01
Scope and legal framework
This notice describes how personal data are processed through the Barbarella Milano institutional website, a brand of Confezioni Cavalleri di Nozza Fabrizio, and through its “Contact” and “Become a retailer” forms. It does not apply to other websites, social platforms or services reached through external links.
It is provided under Articles 12, 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and the Italian Personal Data Protection Code, Legislative Decree 196/2003 as amended.
02
Data controller
03
Personal data we process
Browsing data
The systems used to operate and secure the website may collect IP address, date and time of the request, requested page, response status, browser and device type, and other technical log data. These data are used to deliver the website, protect it, prevent abuse and diagnose faults.
Contact form
Full name, email address, optional telephone number, selected subject and message.
Become a retailer form
Business type, company name, full name, email address, optional telephone number, country or market, city, optional website or social profile, and information entered in the message about the business.
Information provided voluntarily
If you contact us by email, telephone or through other published contact details, we process the data and information you choose to provide. Please do not send special-category personal data — such as health, religious belief or trade-union data — or unnecessary third-party data. If you provide another person’s data, you confirm that you are authorised to do so.
04
Purposes and lawful bases
| Purpose | Lawful basis |
|---|---|
| Deliver the website, maintain security and prevent fraudulent or unlawful use. | The Controller’s legitimate interest in service security and continuity, Article 6(1)(f) GDPR. |
| Reply to enquiries about information, the collection, press or collaborations. | Pre-contractual steps requested by you, Article 6(1)(b) GDPR; for non-contractual enquiries, legitimate interest in managing correspondence, Article 6(1)(f). |
| Assess opportunities with boutiques, showrooms, agents, distributors, wholesalers and e-shops. | Pre-contractual steps, Article 6(1)(b) GDPR, and legitimate interest in developing the retail network, Article 6(1)(f). |
| Comply with legal obligations or public-authority requests. | Legal obligation, Article 6(1)(c) GDPR. |
| Establish, exercise or defend legal claims. | The Controller’s legitimate interest, Article 6(1)(f) GDPR. |
Acknowledging this notice is required to send a form, but it is not consent to marketing, newsletters or profiling. Under the website’s current configuration, form data are not used for these purposes.
05
Required and optional data
Fields marked with an asterisk are necessary to identify and answer the request; the form cannot be submitted without them. Telephone number, website and social profile are optional. You may also contact the company through the direct contact details published on the website.
06
How we process and protect data
Data are mainly processed electronically in accordance with the principles of lawfulness, fairness, transparency, minimisation, accuracy and storage limitation. The Controller applies technical and organisational measures proportionate to the risk to protect personal data against unauthorised access, disclosure, alteration or destruction. No online transmission can, however, be considered entirely risk-free.
07
Recipients and processors
Within the limits of their role, data may be processed by:
- authorised Confezioni Cavalleri personnel and collaborators;
- website hosting, content-delivery, security and technical-maintenance providers;
- email, IT and support providers;
- professional, legal or tax advisers where necessary;
- public authorities and bodies where required by law.
Providers processing data on the Controller’s behalf are appointed as processors under Article 28 GDPR where required. An up-to-date list is available from info@confezionicavalleri.it. Personal data are not sold or made publicly available.
08
Transfers outside the European Economic Area
Some technical providers may use infrastructure or sub-processors outside the European Economic Area. Where this involves a transfer of personal data, the Controller requires a mechanism under Chapter V GDPR, such as an adequacy decision, Standard Contractual Clauses and, where necessary, supplementary safeguards. You may request information about the safeguards through the privacy contact.
09
Retention periods
Normally up to 30 days, except where security, investigations or authority requests require longer retention.
For the time needed to respond and, normally, no longer than 12 months after the last meaningful interaction.
Normally up to 24 months after the last contact, unless a commercial relationship begins.
If a contract is entered into, relevant data become part of the administrative relationship and are kept for statutory periods, generally up to 10 years. Where a dispute arises, necessary data may be kept until it is resolved and all further claim periods have expired.
10
Your rights
Where applicable, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests. Where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
To exercise the rights in Articles 15–22 GDPR, email info@confezionicavalleri.it. The Controller normally replies within one month, subject to the extensions allowed by the GDPR. The Italian Data Protection Authority also provides an official rights guide.
If you believe that processing infringes the law, you may lodge a complaint with the Italian Data Protection Authority or seek a judicial remedy before the competent court.
11
Automated decisions and children
Data collected through the website are not used for solely automated decisions producing legal or similarly significant effects, or for profiling. The website is intended for professional operators and an adult audience and is not designed to knowingly collect children’s data.
13
Updates
This notice may be updated following legal, organisational or technical changes. The latest version is always published on this page together with its revision date.
Last updated: 5 September 2026.