B2B Privacy Policy

With this privacy notice, Elle Group srl (hereinafter "the Company") informs data subjects that — pursuant to and for the purposes of Article 13 of European Regulation 2016/679 on the protection of personal data ("GDPR") — the personal data of company representatives and users registered to the B2B reserved area will be processed through electronic and manual means, in Italy and abroad.

This notice is provided for the B2B reserved area of the Site (hereinafter the "Site" or the "B2B Portal"), reserved for registered wholesale/reseller customers, and not for any other websites that may be accessed via links.

This notice is drafted on the basis of the principle of transparency and all the elements required by the GDPR, and is organised into individual sections to make it quicker, easier and more straightforward to read (hereinafter the "Notice").

1. Data Controller

The Data Controller (hereinafter the "Controller") is Elle Group s.r.l, with registered office at Via del Cantone, 31-35, Sesto Fiorentino, FI - 50019, Italy, registered with the Florence Companies Register under number 05662670487.

For any request concerning the processing of personal data, the Controller may be contacted at [email protected].

To confirm — corporate registration details unchanged since 2021; name/contact of the DPO, if appointed (if not appointed, remove this reference).

2. Categories of personal data processed

As the Portal is reserved for professional operators (resellers, wholesalers, points of sale), in addition to the personal data of the user accessing the Site, the Company also processes data relating to the business/undertaking on whose behalf the user acts as a representative. In particular:

  • Identification and contact details of the company representative: first name, last name, role/position within the company, business e-mail address, telephone number.
  • Identification data of the customer business: company name, legal form, registered/operating office, VAT and/or tax number, REA number, billing and shipping address.
  • Data relating to the business relationship: commercial terms applied, order history, turnover, agreed payment terms and methods and, where applicable, creditworthiness/solvency information collected for the purposes of managing any credit line granted.
  • Browsing data: IP addresses, access logs, device and browser identifiers, data collected through cookies and similar technologies (see Section 5).
  • Payment-related data: details necessary for processing payment, managed directly by the payment service providers listed in Section 5 (the Company does not store full payment card details).

To confirm — whether the Company actually carries out creditworthiness/credit-line checks through third parties (e.g. commercial information companies); if so, specify the party and the methods here, otherwise remove this reference.

3. Legal basis and purposes of processing

Unlike a generic consumer e-commerce site, the processing of personal data within the B2B Portal is based primarily on the performance of the supply contract in place between the Company and the customer business (Art. 6(1)(b)) and on compliance with legal obligations (Art. 6(1)(c)) — e.g. tax, accounting and invoicing obligations. The data subject's consent (Art. 6(1)(a)) is instead the specific legal basis only for the optional purposes described in Sections 6 and 7 (marketing, profiling, newsletter) and for non-technical cookies (see Section 5). For security, fraud-prevention and technical monitoring purposes of the Site, the legal basis is the Controller's legitimate interest (Art. 6(1)(f)) in ensuring the correct and secure operation of the Portal.

Data subjects may always ask the Controller to clarify the specific legal basis of each particular processing activity.

4. Purposes related to the Site and the B2B business relationship

Personal data is processed for the following purposes:

a) managing the business relationship and contractual obligations: creation and management of the B2B account, processing and management of orders, commercial terms, invoicing, management of logistics and shipments, customer support;

b) technical operation of the Site: the computer systems and software procedures used to operate the Site acquire, in the course of their normal operation, certain data whose transmission is implicit in the use of Internet communication protocols (IP addresses, URIs of the resources requested, time of the request, user agent, server response status), used to: derive anonymous statistical information on Site usage, carry out technical administration of the Site, and ascertain liability in the event of computer crimes. Such data is deleted or anonymised as soon as the technical purpose has been fulfilled;

c) administrative and accounting purposes: internal organisational activities and performance of contractual and pre-contractual obligations;

d) legal obligations: compliance with obligations imposed by law, by an authority, by a regulation or by European legislation (e.g. retention of tax/accounting documents).

Providing data for the purposes indicated above is necessary to establish and manage the B2B business relationship: failure to provide such data makes it impossible to activate the B2B account and to process orders.

5. Third-party providers, cookies and other tracking technologies

To provide the Service and for the purposes described in this Notice, the Company relies on third-party providers, some of which act as independent data controllers for their own respective purposes. The providers are grouped below by functional category; the detailed list of cookies and active third parties, together with their respective purposes and duration, is available in the Site's Cookie Policy.

  • Payments and fraud prevention (necessary for contract performance/legitimate interest): Stripe, PayPal (including PayPal Braintree and Payflow), Mollie, Klarna, Cardinal Commerce/Cardinal Cruise (3-D Secure authentication), Adobe Commerce Payment Services.
  • Web analytics and Site usage statistics (legitimate interest for aggregate analytics; consent for individual profiling): Google Analytics (GA4), Google Tag Manager, PostHog.
  • Advertising and remarketing (consent): Google Ads/DoubleClick, Meta/Facebook Pixel, Pinterest, AddThis, Adobe Experience Cloud (Adobe Analytics/Target/Audience Manager).
  • Technical support, security and application monitoring (legitimate interest): New Relic (performance monitoring), Sentry (application error tracking), Cloudflare (content protection and delivery), Google reCAPTCHA (prevention of automated abuse).
  • Embedded multimedia content (consent/technical legitimate interest): YouTube, Vimeo, Google Maps, Adobe Fonts (Typekit).
  • Social networks (consent): Facebook/Meta, Instagram, Pinterest.
  • Cookie consent management: the collection of cookie preferences is managed via a Consent Management platform.

