Privacy Policy

CHURCH’S is committed to protecting your personal information (“Personal Data”) and to processing it fairly and responsibly. This Privacy Policy describes how we process your Personal Data collected through the website www.church-footwear.com/it/en.html (the “Site”), as well as through mobile applications, digital platforms, physical stores and other locations where this Privacy Policy is referenced or made available.

The data controller is Prada S.p.A. (“CHURCH’S”, “we” or “our”), the operating holding company of the Prada Group, with registered office at Via Antonio Fogazzaro 28, Milan (Italy), which manages the sale of the products offered on the Site and in the stores located in Italy.

You may contact the Prada Group Data Protection Officer (DPO) at privacy@prada.com.

Personal Data is information that can identify you directly or indirectly. We collect your Personal Data when you interact with CHURCH’S, for example by purchasing products, using our services, browsing the Site, visiting our stores, contacting us or taking part in events, promotions and surveys.

Depending on the interaction, Personal Data may include:

• Identification and contact data: first and last name, age, date of birth, gender, nationality, language, telephone number and e-mail address.
• Purchase and payment data: billing and delivery addresses, order identifiers and details, transaction and payment method information.
• Account data and preferences: if you register a personal account, username, password, communication and purchase preferences and purchase history, interests and preferences that you choose to share in the course of contacts or meetings with our Client Advisors, such as, by way of example, preferences relating to our collections, size, favourite colours and materials, feedback and survey responses.
• Device and browsing data: IP address, operating system, browser type and information on your browsing of the Site.
• E-mail interaction data: message opens, date, time and number of opens, IP address, type of device and e-mail client used, technical identifiers of the message and of the campaign.
• Support and communications data: recordings of calls and chats with customer service and other correspondence with us.
• Security and identity verification data: video recordings at our stores and other locations equipped with a video surveillance system, including spaces hosting CHURCH’S events, and information obtained during authentication or identity checks, for example when we ask you to show an identity document when collecting a purchase in store.

Information provided directly by you:

We collect Personal Data primarily from you, through the Site, mobile applications, social media channels, our stores and other contact channels. For example, when you:

• purchase products online, remotely or in store;
• create a personal account or subscribe to the newsletter;
• book an appointment, visit our boutiques or contact customer service;
• interact with us on social media or take part in events, promotions and surveys.

CHURCH’S uses this information to identify you as a customer, manage orders, payments and requests, and provide and improve our products and services.

Data collected automatically:

When you visit the Site or use our apps, we automatically collect information about your device, connection and browsing, including through cookies and similar technologies. This information includes the IP address, Internet provider, operating system, date and time of access, referring site, browsing activities and selected preferences.

We use this data to manage, protect and improve the Site and our systems, identify technical problems, analyse use of the Site and visitor preferences, personalise the browsing experience, send targeted advertising and measure the effectiveness of advertising campaigns.

The use of cookies and similar technologies not strictly necessary to enable you to browse the Site securely or use the apps securely takes place, where required, on the basis of your consent expressed through the cookie settings, as further described in our Cookie Policy.

You can configure your browser to receive alerts about cookies or to refuse them; disabling certain cookies may impair the functioning of some features of the Site. To find out which cookies are used and how to disable them or withdraw any consent, please consult our Cookie Policy.

When you interact with our newsletters and other commercial and promotional communications, we may also automatically collect data relating to your interaction with such communications through tracking technologies, such as tracking pixels, i.e. very small, invisible images which, when the message is opened, allow us to detect whether and when the e-mail was opened, measure the effectiveness of our communications and offer more useful and relevant content. Tracking pixels do not allow us to read the content of your e-mails.

We currently do not respond to browser “do not track” signals, as we do not track users across third-party websites.

Data from other sources:

We may receive personal data from third parties (such as fraud detection and prevention service providers) or from public sources (such as government watchlists) in order to meet legal and regulatory requirements and for fraud detection and prevention purposes. The categories of Personal Data we may receive from such sources include: identification data, transaction-related information and data necessary for identity verification.

MANDATORY OR OPTIONAL NATURE OF PROVIDING DATA

Providing Personal Data is generally optional. However, some data is necessary to manage your purchases or provide the services you request, for example for Purchases and support purposes: if you do not provide it, we may be unable to fulfil your request.

For certain services and operations, such as Account creation and management, it may be necessary to provide an e-mail address. We use it, for example, to send service communications, verify identity or account ownership, including by means of a one-time passcode (OTP), and correctly link the interactions and operations of the same customer, avoiding duplication. The use of e-mail for these purposes is separate from consent for Marketing purposes.

You may choose not to create an account or not to receive commercial communications. You may still purchase and use ordinary services without registration, in “guest” mode or as a generic customer.

You may withdraw your consent or change your communication preferences, and choose to continue receiving our marketing e-mails without tracking technologies, by writing to privacy@prada.com, using the Contacts section of the Site or through the links included in all our commercial electronic communications, or through the other available means, for example in your online account.

