Privacy Policy

  1. Privacy Policy

    LAST UPDATED: April 2026

    PRIVACY NOTICE REGARDING THE PROCESSING OF PERSONAL DATA
    A. Data Controllers

    Pursuant to Article 13 of Regulation (EU) No. 2016/679 “General Data Protection Regulation” (hereinafter “GDPR”)

    Exelite S.p.A. (formerly Liu Jo S.p.A.) with registered office in Via Tortona, 37 - 20144 - Milan (MI), Italy
    E-mail: privacyconsumer@liujo.it
    (hereinafter “LIU JO”)

    and

    Digital Boite S.r.l. with registered office in Via Cusani 5, 20122, Milan, Italy
    E-mail: dpo@digitalboite.com
    (hereinafter “DB”)

    (hereinafter jointly referred to as the “Data Controllers”) provide you with the following information regarding the collection, use, disclosure and processing of your personal data carried out through the website www.liujo.com (hereinafter the “Website”), the LIU JO mobile application (hereinafter the “App”) or any retail store belonging to the LIU JO mono-brand store network.

    In particular:

    • LIU JO is the owner of the Website and the App and acts as an independent Data Controller for personal data processed for marketing and profiling purposes;
    • DB acts as an independent Data Controller for personal data processed for purposes related to sales, invoicing, payment and delivery of products purchased through the Website and/or the App;
    • LIU JO and DB act as Joint Data Controllers for personal data processed for the following purposes:
      • registration on the Website and/or the App and use of services reserved for registered users;
      • store planning and sales analysis;
      • management of after-sales assistance requests (online and in physical stores) and returns;
      • management of requests related to the use of omnichannel services;
      • prevention of abuse and fraud.

    The essential content of the joint controllership agreement between LIU JO and DB is set out in the table below. Any further information regarding the content of the aforementioned agreement may be requested by writing to LIU JO or DB at the addresses indicated above or by contacting the Data Protection Officers at the contact details provided in the following section.

    Purpose Legal basis Personal data retention
    User registration on the Website/App and access to services reserved for registered users Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data will be retained until you request the deletion of your registration or, in any case, for the period necessary to provide the requested service
    Store planning and sales analysis Legitimate interest of the Data Controllers pursuant to Article 6(1)(f) GDPR Data relating to sales analysis activities, processed in aggregated form, are retained for three years
    Management of after-sales assistance requests (online and in physical stores) and returns Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data are retained until the request has been fulfilled and for an additional period of six months
    Management of requests related to the use of omnichannel services Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data are retained until the request has been fulfilled and for an additional period of six months
    Prevention of abuse and fraud Legitimate interest of the Data Controllers pursuant to Article 6(1)(f) GDPR Personal data are retained for the time strictly necessary to achieve the aforementioned purpose and, in any case, for the period required to ensure legal protection and to communicate data to the competent authorities

    For further information regarding personal data processed through the use of cookies and other similar tracking technologies, please refer to our Cookie Policy.

    B. Data Protection Officer (DPO)

    LIU JO and DB have each appointed a Data Protection Officer (DPO):

    • The Data Protection Officer (DPO) of LIU JO can be contacted at the following e-mail address: dpo@liujo.it;
    • The Data Protection Officer (DPO) of DB can be contacted at the following e-mail address: dpo@digitalboite.com.

    C. Categories of personal data processed

    Depending on the purposes pursued, we will process the following categories of personal data, by way of example and not limited to:

    • Identification data: first name, last name, date of birth, gender;
    • Contact data: telephone number, e-mail address;
    • Authentication data: username, password;
    • Shipping information: domicile address, residence address, any additional addresses useful for delivering the order;
    • Billing and tax free information: billing address, first and last name, company name, tax code, VAT number, nationality, passport number;
    • Information relating to purchases made: item, size and colour, price, date of sale, amount spent;
    • Data relating to the customer profile and preferences: data relating to purchasing habits;
    • Browsing data: data collected during the visit and consultation of the Website or the App, including through cookies or other tracking technologies (for further information on the processing of your data through such technologies, please refer to the Cookie Policy);
    • Geolocation data (store locator service): IP address;
    • Data relating to loyalty programmes: points, clusters, discounts, vouchers.

    Any additional data communicated in order to use specific Services offered by LIU JO.

