Service client

Privacy Policy

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF EU REGULATION 679/2016 (“GDPR”)

Your privacy is extremely important to us, please read this information notice carefully.

We wish to inform you in a complete and transparent manner about the personal data processing that the companies listed in paragraph 1 below will carry out on your personal data provided by you and/or collected in the context of the contacts you will possibly have with us, including for example the following:

- visiting the website https://www.bravekid.com/ (hereinafter the “Site” or the “Website”) and/or the other websites referring to Brave Kid, interacting with our pages on the social networks (e.g., Facebook, Twitter, Instagram, we chat, etc.);
- contacting our Customer Service.

If you provide personal data on behalf of someone else, you must ensure, in advance, that the interested parties have read this information notice.

1. WHO COLLECT YOUR PERSONAL DATA

The companies collecting and processing personal data as autonomous data controllers (hereinafter the “Data Controllers” or the “Companies”) or as joint controllers are:

- OTB S.p.A. (“OTB”), with registered office in Italy, Breganze (Vi), Via dell’Industria 2, 36042, telephone +390445306555, email privacy@otb.net; OTB’s Data Protection Officer (“DPO”) can be contacted at dpo@otb.net;
- Brave Kid S.r.l. (”Brave Kid”), with registered office in Italy, Marostica (Vi), Via Fosse 14, 36063, telephone 0424 478555, email, customer_privacy@bravekid.com; Brave Kid’s Data Protection Officer (“DPO”) can be contacted at dpo@otb.net.

To facilitate your understanding of the processing activities carried out by the above-mentioned subjects as Controllers or Joint Controllers, we have prepared this document explaining which processing activities each Company carries out autonomously.

Please consider that the Data Controllers do not knowingly collect or solicit personal data from anyone under the age of 16. If you are less than 16 years old, please refrain from provide any personal data. This does not affect the applicable contract law such as the rules on the validity, formation or effect of a contract in relation to a child.

2. WHAT PERSONAL DATA WE PROCESS

Each Company collects different categories of personal data according to the purpose for which it processes them.

Herein below, we specify which categories of personal data are collected; in the following paragraph we will explain for what purposes each Data Controller processes each category of data or by the Joint Controllers as appropriate (hereinafter also “Personal Data” if processed jointly).

- Biographical Data: name, surname, date of birth, gender;
- Contact Data: address of residence (street, city, province, state, cap code), domicile, email address, telephone number, mobile number;
- Sales Data: shipping and billing address, method of delivery and payment, name of the credit card holder and expiry date of the card, information requested by the Customer Service;
- Tracking of Newsletters and Actions Data: information relating to the opening of newsletters or links;
- Purchase Data: detail of the purchased products (e.g., size, price, discount, model, collection, calculated spending level, abandoned cart, etc.);
- Navigation Data: data relating to browsing behaviour and/or use of the websites of the Data Controllers using, for example, cookies or information relating to the pages that have been visited or searched for or related to the wishlist collected while browsing or when shopping on the online store. As for the use of cookies, please refer to the Cookie Policy available at the following link.

3. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA

In this paragraph, we explain for what purposes each category of data is processed by each Data Controller or Joint Controller.

3.1 PURPOSES OF BRAVE KID

Brave Kid is the OTB Group’s company that sells and promotes items of children’s clothing and related accessories bearing various brand names that are licensed to Brave Kid by their respective brand owners. It is the company maintaining the contacts with you if, for example, you decide to participate in initiatives promoted by Brave Kid as prize competitions or other promotional initiatives. Brave Kid will process Personal Data for the following purposes.

a. Registration on the Site and use of the services offered

If you register on the Site, Brave Kid will process your Personal Data necessary to complete the registration procedure and the creation of your personal account.

Legal basis: this processing is based on the execution of a purchase contract to which you are a party; the provision of the Personal Data listed above is necessary for this purpose, as otherwise Brave Kid will not be able to finalise your registration.

b. Sales activities and response to other requests made by customers

If you purchase “Brave Kid” brand products through the e-Commerce service on the Site, Brave Kid will process your Biographical Data, Contact Data and Purchase Data to conclude the sale, as well as for all activities strictly connected and related to it, such as delivery or other administrative and accounting obligations. These closely related activities include, in particular, contact in the event of an abandoned shopping cart, carried out close to the eventual abandonment of the cart itself, by sending a service email in order to support you in the eventual conclusion of the order.

These data will be requested and processed also in case of purchases performed without registration. In this case, the Personal Data will be stored exclusively for the time necessary to complete the purchase activity.

Similarly, Brave Kid may need to process your Biographical Data or Contact Data to respond to any further requests that you may formulate through the Site, in the appropriate sections, or through the Customer Service, through telephone or chat, such as such as requesting information and assistance or asking to be contacted about the availability of a product.

Legal basis: this processing is based on the performance of a purchase contract to which you are a party or of pre-contractual measures; the provision of the Personal Data listed above is necessary for this purpose, since otherwise Brave Kid will not be able to process your request and/or to finalise the purchase.

c. Participation in prize contests

Brave Kid will be able to process your Biographical Data to allow you to participate in prize contest that Brave Kid could organize. In certain situations, for example to proceed with the delivery of the prize, your Contact Data could also be processed. If participation in the contest requires further information, these will be requested to you upon release of a specific privacy policy.

Legal basis: this processing is based on the performance of a contract for attending the relevant prize contest to which you are a party; the provision of the Personal Data listed above is necessary for this purpose, since otherwise Brave Kid will not be able to process your request.

d. Marketing

Only with your consent, Brave Kid will process the Biographical Data, Contact Data and Purchase Data for marketing purposes, that is for advertising on social networks to which you are registered or sending advertising or direct sales material, carrying out market research, commercial communication with automated contact methods (e-mail, newsletter, SMS, MMS, online messaging platforms, etc.) and traditional contact methods (mail).

