PRIVACY POLICY

1. General Information Who is the Data Controller?
YNAP Corporation, a Delaware corporation having an address at 111 West 33rd, 11th floor, New York, NY 10120 (“YOOX USA”), is the Data Controller, the subject who decides how and why to process your personal data.
YOOX USA is a subsidiary of YOOX NET-A-PORTER GROUP S.p.A., an Italian company having an address at Via Morimondo, 17, 20143 Milano, Italy ("YOOX Italy").
You can always contact YOOX USA in writing to the above address, calling 18555294494 or writing to our Customer Care and selecting “privacy”.

2. What personal data do we collect? The categories of personal data that YOOX USA collects and treats when you browse or purchase on yoox.com/us are as follows:
a) We collect the personal data required to conclude and execute your purchase on yoox.com/us such as your name, email address, shipping address, billing address, phone number and payment details as well as your purchase (and return) history;
b) We collect your e-mail address when you sign up for our newsletter service;
c) We process the personal data you provide us when you contact our Customer Care to request assistance;
d) With your prior consent, we collect your personal data for marketing purposes;
e) For the registration of your Myoox account, we collect your name and surname, your e-mail address, password and your date of birth. If you are a registered user, we collect information about your access to the reserved area of the US Site. Subject to your express consent, and through the analysis of your personal data, we process information about your interests and preferences relating to our products and services, in order to customize the US Site and the commercial offers based on your interests. In case of authentication to the Myoox account through external social networks, we collect from these third parties the data necessary for registration/authentication through Facebook, and through Google. We collect information about you also from third parties and, in particular, from Facebook and Google. This information includes the following data categories: e-mail address.
f) We collect information about your browsing on yoox.com/us, such as the pages you visit and how you interact with the single page and we save this information on our servers.
g) In the event that you provide YOOX USA with personal data of third parties, for example if you decide to buy a product to be delivered to a friend, or to send it as a gift, YOOX USA will arrange to deliver the privacy policy to the third party at the time of the first communication. We remind you that the use of personal data of third parties is subject to the discipline regarding the protection of personal data.
We inform you that YOOX USA does not process personal data relating to minors. If you access yoox.com/us and use the services offered by YOOX USA you declare that you are of legal age.

4. Your Myoox profile As part of your Myoox account, we offer you the possibility to use the following services:
• My orders: Track the shipping of your orders, change or return items that are not for you and see the history of your orders.
• Dream Box: Save the items you wish and watch for their availability.
• Secret Preview: Preview the new arrivals every week.
• Moneyoox: Choose the simplest and fastest refund method for the items you want to return. Use the virtual credit for your upcoming orders.
• Premiere: Save your searches while shopping and stay updated on new arrivals of the items that interest you most.
• My Data: Manage your registration data.
• My Addresses: Save or change your addresses to have them always at hand and complete your purchases faster.
• My Cards: Save or change your card information and complete your orders faster and always safely.
• My Sizes: Create your personal profile and only pick products in your perfect size.
• YOOXMIRROR: Create your own personalized avatar.
With your express consent YOOX USA will customize your experience and the contents of the commercial communications and offers that you will see when you browse on yoox.com/us as a registered user, based on your interests. This activity facilitates your search for products and services tailored for you and that might interest you, and at the same time allows us to improve our offer for you. The customization is made possible by the analysis of your personal information in our possession, described in the previous section “What personal data do we collect?”. In particular, the information on purchases you have made in the past and those relating to the sections of the US Site you visit most often or the services you use most often help us to understand what products and services you are most interested in.
To ensure that the information we have is correct and allow us to carry out the activities aforementioned, we invite you to access the “My profile” section of your Myoox and, if you deem it necessary, to update them.

