Privacy Policy

PRIVACY NOTICE FOR DIGITAL SERVICES

This Privacy Notice (“Policy”) describes which of your personal data are collected by Tristate Digital SA and / or its affiliated entities (collectively, “We”, “Us”, “Our”), for what purposes and how they are processed in relation to the website https://massimoosti.com/ (the “Website”, the “Store”).

Below you will also find the information you need to exercise your rights under the applicable data protection regulations, such as the Swiss Data Protection Act (“FADP”), the EU Regulation 679/2016 (“GDPR”) and the UK General Data Protection Regulation (“UK GDPR”) and, for residents of the United States, the state privacy laws described in Section 11 below, including the California Consumer Privacy Act, as amended (the “CCPA”) (the “Applicable Data Protection Regulations”).

1. Who processes your data: Data Controllers

Depending on the services used, your personal data is processed by:

Tristate Digital SA (“Tristate Digital”) with registered office at Via Canova 9, Lugano (Switzerland),
Tristate UK Ltd. (“Tristate UK”) 86 Jermin Street, London, SW1Y 6AW (United Kingdom),
Tristate US Inc. (“Tristate US”), 257 Park Avenue South, Suite 303, New York, New York 10010 (United States),

as Data Controller depending on the processing activity (“Data Controller”).

Each relevant entity acts as an independent Data Controller with respect to the specific processing activities they carries out, as further specified in Section 4 for each processing purpose, and provides this Policy pursuant to the Applicable Data Protection Regulations, including, as applicable, Article 13 and 14 of the GDPR, Article 13 and 14 of the UK GDPR and Article 19 of the FADP, and additional statements required by certain U.S. laws.

We take the utmost account of the right to the protection of data subjects’ (“Data Subjects” or “You”) personal data who, for any information in relation to this Policy or to exercise the rights guaranteed to them by the law, may contact each Data Controller at any time: (i) by sending a registered letter with return receipt to operational office of Tristate Digital SA, Via San Martino, n. 16, 6850, Mendrisio (Switzerland); and (ii) by sending an email to the address privacy@eu.tristateww.com.

2. Which data we process - Type of processed data

We may process:

a) Contact and identification data: such as your first name, surname, email address, telephone number, residential address, country of residence, language, gender.

b) Purchase and transactional data: such as information relating to your purchases (including date, amount, products purchased), order details, returns, participation in promotions or contests.

c) Payment and invoicing data: such as billing address and payment details (including credit card information or other payment instruments) necessary to process your orders and manage related administrative and accounting obligations.

d) Browsing and behavioral data: such as information relating to your interaction with our digital services, including IP address, device identifiers, browsing activity, pages visited and interactions, also collected through cookies and similar technologies, including data used for analytics and advertising purposes.

e) Product-related data: such as product codes, description of the product, details relating to purchased or owned products, requests for assistance, description of reported issues, and any information necessary to provide after-sales services, return and related customer support activities.

f) Email tracking data: such as information relating to your interaction with our emails, including whether an email has been opened or clicked, the time of such interactions, the device and email client used, and approximate location derived from the IP address.

3. Where do we get your data - Data collection methods

Your personal data is collected through the following methods:

a) Directly from you: for example when you make a purchase on the Website, request after-sales services, contact customer care, subscribe to newsletters, participate in surveys, contests or promotions, or otherwise provide your data by filling in forms.

b) Through the use of digital services: when you interact with our online channels, including the Website and dedicated platforms, we may automatically collect certain information through cookies and similar technologies, including data relating to your browsing activities, device, and interactions with our websites and communications.

c) In connection with the services you request: including when you request, after-sales or customer support services, by providing information relating to your product and your request (e.g. product details, description of issues, delivery and return information).

d) From third parties indicated by you: for example, when you provide us with personal data of third parties (such as delivery recipients), you acknowledge that you are responsible for ensuring that such data have been collected and shared in compliance with applicable law.