    D. Purposes, legal basis of processing and data retention periods
    Purpose Legal basis Retention period
    Provision of sales services and any additional services requested by Customers in store Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data will be retained for the time necessary to perform the contract relating to the services provided to you and, in any case, no longer than 10 years from termination of the contract, without prejudice to further retention periods required by applicable law
    Management of customer care and after-sales support services, both online and in store, including support activities relating to payments, shipments, returns and refunds, as well as additional services offered by LIU JO. Please note that the Website includes a generative artificial intelligence chatbot designed to facilitate communication and provide responses. The chatbot may respond to both general queries (for which the provision of personal data is not required) and specific queries for which you may be asked to log in or provide additional information in order to process your request (e.g. order number, e-mail associated with the loyalty profile). If you wish to speak directly with an operator, we kindly ask you to use traditional channels and not to continue the conversation through the chatbot. If the chatbot does not provide the response you require, you may, through the same tool, obtain all the necessary information to contact a human operator or use the traditional contact methods made available on the Website. Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data processed for the purpose of handling your requests will be retained until the request has been fulfilled and for an additional period of 6 months
    Operational management of browsing and security of the Website or the App Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR Personal data processed will be retained for 7 days from the date of visit and consultation of the Website or the App. For data relating to cookies, please refer to the specific Cookie Policy
    Management of administrative, accounting and tax obligations required by law Compliance with a legal obligation to which the Data Controller is subject, pursuant to Article 6(1)(c) GDPR Personal data processed to comply with legal obligations will be retained in accordance with the time limits set by applicable legislation.
    Performance of the online sales contract and related after-sales activities. Please note that the Website includes a generative artificial intelligence chatbot designed to facilitate communication and provide responses regarding support services related to payments, shipments, returns and refunds. The chatbot is able to respond to specific requests (e.g. shipment status; returns) and you may be required to log in or provide additional information in order to process your request (e.g. order number, e-mail associated with the loyalty profile). If you wish to speak directly with an operator, we kindly ask you to use traditional channels and not to continue the conversation through the chatbot. If the chatbot does not provide the response you require, you may, through the same tool, obtain all the necessary information to contact a human operator or use the traditional contact methods made available on the Website. Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data processed will be retained for the time necessary to perform the contract, including the provision of statutory or contractual warranties, and in any case no longer than 10 years following termination of the contract, without prejudice to further retention periods required by applicable law. Personal data processed for handling your requests will be retained until the request has been fulfilled and for an additional period of 6 months.
    User registration on the Website or the App. Registration may take place by completing a data collection form available on the Website and the App. Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data collected for registration purposes will be retained until you request deletion of your account
    Provision of online customer services, including technical support to recover access credentials to your personal account Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data processed to provide the requested service will be retained for the time necessary to perform the service or until you request to withdraw from the service. Data processed to respond to customer requests will be retained until the request has been fulfilled and for an additional period of 6 months.
    Provision of omnichannel services offered to customers, such as, by way of example and not limited to, Click&Collect or Reserve in Store services Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Data will be retained for the time necessary to perform the service or until you request to withdraw from the service
    Provision of the Store Locator service, consisting in identifying the nearest store based on your current location Freely given, specific, informed, unambiguous and revocable consent of the data subject pursuant to Article 6(1)(a) GDPR Data will be retained until you withdraw your consent
    Prevention of abuse and fraud Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR Personal data are retained for the time strictly necessary to achieve the aforementioned purpose and, in any case, for the period required to ensure legal protection and communication to the competent authorities
    Establishment, exercise or defence of legal claims and out-of-court debt collection Legitimate interest of the Data Controller pursuant to Article 6(1)(f) GDPR Personal data will be retained for the entire duration of the debt recovery activity and, in the event of legal proceedings, for the entire duration thereof, until the expiry of the time limits for bringing appeals
    Sending of “soft spam” communications via e-mail, i.e. commercial communications relating to products and services similar to those you have purchased Exemption provided for by Article 130(4) of the Italian Privacy Code Personal data will be retained until you object to receiving such communications, which can be done via the link available at the bottom of each e-mail
    Marketing activities, such as sending commercial communications regarding products and services (news, new arrivals, exclusives, offers and promotions), sending newsletters and carrying out market research and surveys aimed at measuring customer satisfaction in order to improve services and customer relationships Freely given, specific, informed, unambiguous and revocable consent of the data subject pursuant to Article 6(1)(a) GDPR Personal data collected for marketing purposes will be retained until you withdraw your consent. Personal data relating to purchase details processed for marketing purposes will be retained for 24 months from their collection. Upon expiry of the above retention periods, the data will be automatically deleted or permanently and irreversibly anonymised.
    Profiling activities relating to browsing and purchasing habits of registered users, carried out through the use of data provided by the user, data collected during browsing on the Website or the App and data relating to purchase details, for the purpose of sending personalised commercial communications based on user interests Freely given, specific, informed, unambiguous and revocable consent of the data subject, pursuant to Article 6(1)(a) GDPR Personal data collected for profiling purposes will be retained until you withdraw your registration from the Website or the App or withdraw your consent to data processing. Personal data relating to browsing and purchase details processed for profiling purposes will be retained for 24 months. Upon expiry of the above retention periods, the data will be automatically deleted or permanently and irreversibly anonymised.
    Recruitment activities, including the storage and management of applications and documents (such as CVs) submitted through the “Careers” section of the Website Performance of a contract to which the data subject is a party or pre-contractual measures taken at the request of the data subject, pursuant to Article 6(1)(b) GDPR Personal data collected will be retained for the period strictly necessary for candidate selection for specific positions and, in any case, no longer than 12 months from their submission. Before the expiry of this period, the Data Controllers may contact you to verify your interest in being considered for future positions. In the absence of a response or in case of a negative response, your personal data will be deleted. In the event of a positive response, your data will be retained for a further 12 months.