5. Cookies

6. Legal basis of processing activities We only process your personal data in the presence of one of the conditions provided for by applicable law, and specifically:
a) for the conclusion and execution of a contract of which you are a party. When we process your data for the conclusion of the purchase contract of which you are a party, we ensure that we only use the minimum information necessary for its execution. This basis legitimizes the processing of personal data, which takes place in the following activities: - conclusion and execution of a purchase contract for the products offered on yoox.com; - registration on the Website and use of services reserved for registered users; - provision of services offered on yoox.com and the App; - management of your requests by our Customer Service department, including processing of returns. The provision of your personal data for these activities is a contractual obligation. You have the choice to provide your data, however without the data requested it will not be possible to conclude or execute the contract and/or your requests. This means that you will not be able to purchase products, you will not be able to use YOOX services, and YOOX will not be able to process your requests;
b) to comply with a legal obligation. In the event of conclusion of a contract for the purchase of goods on yoox.com, the processing of the User's data will take place in order to fulfill the legal obligations to which YOOX is held in accordance with tax provisions and other regulations to which YOOX is subject. You are free to decide whether to conclude a contract and disclose your data; if you conclude a contract, your data will be required and processed to give effect to the aforementioned legal obligations to which YOOX is held to comply. The processing of resumes received, which is carried out to evaluate candidates with respect to a job position at YOOX, is legitimate as it is expressly authorized by law, which specifies the consent of the person to whom personal data refer. You are free to send us your resume; failing that we will not be able to evaluate your candidacy for a job position at YOOX;
c) to fulfil a legitimate interest of ours. Your personal data may also be processed to prevent and prosecute fraudulent activity, counterfeiting and abusive conduct (also by third parties) that constitute a violation of current legislation, contractual provisions applicable to the Site, the App and the related services, and regulations on honesty and good faith. In such case, the processing of your data is not performed under any legal or contractual obligations, but to respond to a legitimate interest of ours. For internal administrative purposes, data may be processed by companies belonging to the YOOX NET-A-PORTER GROUP.
d) based on your consent. We will carry out the following processing activities only if you have given us your express consent:
• performance of marketing activities, opinion polls and market research;
• analysis of your browsing and consumption habits in the use of your Myoox profile, in order to personalize your experience on our site. The provision of your personal data for these activities is voluntary. You are under no obligation to provide us with your data for these purposes, but without it, it will not be possible for YOOX to carry out marketing activities, opinion polls and market research, or analyze your habits.

7. Who will process your data? Your personal data will be processed by YOOX USA internal staff specifically trained and authorized for this purpose. In the performance of the processing, the data may also be transmitted to YOOX Italy with headquarters in Via Morimondo, 17, 20143 Milano, Italy, who has been appointed Data Processor for the processing performed on behalf of YOOX USA.
Your personal data will also be transmitted to third parties that we use to provide our services; these subjects have been adequately selected and offer a guarantee of compliance with the rules on the processing of personal data. These persons have been appointed as data controllers and carry out their activities according to the instructions given by YOOX USA and under its control.
The third parties in question belong to the following categories: banking operators, Internet providers, companies specialized in IT and telematic services; couriers; companies that carry out marketing activities; companies specialized in market research and data processing.
Your data may be transmitted to police and judicial and administrative authorities, in accordance with the law, for the detection and prosecution of crimes, the prevention and protection from threats to public security, to allow YOOX USA to ascertain, exercise or defend a right in court, as well as for other reasons related to the protection of the rights and freedoms of others.
In carrying out the data processing for pre-contractual performance and fulfilment as well as for marketing measures, YOOX, as a part of LuxExperience Group, will share your personal data with other affiliated entities of our parent company LuxExperience B.V. based on Art. 6 (1)(a) or (f) of the General Data Protection Regulation (Regulation (EU) 2016/679).

8. APP Version of the Website In addition to the data referred to in the paragraph "What personal data do we collect?", when you use the App version of our Website, YOOX may: a) with your express consent, collect personal data in the marketing activity, in order to send push notifications on your device. You can disable push notification at any time by changing your choice from the settings of your mobile device; b) upon your express consent, collect information in an automated manner, such as data relating to your traffic and use of the App or IP address, in order to improve our product and service offering;
c) to use the service, collect the information you wish to provide us with, such as your photo and sizes of clothing and accessories. We will retain this information until you decide to delete the profiles that you created yourself or do not require the cancellation of your Myoox account.

