Privacy Policy

Privacy Policy 
Please read this Privacy Policy carefully. It is addressed to users of the websites Vibram.com and events.vibram.com (hereinafter, the “Website”) and is drafted pursuant to Article 13 of Regulation (EU) 2016/679 (General Data Protection Regulation – GDPR).

This document provides all details concerning the processing and use of personal data (hereinafter, the “Data”).

Note: This Privacy Policy applies exclusively to data processing activities carried out on the Website and not to processing carried out on other websites, even if accessible via links contained on the Website.

1. Data Controller and Contact Details
The Data Controller is:

- Company: Vibram S.p.A.

- Address: Via Cristoforo Colombo No. 5, 21014 Albizzate (VA), Italy

- Email: [e-mail]

2. Data Protection Officer (DPO) Contact Details
The Data Protection Officer (DPO) can be contacted at:

- Email: [e-mail]

3. Types of Data Processed
3.1 Browsing Data
We collect the following Data through the services you use on the Website:

- Technical Data (Anonymous): this includes IP addresses, domain names, URI addresses, request time, server response status, and other parameters relating to your IT environment.

- Purpose: such Data are used solely for statistical purposes, to verify the proper functioning of the Website, and are deleted immediately after processing.

- Note: such Data may be used to ascertain liability in the event of suspected cybercrime.

- Cookies: the Website collects Data through cookies or similar technologies. For further details, please refer to the Website’s Cookie Policy.

3.2 Data provided voluntarily by the user
The Website allows users to voluntarily provide personal data (e.g., first name, last name, email address, telephone number) through actions such as:

- completing the "Create Account" or "Checkout" forms;

- subscribing to newsletters.

4. Services Provided by the Website: Purposes and Legal Bases
Below is a summary of the purposes of processing, the legal bases, and the retention periods relating to the main services provided by the Website:

Service	Purpose of processing	Legal Basis	Data retention
4.1  E-commerce	Provide online services for buying and selling Vibram products and ship the purchased products (including payment as a guest).	Art. 6(1)(b): Performance of a contract.	For the duration of the contract, plus the subsequent ordinary statute of limitations period.
4.2 Website Registration	Registration and account creation on the Website (to track orders, sign up for events, etc.).	Art. 6(1)(b): Performance of a contract.	For the duration of the contract, plus the subsequent ordinary statute of limitations period.
4.3 Newsletter	Sending updates on products, promotions, and events.	Art. 6(1)(a): Consent of the data subject.	Until the user revokes their consent.

5. Additional Purposes of Processing
The Data Controller also pursues the following additional specific purposes:

5.1 Compliance with Legal Obligations
- Purpose: to ensure compliance with legal obligations, regulations, and EU legislation to which the Data Controller is subject.

- Legal Basis: Article 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation.

- Retention Period: for the time strictly necessary to enable the Data Controller to fulfil its legal obligations.

5.2 Establishment, Exercise or Defence of Legal Claims (Legitimate Interest)
- Purpose: to establish, exercise, or defend legal claims.

- Legal Basis: Article 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Data Controller.

- Retention Period: limited to the duration of the dispute, until the expiry of the time limits for any appeal.

5.3 Direct Marketing

- Purpose: To keep you informed about promotional, commercial, and advertising initiatives, as well as events.

- Methods: This may be carried out using automated means (e.g., email, text messages, social media).

- Legal basis: Art. 6(1)(a): Consent of the data subject (required).

- Retention period: Until consent is withdrawn. Purchase data used for marketing purposes will be retained for 24 months.

5.4 Profiling

- Purpose: Monitoring of purchased products/services, behavior, and interactions to assess preferences, interests, and consumption habits.

- Legal basis: Art. 6(1)(a): Consent of the data subject (required).

- Retention period: Until consent is withdrawn. Purchase data used for profiling purposes will be retained for 12 months.

6. Recipients and Transfer of Personal Data

Recipients of the Data

The Data may be processed by:

- Independent data controllers: Authorities, supervisory bodies, and public or private entities authorized to request the Data.

- External Data Processors (Art. 28 GDPR): External entities entrusted with processing the Data on behalf of the Company, including (by way of example but not limited to):

- Companies that provide email delivery services.

- Companies that provide services necessary to achieve the stated purposes (IT providers, shipping companies, financial services, media agencies, etc.).

International Data Transfer

The Data may be transferred outside the EU:

- Adequacy Decision: to non-EU countries whose level of data protection has been deemed adequate by the European Commission (e.g., Japan).

- Standard Contractual Clauses (SCCs): Data may be transferred upon signing the SCCs provided for in Article 46(2)(c) of the GDPR (e.g., the U.S. and China).

7. Persons Authorized to Process Data

The Data may be processed by employees and/or contractors of the Data Controller and/or the Data Processor who are assigned to carry out the purposes indicated, have been expressly authorized to process the data, and have received appropriate operational instructions.

8. Withdrawal of Consent and Exercise of Data Subjects’ Rights

Data subjects may contact the Data Controller to exercise their rights:

- By mail: Vibram S.p.A., Via Cristoforo Colombo No. 5, 21014, Albizzate (VA)

- By email: [e-mail] or [e-mail]

Your Rights

Data subjects may request the following from the Data Controller:

- Access to their Data.

- Erasure (deletion) of their Data.

- Rectification of inaccurate Data.

- Completion of incomplete Data.

- Restriction of processing (in the cases provided for in Article 18 of the GDPR).

- Objection to processing (for reasons related to their particular situation, in cases of legitimate interest).

- Data portability (Article 20 of the GDPR): the right to receive the data in a structured, commonly used, and machine-readable format and to transmit it to another data controller (where the processing is based on consent or a contract and is carried out by automated means).

Right to Withdraw Consent

- You have the right to withdraw your consent at any time for marketing and/or profiling and/or data transfer/disclosure purposes.

- If you prefer to be contacted exclusively through traditional means, you may object to processing for marketing purposes, limited to communications via automated means.

Right to lodge a complaint with a supervisory authority

- Data subjects have the right to file a complaint with the competent supervisory authority in the Member State where they habitually reside or work, or in the State where the alleged violation occurred.