4. Why we process your data and the related legal basis

We process your personal data for the following purposes:

a) Website Navigation: to enable you to navigate Website, as well as to obtain anonymous statistical information on the use of the Website and to ensure its proper functioning. The provision of this data is necessary to allow the Data Subject to access the content of the Website while browsing it. Failure to provide such data will prevent the Data Subject from browsing the Website.

The Data Controller for this purpose is Tristate Digital.

The legal basis for the processing is the performance of a contract to which the Data Subject is party or for the implementation of pre-contractual measures taken at the Data Subject’s request (Article 6(1)(b) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).

b) Contractual and service-related purposes: to help you complete your purchases on the Website, carrying out organizational, administrative, financial and accounting activities necessary to fulfil our contractual and pre-contractual obligations, receive customer care and after-sales support, and access to maintenance services (such as product collection and return). For these activities, We process your personal data as necessary to perform a contract with you or to take steps at your request prior to entering into a contract. These purposes also include performing our obligations under the General Terms and Conditions [hyperlink][MS2.1] of services published on the Website and accepted by You upon your purchase, verifying your identity, including by validating your email address, and handling your specific requests. We may also (i) contact You with service-related communications, including notifications concerning the services You use and updates to the General Terms and Conditions mentioned above and (ii) use your data to keep You updated on things that are relevant to your shopping experience, such as notifying You when a product becomes available, where this is necessary to provide the service You requested, and reminding You about items left in your shopping cart, based on our legitimate interest in facilitating your purchase experience and improving our services.

The Data Controller for these purposes is the entity acting as the seller. Specifically, the Data Controller is Tristate Digital, except for purchases made through the UK and US sections of the Website, for which the Data Controller are Tristate UK and Tristate US, respectively.

The legal basis for this processing, where applicable, is the pursuit of the Data Controller’s legitimate interest in facilitating your purchase experience and improving its services (Article 6(1)(f) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).

c) Administrative, accounting and legal purposes: to comply with obligations arising from applicable laws and regulations or imposed by competent authorities, (including tax, accounting and reporting obligations, as well as responding to requests from Data Subjects to access their personal data), to manage administrative processes connected to our business activities, and to prevent fraud, unlawful conduct or misuse of our services, as well as to protect and enforce our rights. For these purposes, we process your personal data where necessary to comply with a legal obligation to which we are subject.

The legal basis for the processing is its necessity for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations).

d) Customer care and support purposes: to handle your requests, provide assistance through customer service channels, respond to inquiries (including product availability or service-related requests), and manage interactions related to purchases, services or accounts. For these purposes, we process your personal data as necessary to perform a contract with you or to take steps at your request prior to entering into a contract.

The Data Controller for these purposes is the entity to which your customer care or support request is addressed, where the request relates to the purchase of a product or the management of a purchase falling within that entity’s responsibility. Specifically, the Data Controller is Tristate Digital, except for purchases made through the UK and USA sections of the Website, for which the Data Controller are Tristate UK and Tristate USA, respectively.

e) Marketing purposes: to send you newsletters, promotional communications and information about products, services, initiatives or events offered by the Data Controller, including offers, promotions and commercial opportunities through email or other communication channels (in particular, whatsapp).

The Data Controller for these purposes is Tristate Digital.

The legal basis is the provision of Data Subject of consent to the processing of his/her personal data for this specific purpose (Article 6(1)(a) of the GDPR and of the UK GDPR, and the other Applicable Data Protection Regulations). Providing consent is optional.

f) Profiling and personalization purposes: to analyze your preferences and consumption habits, purchase history and interactions with our services in order to better understand your interests, determine your consumer profile and provide you with personalized communications and offers, including through automated processing activities (profiling).

The Data Controller for these purposes is Tristate Digital.

g) Soft spam purposes (existing customers): to send you communications relating to products and services similar to those you have previously purchased or requested, using the contact details collected in the context of a sale or negotiations for a sale, in accordance with applicable data protection and electronic communications laws. Such communications will concern our own products and services and will be sent only where you were duly informed of this use at the time of data collection and were given the opportunity to object.