Legal basis: this processing is based on the consent you have given.

You can at any time withdraw your consent to receive the above-mentioned communications by clicking on the appropriate option in each marketing email received, as well as by writing to the address customer_privacy@bravekid.com, or otherwise by contacting the company at the addresses indicated in paragraph 1.

e. Customer satisfaction

Brave Kid may use your Contact Data to conduct surveys to measure the level of satisfaction (i.e., customer satisfaction) with the service provided (by way of example but not limited to: online post-sales surveys; etc.). Please note that your Contact Data will be used by Brave Kid to re-contact you in case you respond negatively to the survey because it is important for the company to improve its relationship with you. In this latter case, the data will be kept for as long as necessary to obtain feedback.

In any case, the communications made for this purpose will not have an advertising content, or direct sales or will be used for market research or commercial communication.

Legal basis: this processing is based on the legitimate interest of Brave Kid to verify and improve the quality of its services.

f. Other administrative-accounting activities

Brave Kid may also process your Personal Data for administrative, accounting and internal statistical analysis for business planning purposes.

Legal basis: this processing is based on the legitimate interest of Brave Kid to improve the quality of its services and business.

3.2 PURPOSES OF THE JOINT CONTROLLERS (BRAVE KID AND OTB)

Brave Kid and OTB operate as Joint Controllers on the basis of a specific agreement for the purpose indicated below.

a. Customer profiling

With your consent, the Joint Controllers will be entitled to process Biographical Data, Contact Data, Sales Data, the Purchase Data, Tracking of Newsletters Data and Actions Data and the Navigation Data for profiling purposes and for business analysis, that is for analysis on your purchase preferences consisting of automated processing of the above-mentioned Personal Data. This processing is aimed at analytically knowing or predicting your purchasing preferences also in order to create customer profiles and customize the commercial offer so that it is more in line with your preferences.

Legal basis: this processing is based on the consent you have given..

You will be entitled at any time to withdraw your consent to be subject to profiling by writing to customer_privacy@bravekid.com or otherwise by contacting the Joint Controllers at the addresses indicated in paragraph 1.

3.3 PURPOSES OF ALL DATA CONTROLLERS OR JOINT CONTROLLERS

Finally, each Data Controller or Join Controller may need to comply with a specific legal provision to which it is subject or to defend its own right in court.

a. Purposes related to the obligations established by laws or regulations, by decisions/requests of competent authorities or by supervisory and control bodies

Each Data Controller or Joint Controller may process your Personal Data to comply with a legal obligation to which it is subject.

Legal basis: compliance with a legal obligation.

The provision of data for this purpose is mandatory because in the absence of data the Data Controller or the Joint Controller will not be in a position to comply with their legal obligations.

b. Defense of rights during judicial, administrative or extra-judicial proceedings and in disputes arising in connection with the services offered

Your Personal Data may be processed by each Data Controller or Joint Controller to defend their rights or take legal action or make claims against you or third parties, including the prevention of fraud.

Legal basis: this processing is based on the legitimate interest pursued by the Data Controller or Joint Controller to protect their rights.

4. WHAT PROCESSING ACTIVITIES WE CARRY OUT IF YOU’RE USING OUR SITE AND YOU NAVIGATE WITHOUT BEING LOGGED IN

The Site is managed by Brave Kid, with the use of Shopify’s platform, acting as data processor. It is possible to browse the Site without having to actively communicate your Personal Data if you are not logged in. In this case, we inform you that the computer systems and software procedures used to operate the Site acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols.

This is information that is not directly associated with identified users, but which by its very nature could, through processing and association with data held by third parties, allow these users to be identified.

This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, information regarding access, information regarding location, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), the information regarding the user’s visit including data clickstream of the URL, within and from the Site, the duration of the visit on some pages and the interaction on these pages and other parameters relating to the operating system and the user’s IT environment.

These data are collected through the use of “cookies”. We specifically use browser cookies for various purposes, including cookies strictly necessary for the operation of the Site and the use of services through the appropriate features, and the cookies that are used for personalization, performance/analysis and promotional activities. Our Cookie Policy, available here, contains more information regarding the use of cookies on the Site, as well as the options for accepting or rejecting them.

The data collected while browsing the Site will be processed to (i) manage the Site and resolve any operating problems, (ii) make sure that the content of the Site is presented in the most effective way for its devices, developing, testing and making improvements to the Site, (iii) as far as possible, to keep the Site safe and secure, (iv) to obtain anonymous statistical information on the use of the Site and to check its correct functioning, (v) identify anomalies and/or abuses in the use of the Site. The data could also be used to ascertain responsibility in case of possible computer crimes committed against the Site or third parties and may be presented to the Judicial Authority, if this makes an explicit request.

5. WHAT HAPPENS IF YOU DO NOT PROVIDE PERSONAL DATA

Some Personal Data that we will indicate you from time to time during the registration or purchase process are necessary for the completion of the purchase contract and for administrative and accounting purposes.

In the description of the purposes in paragraph 3, we have specified when it is necessary to provide Personal Data. Where not expressly indicated as mandatory, therefore, the provision of Personal Data is optional and there will be no consequences if you do not provide them, if not the impossibility for the Data Controllers or Joint Controllers to act as described (for example, the impossibility to carry out marketing activities).