We are committed to protecting the privacy of minors. Our Site and services are intended for use by persons who are of legal age in the country or territory where they reside and are not directed at minors. In order to protect the privacy of minors, CHURCH’S does not knowingly collect Personal Data of minors under the age of 16 without the prior consent of the holder of parental responsibility. We therefore ask you not to provide us with the Personal Data of persons who do not meet this requirement.

Please contact us at privacy@prada.com or through the Contacts section of the Site if you believe that we have collected Personal Data relating to the minor over whom you exercise parental responsibility without your consent. We will carry out the appropriate checks and, where appropriate, delete such data.

We use your Personal Data for the following purposes:

(a) Manage purchases, orders, deliveries, payments, exchanges and returns; provide the information and services requested, including warranty and repair services; respond to your requests and handle complaints ("Purchases and support").

(b) Enable you to register and use a personal account, retain your purchase history and access services reserved for registered customers, such as faster checkout, simplified repair and warranty procedures and assistance in Prada Group stores ("Account creation and management").

(c) Offer you an experience and assistance in line with your interests, by analysing your preferences and purchase habits relating to Church’s and the other brands of the Prada Group, including in order to propose relevant products and services, assist you more effectively during your visits to the boutique or when you contact customer service, and offer you a consistent level of service within the Prada Group ("Personalisation and Clienteling"). Personalisation activities do not produce legal effects concerning you or decisions based solely on automated processing within the meaning of Article 22 GDPR;

(d) Subject to your consent, send you newsletters, offers, catalogues and other promotional communications relating to Church’s and the other brands, products and services of the Prada Group, including invitations to events, pre-sales and special initiatives, by telephone, e-mail, social networks, messaging applications and other electronic or digital channels ("Marketing"). As part of e-mail marketing communications, we also use tracking pixels to detect whether and when communications are opened, measure their effectiveness and offer more useful and relevant communications ("E-mail measurement").

(e) With reference to customers who have already made a purchase, CHURCH’S may also send commercial communications relating to products or services similar to those already purchased, by e-mail, without the need for your prior consent, subject to your right to object at any time through the link at the foot of each e-mail received ("Soft spam"). Communications sent as Soft spam do not contain tracking pixels enabling individual measurement of opens.

(f) Prevent and counter fraud, theft and other unlawful activities, safeguard the security of our online and physical operations, manage disputes and establish, exercise or defend our rights ("Security and protection of rights").

(g) Carry out statistical analyses, market research and surveys, assess the quality of services and provide internal training; analyse in aggregate form conversions and the effectiveness of marketing campaigns ("Analysis and improvement of services").

(h) Comply with applicable legal and regulatory obligations, including tax, accounting and record-keeping obligations relating to transactions ("Legal compliance").

(i) Share your Personal Data with the other companies of the Prada Group for internal administrative needs and to coordinate services, offering you consistent assistance even when you interact with stores in different countries ("Group coordination and services").

(j) Manage the sale, merger, transfer or reorganisation of all or part of our business, including by sharing or transferring your Personal Data and the information relating to the consents given ("Corporate transactions").

Before processing your Personal Data for further purposes, we will provide you with the necessary information and, where required, ask for your consent.

For each of the purposes described in paragraph 4, we process your Personal Data on the basis of the following legal grounds:

• For the purposes of Purchases and support and Account creation and management, processing is necessary to perform the contract with you or to take pre-contractual steps at your request (Article 6(1)(b) GDPR).
• For the purposes of Personalisation and Clienteling, Security and protection of rights, Analysis and improvement of services, Group coordination and services and Corporate transactions, processing is based on CHURCH’S legitimate interest in offering you an experience in line with your preferences, protecting its business and its rights, improving services and the effectiveness of campaigns, coordinating the Group’s administrative activities and services and managing corporate transactions. This processing is carried out only where your interests or fundamental rights and freedoms do not override it (Article 6(1)(f) GDPR).
• For Marketing purposes, including E-mail measurement through tracking pixels, we process your Personal Data on the basis of your prior consent (Article 6(1)(a) GDPR and Article 122 of Legislative Decree No. 196/2003). You may subsequently choose to continue receiving our marketing communications without tracking pixels.
• For Soft spam, processing is based on CHURCH’S legitimate interest, in accordance with Article 130(4) of Legislative Decree No. 196/2003. You may object to such communications at any time.
• For Legal compliance, processing is necessary to comply with the legal obligations to which CHURCH’S is subject (Article 6(1)(c) GDPR).

Consent to marketing is optional and may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. You may use the links in the newsletters and other commercial communications, choosing whether to unsubscribe or to continue receiving communications without tracking pixels, change the preferences in your account or contact us at privacy@prada.com or through the Contacts section of the Site.

We process your Personal Data using electronic tools or on paper, lawfully and fairly and for the purposes indicated in this Privacy Policy. We adopt organisational, technical and physical measures to protect it against undue loss, alteration, deletion or destruction, unauthorised access and unauthorised use.