The Data Controller for this purpose is the entity that has or has had a direct contractual relationship with You as the seller, to the extent permitted by the laws applicable to each group company to the relevant communications. Specifically, the Data Controller is Tristate Digital, except for purchases made through the UK and USA sections of the Website, for which the Data Controller are Tristate UK and Tristate US, respectively.

For Data Subjects in the European Union, this processing is carried out without your prior consent pursuant to the “soft spam” exemption provided for under Article 13(2) of Directive 2002/58/EC, as amended (“ePrivacy Directive”), as implemented by the applicable national legislation and subject to the conditions set out therein. For other jurisdictions, reference is made to the relevant provisions of the Applicable Data Protection Regulations, where applicable.

You may object to the processing at any time (“opt-out”), either to receiving further soft spam emails or only to the use of tracking pixels embedded in those emails, through the methods described in this Policy.

h) Use of tracking pixels in email communications (for non-technical purposes): to use tracking pixel in emails – which are sent to the Data Subject for the marketing, profiling and soft spam purposes as referred to in the above paragraphs e), f), g) - to carry out individual measurement and analysis of the open rate of the emails sent to the Data Subjects. The information collected via tracking pixels will be used, more specifically, to evaluate and improve the performance of marketing campaigns and newsletter communications on the basis of observed behaviour (by changing the subject line of messages in the event of a low open rate or by improving their relevance, readability or appeal; by adjusting the frequency or ceasing to send messages based on the recipient’s expressed interest in the messages received, etc.).

The Data Controller for the use of tracking pixels in emails sent for consent-based marketing or profiling purposes is Tristate Digital. For the use of tracking pixels in emails sent for soft spam purposes, the Data Controller is the relevant Group company acting as the seller of the product, as specified in the preceding paragraphs.

For Data Subjects in the European Union, the use of tracking pixels for the purposes described herein is subject to your prior consent pursuant to Article 5(3) of ePrivacy Directive, as implemented by the applicable national legislation and subject to the conditions set out therein.

Based on the guidance provided by the Italian Data Protection Authority (Garante per la protezione dei dati personali), the specific consent you provide for the marketing and profiling purposes described in the preceding paragraphs also covers the use of tracking pixels embedded in the relevant promotional emails, as described in this privacy policy. According to the French Data Protection Authority (CNIL), a single consent may be obtained for the receipt of promotional emails and the use of tracking pixels embedded in those emails where, as in our case, the two purposes are closely connected because the pixels contribute directly to the personalisation of those communications, including by tailoring their content or adjusting their frequency based on your interactions.

For further information on withdrawing your consent on a granular basis, including only in relation to the use of tracking pixels, or exercising your right to object, please refer to the paragraphs on marketing, profiling and soft spam above and to Section 10 of this Policy.

i) Behavioral advertising and retargeting purposes: to display advertisements relating to our products and services based on your browsing behavior and interactions with our Website, digital platforms and inferred preferences from those activities, including cookies, pixels and similar technologies deployed on the Website and digital platforms, and to deliver targeted advertising across digital channels, subject to your consent where required.

The Data Controller, where your personal data is processed for these purposes, is Tristate Digital. For further information about the processing activities described in this paragraph, please refer to our Cookie Policy at the following link: https://massimoosti.com/services/cookies/.

j) Market research and consumer analytics purposes: to carry out statistical analyses, customer satisfaction surveys and market research activities, including the analysis of purchasing behavior, preferences and trends, in order to improve our products, services and commercial strategies, in aggregated form or, where necessary, identifiable form, based on your consent or our legitimate interest, as applicable.

The Data Controller, where your personal data is processed for these purposes, is Tristate Digital.

k) Service quality and feedback purposes: to send you surveys and collect feedback regarding your experience with our products and services (including post-purchase feedback or interaction with Our customer care), in order to improve our offering. This processing is carried out on the basis of Our legitimate interest in monitoring and improving the quality, effectiveness and customer experience of our products and services. You may object at any time, including through the opt-out mechanism provided in each communication or through the procedures set out in section 10 of this Policy. Where you exercise your right to object, we will cease further processing of your personal data for these purposes, unless we demonstrate compelling legitimate grounds for continuing the processing which override your interests, rights and freedoms, or where the processing is necessary for the establishment, exercise or defence of legal claims.

