contract for the purchase of products on the Website, and only where such purpose is not incompatible with the purposes for which the Personal Data was collected and subsequently processed, and, in any event, in accordance with the law.

In particular, DAINESE uses suppliers who provide after-sales service, as set out in more detail in the Website’s Terms and Conditions of Sale, which can be viewed via the following link. DAINESE also uses carriers and couriers (UPS, DHL, etc.) or logistics service providers to carry out the dispatch process; these parties will process Users’ personal data solely for the purpose of completing the service entrusted to them.

Data may also be disclosed to: 1) banks, electronic money institutions or other authorised entities for the provision of remote electronic payment services (via credit/debit card or via functions made available through mobile devices); 2) insurance companies (for transport insurance cover); 3) other companies, organisations and/or individuals carrying out activities that are instrumental, supportive or functional to the performance of the contracts or services requested by you (e.g. companies responsible for managing the Website, companies providing maintenance and support services in relation to the Data Controllers’ databases).

Personal data is disclosed to chartered accountants, solicitors and law firms, auditing firms and/or auditors, who, in various capacities and in accordance with guidelines previously issued by DAINESE, carry out the activities necessary to ensure compliance with legal obligations relating to the sale of goods and services via the Website.

Personal Data may be disclosed to the police or judicial authorities, in accordance with the law and following a formal request from such bodies, for example in the context of anti-fraud measures, or even in the absence of a specific request, for the fulfilment of tax obligations (e.g. the Italian Revenue Agency).For marketing purposes, DAINESE also discloses Personal Data to external third-party data processors: marketing and advertising agencies, hosting service providers, website development and management companies, web marketing companies, and providers of electronic communications and ICT services; third-party commercial partners – even if operating in sectors not covered by the e-shop, such as the automotive sector – with whom DAINESE carries out co-marketing initiatives or organises events.

In the event of accidents involving DAINESE’s product liability, personal data may be disclosed to third parties responsible for handling the relevant claim (e.g. law firms, as well as technical experts and insurance companies providing the relevant insurance policy activated in relation to the claim itself).

In the event of the sale to a third party of the company or business unit to which the Website belongs, the user’s personal data will automatically be transferred to the purchaser. In the event of the sale to a third party of a controlling stake in DAINESE’s share capital, personal data may be disclosed to the purchaser(s).

Personal Data will not be disclosed, that is to say, made available to an uncontrolled number of third parties.

Our website may use social media features such as the Facebook ‘Like’ button, the ‘Tweet’ button and other sharing widgets (‘Social Media Features’). Social Media Features may allow you to publish information about your activities on the DAINESE website on external platforms and social media sites. Social Media Features may also allow you to ‘like’ or highlight information that we have published on the DAINESE website or on DAINESE’s official social media pages.

Social media features are hosted by the respective social media platforms or directly on our website. Where social media features are hosted by the platforms themselves and are clicked on via our website, the platform may receive information indicating that you have visited our sites.

If you are logged into your social media account, the relevant social media platform may link your visit to our website to your social media profile. With regard solely to the collection of data on our website and the automatic transmission to social media platforms of the personal data of users of our website – whether or not they are registered with those social media platforms – DAINESE acts as a joint controller pursuant to Article 26 of the GDPR.

With regard to its Facebook pages https://www.facebook.com/daineseofficial/ and Instagram https://www.instagram.com/daineseofficial/, DAINESE is a joint controller of statistical data together with Facebook Ireland Limited (“Facebook Ireland”).

DAINESE may also share certain data (first name, surname, email address) with third-party social media platforms (e.g. Facebook, Google), which use this data solely for the purpose of identifying other people similar to the user who may be interested in DAINESE’s services and/or products, in order to advertise them via social media platforms. Further information on DAINESE’s remarketing policies (so-called ‘behavioural advertising’) can be found in our Cookie Policy.

Your interactions with the Social Network Features are governed both by this privacy notice (limited to processing carried out under joint controllership as described above) and functionality (for any aspect of personal data processing not covered by the aforementioned joint controllership arrangement).

Commercial and promotional emails sent by Dainese may contain tracking tools known as ‘tracking pixels’ or similar technologies.