Our internal procedures govern the use and protection of data, respect for your privacy choices, the handling of complaints and access requests, action in the event of personal data breaches and the deletion of data no longer needed.

We limit access to Personal Data to staff who need it to perform their duties and require service providers to protect the data they access in order to carry out the activities entrusted to them.

For the purposes described in this Privacy Policy, we may share your Personal Data with:

• Companies of the Prada Group, to coordinate the Group's activities and services. If you create an account, your data will be shared with the Group's stores to offer you consistent assistance worldwide. The list of the companies and countries in which we operate is available here.
• Service providers, including hosting and cloud, payments, shipping and marketing, including e-mail delivery platforms. When they process data on our behalf, they operate according to our instructions as data processors pursuant to Article 28 GDPR and are bound by confidentiality obligations.
• Anti-fraud service providers, including Riskified Ltd. (Israel, a country covered by an adequacy decision of the European Commission), to detect and prevent fraudulent online transactions. For more information, please consult Riskified's privacy policy.
• Authorities and other competent bodies, where necessary to comply with legal obligations, respond to legitimate requests or prevent and counter unlawful acts and threats to the safety of individuals.
• Parties involved in corporate transactions, in the event of the sale, merger, transfer or reorganisation of all or part of our business, including the information relating to the consents given.

Your Personal Data may be transferred outside the European Economic Area in compliance with applicable law and with the required safeguards, including, where applicable, the Standard Contractual Clauses approved by the European Commission or on the basis of an adequacy decision pursuant to Article 45 GDPR. For more information on the countries to which we transfer data and the applicable safeguards, you may contact us at privacy@prada.com.

We keep your Personal Data for as long as necessary for the purposes for which it was collected, in compliance with the periods provided for by law. For processing based on consent, retention ceases in any event upon withdrawal, unless it is necessary to keep the data for other purposes based on a different legal basis.

For Purchases and support purposes, we keep your Personal Data for the duration of the contractual relationship and for a further 10 years for civil, tax and accounting obligations.

If you have a personal account, we keep the Personal Data associated with the account for Account creation and management and Personalisation and Clienteling purposes, for 7 years from the last purchase or the last interaction initiated by you with us, unless you request deletion of the account beforehand.

For Marketing and E-mail measurement purposes, we keep your Personal Data until consent is withdrawn and in any event for a period not exceeding 7 years from the last purchase or last interaction. E-mail measurement data will no longer be collected if you choose to disable tracking of marketing communications.

If you are subscribed to the newsletter but do not have a personal account, we keep the e-mail address until consent is withdrawn.

For Security and protection of rights purposes, Personal Data is kept for the period necessary to manage the investigative activity or for the duration of the dispute and for the subsequent applicable limitation periods. The retention of data collected by the video surveillance system is limited to 24-72 hours, save for specific needs.

For Analysis and improvement of services purposes, we keep Personal Data in aggregated or anonymised form; where the processing concerns identifying personal data, retention does not exceed 24 months from collection.

For Legal compliance purposes, Personal Data is kept for the periods provided for by the specific applicable legal provisions.

We may keep data longer where necessary to comply with legal obligations or to establish, exercise or defend a right.

At the end of the applicable period, we securely delete the data or render it anonymous.

You may exercise the rights recognised by the applicable data protection legislation, including Regulation (EU) 2016/679 ("GDPR"). In particular, in the cases provided for by law, you may request access to your Personal Data, its rectification, erasure, and the restriction of processing, that is, that your Data be kept without being further used, save in the cases permitted by law.

Where processing is based on consent, you may withdraw it at any time and free of charge, without affecting the lawfulness of processing carried out before withdrawal.

You may request the portability of the Personal Data provided by you and processed by automated means for the purposes of Purchases and support, Account creation and management and Marketing, receiving it in a structured, commonly used and machine-readable format and, where technically feasible, requesting that it be transmitted directly to another controller.

You may object to the processing of your Personal Data based on our legitimate interest for the purposes of Personalisation and Clienteling, Security and protection of rights, Analysis and improvement of services, Group coordination and services and Corporate transactions. You may also object at any time to the sending of promotional communications relating to similar products or services (Soft spam), without the need to give reasons, using the unsubscribe link in the communications or by contacting us at privacy@prada.com.

If you believe that the processing of your Personal Data takes place in breach of applicable law, you may lodge a complaint with the competent supervisory authority pursuant to Article 77 GDPR or bring proceedings before the courts pursuant to Article 79 GDPR.

To exercise your rights, please send a written request to privacy@prada.com  or use the Contacts section of the Site.

We may update this Privacy Policy over time. The version in force is always available on the Site, with the date of the last update.

In the event of material changes, we will inform you and, where required by applicable law, ask for your consent.

We invite you to consult this Privacy Policy periodically, in particular before providing us with your Personal Data.