6. HOW AND HOW LONG WE WILL PROCESS PERSONAL DATA

The Personal Data provided to and/or collected by the Data Controllers or the Joint Controllers are processed and stored with automated tools and, in some cases, may be processed and stored on a paper backing. In particular, the Personal Data processed for purposes of marketing and customer profiling will be entered and stored in the CRM systems that allow the processing of Personal Data for these purposes.

Moreover, the Personal Data will be stored for the time necessary to achieve the purposes for which they were collected. In particular, the following rules will apply.

- data collected to enter into and perform purchase contracts on the Site, including payments: up to the conclusion of administrative and accounting obligations. The billing data will be kept for 10 years from the billing date;
- data linked to Website registration: up to the deletion of the account;
- data related to data subjects’ requests: the data will be stored for a period of 3 months after the request has been satisfied;
- data collected and processed for survey of customer satisfaction will be retained for 30 days, except where the data are needed to obtain further feedback from you; in this case data will be retain not longer than what is necessary for manage your feedback;
- if you have provided your consent, the data processed for purposes of marketing and customer profiling will be stored for a period of 7 years, unless you revoke your consent. In any case, you will not be contacted again for marketing and customer profiling activities 7 years after your last interaction with us or even earlier if you revoke the consent previously given. The events that identify this “interaction” may include, but are not limited to, a purchase, opening an email sent, participation in a survey, contest or event, interaction with Customer Service etc. For completeness, we would like to point out that, at any time, it is possible to review and modify your previously expressed consents contacting Brave Kid at customer_privacy@bravekid.com or the Customer Service.

With particular reference to the judicial protection of our rights or in case of requests from the authority, the data processed will be stored for the time necessary to process the request or to protect the right.

7. WHERE PERSONAL DATA MAY BE TRANSFERRED

For the purposes indicated above, we may also transfer your Personal Data to third countries, not belonging to the European Union, which may possibly do not guarantee the same level of protection of Personal Data. The transfer to third countries will always take place in accordance with the provisions of the GDPR, adopting any other measures necessary to ensure the security of the Personal Data being transferred. These measures possibly include agreements incorporating the so-called “standard contractual clauses” issued by the European Commission. You can ask for information regarding these third countries and how to obtain a copy of the appropriate safeguards using the following email: customer_privacy@bravekid.com or writing to the postal address indicated above.

8. WHO WILL PROCESS PERSONAL DATA

Personal Data will be processed by:

- employees and collaborators of the Data Controllers or of the Joint Controllers processing data under the authority of the Data Controllers or of the Joint Controllers;
- employees and collaborators of the Data Processors designated by the Data Controllers or Joint Controllers, including (i) the companies managing the online store and who will be entitled to view, modify and update the Personal Data entered in the CRM systems through which the Data Controllers or the Joint Controllers carry out the processing activities for marketing and customer profiling purposes (ii) the companies managing the storage of the Personal Data of the Data Controllers or Joint Controllers based on agreements or local regulations;
- third parties established in the European Union and also outside the European Union, Data Processors, used by the Data Controllers or Joint Controllers in particular for services of: Personal Data acquisition and data entry, shipping, mailing of promotional material, after sales assistance and Customer Service, market research, management and maintenance of the CRM systems through which the Data Controllers or Joint Controllers carry out processing activities for marketing and customer profiling purposes and of the other corporate information systems of the Data Controllers or Joint Controllers of the processing. The complete list of Data Processors appointed by the Data Controllers or Joint Controllers can be requested to the following email address customer_privacy@bravekid.com or writing to the postal addresses indicated above.

Personal Data will not be disseminated in any way.

9. YOUR RIGHTS

Pursuant to Chapter III of the GDPR, you have the right to ask each Data Controller or Joint Controller:

- to access to your Personal Data;
- to receive the copy of the Personal Data you provided us (so-called “data portability”) and to have data transmitted to another controller, if technically possible;
- the rectification of the Personal Data in our possession;
- the erasure of any Personal Data in relation to which we no longer have any legal basis for processing;
- the limitation of the way in which we process your Personal Data, within the limits set by the applicable law data protection law.

Right to object: in addition to the rights listed above, you always have the right to object at any time to the processing of your Personal Data carried out by the Data Controller or Joint Controller for the pursuit of its legitimate interest. You have the right to object to direct marketing, which includes customer profiling. If you prefer that the processing of your Personal Data is carried out solely through traditional contact methods, you can object to the processing of your Personal Data carried out through automated contact methods.

You also have the right to withdraw, in whole or in part, the consent to the processing of Personal Data concerning you for the purpose of sending advertisements or direct selling or for carrying out market research or commercial communication with automated contact methods (e-mail, other remote communication systems via communication networks such as, for instance: SMS, MMS, messaging platforms, etc.) and traditional contact methods (mail).

The exercise of these rights, which can be done through the contact details indicated in paragraph 1, is not subject to formal constraints. In the event that you exercise any of the above-mentioned rights, it will be the responsibility of the Data Controller or Joint Controller that you contacted to verify if you are entitled to exercise the right and to provide you with an answer, normally within a month.

If you believe that the processing of your Personal Data is carried out in breach of the provisions of the GDPR, you have the right to lodge a complaint with the Supervisory Authority or to start the appropriate legal actions before the competent courts.

To exercise your rights, you can send a request to the Data Controllers or Joint Controllers by writing to the addresses indicated in paragraph 1. The OTB and Brave Kid’s Data Protection Officer can be contacted at the email address dpo@otb.net.

