Privacy Policy

  1. Privacy Policy

    LAST UPDATED: October 2026

    PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA
    A. Data Controllers

    Pursuant to Article 13 of Regulation (EU) No. 2016/679 “General Data Protection Regulation” (hereinafter “GDPR”)

    Exelite S.p.A. (formerly Liu Jo S.p.A.) with registered office in Via Tortona, 37 - 20144 - Milan (MI), Italy
    E-mail: privacyconsumer@liujo.it
    (hereinafter “LIU JO”)

    and

    Digital Boite S.r.l. with registered office in Via Cusani 5, 20122, Milan, Italy
    E-mail: dpo@digitalboite.com
    (hereinafter “DB”)

    (hereinafter jointly referred to as the “Data Controllers”) provide you with the following information regarding the collection, use, disclosure and processing of your personal data carried out through the website www.liujo.com (hereinafter the “Website”), the LIU JO mobile application (hereinafter the “App”) or any retail store belonging to the LIU JO mono-brand store network.

    In particular:

    • LIU JO is the owner of the Website and the App and acts as an independent Data Controller for personal data processed for marketing and profiling purposes;
    • DB acts as an independent Data Controller for personal data processed for purposes related to sales, invoicing, payment and delivery of products purchased through the Website and/or the App;
    • LIU JO and DB act as Joint Data Controllers for personal data processed for the following purposes:
      • registration on the Website and/or the App and use of services reserved for registered users;
      • store planning and sales analysis;
      • management of after-sales assistance requests (online and in physical stores) and returns;
      • management of requests related to the use of omnichannel services;
      • prevention of abuse and fraud.

    The essential content of the joint controllership agreement between LIU JO and DB is set out in the table below. Any further information regarding the content of the aforementioned agreement may be requested by writing to LIU JO or DB at the addresses indicated above or by contacting the Data Protection Officers at the contact details provided in the following section.

    Purpose Legal basis Personal data retention
    User registration on the Website/App and access to services reserved for registered users Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data will be retained until you request the deletion of your registration or, in any case, for the period necessary to provide the requested service
    Store planning and sales analysis Legitimate interest of the Data Controllers pursuant to Article 6(1)(f) GDPR Data relating to sales analysis activities, processed in aggregated form, are retained for three years
    Management of after-sales assistance requests (online and in physical stores) and returns Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data are retained until the request has been fulfilled and for an additional period of six months
    Management of requests related to the use of omnichannel services Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data are retained until the request has been fulfilled and for an additional period of six months
    Prevention of abuse and fraud Legitimate interest of the Data Controllers pursuant to Article 6(1)(f) GDPR Personal data are retained for the time strictly necessary to achieve the aforementioned purpose and, in any case, for the period required to ensure legal protection and to communicate data to the competent authorities

    For further information regarding personal data processed through the use of cookies and other similar tracking technologies, please refer to our Cookie Policy.

    B. Data Protection Officer (DPO)

    LIU JO and DB have each appointed a Data Protection Officer (DPO):

    • The Data Protection Officer (DPO) of LIU JO can be contacted at the following e-mail address: dpo@liujo.it;
    • The Data Protection Officer (DPO) of DB can be contacted at the following e-mail address: dpo@digitalboite.com.

    C. Categories of personal data processed

    Depending on the purposes pursued, we will process the following categories of personal data, by way of example and not limited to:

    • Identification data: first name, last name, date of birth, gender;
    • Contact data: telephone number, e-mail address;
    • Authentication data: username, password;
    • Shipping information: domicile address, residence address, any additional addresses useful for delivering the order;
    • Billing and tax free information: billing address, first and last name, company name, tax code, VAT number, nationality, passport number;
    • Information relating to purchases made: item, size and colour, price, date of sale, amount spent;
    • Data relating to the customer profile and preferences: data relating to purchasing habits;
    • Browsing data: data collected during the visit and consultation of the Website or the App, including through cookies or other tracking technologies (for further information on the processing of your data through such technologies, please refer to the Cookie Policy);
    • Geolocation data (store locator service): IP address;
    • Data relating to loyalty programmes: points, clusters, discounts, vouchers.
    • Information collected through the use of tracking pixels: email opening event (date and time), IP address of the recipient's device, User Agent (type of email client, operating system, device), browser information, internal subscriber identifier, number of times the same message is opened. To learn what tracking pixels are and how they work, see our Cookie Policy.
    • Click-through information (i.e., interactions recorded when a user clicks on a hyperlink within an email): internal subscriber and sender identifier, clicked link (URL and/or name assigned to the link) and date/time of the click, device IP address and user agent, total clicks and unique clicks. Such personal data may also be processed anonymously to measure the effectiveness of information and promotional campaigns and improve the services offered.

