Dear Interested Party, Braveshirts srl protects the privacy of Users. Any data communicated by the User through the Website will be processed with the utmost care and with all tools aimed at ensuring its security, in full compliance with current legislation. We wish to inform you that the "European Regulation 2016/679 concerning the protection of natural persons with regard to the processing of personal data, as well as the free movement of such data" (hereinafter "GDPR") provides for the protection of natural persons with regard to the processing of personal data as a fundamental right. Pursuant to Article 13 of the GDPR, therefore, we inform you that:

DATA CONTROLLER.

the data controller is Braveshirts srl, with registered office in via Godi 15, 28024 Gozzano (NO), P.IVA 02617930033.

CATEGORIES OF DATA.

The following may be subject to processing:

1. Data collected automatically. The computer systems and applications dedicated to the operation of this website detect, during their normal operation, some data (the transmission of which is implicit in the use of Internet communication protocols) potentially associated with identifiable users. The collected data includes IP addresses and domain names of the computers used by users connecting to the site, URI (Uniform Resource Identifier) addresses of the requested resources, the method used in submitting the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters concerning the operating system, the browser and the IT environment used by the user, internet service provider (ISP) name, date and time of visit, visitor's origin web page (referral) and exit.
2. Data provided voluntarily by the user. The voluntary and explicit sending of e-mails to the addresses indicated in the different access channels of this site does not require consent and entails the acquisition of the sender's address and data, necessary to respond to requests, as well as any other personal data included in the message. Such data are understood to be voluntarily provided by the user at the time of requesting the service. By inserting a comment or other information, the user expressly accepts the privacy policy. Conversely, specific summary information will be reported or displayed on the pages of the site prepared for particular services on request (form). The user must therefore explicitly consent to the use of the data reported in these forms to be able to send the request.

   Withdrawal and return requests:

   The website provides users with a function dedicated to exercising the right of withdrawal and managing return requests. The personal data entered by the user through this function (such as name, surname, email address, order number, and purchase-related information) are processed exclusively for managing the request, fulfilling contractual and legal obligations, and for any refund or replacement of products.

   The legal basis for processing is the performance of the contract and the fulfillment of legal obligations to which the Data Controller is subject, pursuant to art. 6, par. 1, lett. b) and c) of Regulation (EU) 2016/679.

   The data will be stored for the time necessary to manage the practice and subsequently for the period provided by the applicable civil, tax, and consumer protection regulations.

3. Cookies. The site uses cookies. The data collected through cookies can be used to access parts of the site or for statistical purposes or to make the browsing experience more pleasant and more efficient in the future, trying to evaluate user behavior and modify the content offer proposal based on their behavior. For more information, a specific Cookie Policy is available.

PURPOSE OF DATA PROCESSING AND LEGAL BASIS:

The processing of your data has the following purpose and legal basis:

1. For automatically collected data, the legal basis is the legitimate interest of the controller and the purpose is to guarantee and improve the web browsing experience.
2. For data voluntarily provided by the user, the legal basis is specified in the individual privacy policies provided, depending on the various services requested provided through the site.
3. For cookies: refer to the specific Cookie Policy.

PROMOTIONAL COMMUNICATIONS VIA WHATSAPP

Should the User choose to voluntarily provide their phone number to subscribe to the WhatsApp Marketing service, Braveshirts Srl may use this contact exclusively for sending promotional communications, updates on collections, offers, and brand initiatives of Camiciecoraggiose.

Data processing takes place on the basis of the User's explicit consent, pursuant to art. 6, par. 1, lett. a) of the GDPR, expressed at the time of subscribing to the service.

The User may revoke consent at any time previously given through the direct unsubscribe link present in every message received on WhatsApp, or by writing to the Data Controller's email address indicated in this privacy policy.

The personal data provided will not be transferred to third parties or used for purposes other than those indicated above. However, for the provision of the service, the User's data may also be processed by WhatsApp Ireland Ltd. and Meta Platforms, Inc., who act as Data Processors based on specific contractual agreements with Braveshirts Srl.

Since WhatsApp belongs to the Meta group, data may be transferred outside the European Economic Area (EEA), particularly to the United States. This transfer takes place in compliance with the guarantees provided by Regulation (EU) 2016/679, as Meta Platforms, Inc. adheres to the EU–US Data Privacy Framework, recognized by the European Commission as a system that ensures an adequate level of personal data protection.

The data collected within the WhatsApp Marketing service will be retained until the User withdraws consent, after which they will be deleted or anonymized.

For any further information on data processing, the User may consult this policy or contact the Data Controller at the addresses indicated.

DATA RECIPIENTS

Within the limits relevant to the stated processing purposes, your data may be communicated to partners, consulting firms, private companies, third-party technical service providers, hosting providers, IT companies, communication agencies. The recipient entities are appointed Data Processors.

TRANSFER OF DATA TO THIRD COUNTRIES:

The transfer of data to third countries may occur to the extent necessary for the use of services provided by entities established outside the European Economic Area, such as Meta Platforms, Inc. for WhatsApp Marketing and other communication or marketing tools. In such cases, the transfer takes place in compliance with the guarantees provided by the GDPR, including adequacy decisions, standard contractual clauses, or other instruments recognized by applicable law.

RETENTION PERIOD:

Due to the principle of storage limitation (Art. 5, GDPR), the obsolescence of retained data in relation to the purposes for which they were collected is periodically verified. In particular:

1. Automatically collected data are processed, for the time strictly necessary, solely for the purpose of obtaining statistical information on the use of the site and to check its regular operation, also for security purposes or based on legal deadlines.
2. Data voluntarily provided by the user will be kept for a period not exceeding the time necessary to achieve the purposes for which they are processed or in accordance with legal provisions.
3. Data collected through cookies: refer to the specific Cookie Policy.

DATA SUBJECT'S RIGHTS:

As "Data Subjects" of the processing, the user has the right:

• To access, rectify, erase, restrict, and object to the processing of data
• To obtain without impediment from the data controller the data in a structured, commonly used and machine-readable format to transmit them to another data controller
• To revoke consent to processing, without prejudice to the lawfulness of processing based on consent acquired before revocation
• To lodge a complaint with the Personal Data Protection Authority.
• If it is not possible to request the deletion of data, you may still object to the processing when this is justified by reasons inherent to your particular situation.

The aforementioned rights can be exercised by written communication to be sent via certified email (PEC) to Braveshirtssrl@pec.it or by registered letter with return receipt to via Godi 15, 28024 Gozzano (NO).

DATA PROCESSING METHODS:

The personal data you provide will be subject to processing operations in compliance with the aforementioned legislation and the confidentiality obligations that inspire the Data Controller's activity. The data will be processed using both IT tools and paper records, as well as any other suitable medium (e.g., cloud systems, digital archiving and substitute conservation systems, etc.), in compliance with adequate technical and organizational security measures provided by the GDPR.

FINAL PROVISIONS:

this privacy policy is provided only for this website and not for other websites that may be consulted by the user through links contained on this site. The privacy policy may be subject to changes due to the introduction of new regulations; therefore, the user is invited to periodically check this page to always be updated.

AUTOMATED DECISION-MAKING PROCESSES:

No automated decision-making processes are foreseen.