LAST UPDATE: February, 2023

INFORMATION NOTICE ON THE PROCESSING OF PERSONAL DATA PURSUANT TO ARTICLES 13 AND 14 OF EU REGULATION 679/2016 (“GDPR”)

Your privacy is extremely important to us, please read this information notice carefully.
We wish to inform you in a complete and transparent manner about the personal data processing that the companies listed in paragraph 1 below will carry out on your personal data provided by you and/or collected in the context of the contacts you will possibly have with us, including for example the following:

visiting the website https://www.bravekid.com (hereinafter the “Site” or the “Website”) and/or the other websites referring to Brave Kid, interacting with our pages on the social networks (e.g., Facebook, Twitter, Instagram, we chat, etc.);
contacting our Customer Service.

When we collect your personal data, we differentiate between active and passive users, depending on how you use our Site or services.
You are an active user (“User”) when you:

Register an account;
Sign up for a newsletter on our website;
Download and use our applications;
Participate in prize contest;
Engage with us on social networks.

1. WHO COLLECT YOUR PERSONAL DATA
The companies collecting and processing personal data as autonomous data controllers (hereinafter the “Data Controllers” or the “Companies”) or as joint controllers are:

OTB S.p.A. (“OTB”), with registered office in Italy, Breganze (Vi), Via dell’Industria 2, 36042, telephone +390445306555, email privacy@otb.net; OTB’s Data Protection Officer (“DPO”) can be contacted at dpo@otb.net;
Brave Kid S.r.l. (”Brave Kid”), with registered office in Italy, Marostica (Vi), Via Fosse 14, 36063, telephone 0424 478555, email, customer_privacy@bravekid.com; Brave Kid’s Data Protection Officer (“DPO”) can be contacted at dpo@otb.net;
Diana e-Commerce Corporation S.r.l. (“Diana”), with registered office in Italy, Torreglia (PD), Via San Daniele 137/139, 35038; email privacy@dianacorp.com ; Diana’s Data Protection Officer can be contacted at privacy@dianacorp.com.

OTB and Brave Kid carry out analysis and profiling activities as joint controllers, taking jointly the decisions regarding the purposes and means of personal data processing. Hereafter, the term “Joint Controllers” means Brave Kid and OTB jointly considered when they process data as joint controllers.
To facilitate your understanding of the processing activities carried out by the above-mentioned subjects as Controllers or Joint Controllers, we have prepared this document explaining which processing activities each Company carries out autonomously.
Brave Kid and Diana, on the other hand, carry out, as joint controllers, the processing operations connected to the activities of online product sales, including after-sales support through Customer Service.
Please note that this Privacy statement is subject to an arbitration provision, requiring you to arbitrate any claims you may have against us on an individual basis. ARBITRATION ON AN INDIVIDUAL BASIS MEANS THAT YOU WILL NOT HAVE, AND YOU WAIVE, THE RIGHT FOR A JUDGE OR JURY TO DECIDE YOUR CLAIMS, IF ANY, AND THAT YOU MAY NOT PROCEED IN A CLASS, CONSOLIDATED OR REPRESENTATIVE CAPACITY

2. WHAT PERSONAL DATA WE PROCESS
Each Company collects different categories of personal data according to the purpose for which it processes them.
Herein below we specify which categories of personal data are collected; in the following paragraph we will explain for what purposes each category of data is processed by each Data Controller or by the Joint Controllers as appropriate (hereinafter also “Personal Data” if processed jointly). “Personal Data” is information that identifies, relates to, describes, is capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular individual, device, or household.

Identifiers/contact data/biographical data, which may include name, last name, date of birth, address of residence (street, city, province, state, cap code), domicile, online identifier or username, Internet Protocol address, email address, telephone number, or account name. These are sourced directly from you or indirectly from you (e.g., from observing your actions on the Site). They are used to fulfil or meet the reason you provided the information, to contact you in relation to our Site, to respond to an inquiry, for product and service improvement, to provide loyalty programs, to provide prizes, marketing, or to process an order. For example, when you create an account, you provide your first and last name, email address, and other identifying information. We disclose this information for business purposes to Internet service providers, administrative service providers, and payment processors.
Personal Data categories contained in customer records, which may include name, shipping and billing address, telephone number, bank account number, credit card number, debit card number, tax code, information requested by the Customer Service, or any other payment and financial information for billing. We source this information directly from you. We use this information to fulfil or meet the reason you provided the information, to contact you in relation to our Site, to respond to an inquiry, or process an order. For example, we need your payment information when you purchase products and services from us. We disclose this information for business purposes to Internet service providers, administrative service providers, and payment processors.
Characteristics of protected classifications, such as age or gender. We source this information directly from you. We use this information to fulfil or meet the reason you provided the information or to provide relevant services and advertising. We do not disclose this information to third parties.
Commercial information/purchase data, which may include records of products or services purchased, obtained, or considered, such as details on purchased items (e.g., size, price, discount, model, collection, calculated spending level, abandoned cart items, etc.) or other purchasing or consuming histories or tendencies. We source this information directly from you. We use this information to fulfil or meet the reason you provided the information, to contact you in relation to our Site, marketing, and to respond to an inquiry or process an order. For example, we keep track of your purchases to create a purchase history. We disclose this information for business purposes to Internet service providers, administrative service providers, and payment processors.
Internet, technical or other similar network activity/navigation data, which may include usage and browsing history; device information, including device properties; network connection information, such as time zone; search history; information on your interaction with our Site, newsletters, or links; and error logs. We source this information directly or indirectly from you (e.g., from observing your actions on our Site). We use this information to fulfil or meet the reason you provided the information, or to improve our Site. We disclose this information for business purposes to administrative service providers, data analytics providers, and Internet service providers. See paragraph 4 below and our Cookie Policy, available at the following link, for more information on the types of information we collect, how it is used, and how to opt-out.