    Any additional data communicated in order to use specific Services offered by LIU JO.

    D. Purposes, legal basis of processing and data retention periods
    Purpose Legal basis Retention period
    Provision of sales services and any additional services requested by Customers in store Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data will be retained for the time necessary to perform the contract relating to the services provided to you and, in any case, no longer than 10 years from termination of the contract, without prejudice to further retention periods required by applicable law
    Management of customer care and after-sales support services, both online and in store, including support activities relating to payments, shipments, returns and refunds, as well as additional services offered by LIU JO. Please note that the Website includes a generative artificial intelligence chatbot designed to facilitate communication and provide responses. The chatbot may respond to both general queries (for which the provision of personal data is not required) and specific queries for which you may be asked to log in or provide additional information in order to process your request (e.g. order number, e-mail associated with the loyalty profile). If you wish to speak directly with an operator, we kindly ask you to use traditional channels and not to continue the conversation through the chatbot. If the chatbot does not provide the response you require, you may, through the same tool, obtain all the necessary information to contact a human operator or use the traditional contact methods made available on the Website. Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data processed for the purpose of handling your requests will be retained until the request has been fulfilled and for an additional period of 6 months
    Operational management of browsing and security of the Website or the App Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR Personal data processed will be retained for 7 days from the date of visit and consultation of the Website or the App. For data relating to cookies, please refer to the specific Cookie Policy
    Management of administrative, accounting and tax obligations required by law Compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) GDPR Personal data processed to comply with legal obligations will be retained in accordance with the time limits set by applicable legislation.
    Performance of the online sales contract and related after-sales activities. Please note that the Website includes a generative artificial intelligence chatbot designed to facilitate communication and provide responses regarding support services related to payments, shipments, returns and refunds. The chatbot is able to respond to specific requests (e.g. shipment status; returns) and you may be required to log in or provide additional information in order to process your request (e.g. order number, e-mail associated with the loyalty profile). If you wish to speak directly with an operator, we kindly ask you to use traditional channels and not to continue the conversation through the chatbot. If the chatbot does not provide the response you require, you may, through the same tool, obtain all the necessary information to contact a human operator or use the traditional contact methods made available on the Website. Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data processed will be retained for the time necessary to perform the contract, including the provision of statutory or contractual warranties, and in any case no longer than 10 years following termination of the contract, without prejudice to further retention periods required by applicable law. Personal data processed for handling your requests will be retained until the request has been fulfilled and for an additional period of 6 months.
    User registration on the Website or the App. Registration may take place by completing a data collection form available on the Website and the App. Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data collected for registration purposes will be retained until you request deletion of your account
    Provision of online customer services, including technical support to recover access credentials to your personal account Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data processed to provide the requested service will be retained for the time necessary to perform the service or until you request to withdraw from the service. Data processed to respond to customer requests will be retained until the request has been fulfilled and for an additional period of 6 months.
    Provision of omnichannel services offered to customers, such as, by way of example and not limited to, Click&Collect or Reserve in Store services Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data will be retained for the time necessary to perform the service or until you request to withdraw from the service
    Provision of the Store Locator service, consisting in identifying the nearest store based on your current location Freely given, specific, informed, unambiguous and revocable consent of the data subject pursuant to Article 6(1)(a) GDPR Data will be retained until you withdraw your consent
    Prevention of abuse and fraud Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR Personal data are retained for the time strictly necessary to achieve the aforementioned purpose and, in any case, for the period required to ensure legal protection and communication to the competent authorities
    Establishment, exercise or defence of legal claims and out-of-court debt collection Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR Personal data will be retained for the entire duration of the debt recovery activity and, in the event of legal proceedings, for the entire duration thereof, until the expiry of the time limits for bringing appeals
    Sending of “soft spam” communications via e-mail, i.e. commercial communications relating to products and services similar to those you have purchased Exemption provided for by Article 130(4) of the Italian Privacy Code Personal data will be retained until you object to receiving such communications, which can be done via the link available at the bottom of each e-mail