These tools enable the collection of information relating to the user’s interaction with the communication received, such as, by way of example: opening of the message; date and time of opening; number of times the message was opened; technical information relating to the device or email client used. The data collected in this way may be used to: monitor the effectiveness of communication campaigns; improve the quality and relevance of the content sent; optimise marketing and customer engagement activities; and avoid sending unsolicited or irrelevant communications.

The processing carried out using tracking pixels in commercial communications takes place – in the case of soft spam directed at individuals who are not already our customers – on the basis of the data subject’s express consent pursuant to Article 122 of Legislative Decree 196/2003 and Articles 6 and 7 of Regulation (EU) 2016/679.

The data subject may withdraw their consent to the tracking of email communications at any time without affecting the lawfulness of the processing carried out prior to the withdrawal.

Consent may be withdrawn at any time by using the dedicated link provided in the email communications for managing privacy preferences, or by contacting the Data Controller at privacy@dainese.com

Where, however, marketing communications are directed at individuals who are not already our customers, or are directed at our customers but fall outside the scope of ‘soft-spam’ (because they relate to products or services not similar to those previously purchased by the data subject), the processing carried out via tracking is based on our legitimate interest in pursuing the aforementioned purposes (and therefore does not require initial consent), without prejudice to the data subject’s right to object at any time to the tracking processing and/or to the sending of further commercial communications.

In the context of the offering and distribution of insurance products that may be combined with Dainese products or services, the user’s personal data may be processed by various parties, each within the scope of their own competences and responsibilities.

Dainese S.p.A. acts as an independent data controller with regard to the promotion, distribution and administrative management of customer relationships, as well as for the fulfilment of regulatory obligations applicable to insurance distributors.

AIG Europe S.A. – General Representative Office for Italy, in its capacity as the issuing insurance company, acts as an independent data controller for activities relating to insurance risk assessment, the issue, management and administration of the policy, claims handling, fraud prevention and compliance with regulatory obligations applicable to the insurance sector.

Howden S.p.A., as the insurance broker responsible for structuring and managing the insurance programme, may process personal data in the context of insurance brokerage, consultancy and assistance activities, acting as an independent data controller for the purposes falling within its remit.

To the extent that Dainese carries out any administrative activities on behalf of the insurance company in relation to the management of insurance cover, Dainese may act as a data processor pursuant to Article 28 of Regulation (EU) 2016/679, on the basis of instructions provided by AIG. For further information on the processing carried out by AIG and Howden and on how data subjects may exercise their rights, please refer to the respective privacy notices provided by these entities.

The processing of personal data will take place mainly in Italy, and in other countries where other companies in the Dainese Group are based. Processing may partly take place in other countries, either within or outside the EU, to the extent that DAINESE transfers data to suppliers with data centers or offices in those countries (for example, for the technical management of this website and the database underpinning its operation, or for the management of direct marketing activities and profiling related to it in various ways).

In particular, Personal Data will be transferred abroad to companies belonging to the Dainese Group (a list of which is available on the Website), as well as, where necessary for the pursuit of Commercial or Marketing Purposes, to non-EU countries that ensure adequate levels of protection in accordance with the relevant decisions of the European Commission, or, in the absence of such specific decisions, only following the conclusion between DAINESE and the said entities, in relation to Marketing Purposes, of specific contracts containing adequate safeguards for the protection of Personal Data to be implemented by the foreign entity receiving the personal data, in accordance with the applicable legislation on the matter and, in particular, as a minimum, the relevant standard texts approved by the EU Commission (the so-called Standard Contractual Clauses or “SCCs”).

The cloud providers based outside the EU or with data centres outside the EU used by DAINESE are as follows:

• Salesforce, Inc., a provider of e-commerce, customer relationship management (CRM), customer care and marketing automation services via the Salesforce Commerce Cloud, Salesforce Service Cloud and Salesforce Marketing Cloud platforms. For further information on the processing of personal data by Salesforce, please refer to the relevant privacy policy available at https://www.salesforce.com/it/company/privacy/.
• YotPO, with its registered office at 400 Lafayette St, New York, NY, USA, as the provider of the review collection service. For the privacy policy, see the URL https://www.yotpo.com/yotpo-privacy-guide/
• OneTrust, with its registered office in London (Co-Headquarters) at Dixon House, 1 Lloyd’s Avenue, London, EC3N 3DQ, United Kingdom, as a provider of the review collection service. For the privacy policy, see the URL https://www.onetrust.com/privacy/
• Facelift, with its registered office at Gerhofstr. 19, 20354 Hamburg, as a provider of a service designed to optimise social media management. Facelift transfers data to the USA. For the privacy policy, see the URL https://facelift-bbt.com/en/data-privacy-policy
• Microsoft Corporation, with its registered office at 1 Microsoft Way, Redmond, WA – Washington 98052, USA, as the provider of the ‘Microsoft 365’ individual productivity cloud application service and/or the Microsoft TEAMS video conferencing service, used in the management of pre-contractual or contractual relationships with data subjects.