Inferences drawn from other personal data, which may include a profile reflecting preferences, interests, characteristics, psychological trends, predispositions, behaviour, attitudes, intelligence, abilities, and aptitudes. We source this information directly or indirectly from you, (e.g., from observing your actions on our Site). We use this information to fulfil or meet the reason you provided the information, marketing, to provide more relevant products and services, and to improve our Site and services. We do not disclose this information to third parties.

3. FOR WHAT PURPOSES WE PROCESS YOUR PERSONAL DATA
In this paragraph, we explain for what purposes each category of data is processed by each Data Controller or Joint Controller.

3.1 PURPOSES OF BRAVE KID
Brave Kid is the OTB Group’s company that sells and promotes items of children’s clothing and related accessories bearing various brand names that are licensed to Brave Kid by their respective brand owners. It is the company maintaining the contacts with you if, for example, you decide to participate in initiatives promoted by Brave Kid as prize competitions or other promotional initiatives. Brave Kid will process Personal Data for the following purposes.

a. Participation in prize contests
Brave Kid will be able to process your identifiers and biographical data to allow you to participate in prize contests that Brave Kid could organize. In certain situations, for example to proceed with the delivery of the prize, your contact data could also be processed. If participation in the contest requires further information, these will be requested to you upon release of a specific privacy policy.
Legal basis: this processing is based on the performance of a contract for attending the relevant prize contest to which you are a party; the provision of the Personal Data listed above is necessary for this purpose, since otherwise Brave Kid will not be able to process your request.

b. Marketing
Only with your consent, Brave Kid will process your identifiers, contact data, biographical data, and purchase data for marketing purposes, that is for advertising on social networks to which you are registered or sending advertising or direct sales material, carrying out market research, commercial communication with automated contact methods (email, newsletter, SMS, MMS, online messaging platforms, etc.) and traditional contact methods (mail).
Legal basis: this processing is based on the consent you have given via the appropriate opt-in disclosure.

You can at any time withdraw your consent to receive the above-mentioned communications by clicking on the appropriate option in each marketing email received, as well as by writing to the address: customer_privacy@bravekid.com, or otherwise by contacting the company at the addresses indicated in paragraph 1.

3.2 PURPOSES OF THE JOINT CONTROLLERS (BRAVE KID AND OTB)
Brave Kid and OTB operate as Joint Controllers on the basis of a specific agreement for the purpose indicated below.

a. Customer profiling
With your consent, the Joint Data Controllers will be entitled to process identifiers, biographical data, contact data, commercial information, purchase data, navigation data, and other similar network activity for profiling purposes and for business analysis, that is for analysis on your purchase preferences consisting of automated processing of the above mentioned Personal Data. This processing is aimed at analytically knowing or predicting your purchasing preferences, and also in order to create customer profiles and customize the commercial offer so that it is more in line with your preferences.
Legal basis: this processing is based on the consent you have given.
You will be entitled at any time to withdraw your consent to be subject to profiling by writing to customer_privacy@bravekid.com or otherwise by contacting the Joint Controllers at the addresses indicated in paragraph 1.

3.3. PURPOSES OF THE JOINT CONTROLLERS (BRAVE KID AND DIANA)
Brave Kid and Diana operate as joint controllers on the basis of a specific agreement for the purposes indicated below.

a. Website registration
If you register on the Site, Brave Kid and Diana will process your Personal Data necessary to complete the registration procedure and the creation of your personal account.
Legal basis: this processing is based on the execution of a purchase contract to which you are a party; the provision of the Personal Data listed above is necessary for this purpose, as otherwise Brave Kid and Diana will not be able to finalise your registration.

b. Sales activities and response to other requests made by customers
If you purchase “Brave Kid” brand products through the e-Commerce service on the Site, Brave Kid and Diana will process your Biographical Data, Contact Data and Purchase Data to conclude the sale, as well as for all activities strictly connected and related to it, such as delivery or other administrative and accounting obligations. These closely related activities include, in particular, contact in the event of an abandoned shopping cart, carried out close to the eventual abandonment of the cart itself, by sending a service email in order to support you in the eventual conclusion of the order.
Similarly, Brave Kid and Diana may need to process your Biographical Data or Contact Data to respond to any further requests that you may formulate through the Site, in the appropriate sections, or through the Customer Service, through telephone or chat, such as such as requesting information and assistance or asking to be contacted about the availability of a product.
Legal basis: this processing is based on the performance of a purchase contract to which you are a party or of pre-contractual measures; the provision of the Personal Data listed above is necessary for this purpose, since otherwise Brave Kid and Diana will not be able to process your request and/or to finalise the purchase.

3.4 PURPOSES OF ALL DATA CONTROLLERS OR JOINT CONTROLLERS
Finally, each Data Controller or Join Controller may need to comply with a specific legal provision to which it is subject or to defend its own right in court.

a. Purposes related to the obligations established by laws or regulations, by decisions/requests of competent authorities or by supervisory and control bodies
Each Data Controller or Joint Controller may process your Personal Data to comply with a legal obligation to which it is subject.
Legal basis: compliance with a legal obligation. The provision of data for this purpose is mandatory because in the absence of data the Data Controller or the Joint Controller will not be in a position to comply with their legal obligations.

b. Defense of rights during judicial, administrative or extra-judicial proceedings and in disputes arising in connection with the services offered
Your Personal Data may be processed by each Data Controller or Joint Controller to defend their rights or take legal action or make claims against you or third parties, including the prevention of fraud.
Legal basis: this processing is based on the legitimate interest pursued by the Data Controller or Joint Controller to protect their rights.

