PRIVACY POLICY

Welcome to the website www.herno.com (hereinafter also the “Site”). Please read carefully this privacy policy (hereinafter also the “Privacy Policy”), which applies to every access to the Site, regardless of whether you purchase the products sold on it.

Please note that this Privacy Policy is governed by the General Data Protection Regulation (EU) 2016/679 (hereinafter also the “GDPR”) and by Italian legislation on the protection of personal data. These rules ensure that personal data are processed in compliance with the fundamental rights and freedoms, as well as the dignity, of the data subject, with particular regard to confidentiality, personal identity and the right to the protection of personal data.

Finally, please note that users under the age of 14 (fourteen) may not give their consent to the processing of personal data without the authorisation of the holder of parental responsibility.

Control of the data collected through the Site

Pursuant to the GDPR, the data controller is the person or entity which, alone or jointly with others, determines the purposes and means of the processing of personal data. Where two or more controllers jointly determine the purposes and means of processing, they are joint controllers.

With regard to the processing of data collected and processed through the Site, please be informed that:

• Herno S.p.A. and The Level S.r.l. are joint controllers of browsing data, profiling data, data relating to user accounts on the Site, as well as data connected and related to sales made through the Site and to the related pre-sale and after-sale support activities.

• Herno S.p.A. is the independent controller of the data collected for marketing purposes and for the communication of data to third parties belonging to the same group (for these activities it has appointed The Level S.r.l. as data processor).

PRIVACY NOTICE PROVIDED BY HERNO S.P.A. AS INDEPENDENT DATA CONTROLLER

1.Data Controller and contact details of the Data Protection Officer

The Data Controller is Herno S.p.A., with registered office in Via Opifici n. 100 – 28040 Lesa (NO), Italy (hereinafter also “Herno” or the “Controller”). The Controller has appointed a Data Protection Officer, who may be contacted for any matter concerning the processing of personal data at the following email address: privacy@herno.it.

2.Purposes and legal basis of the processing

Herno may collect and process the user’s personal data (email address and personal details) for its own commercial and marketing purposes, including commercial communications, invitations to events and customer satisfaction surveys, by automated means (including SMS, instant messaging, email, and the display of advertising messages on the user’s social media account through Custom Audience campaigns), as well as by traditional means (post and telephone calls). Please note that, in communications sent by email (newsletters), Herno may use tracking pixels, i.e. small invisible graphic elements embedded in the messages, capable of detecting the opening of the communication and certain technical information related to the recipient’s interaction, such as the date and time of opening, IP address, device type, operating system, email client and other similar technical information, to the extent necessary to assess the results of marketing campaigns and for remarketing activities;

Herno may also communicate the user’s data to companies belonging to the same group, operating in the clothing and sports sector, so that they, acting as independent controllers, may send you commercial and marketing messages directly (by both traditional and automated means). 

The legal basis for the above processing is the freely given consent expressed by the user.

3.Processing methods

Personal data collected through the Site are processed by Herno mainly by electronic and telematic means and tools, adopting the security measures necessary to minimise the risk of destruction or loss, including accidental loss, of the data, of unauthorised access, or of processing that is not permitted or not consistent with the purposes of collection set out in this Privacy Policy. However, owing to the nature of online transmission, such measures cannot entirely limit or exclude any risk of unauthorised access or data leakage. For this reason, we recommend that you periodically check that your computer is equipped with suitable software for protecting the transmission of data over the network and that your Internet service provider has adopted appropriate measures for the security of data transmission over the network (such as firewalls and anti-spam filters).

With specific regard to any tracking pixels used in marketing emails, Herno adopts technical and organisational measures consistent with the principles of privacy by design and privacy by default, limiting the data collected to what is necessary, avoiding where possible the use of directly intelligible identifiers and keeping tracking data separate from other customer information.

4.Source of the data and mandatory or optional nature of providing the data

The personal data collected by Herno are provided directly by the user through their interaction with the Site.

Providing personal data to Herno is free, voluntary and optional. Failure to provide them does not limit the use of the Site, but may make it impossible for Herno to send commercial communications, information material, updates, newsletters or invitations to events of Herno or of the other companies of the same group.

5.Categories of recipients of personal data

Herno communicates the personal data of Site users only within the limits permitted by law and in accordance with the following. In particular, the data may be processed by and made known to:

(i) providers of technical services instrumental to marketing activities, including any social media platforms, such as Meta, for “Custom Audience” activities;

(ii) companies of the same group as Herno;

(iii) The Level S.r.l., as provider of technical services instrumental to the activities of the Site.

6.Transfers outside the EEA

Your data will not be disseminated by the Controller. They may also be transferred outside the EEA, always ensuring adequate levels of protection and safeguards, through technical and organisational measures to protect them and the execution of Standard Contractual Clauses, in accordance with applicable law. You may contact the Controller at any time to find out where your data are located and to obtain a copy of them.