The Data Controller where your personal data is processed for these purposes, is Tristate Digital.

The legal basis for this processing is the pursuit of the Data Controller’s legitimate interest in monitoring and improving the quality and effectiveness of its products and services and the associated customer experience (Article 6(1)(f) of the GDPR and the UK GDPR, and the other Applicable Data Protection Regulations).

5. Nature of the provision of personal data

The provision of your personal data is:

a) Necessary for the provision of core services: such as the creation and management of your account, the purchase of products on the Store, access to customer care and after-sales services and the fulfillment of related administrative, accounting and legal obligations. Failure to provide such data may result in the impossibility of accessing or using this service.

b) Optional for marketing and profiling purposes: such as receiving promotional communications where applicable containing tracking pixels, newsletters, personalized offers, and participating in surveys or feedback activities. Refusal to provide such data or to give your consent will not affect your ability to access core services. You may withdraw your consent and/or object to the processing at any time, without affecting the lawfulness of processing carried out prior to such withdrawal/object.

6. Data retention

Your personal data will be retained for periods that are proportionate to the purposes for which they are processed and in accordance with applicable data protection laws. In particular:

a) Website Navigation: the browsing data processed to enable the Data Subject to browse the Website are not retained for as long as necessary for that purpose.

b) Marketing data (e.g. for sending newsletters and promotional communications) are retained for a period of up to 24 months from their collection, unless you withdraw your consent earlier.

c) Soft spam data (existing customers) are retained for a period of up to 24 months from the last purchase, unless you object to this processing.

d) Profiling, personalization data and behavioral advertising are retained for a period of up to 12 months from their collection, unless you withdraw your consent earlier.

e) Data processed for administrative, accounting and legal purposes may be retained for longer periods, where required by applicable laws and regulations (e.g. tax and accounting obligations).

f) Use of tracking pixels in email communications (for non-technical purposes): Personal data collected via tracking pixels used by the Controller in emails, subject to the Data Subject’s prior consent for marketing, profiling and soft spam purposes (and without prejudice to any granular withdrawal made by the Data Subject), will be processed for for as long as necessary to that purpose.

g) Data related to after-sales services are retained for the time strictly necessary to provide the requested service and to manage any related requests, as well as for any additional period necessary to protect our rights in case of disputes.

h) Service quality and feedback purposes: the association between the responses provided through the survey and the identity of the relevant individual will be retained for the period strictly necessary to identify any issues and areas for improvement, and improve the quality, effectiveness and overall customer experience associated with our products and services.

At the end of the applicable retention period, your personal data will be deleted or anonymised, unless further retention is necessary for other lawful purposes, including compliance with legal obligations or the establishment, exercise or defence of legal claims. Where anonymisation is carried out, your personal data will be processed to produce anonymous information, in accordance with the purposes, legal bases and retention periods specified in this Policy for the relevant processing activity. Once effectively anonymised, the resulting information will no longer constitute personal data and will therefore fall outside the scope of the GDPR.

7. Where your data are processed – Data transfers

Your personal data may be processed and stored at the premises and IT systems of the Data Controllers and their service providers, located within the European Union, Switzerland, UK and, where applicable, in countries outside these jurisdictions.

In particular:

a) Personal data are primarily processed within the EU and Switzerland, where the Data Controllers and their main service providers are established.

b) In certain cases, your data may be transferred to and processed in countries outside the EU/Switzerland, including where our service providers, IT infrastructure providers, logistics partners or other entities involved in the provision of our services (including e-commerce, customer care services) are located.

c) Any such transfers will be carried out in compliance with the Applicable Data Protection Regulations and will rely to appropriate safeguards, as applicable, including:

- adequacy decisions, regulations or determinations issued by the competent authorities (e.g. the European Commission, the UK Secretary of State, the Swiss Federal Council, as applicable), or

- appropriate safeguards recognised under the applicable legal framework such as standard contractual clauses, binding corporate rules, the UK International Data Transfer Agreement (IDTA), the UK International Data Transfer Addendum to the European Commission’s standard contractual clauses,or other mechanisms provided for under applicable law.