    Marketing activities, such as sending commercial communications regarding products and services (news, new arrivals, exclusives, offers and promotions), sending newsletters and carrying out market research and surveys aimed at measuring customer satisfaction in order to improve services and customer relationships

    Use of tracking pixels in email communications. The emails that LIU JO sends may contain tracking tools (known as tracking pixels) that allow us to detect whether the message has been opened and to collect related technical information (please see the see “Categories of data processed” section). This information is processed for the following purposes:

    • to measure campaign performance (open rate, engagement);
    • to optimise deliverability (guarantee correct reception);
    • to evaluate and improve a promotional campaign in order to modify communications based on email opens.

    Freely given, specific, informed, unambiguous and revocable consent of the data subject pursuant to Article 6(1)(a) GDPR

    You may withdraw your consent at any time by using the dedicated link provided in the footer of every email communication you receive.

    Personal data collected for marketing purposes will be retained until you withdraw your consent. Personal data relating to purchase details processed for marketing purposes will be retained for 24 months from their collection. Upon expiry of the above retention periods, the data will be automatically deleted or permanently and irreversibly anonymised.

    Personal data processed as a result of the use of tracking pixels will be retained for 6 months from the date of collection. After this period, the data will be deleted or anonymised and used for statistical purposes. 
    Profiling activities using the navigation and shopping habits of registered users via the data provided by the users, data provided by the use of the Website or the App, and from data relating to the details of purchases made on the Website, on the App or in store and data collection via the analysis of user interaction with emails sent by LUI JO (for example, clicks on links contained in emails), in order to understand user preferences, interests, and characteristics; to segment customers; to personalise content and commercial offers; and to develop automated marketing campaigns and customer journeys based on the behaviour and interests demonstrated by the data subject.

    Freely given, specific, informed, unambiguous and revocable consent of the data subject, pursuant to Article 6(1)(a) GDPR

    You may withdraw your consent at any time by using the dedicated link provided in the footer of every email communication you receive.

    		 Personal data collected for profiling purposes will be retained until you withdraw your registration from the Website or the App or withdraw your consent to data processing. Personal data relating to browsing activity and purchase details processed for profiling purposes will be retained for 24 months. Upon expiry of the above retention periods, the data will be automatically deleted or permanently and irreversibly anonymised.
    Recruitment activities, including the storage and management of applications and documents (such as CVs) submitted through the “Careers” section of the Website

    Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR

    For special categories of data (e.g., health status), the legal basis is the need to fulfil the obligations and exercise specific rights of the Data Controller or the data subject in the field of employment and social security and social protection law, to the extent authorised by European Union or Member State law or by a collective agreement pursuant to Member State law, providing appropriate safeguards for the fundamental rights and the interests of the data subject pursuant to Article 9.2, letter b) of the GDPR. 

    		 Personal data collected will be retained for the period strictly necessary for candidate selection for specific positions and, in any case, no longer than 12 months from their submission. Before the expiry of this period, the Data Controllers may contact you to verify your interest in being considered for future positions. In the absence of a response or in case of a negative response, your personal data will be deleted. In the event of a positive response, your data will be retained for a further 12 months.

    E. Provision of data

    The provision of data for the purposes based on the legal grounds referred to in Article 6(1)(b), (c) and (f) GDPR is necessary in order to pursue the aforementioned purposes. With reference to the use of the chatbot, if you do not wish to use the chatbot, you may contact a human operator and/or use the traditional contact methods made available on the Website.