7.Data retention period

Personal data provided for marketing purposes and for communication to third parties are retained for a maximum of 5 (five) years from the date consent was given, unless the data subject renews such consent.

8.Rights granted to the data subject under privacy law

The data subject always has the right to obtain from Herno confirmation as to whether or not personal data concerning them exist and to have such data communicated in an intelligible form. The data subject also has the right to obtain information about the source of the personal data, the purposes and methods of the processing, the logic applied in the case of processing carried out with the aid of electronic tools, the identification details of the controller and of the data processors, and the persons or categories of persons to whom the personal data may be communicated or who may become aware of them, for example as data processors or persons otherwise authorised to process the data. The data subject further has the right to request the updating, rectification or, where they have an interest, the integration of personal data, the erasure, anonymisation or blocking of personal data processed unlawfully, including data whose retention is not necessary for the purposes for which they were collected or subsequently processed; and certification that the above operations, including their content, have been brought to the attention of those to whom the data were communicated, except where this proves impossible or involves a manifestly disproportionate effort compared to the right protected. The user also has the right to data portability.

The data subject also has the right to object, in whole or in part (withdrawal of consent), to the processing of personal data concerning them. The right to object may also be exercised specifically with regard to one or more methods of sending marketing communications. Please note that the right to object to the processing of one’s data for direct marketing purposes carried out by electronic means also extends to traditional means, without prejudice to the option of exercising this right only in part, where technically possible. 

The above rights may be exercised by writing to: privacy@herno.it.

Please also note that the data subject may at any time withdraw their consent to tracking through the pixels contained in newsletters, using the options provided at the bottom of the newsletters themselves. 

Finally, please note that you always have the right to lodge a complaint with the competent Supervisory Authority (www.garanteprivacy.it).

PRIVACY NOTICE PROVIDED BY HERNO S.P.A. AND THE LEVEL S.R.L. AS JOINT DATA CONTROLLERS

1.Joint Controllers and contact details of the Data Protection Officers

With regard to browsing data, profiling data, data relating to user accounts created on the Site, as well as data relating to sales, including pre-sale and after-sale activities, Herno S.p.A., with registered office in Via Opifici n. 100 – 28040 Lesa (NO), Italy, and The Level S.r.l., with registered office in Piazza Arcole n. 4 – 20143 Milan (MI), Italy, act as joint controllers (hereinafter, for brevity, the “Joint Controllers”).

The Level S.r.l. has appointed a Data Protection Officer (“TL DPO”), who may be contacted for any request at the following email address: dpo@thelevelgroup.com.

Herno S.p.A. has appointed a Data Protection Officer (“Herno DPO”), who may be contacted for any request at the following email address: privacy@herno.it.

2.Purposes and legal basis of the processing

The Joint Controllers may process and collect the following data for the following purposes:

a. Management of cookies and of the data collected through them on the Site. In this regard, please read the “Cookie Policy” [Cookie Policy | Herno S.p.A.]

b. Creation and management of the user’s account on the Site, and provision of the related services, responding to user requests, assistance and sending the requested information about the products sold. For this purpose, personal data voluntarily provided by the user (such as email address, personal details and the password chosen when registering on the Site) or otherwise lawfully acquired during the user’s interaction with the Site are processed.

c. Sale of products through the Site and pre-sale and after-sale activities, including all resulting contractual and legal obligations;

d. Study and analysis of consumer habits and choices, in order to make the products, initiatives and services of the Site more responsive to users’ tastes and needs.

With the exception of browsing data, which are governed by the Cookie Policy, the legal basis for the processing is:

(i) the user’s consent, with regard to the purposes referred to in letter d. (study and analysis of consumer habits and choices);

(ii) the legitimate interest in providing information and services and responding to user requests, with regard to the purposes referred to in letter b.;

(iii) the performance of the contract and of pre-contractual and post-contractual obligations, with regard to the purposes referred to in letter c., and compliance with legal obligations relating to the tax and legal requirements connected with the above activities.

3.Study of users’ consumer habits and choices

As indicated in point 2, letter d. above, with the user’s express consent, the Joint Controllers may process their personal data for the purpose of studying consumer habits and choices, in order to make the products and initiatives promoted on the Site more responsive to the tastes and needs of their customers.

With the aid of automated tools, the Joint Controllers therefore process data relating to the value and frequency of purchases, the type of products purchased over a specific period of time, as well as data relating to the user’s purchasing habits and preferences. The sole aim of this study is to offer customers and users products, services and initiatives that better match their tastes and needs. In this regard, please note that the study of user and customer behaviour will be carried out in a manner that is not invasive of their private sphere.