Where required under the Applicable Data Protection Regulations, we will assess the level of protection afforded to the transferred personal data and implement supplementary measures as necessary.

d) You may request further information on transfer mechanisms and obtain a copy of the safeguards adopted by contacting us (i) by sending a registered letter with return receipt to the operational office of Tristate Digital SA, Via San Martino, n. 16, 6850, Mendrisio (Switzerland), Attn: Privacy Department; and (ii) by sending us an email to the address at privacy@eu.tristateww.com

8. Who we share your data with – Recipients

Your personal data may be shared with the following categories of recipients, in accordance with applicable data protection laws:

a) Service providers: such as IT service providers, hosting providers, platforms managing the Store and digital services, customer care providers, marketing and profiling service providers, as well as consultants (e.g. legal, tax and accounting), who process personal data on our behalf as data processors under appropriate contractual arrangements including advertising networks and analytics providers.

b) Advertising networks and platforms: third-party providers that support the delivery, management and measurement of advertising campaigns across digital channels (e.g. social media platforms, search engines and advertising networks). These entities may process personal data such as online identifiers, browsing data and interaction data, collected through cookies, pixels and similar technologies, in order to display targeted advertisements, perform retargeting activities and measure the effectiveness of advertising campaigns, in accordance with your preferences and the choices expressed through our consent management tools.

c) Group companies: including companies belonging to Tristate’s group, operating in the fashion and retail sectors, and selected distributors or partners, which may process your data in order to provide you with integrated services and a consistent customer experience across online and offline channels (e.g. account management and purchase history sharing). Where such group companies and / or selected distributors or partners, process your personal data on behalf of the Data Controller, they will be appointed as Data Processors in accordance with the Applicable Data Protection Regulations and will act on the documented instructions of the relevant Data Controller.

d) Payment service providers and banking institutions: for the management of payments, transactions and related financial operations, where applicable.

e) Public authorities and third parties if required by law: including administrative authorities, judicial authorities or other entities, where disclosure is necessary to comply with legal obligations, prevent unlawful activities, or protect and enforce our rights or the rights of third parties.

f) Other recipients in the context of corporate transactions: such as legal advisors or consultants, in case of extraordinary transactions (e.g. mergers, acquisitions or reorganizations), in compliance with applicable law.

9. Minors

Our services, including the Store and after-sales services, are not intended for individuals under 18 years of age, but rather for adults. We do not knowingly collect personal data from anyone under 16 years of age, and we do not knowingly sell or share (as those terms are defined under the CCPA) the personal data of consumers under 16 years of age.

If you are a parent or legal guardian and you believe that a minor has provided us with personal data, you may contact us at any time using the contact details indicated in this Privacy Policy. We will take appropriate steps to verify the situation and, where necessary, promptly delete such data in accordance with Applicable Data Protection Regulations.

10. Your rights

You may at any time exercise your rights under the Applicable Data Protection Regulations, including the right to obtain confirmation as to whether or not your personal data are being processed and, where that is the case, to access such data and verify their origin and accuracy.

In particular, in accordance with applicable law, we hereby inform the Data Subjects that they have:

- the right to withdraw consent (in cases where processing is based on consent), without this affecting the lawfulness of processing based on consent prior to withdrawal. In particular, the Data Subject who has consented to the processing of personal data for purposes referred to in the preceding paragraphs e) and f) (consent which also includes the use of tracking pixels for non-technical purposes, which the Data Controller includes in such communications) may, at any time, withdraw the choices made, including on a granular basis. In other words, the Data Subject may: i) withdraw the consent given, thereby preventing the future receipt of further communications for marketing purposes; or ii) choose to withdraw consent only partially, with regard solely to the receipt of tracking pixels within such communications. Data Subject may withdraw their consent by contacting Us at the addresses provided in this paragraph and/or by clicking on the link provided in each communication;