4. COOKIES; WHAT PROCESSING ACTIVITIES WE CARRY OUT IF YOU’RE USING OUR WEBSITE AND YOU NAVIGATE WITHOUT BEING LOGGED IN
The Site is managed by Brave Kid.. It is possible to browse the Site without logging in. In this case, while browsing the Site, we inform you that the computer systems and software procedures used to operate the Site acquire, during their normal operation, some data whose transmission is implicit in the use of Internet communication protocols.
This is information that is not directly associated with individuals, but which by its very nature could, through processing and association with data held by third parties, allow these users to be identified.
This category of data includes the IP addresses or domain names of the computers used by users who connect to the Site, the addresses in URI (Uniform Resource Identifier) notation of the requested resources, information regarding access, information regarding location, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.), the information regarding the user’s visit including data clickstream of the URL, within and from the Site, the duration of the visit on some pages and the interaction on these pages and other parameters relating to the operating system and the user’s IT environment.
These data are collected through the use of “cookies”. We specifically use browser cookies for various purposes, including cookies strictly necessary for the operation of the Site and the use of services through the appropriate features, and the cookies that are used for personalization, performance/analysis and promotional activities. Our Cookie Policy, available here, contains more information regarding the use of cookies on the Site, as well as the options for accepting or rejecting them.
The data collected while browsing the Site will be processed to (i) manage the Site and resolve any operating problems, (ii) make sure that the content of the Site is presented in the most effective way for its devices, developing, testing and making improvements to the Site, (iii) as far as possible, to keep the Site safe and secure, (iv) to obtain anonymous statistical information on the use of the Site and to check its correct functioning, (v) identify anomalies and/or abuses in the use of the Site. The data could also be used to ascertain responsibility in case of possible computer crimes committed against the Site or third parties and may be presented to the Judicial Authority, if this makes an explicit request.

5. WHAT HAPPENS IF YOU DO NOT PROVIDE PERSONAL DATA
Some Personal Data that we will indicate you from time to time during the registration or purchase process are necessary for the completion of the purchase contract and for administrative and accounting purposes.
In the description of the purposes in paragraph 3, we have specified when it is necessary to provide Personal Data. Where not expressly indicated as mandatory, therefore, the provision of Personal Data is optional and there will be no consequences if you do not provide them, if not the impossibility for the Data Controllers or Joint Controllers to act as described (for example, the impossibility to carry out marketing activities).

6. HOW AND HOW LONG WE WILL PROCESS PERSONAL DATA
The Personal Data provided to and/or collected by the Data Controllers or the Joint Controllers are processed and stored with automated tools and, in some cases, may be processed and stored on a paper backing. In particular, the Personal Data processed for purposes of marketing and profiling will be entered and stored in the CRM systems that allow the processing of Personal Data for these purposes.
Moreover, the Personal Data will be stored for the time necessary to achieve the purposes for which they were collected. In particular, the following rules will apply.

data collected to enter into and perform purchase contracts, including payments: up to the conclusion of administrative and accounting obligations. The billing data will be kept for 10 years from the billing date;
data linked to Website registration: up to the deletion of the account;
data related to data subjects’ requests: the data will be stored for a period of 3 months after the request has been satisfied;
if you have provided your consent, the data processed for purposes of marketing and profiling will be stored for a period of 7 years unless you revoke your consent. In this case, upon withdrawal of your consent, we will delete your data.

In any case, for technical reasons, the termination of the processing and the consequent cancellation or irreversible anonymization of the related Personal Data will be definitive within sixty days from the terms indicated above.
With particular reference to the judicial protection of our rights or in case of requests from the authority, the data processed will be stored for the time necessary to process the request or to protect the right.

7. WHERE PERSONAL DATA MAY BE TRANSFERRED
For the purposes indicated above, your Personal Data, processed in Italy by the Data Controllers, could be transfer to third countries, not belonging to the European Union, which may possibly do not guarantee the same level of protection of Personal Data. The transfer to third countries will always take place in accordance with the provisions of the GDPR, adopting any other measures necessary to ensure the security of the Personal Data being transferred. These measures possibly include agreements incorporating the so-called “standard contractual clauses” issued by the European Commission or your consent. You can ask for information regarding these third countries and how to obtain a copy of the appropriate safeguards using the following email: customer_privacy@bravekid.com or writing to the postal address indicated above.

8. WHO WILL PROCESS PERSONAL DATA
Personal Data will be processed by:

employees and collaborators of the Data Controllers or of the Joint Controllers processing data under the authority of the Data Controllers or of the Joint Controllers;
employees and collaborators of the Data Processors designated by the Data Controllers or Joint Controllers, including (i) the companies managing the online store and who will be entitled to view, modify and update the Personal Data entered in the CRM systems through which the Data Controllers or the Joint Controllers carry out the processing activities for marketing and profiling purposes (ii) the companies managing the storage of the Personal Data of the Data Controllers or Joint Controllers based on agreements or local regulations;
third parties established in the European Union and also outside the European Union, Data Processors, used by the Data Controllers or Joint Controllers in particular for services of: Personal Data acquisition and data entry, shipping, mailing of promotional material, after sales assistance and Customer Service, market research, management and maintenance of the CRM systems through which the Data Controllers or Joint Controllers carry out processing activities for marketing and profiling purposes and of the other corporate information systems of the Data Controllers or Joint Controllers of the processing. The complete list of Data Processors appointed by the Data Controllers or Joint Controllers can be requested to the following email address customer_privacy@bravekid.com or writing to the postal addresses indicated above.