In particular, as set out in Annex 1 to the Terms and Conditions for the Use of Online Services, with regard to the 365 Service, Microsoft undertakes to store the Company’s inactive data processed by DAINESE as follows: “where the Company provisions its tenant (…) within the European Union, Microsoft shall store the following Inactive Company Data solely within that Geographical Area: (1) the contents of the Exchange Online mailbox (body of email messages, calendar entries and the contents of email attachments), (2) the content of the SharePoint Online site and the files stored on that site; and (3) files uploaded to OneDrive for Business.” For such data, therefore, no transfer to the USA takes place, or such transfers are purely occasional. Please refer to Microsoft’s policy at the URL: https://docs.microsoft.com/it-it/microsoft-365/enterprise/o365-data-locations?view=o365-worldwide, and Microsoft’s privacy policy at the URL: https://privacy.microsoft.com/it-it/privacystatement.

It is, however, possible that other inactive data processed by DAINESE – in particular, data other than that indicated above – may be transferred from the EU to the US for the service in question, and that such transfers may occur on a more than occasional basis.

It cannot be ruled out with absolute certainty that, in certain exceptional circumstances, the US public authorities – pursuant to legislation in force in the USA (e.g. Section 702 of the FISA and Executive Order EO 12333) – may, for the sole purposes of national security, access personal data transferred by DAINESE to the USA as described above. However, based on a specific analysis of the matter carried out by DAINESE in accordance with the ‘Schrems II’ judgement of 16 July 2020 of the CJEU and the relevant Guidelines issued by the EDPB – European Data Protection Board – in practice, the possibility that the aforementioned public authorities may have a genuine interest in accessing and further processing such data (of which the provider may not, by law, be required to notify DAINESE and/or the data subject) appears entirely remote, given: i) DAINESE’s specific core business; ii) the limited types of personal data it processes; and iii) the limited categories of data subjects to whom the data relate.

Therefore, the Company considers that the SCC’s guarantee protection of the data subjects’ rights that is substantially equivalent to that provided for by the GDPR. DAINESE will notify the data subjects of the adoption of any additional measures.

DAINESE also carries out ongoing monitoring to identify its suppliers with headquarters or data centres in the USA and to verify that data transfers to them are based on appropriate legal grounds as provided for by the GDPR.

Where data is transferred outside the EU for reasons other than Marketing Purposes, the legal basis for the transfer is also DAINESE’s legitimate interest in performing the contract with the data subject or a contract entered into by DAINESE with third parties for the benefit of the data subject, or in complying with the relevant legal obligations.

This Website and the Data Controller’s Services are not intended for children under the age of 16, and the Data Controller does not intentionally collect personal information relating to children.

Should information concerning children be inadvertently recorded, the Data Controller will delete it promptly, upon request from users.

Please note that the data subject shall have the right to:

- request confirmation from the Data Controller as to whether or not personal data concerning them is being processed and, if so, to obtain access to that personal data;

-  to obtain clear and concise information regarding the following aspects: a) the purposes of the processing; b) the categories of personal data concerned; c) the recipients or categories of recipients to whom the personal data have been or will be disclosed, in particular if they are recipients in third countries or international organisations; d) where possible, the envisaged period for which the personal data will be stored or, if this is not possible, the criteria used to determine that period; e) the existence of the data subject’s right to request from the data controller the rectification or erasure of personal data, or the restriction of the processing of personal data concerning them, or to object to such processing; f) the right to lodge a complaint with a supervisory authority; g) where the data are not collected from the data subject, any available information as to their origin; h) the existence of automated decision-making, including profiling, and, at least in such cases, meaningful information on the logic used, as well as the significance and the envisaged consequences of such processing for the data subject.