    The disclosure of data for the purposes for which a legal basis of consent is provided, as per art. 6.1 lett. a) of the GDPR, is purely voluntary and the lack of disclosure of data or the lack of consent provided precludes the pursuance of the purposes related to profiling and marketing purposes and for activating the Store locator service and tracking pixels, but without prejudice to your possibility to register on the Website or on the App, or to make use of services provided on a contractual basis.

    The provision of data for the purposes for which consent is the legal basis pursuant to Article 6(1)(a) GDPR is entirely optional, and failure to provide such data or to give such consent will prevent the pursuit of the related purposes of profiling, marketing and data enrichment, but will not affect your ability to register on the Website or the App or to use the services provided on a contractual basis.

    The IT systems and software procedures used to operate the Website or the App acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
    This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
    This category of data includes IP addresses, the type of browser or operating system used, URI (Uniform Resource Identifier) addresses, domain names and addresses of websites from which access or exit was made (referring/exit pages), the time of the request made to the server, the method used and information regarding the response obtained, as well as further information relating to the user's browsing activity (please also refer to the section relating to Cookies) and other parameters relating to the user's operating system and IT environment.
    Such data may also be used to ascertain responsibility in the event of any cybercrime against the Website or the App.



    F. Recipients of personal data

    The data will be processed by:

    a. employees and collaborators of the Data Controllers (including personnel of physical stores) authorised to collect, use, disclose or otherwise process your personal data;

    b. employees and collaborators of DB, acting as data processor, with regard to the management of marketing and profiling activities on behalf of LIU JO;

    c. third parties established within the European Union, acting as data processors, engaged by the Data Controllers, in particular for services relating to the collection and entry of personal data, shipping, mailing of promotional materials, services provided through the Website (e.g. chatbot), market research, customer satisfaction surveys, as well as management and maintenance of IT systems;

    d. third parties acting as independent data controllers, in particular professionals or companies providing legal or tax consultancy and assistance services, as well as companies managing payments made by debit or credit card;

    e. third parties acting as independent data controllers such as supervisory and control authorities or other public or private entities entitled to request the data.

    The complete list of recipients of personal data may be requested in writing at the contact details indicated above in paragraph A.



    G. Transfer of data outside the European Union

    Your personal data may be transferred outside the European Economic Area (for example, to Albania, for customer support services managed by call centres). LIU JO undertakes to ensure that such transfers are carried out in compliance with the provisions set out in Chapter V of the GDPR. In particular, appropriate safeguards and transfer mechanisms (such as standard contractual clauses approved by the European Commission) will be adopted in order to ensure a level of data protection equivalent to that guaranteed within the EEA.



    H. Data subjects’ rights

    By contacting the email addresses indicated above in Section A, you may request from the data controllers access to your personal data, the erasure of such data, the rectification of inaccurate data, the completion of incomplete data, the restriction of processing in the cases provided for under Article 18 of the GDPR, and object to processing on grounds relating to your particular situation where the processing is based on the controller’s legitimate interests.

    Furthermore, where the processing is based on consent or a contract and is carried out by automated means, you may exercise your right to receive your personal data in a structured, commonly used and machine-readable format and, where technically feasible, request that such data be transmitted to another data controller without hindrance.

    You have the right to revoke at any time, in a simple and free manner, any consent you may have given for marketing or profiling purposes, use of the Store locator service, and activation of tracking pixels. The withdrawal of consent can be exercised freely and specifically for each of the aforementioned purposes, without affecting the lawfulness of the processing carried out on the basis of the consent given before the withdrawal.

    Revoking your consent to the use of tracking pixels does not stop us from sending you newsletters, promotional communications, initiatives, and event invitations. You will continue to receive them regularly if you have given your consent to the processing of your data for marketing purposes. You will be able to choose, specifically and independently, whether to revoke consent for marketing purposes only, consent for the use of tracking pixels only, or both.

    You also have the right to lodge a complaint with the competent supervisory authority in the Member State of your habitual residence or place of work, or in the Member State where the alleged infringement occurred.

    You may, at any time, modify/update your personal data and your consents to the processing of personal data by accessing your personal account or by sending an e-mail to dpo@liujo.it or, alternatively, to privacyconsumer@liujo.it.