Personal Data may also be disclosed to third parties, independent data controllers, in particular to freelancers or companies providing legal or tax advice and assistance and to companies managing payments made by debit or credit cards or for fraud prevention and management activities.
Lastly, we may share your information with third parties, unrelated to the services provided on the Site, when we believe it is necessary or appropriate, including: (a) as required or necessary in order to comply with applicable law (including laws outside your country of residence); (b) to protect us against liability; (c) to respond to subpoenas, judicial processes, or legitimate requests by law enforcement officials; (d) to purchasers in connection with any sale, assignment, or other transfer of all or a part of our business or company; (e) to protect our operations; (f) to protect our rights, privacy, safety or property; and (g) to allow us to pursue available remedies or limit the damages we may sustain.
9. COLLECTION FROM CHILDREN
The Site is not intended for children under the age of 16 and we do not knowingly collect Personal Data from such children. Children under the age of 16 should not use or attempt to use our Site or send Personal Data to us. In the event that we learn that we have inadvertently gathered Personal Data from a child under the age of 16, we will take reasonable measures to erase such information from our records. Parents who believe that we might have any information from or about a child under 16, may submit a request to customer_privacy@bravekid.com and request that such data be removed.
10. THIRD-PARTY ADVERTISING
We may use advertisers, third-party ad platform, tracking technologies and other advertising companies to serve advertisements on the Site and to improve the performance of our advertising across the Internet. Please be advised that such advertising companies may gather Personal Data about your visit to our Site or other websites (such as through cookies, web beacons, and other technologies) to enable such advertising companies to market products or services to you, to monitor which ads have been served to your browser and which webpages you were viewing when such ads were delivered. You can also generally opt-out of receiving personalized ads from third-party advertisers and ad networks who are members of the Network Advertising Initiative (NAI) or who follow the Digital Advertising Alliance’s Self-Regulatory Principles for Online Behavioral Advertising by visiting the opt-out pages on the NAI website https://optout.networkadvertising.org/?c=1 here and DAA website here https://optout.aboutads.info/?c=2&lang=EN.
11. LINKS TO THIRD-PARTY WEBSITES
Our Site contain links to other third party websites. We are not responsible for the privacy practices or the content of such third party websites. To better protect your privacy, we recommend that you review the privacy policy of any third party website you visit.
AGAIN, PLEASE NOTE THAT THIS PRIVACY STATEMENT DOES NOT COVER THE COLLECTION AND USE OF INFORMATION BY SUCH THIRD-PARTY WEBSITES AND ADVERTISERS.
12. SECURITY
We have adopted commercially reasonable security measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, or unauthorized disclosure or access. We may use third-party products and services to secure or store your information. We encrypt credit card numbers from e-commerce transactions conducted on our Site. However, no method of Internet transmission or electronic storage is 100% secure or error free. Consequently, we cannot ensure or warrant the security of any information you transmit to us. If we learn of data security systems breach we may attempt to notify you electronically so that you can take appropriate protective steps. By using the Site or providing Personal Data to us, you agree that we can communicate with you electronically regarding security, privacy, and administrative issues relating to your use of the Site. We may post a notice via the Site if a security breach occurs. We may also send an email to you at the email address you have provided to us in these circumstances. Depending on where you live, you may have a legal right to receive written notice of a data privacy or security breach. If you have any reason to believe that your interactions with the Site are no longer secure, please notify us immediately at the addresses provided above.
Additionally, please do not forget that it is essential for the safety of your data that your device is equipped with tools such as constant antivirus updates and that your internet provider provides a connection ensuring a secure data transmission through firewalls, spam filters, and similar measures.

13. EXERCISING YOUR RIGHTS
Pursuant to Chapter III of the GDPR, you have the right to ask each Data Controller or Joint Controller:

to access to your Personal Data;
to receive the copy of the Personal Data you provided us (so-called “data portability”) and to have data transmitted to another controller, if technically possible;
the rectification of the Personal Data in our possession;
the erasure of any Personal Data in relation to which we no longer have any legal basis for processing;
the limitation of the way in which we process your Personal Data, within the limits set by the applicable law data protection law.

Right to object

: in addition to the rights listed above, you always have the right to object at any time to the processing of your Personal Data carried out by the Data Controller or Joint Controller for the pursuit of its legitimate interest. You have the right to object to direct marketing, which includes profiling. If you prefer that the processing of your Personal Data is carried out solely through traditional contact methods, you can object to the processing of your Personal Data carried out through automated contact methods.

The exercise of these rights, which can be done through the contact details indicated in paragraph 1, is not subject to formal constraints. In the event that you exercise any of the above mentioned rights, it will be the responsibility of the Data Controller or Joint Controller that you contacted to verify if you are entitled to exercise the right and to provide you with an answer, normally within a month.

As regards the Joint Controllers relationship, please note that OTB and Brave Kid entered into a specific agreement pursuant to article 26 of the GDPR, an extract of which is available for consultation contacting each of the Joint Controllers using the contact details indicated under paragraph 1. Similarly, we would like to inform you that the joint controllers Brave Kid and Diana have also concluded a specific agreement pursuant to Article 26 of the GDPR, the extract of which is available for consultation contacting each of the joint controllers at the addresses indicated in paragraph 1.