To confirm — name of the CMP (Consent Management Platform) in use; a technical domain (avada.io) not reliably attributable to a known service for this stack has also been detected — verify whether it is an active service to be declared or a configuration to be removed.

Information on the individual cookies used on this Site is available on the Cookie Policy page.

6. Further purposes: marketing, direct sales and profiling

With the User's free, revocable and optional consent, personal data may also be processed by Elle Group srl for marketing purposes, i.e. for sending advertising or direct-sales material, conducting market research or commercial communications (including personalised communications where specific consent is given) using automated contact methods (e-mail, other remote communication systems such as fax, SMS, MMS, WhatsApp) and traditional methods (postal mail, telephone via an operator).

With the User's free, revocable and optional consent, personal data (including personal and contact details, as well as information on the details of orders placed through the Portal) may also be processed for the purposes of analysis and profiling, in order to reconstruct purchasing habits and send commercial offers consistent with the profile identified.

If consent is not given, the ability to use the B2B account will not be affected in any way, but it will not be possible to pursue the marketing and/or profiling purposes described above.

The User may withdraw consent at any time, by making a request using the methods indicated in Section 11, or by clicking the appropriate link included in each promotional e-mail.

Withdrawal of consent does not affect the lawfulness of processing based on consent given before the withdrawal.

7. Newsletter

For the newsletter service, the User is asked, in a separate box, to provide certain personal data (e-mail address, personal details). The legal basis for this processing is the User's request to receive the newsletter. In the same box, the consent referred to in Section 6 may also be freely and optionally given.

Providing data for this purpose is optional but necessary: failure to provide it makes it impossible to receive the newsletter service.

The User may unsubscribe at any time by clicking the appropriate link included in each e-mail, and will receive confirmation of the unsubscription.

8. Judicial and extrajudicial protection

The Controller may process personal data, where necessary, to establish, exercise or defend its rights in judicial and extrajudicial proceedings. The legal basis is the Controller's legitimate interest in its own protection.

9. Disclosure and transfer of personal data

Personal data is processed exclusively by authorised persons and by persons appointed as Data Processors, in compliance with the GDPR. Data may be disclosed to the third-party providers listed in Section 5, to companies specialising in the management of customer data archives and to marketing agencies, on the basis of appropriate data processing agreements. Personal data may also be disclosed to public bodies or judicial authorities where required by law.

Personal data is processed within the territory of the European Union. Several providers listed in Section 5 (including, by way of example, Google, Meta, Adobe, New Relic, Sentry, PostHog, Stripe, PayPal) are based, or carry out processing, outside the European Economic Area, in particular in the United States. In such cases, the transfer of data is governed in accordance with Chapter V of the GDPR, on the basis of European Commission adequacy decisions (where applicable, e.g. the EU-U.S. Data Privacy Framework) and/or Standard Contractual Clauses and additional appropriate technical and organisational safeguards. Further details on the safeguards adopted by each provider are available by contacting the Controller.

10. Data retention period

Data relating to the B2B business relationship (orders, invoicing, accounting and tax documentation) is retained for the period required by applicable civil and tax law (as a rule, 10 years from the termination of the relationship, subject to any different terms provided by law). Data processed for marketing and profiling purposes is retained, unless consent is withdrawn, for a period not exceeding what is necessary to achieve the purposes. Data may be retained for a further period should the need arise to manage disputes or litigation.

11. Withdrawal of consent

The data subject has the right to withdraw consent given at any time, in whole or in part, without affecting the lawfulness of processing based on consent given before the withdrawal. To withdraw consent, the data subject may contact the Controller at the address indicated in this Notice, or, if registered on the Site, access their personal profile and change the consents given.

12. Data subject's rights

Pursuant to Articles 15 et seq. of the GDPR, the data subject may at any time exercise the following rights:

  • to obtain confirmation of the existence of processing and access to the data and related information (purposes, categories of data, recipients, retention period);
  • rectification of inaccurate data and/or completion of incomplete data;
  • erasure of data, in the cases provided for by the GDPR;
  • restriction of processing in the cases provided for by applicable law;
  • portability of the data provided to the Controller, or a request for direct transmission to another controller;
  • objection to processing on grounds relating to the data subject's particular situation, as well as for marketing and profiling purposes.

These rights may be exercised by writing to [email protected], enclosing a copy of an identity document. In any case, the data subject always has the right to lodge a complaint with the competent supervisory authority (Garante per la Protezione dei Dati Personali), pursuant to Art. 77 GDPR.

13. KLARNA Terms and Conditions

Buy now and pay later at your favourite stores thanks to Klarna. At checkout, you can split the total purchase amount into three convenient instalments.