- the right to access their personal data;

- the right to data portability (the right to receive all personal data provided knowingly and actively by the Data Subject, as well as personal data collected directly from the Data Subject using the Website or his/her device, in a structured, commonly used, and machine-readable format);

- when one of the cases provided for by law occurs, the right to limitation of the processing of personal data;

- the right to rectification (obtain from the Controller the rectification of inaccurate personal data concerning the Data Subject);

- the right to have incomplete personal data completed (including by providing a supplementary statement);

- the right to erasure of personal data concerning Data Subjects when one of the reasons provided for by law applies;

- the right to object to processing of personal data for direct marketing purposes, including profiling to the extent that it is related to such direct marketing. For soft spam emails, Data Subjects may likewise object to receiving further emails or only to the use of tracking pixels, using the same methods described above. Following the exercise of the right to object to the sending of promotional communications by email, it is possible that, for technical and operational reasons (i.e., the formation of contact lists already completed shortly before the receipt by the Controller of the request for objection) the Data Subject will continue to receive some further promotional messages. If you continue to receive promotional messages after 24 hours of exercising your right to object, please report the problem to the Data Controller.

- if they believe that the processing that concerns them violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State where Data Subjects habitually reside, where they work, or where the alleged violation occurred). The list of other Supervisory Authorities located in other Member States can be found on the website of the European Data Protection Board, at the following link. In the United Kingdom the Authority is the Information Commissioner’s Office (ICO) which can be contacted through the following link. In Switzerland the Authority is the Federal Data Protection and Information Commissioner (FDPIC) which can be contacted through the following link.

To exercise your rights or request further information, you may contact us (i) by sending a registered letter with return receipt to the operational office of Tristate Digital SA, Via San Martino, n. 16, 6850, Mendrisio (Switzerland), Attn: Privacy Department; and (ii) by sending us an email to the address privacy@eu.tristateww.com

11. United States Privacy Rights

This Section applies to residents of California and of other US states whose privacy laws provide the rights described below, and supplements the rest of this Privacy Notice. For purposes of those laws, the entities identified in Section 1 are the “business” or “controller” responsible for the personal data described in this Privacy Notice. If this Section conflicts with any other part of this Privacy Notice, this Section controls for US residents to the extent of the conflict.

The descriptions below summarize rights available under US state privacy laws currently in effect. These rights are subject to conditions and exceptions and may not apply to all data or to all of our processing activities.

a) Categories of personal information: in the last 12 months, we have collected the categories of personal data described in Section 2, which correspond to the following categories under the CCPA: identifiers (such as name, email address, telephone number, and postal address); customer records and commercial information (such as purchases, orders, returns, , and the contents of communications you exchange with us, including through customer service channels); payment information (collected and processed through our payment service providers); internet or other electronic network activity information (such as browsing activity and interactions with the Website, collected through cookies and similar technologies); approximate geolocation inferred from IP address; and inferences drawn from the foregoing to reflect preferences. We collect this information from the sources described in Section 3, use it for the purposes described in Section 4, and retain it as described in Section 6. We do not use or disclose sensitive personal information for purposes that require a right to limit under the CCPA.

b) Disclosure, “sale,” and “sharing”: we disclose personal data to the categories of recipients described in Section 8 for business purposes. We do not sell personal data in exchange for money. However, our use of advertising cookies, pixels, and similar technologies, as described in Sections 4 and 8, may constitute “sharing” of personal information for cross-context behavioral advertising, and in some states “selling” or processing for targeted advertising, under applicable law. The categories involved are identifiers and internet or other electronic network activity information, and the recipients are advertising networks and analytics providers.

c) California: if you are a California resident, you have the right to: (i) know and access the personal information we have collected about you, including the categories of personal information, the categories of sources, the business or commercial purposes for collecting, “selling,” or “sharing” it, the categories of third parties to whom it is disclosed, and the specific pieces of personal information collected, including in a portable format; (ii) correct inaccurate personal information; (iii) delete personal information, subject to legal exceptions; (iv) opt out of the “sale” or “sharing” of personal information; and (v) not receive discriminatory treatment for exercising these rights. This Privacy Notice, including this Section, is our notice at collection for California residents.