To exercise your rights, you can send a request to the Data Controllers or Joint Controllers by writing to the addresses indicated in paragraph 1. The OTB’s Data Protection Officer can be contacted at the email address

dpo@otb.net

. The Brave Kid’s Data Protection Officer can be contacted at the email address

dpo@otb.net. The Diana’s Data Protection Officer can be contacted at the email addressprivacy@dianacorp.com.
14. CHANGES TO OUR PRIVACY STATEMENT
We reserve the right to amend all or part of our Privacy statement from time to time. The version published on the Site is the version currently in force. Changes to our Privacy statement are communicated by placing a notice on the Site stating “Revised Privacy statement(s).” Changes to our Privacy statement will be effective immediately once published on the Site unless otherwise noted. If we make material changes to our Privacy statement, we will notify you by prominently posting the changes on our Site as described or by using the contact information you have on file with us. Your use of the Site following any amendments, indicates your consent to the practices described in the revised Privacy statement. We invite you to periodically review our Privacy statement to be informed of any relevant changes, especially before providing any data to us.
15. ASSIGNMENT
We may share or transfer your information in the course of any direct or indirect reorganization process including, but not limited to, mergers, acquisitions, divestitures, bankruptcies, and sales of all or a part of our assets. Your information may be shared following completion of such transaction and/or during the assessment process pending transfer. If transferred in such a case, your information would remain subject to this Privacy statement that, at a minimum, protects your privacy to an equal degree as this Privacy statement

Please, consider the following paragraphs if you are a U.S. resident
16. YOUR CALIFORNIA PRIVACY RIGHTS & HOW WE RESPOND TO “DO NOT TRACK” SIGNALS
If you are a California resident, you may have the right to request and receive certain information about a company’s disclosure of your Personal Data to third parties for their own direct marketing use, and your choices with respect to such disclosures. Because we do not share your Personal Data with third parties for their own direct marketing use unless you are first given the opportunity to opt in or out, we are exempt from this requirement. If you still wish to learn more about our compliance with this requirement, please contact us at the address listed in paragraph 1.
As of January 1, 2020, you may be entitled to the below rights:

the right to know. You may request information about the categories and specific pieces of Personal Data we have collected about you over the last 12 months, as well as the categories of sources from which such information is collected, the purpose for collecting such information, and the sale or disclosure for business purposes of your Personal Data to third parties, and the categories of third parties with whom this information was shared. You may also request a copy of the Personal Data we have collected, and upon request, we will provide this information to you in electronic form;
the right to opt-out of the sale of your Personal Data to third parties. We do not sell your Personal Data at this time, and we do not sell the Personal Data of children under 16 years old;
the right to request deletion of your Personal Data, subject to certain legal exceptions; and
the right to not be discriminated against for exercising any of the rights mentioned above.

You can exercise your rights by contacting us using the details set out in paragraph 1. Whenever feasible for verification, we will match the identifying information provided by you to the Personal Data already maintained by us. If, however, we cannot verify your identity from the information already maintained by us, we may request additional information. You may designate an authorized agent to make a request on your behalf. Such authorized agent must be registered with the California Secretary of State and must have permission to submit requests on your behalf. We may deny a request from an agent that does not submit proof that they have been authorized by you to act on your behalf.
17. HOW WE RESPOND TO DO NOT TRACK SIGNALS
The “Do Not Track” (“DNT”) privacy preference is an option that may be made in some web browsers allowing you to opt-out of tracking by websites and online services. At this time, global standard DNT technology is not yet finalized and not all browsers support DNT. We therefore do not recognize DNT signals and do not respond to them.
18. DISPUTES, AGREEMENT TO ARBITRATE, AND CHOICE OF LAW
By using the Site, you and we agree that, if there is any controversy, claim, action, or dispute arising out of or related to your use of the Site, or the breach, enforcement, interpretation, or validity of this Privacy statement or any part of it (“Dispute”), both parties shall first try in good faith to settle such Dispute by providing written notice to the other party describing the facts and circumstances of the Dispute and allowing the receiving party 30 days in which to respond to or settle the Dispute.
Notice shall be sent:
(1) to us at the address(es) listed above, towards the beginning of this Privacy statement; and (2) to you at: the contact information on file with us. Both you and we agree that this dispute resolution procedure is a condition precedent that must be satisfied before initiating any litigation or filing any claim against the other party.
IF ANY DISPUTE CANNOT BE RESOLVED BY THE ABOVE DISPUTE RESOLUTION PROCEDURE, YOU AGREE THAT THE SOLE AND EXCLUSIVE JURISDICTION FOR SUCH DISPUTE WILL BE DECIDED BY BINDING ARBITRATION ON AN INDIVIDUAL BASIS. ARBITRATION ON AN INDIVIDUAL BASIS MEANS THAT YOU WILL NOT HAVE, AND YOU WAIVE, THE RIGHT FOR A JUDGE OR JURY TO DECIDE YOUR CLAIMS, AND THAT YOU MAY NOT PROCEED IN A CLASS, CONSOLIDATED, OR REPRESENTATIVE CAPACITY. Other rights that you and we would have in court will not be available or will be more limited in arbitration, including discovery and appeal rights. All such Disputes shall be exclusively submitted to JAMS (www.jamsadr.com) for binding arbitration under its rules then in effect, before one arbitrator to be mutually agreed upon by both parties. The arbitrator, and not any federal, state, or local court or agency, shall have exclusive authority to resolve any dispute arising under or relating to the interpretation, applicability, enforceability, or formation of this Privacy statement, including any claim that all or any part of this Privacy statement is void or voidable. This Privacy statement has been made in, and shall be construed in accordance with, the laws of the State of New York, without giving effect to any conflict of law principles. The parties acknowledge that this Privacy statement evidences a transaction involving interstate commerce. Notwithstanding the provision in the preceding paragraph with respect to applicable substantive law, any arbitration conducted pursuant to the terms of this Privacy statement shall be governed by the Federal Arbitration Act (9 U.S.C. §§ 1-16).

LAST UPDATE May 24th 2021