9. Web push notification We use some of your personal data to send you personalized notices on your device, upon your express consent, about new sales offerings and products from YOOX (so-called "web push notifications.")
In order to be able to send you these notifications, we use technologies similar to cookies (in particular "HTML5 Local Storage") which store information in the Local Storage area of your device. Some of your personal data is also saved on our servers - which are located in the European Union - in order to manage "web push notifications."
Communications are personalized based on how you navigate and use the Site and, in particular, based on the products you have viewed, purchased, or placed in your cart, or on the information you entered on the Site registration form, or while purchasing products on the site (in particular, your name to personalize communications sent to you, and your date of birth, to offer you promotions and discounts on your birthday.)
The categories of personal data used for this purpose are:
products purchased, viewed, or placed in cart;
name;
birthday;
gender (male or female);
language used to navigate and version of the Site used (country);
information on the device and browser you use;
date and time when you provided consent to receiving web push notifications;
date of creation of Myoox;
date of last visit to our site.

You may revoke your consent to receiving such personal notifications at any time by following the instructions below for your browser.
Main browsers:
Chrome: Settings > Show Advanced Settings > Privacy _ Content Settings > Notices > Manage exceptions > Enter www.yoox.com and select "Block"
Firefox: Options > Content > Notices - Select > www.yoox.com - "Block"
Safari: Preferences > Notices > From here set to "Refuse"

You may also even revoke your consent to receiving notifications for the communications you receive, by following the instructions below.

Desktop: Right-click on notice > disable notifications from www.yoox.com
Mobile: Access the notifications center > Site Parameters > Notices > Block notices from www.yoox.com

In any case, the service and related personal data in our possession will be deleted after 365 days from the date of your last visit to our Site.

10. Transfer of the data Some of the third parties listed in the previous paragraph “Who will process your data?” may be located in countries outside the European Union which, nevertheless, offer an adequate level of data protection, as established by specific decisions of the European Commission. (http://www.garanteprivacy.it/home/provvedimenti-normativa/normativa/normativa-comunitaria-e-intenazionale/trasferimento-dei-dati-verso-paesi-terzi#1).
The transfer of your personal data to countries that do not belong to the European Union and that do not ensure adequate levels of protection will be performed only after conclusion between YOOX USA and said subjects of specific agreements, containing safeguard clauses and appropriate safeguards for the protection of your data personal so-called "standard model clauses", also approved by the European Commission, or if the transfer is necessary to the conclusion and execution of a contract between you and YOOX USA (for the purchase of goods offered on our US Site, for registration on the US Site or the use of services on the US Site) or for the management of your requests.

11. For how long do we keep your data? We keep your personal data for a limited period of time; depending on the type of activity that involves the processing of your personal data.
After this period, your data will be permanently erased or otherwise rendered anonymous in an irreversible way.
Your personal data is stored in compliance with the terms and criteria specified below:
a) Data collected to conclude and execute contracts for the purchase of goods on yoox.com/us: Until the administrative and accounting formalities have been met. The billing data will be kept for ten years from the date of the invoice;
b) The data of the registered User: The data will be stored until you request cancellation of your Myoox profile;
c) Payment data: Until payment certification and the conclusion of its administrative and accounting formalities resulting from the expiration of the right of withdrawal and the terms applied for contesting the payment;
d) Data collected in the context of the use of services offered on yoox.com/us to the user: these data are retained until the termination of service or cancellation of the subscription to the service by the user;
e) Data related to the requests of the users to our customer service: The useful data to assist you will be kept until the fulfillment of your request;
f) CV: For six months from receipt;
g) Data used for commercial communication activities towards users who purchase products on yoox.com/us (soft spam): These data are kept until the termination of service or the exercise of the opposition by cancellation by the user;
h) Data provided for commercial communications activities, opinion polls and market research: Until the request to interrupt the activity and in any case within 2 years from the last interaction of any kind of user with YOOX USA;
i) Data used to personalize the US Site and to show customized commercial offers: As long as the user does not request the cessation of the activity and in any case within two years from the last interaction of any kind of user with YOOX USA;
j) Data used for conducting market research and surveys for the detection of satisfaction: As long as the User does not request the termination of the activity.
k) data in our possession to manage web push notifications: until the user revokes consent and in any case for a maximum of 365 days from the date of the user's last visit to our Site.