d) Virginia, Indiana, Kentucky, Montana, Nebraska, New Hampshire, New Jersey, Rhode Island, Tennessee, and Texas: if you are a resident of one of these states, you have the following rights: confirm whether we process your personal data and access it; correct inaccuracies; delete personal data, subject to exceptions; obtain a portable copy of personal data you provided; opt out of (i) targeted advertising, (ii) the sale of personal data, and (iii) profiling in furtherance of decisions that produce legal or similarly significant effects; and appeal our decision on a request, as described in paragraph n) below.

e) Colorado: Colorado residents have the rights described in paragraph d) above. Colorado also requires recognition of certain opt-out preference signals, which we honor as described in paragraph n) below.

f) Connecticut: Connecticut residents have the rights described in paragraph d) above. Connecticut also requires recognition of certain opt-out preference signals, which we honor as described in paragraph n) below.

g) Delaware: Delaware residents have the rights described in paragraph d) above. Delaware also requires recognition of a universal opt-out mechanism, which we honor as described in paragraph n) below.

h) Florida: Florida residents have rights to access, correct, delete, and obtain a portable copy of personal data, and to opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects. Florida law also provides additional opt-out rights related to certain sensitive data and certain collection through voice recognition or facial recognition features.

i) Iowa: Iowa residents have rights to access and delete personal data, to obtain a portable copy of personal data they provided, and to opt out of the sale of personal data and of targeted advertising, and may appeal our decision on a request.

j) Maryland: Maryland residents have the rights described in paragraph d) above. Maryland law also provides a right to obtain a list of the categories of third parties to which we have disclosed personal data.

k) Minnesota: Minnesota residents have the rights described in paragraph d) above. Minnesota law also provides additional rights relating to certain profiling decisions, including the right to question the result of certain profiling and obtain an explanation.

l) Oregon: Oregon residents have the rights described in paragraph d) above. Oregon law also provides a right to obtain a list of the specific third parties to which we have disclosed personal data.

m) Utah: Utah residents have rights to access and delete personal data, to obtain a copy of personal data they provided, to correct inaccuracies, and to opt out of targeted advertising and the sale of personal data.

n) How to exercise your rights: you may submit access, correction, and deletion requests by emailing us at privacy@eu.tristateww.com or by using the Contact form on the Website. You may opt out of “sale,” “sharing,” and targeted advertising through the “Do Not Sell or Share My Personal Information” link on the Website and by managing your preferences through our cookie consent tool, and we honor opt-out preference signals, such as the Global Privacy Control, as required by applicable law. We will verify your request using information associated with your account or orders and may ask for additional information where necessary to verify your identity. You may designate an authorized agent to submit a request on your behalf; we may require proof of the agent’s authority and verification of your identity. We will respond to verifiable requests within 45 days, and we may extend that period by an additional 45 days where reasonably necessary, with notice to you. If we decline to act on your request, you may appeal by replying to our response, and we will respond to appeals within 45 days, or as otherwise required by applicable law. If your appeal is denied, we will provide information about how to contact your state Attorney General or other relevant regulatory authority.

o) Data minimization: we limit our collection of personal data to what is reasonably necessary and proportionate to the purposes described in this Privacy Notice. Where required by applicable law, we conduct data protection assessments for processing activities that present heightened risks to consumer privacy, including targeted advertising, the sale of personal data, the processing of sensitive data, and the use of certain automated decision-making technologies.

12. Updates

We may update this Policy from time to time in order to reflect changes in applicable laws or regulations, as well as to consider modifications to our services, processing activities or internal organizational structure.

In case of material changes, we will provide appropriate notice for you, where required by applicable law, for example through our website or other communication channels. The updated version of the Policy will be made available on our digital platforms and will indicate the date of the latest revision.

We encourage you to periodically review this Policy to stay informed about how we process your personal data.

Last update of the current Privacy Notice on 28/10/2026