- where personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the existence of appropriate safeguards relating to the transfer;

- to request, and obtain without undue delay, the rectification of inaccurate data; taking into account the purposes of the processing, the completion of incomplete personal data, including by providing a supplementary statement;

- to request the erasure of data if: (a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed; (b) the data subject withdraws the consent on which the processing is based and there is no other legal basis for the processing; c) the data subject objects to the processing, and there are no overriding legitimate grounds for continuing the processing, or the data subject objects to processing carried out for the purposes of direct marketing (including profiling for the purposes of such direct marketing); d) the personal data have been processed unlawfully; e) the personal data must be erased to comply with a legal obligation under Union law or the law of the Member State to which the data controller is subject; f) the personal data were collected in relation to the provision of information society services.

Removal from the DAINESE database

-  to request the restriction of processing concerning the data subject, where one of the following circumstances applies: (a) the data subject contests the accuracy of the personal data, for the period necessary for the data controller to verify the accuracy of such personal data; (b) the processing is unlawful and the data subject opposes the erasure of the personal data and requests, instead, that its use be restricted; c) although the data controller no longer requires the personal data for the purposes of processing, the data are necessary for the data subject to establish, exercise or defend legal claims; d) the data subject has objected to processing carried out for direct marketing purposes, pending verification as to whether the legitimate grounds of the data controller override those of the data subject;

- to obtain from the data controller, upon request, information regarding the third-party recipients to whom the personal data have been disclosed;

- to withdraw, at any time, consent to the processing where such consent was previously given for one or more specific purposes relating to their personal data, it being understood that this shall not affect the lawfulness of the processing based on the consent given prior to the withdrawal.

In particular, to withdraw consent previously given to DAINESE, the data subject may submit a specific request in one of the following ways: i) by following the unsubscribe instructions provided at the bottom of each email, or ii) by sending an email to privacy@dainese.com containing the request.

-  to receive, in a structured, commonly used and machine-readable format, the personal data concerning the data subject that they have provided to the data controller and, where technically feasible, to have such data transmitted directly to another data controller without hindrance from the data controller to whom they provided it, provided that the following (cumulative) condition is met: (a) the processing is based on the data subject’s consent for one or more specific purposes, or on a contract to which the data subject is a party and for the performance of which the processing is necessary; and (b) the processing is carried out by automated means (software) (the overall right to so-called ‘data portability’). The exercise of the right to data portability is without prejudice to the right to erasure provided for above;

- the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them. Automated decision-making does not currently take place on our websites or within our services.

- The data subject may also lodge a complaint at any time with the competent supervisory authority under the GDPR (that of their place of residence or domicile).

How to exercise your rights

You may exercise the aforementioned rights, as well as obtain a list of the data processors and independent third-party data controllers to whom DAINESE has disclosed your data, or receive further information on how DAINESE processes Personal Data, by sending an email to privacy@dainese.com or by writing to the postal address of DAINESE S.p.A., Via Louvigny No. 35 – 36064 – Colceresa (VI) – Italy.

We aim to respond to all legitimate requests within one month, unless otherwise required by law, and we will contact you if we need further information to process your request or verify your identity. In some cases, it may take longer than one month, depending on the complexity and number of requests we receive.

Some registered users can update their user settings and profiles, organisation settings and event registrations by logging into their accounts and amending their settings or profiles.

The data controller for Users’ personal data is DAINESE S.p.A., with its registered office at Via Louvigny No. 35 – 36064 – Colceresa (VI) – Italy, Tax Code and VAT No. 03924090248.

In order to ensure compliance with the GDPR and the laws applicable to the processing of the data subject’s personal data by Dainese, Dainese has appointed an independent third party as Data Protection Officer: Mr Luca De Muri, a solicitor, whose address for service is at the registered office and who can be contacted at the email address privacy@dainese.com.

DAINESE may, at any time, amend or simply update, in whole or in part, the Privacy Policy, including in light of changes to the laws or regulations that protect your rights. The latest version of the Privacy Policy is indicated at the end of this document, and applies to the processing of Personal Data from the date specified therein. Amendments and updates to the Website’s Privacy Policy shall take effect as soon as they are published on the Website, in this section. Users will be notified by email of any changes made to this Privacy Policy. In any event, you are required to visit this section regularly to check for the publication of the most recent and up-to-date version of the Website’s Privacy Policy.

Version 4 of 21 October 2026