In any case, for technical reasons, the termination of the processing and the subsequent cancellation or irreversible anonymisation of the related personal data will be final within thirty days of the terms indicated above. 12. Children’s rights YOOX USA does not sell products or services for purchase by children, but by adults. If you are under 18, you may use the US Site only with the involvement of a parent or guardian. In accordance with the Federal Children's Online Privacy Protection Act of 1998 (COPPA), yoox.com/us does not knowingly collect, solicit or use personal data of children under the age of 13 provided without parental consent, and will delete any such data should we become aware that a user under the age of 13 has registered without verifiable parental consent. Therefore, if you are not 18 years or older, you are not authorized to use our US Site. 13. Rights of California residents

14. Your rights At any time you can exercise the rights with reference to the specific processing of your personal data by YOOX USA. Find below their general description and how to practice them.
a) Access your data and modify it: you have the right to access your personal data and to request that they be correct, modified or integrated with other information. If you wish, we will provide you with a copy of your data in our possession.
b) Revoke your consent: You can revoke at any time a consent you have given for the processing of your personal data in relation to any activity for marketing purposes. In this regard, we remind you that marketing activities are considered the sending of commercial and promotional communications, the conduct of market research and surveys for the detection of satisfaction for the customization of the US Site and commercial offers according to your interests. Upon receipt of your request, we will promptly cease the processing your personal data based on this consent, while different processings or based on other conditions will continue to be carried out in full compliance with the provisions in force.
c) Opposing the processing of your data: You have the right to object at any time to the processing of your personal data on the basis of our legitimate interest, explaining the reasons that justify your request; before accepting it, YOOX USA will have to assess the reasons for your request.
d) Delete your data: In the cases provided for by current legislation you can request the deletion of your personal data. Upon receipt and assessment of your request and, if legitimate, it will be our care to cease timely processing and delete your personal data.
e) Request that the processing of your personal data is temporarily limited: In this case, YOOX USA will continue to keep your personal data but will not process it, unless it is subject to your different request and the exceptions established by law. You can get the limitation of processing when you dispute the accuracy of your personal data, when the processing is unlawful but you oppose to the deletion of your data, when your data is no longer relevant for anymore but you need to exercise your right in court and when you oppose your processing, in the period in which we evaluate the reasons for your request.
f) Request your data or transfer it to a person other than YOOX USA ("right to data portability"). You may request to receive your data that we process based on your consent or on the basis of a contract with you in a standard format. If you wish, and where technically possible, we can, upon request, transfer your data directly to a third party of your choice.
In order to exercise some of your rights aforementioned you can access your Myoox account, or alternatively, you can contact us by calling 18555294494, or by writing to our Customer Care and selecting “privacy”, or by writing to the address of the data controller aforementioned.
In order to ensure that the data of our users is not infringed or illegitimately used by third parties, we will request you for some information to be sure of your identity before accepting your request to exercise one of the rights indicated.

15. Security measures We protect your personal data with specific technical and organizational security measures, aimed at preventing your personal data from being used illegitimately or fraudulently. In particular, we use security measures that guarantee: the pseudonymisation or the encryption of your data; the confidentiality, integrity, availability of your data as well as the resilience of the systems and services that process them; the ability to restore data in the event of a data breach. Furthermore, YOOX USA undertakes to test, verify and regularly evaluate the effectiveness of technical and organizational measures in order to guarantee the continuous improvement in the safety of processings.

16. Claims If you believe that the processing of your personal data has been unlawfully done, you can file a complaint with the competent authority regarding the protection of personal data in your country. We also inform you that, according to the European legislation to which the Data Processor of Italy is subject, you can also contact the Italian Data Protection Authority. Further information on how to file a claim is available on the site of the Italian Data Protection Authority, at http://www.garanteprivacy.it.

17. Changes to the present policy The constant evolution of our services may involve changes in the characteristics of the processing of your personal data described up to now. Consequently, this privacy notice may be subject to changes and additions over time, which may also be necessary with regard to new regulatory measures regarding the protection of personal data.
We request of you, therefore, to periodically check the contents: where possible, we will try to inform you promptly about the changes made and their consequences
The updated version of the privacy notice, in any case, will be published on this page, with indication of the date of its last update. 18. Legislative references and useful links The processing of your personal data is performed by YOOX USA, which also uses the Data Processor YOOX Italy processing, which, having its registered office in the EU, is subject to the General Data Protection Regulation (UE) 2016/679, the rules on the processing of personal data and Italian measures of the Italian Data Protection Authority (http://www.garanteprivacy.it).