4.Processing methods

Personal data collected through the Site are processed mainly by electronic and telematic means and tools, adopting security measures so as to minimise the risk of destruction or loss, including accidental loss, of the data, of unauthorised access, or of processing that is not permitted or not consistent with the purposes of collection set out in this Privacy Policy. However, owing to the nature of online transmission, such measures cannot entirely limit or exclude any risk of unauthorised access or data leakage. For this reason, we recommend that you periodically check that your computer is equipped with suitable software for protecting the transmission of data over the network, both incoming and outgoing, and that your Internet service provider has adopted appropriate measures for the security of data transmission over the network.

5.Source of the data and mandatory or optional nature of providing the data

With the exception of browsing data, the provision and collection of which are governed by the Cookie Policy, the personal data collected by the Joint Controllers are provided directly by the user.

Providing the personal data collected for the purposes referred to in point 2, letters b. and d. is free, voluntary and optional. Failure to provide such data will make it impossible for the Joint Controllers to respond to the user’s requests for information and queries, and to offer products, services and initiatives that better meet the user’s needs.

Providing data, in particular personal and contact details, for the purposes connected with sales, as further specified in point 2, letter c., is necessary for the conclusion of the contract for the purchase of products through the Site, for the provision of other services offered on the Site and related to the sale, or to comply with obligations arising from laws or regulations. Any refusal to provide certain data necessary for these purposes may make it impossible to perform the contract for the purchase of products on the Site, or to provide the other related services – such as assistance services – or to correctly fulfil legal and regulatory obligations. Failure to provide the data may therefore constitute, depending on the case, a legitimate and justified reason for not performing the contract for the purchase of products on the Site and for not providing the related services.

Depending on the case and where necessary, the mandatory or optional nature of providing the data will be indicated each time by marking mandatory information, i.e. only the data necessary for the provision of the services and for the purchase of products on the Site, with a specific symbol (*). Failure to provide optional personal data will not entail any obligation or disadvantage.

Please also note that payment data (credit card data) are collected and processed directly by the online payment providers and are neither viewed nor processed by the Joint Controllers.

6.Scope of communication of personal data

Personal data may be communicated to and made known to:

• employees and/or consultants of the Joint Controllers, who will act as persons authorised to process the data;

• third-party companies that perform specific services on behalf of the Joint Controllers, acting as Data Processors (such as logistics services, IT services and services instrumental to profiling activities).

Personal data may also be made known to third parties for the sole purpose of performing the purchase contract (for example, the bank for the provision of remote electronic payment services by credit/debit card).

7.Transfers outside the EEA

Your data will not be disseminated. They may also be transferred outside the EEA, always ensuring adequate levels of protection and safeguards, through technical and organisational measures to protect them and the execution of Standard Contractual Clauses, in accordance with applicable law. You may contact the Joint Controllers at any time to find out where your data are located and to obtain a copy of them.

8.Data retention period

With the exception of browsing data, the retention of which is detailed in the Cookie Policy [Cookie Policy | Herno S.p.A.], personal data relating to registration, access and use of the user’s personal account on the Site are retained for as long as the account is active and in use; unused accounts are deleted within two years of the last access to or use of the account. Data processed to provide a service or to respond to specific user requests will be retained for the time necessary to handle the request and for any further time necessary for the Joint Controllers to meet the need or request received. Data processed for purposes connected with sales are retained for the period necessary to perform the contract and the related services, and for the subsequent period required by civil and tax law, up to a maximum of 10 years. Finally, where the user has given consent, data collected for the purpose of analysing and studying consumer habits and choices are retained for a maximum of 4 years from the date consent was given.

9.Rights granted to the data subject under privacy law

The data subject always has the right to obtain from the Joint Controllers confirmation as to whether or not personal data concerning them exist and to have such data communicated in an intelligible form. The data subject also has the right to obtain information about the source of the personal data, the purposes and methods of the processing, the logic applied in the case of processing carried out with the aid of electronic tools, the identification details of the joint controller and of the data processors, and the persons or categories of persons to whom the personal data may be communicated or who may become aware of them, for example as data processors or persons otherwise authorised to process the data. The data subject further has the right to request the updating, rectification or, where they have an interest, the integration of personal data, the erasure, anonymisation or blocking of personal data processed unlawfully, including data whose retention is not necessary for the purposes for which they were collected or subsequently processed; and certification that the above operations, including their content, have been brought to the attention of those to whom the data were communicated, except where this proves impossible or involves a manifestly disproportionate effort compared to the right protected. The user also has the right to data portability.

The data subject also has the right to object, in whole or in part (withdrawal of consent), to the processing of personal data concerning them. 

The above rights may be exercised by writing to privacy@thelevelgroup.com, dpo@thelevelgroup.com, or privacy@herno.it.

Finally, please note that you always have the right to lodge a complaint with the competent Supervisory Authority (www.garanteprivacy.it). 

Last Update: 21/10/2026