    E. Provision of data

    The provision of data for the purposes based on the legal grounds referred to in Article 6(1)(b), (c) and (f) GDPR is necessary in order to pursue the aforementioned purposes. With reference to the use of the chatbot, if you do not wish to use the chatbot, you may contact a human operator and/or use the traditional contact methods made available on the Website. The provision of data for the purposes for which consent is the legal basis pursuant to Article 6(1)(a) GDPR is entirely optional, and failure to provide such data or to give such consent will prevent the pursuit of the related purposes of profiling, marketing and data enrichment, but will not affect your ability to register on the Website or the App or to use the services provided on a contractual basis.
    The IT systems and software procedures used to operate the Website or the App acquire, during their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols.
    This information is not collected to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified.
    This category of data includes IP addresses, the type of browser or operating system used, URI (Uniform Resource Identifier) addresses, domain names and addresses of websites from which access or exit was made (referring/exit pages), the time of the request made to the server, the method used and information regarding the response obtained, as well as further information relating to the user's browsing activity (please also refer to the section relating to Cookies) and other parameters relating to the user's operating system and IT environment.
    Such data may also be used to ascertain responsibility in the event of any cybercrime against the Website or the App.



    F. Recipients of personal data

    The data will be processed by:

    a. employees and collaborators of the Data Controllers (including personnel of physical stores) authorised to collect, use, disclose or otherwise process your personal data;

    b. employees and collaborators of DB, acting as data processor, with regard to the management of marketing and profiling activities on behalf of LIU JO;

    c. third parties established within the European Union, acting as data processors, engaged by the Data Controllers, in particular for services relating to the collection and entry of personal data, shipping, mailing of promotional materials, services provided through the Website (e.g. chatbot), market research, customer satisfaction surveys, as well as management and maintenance of IT systems;

    d. third parties acting as independent data controllers, in particular professionals or companies providing legal or tax consultancy and assistance services, as well as companies managing payments made by debit or credit card;

    e. third parties acting as independent data controllers such as supervisory and control authorities or other public or private entities entitled to request the data.

    The complete list of recipients of personal data may be requested in writing at the contact details indicated above in paragraph A.



    G. Transfer of data outside the European Union

    Your personal data may be transferred outside the European Economic Area (for example, to Albania, for customer support services managed by call centres). LIU JO undertakes to ensure that such transfers are carried out in compliance with the provisions set out in Chapter V of the GDPR. In particular, appropriate safeguards and transfer mechanisms (such as standard contractual clauses approved by the European Commission) will be adopted in order to ensure a level of data protection equivalent to that guaranteed within the EEA.



    H. Data subjects’ rights

    By contacting the e-mail addresses indicated above in paragraph A, you may request from the Data Controllers access to your personal data, their erasure, rectification of inaccurate data, completion of incomplete data, restriction of processing in the cases provided for by Article 18 GDPR, as well as object to processing, for reasons relating to your particular situation, in cases where processing is based on the legitimate interest of the Data Controller. Furthermore, where processing is based on consent or on a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used and machine-readable format, as well as, where technically feasible, to request the transmission of such data to another data controller without hindrance. You have the right to withdraw your consent at any time for marketing and/or profiling purposes, as well as to object to the processing of your data for marketing purposes, including profiling related to direct marketing. If you prefer, you may request to be contacted for such purposes exclusively through traditional means, and you may object solely to the receipt of communications via automated means. You also have the right to lodge a complaint with the competent supervisory authority in the Member State in which you habitually reside, work, or where the alleged infringement occurred.

    You may, at any time, modify/update your personal data and your consents to the processing of personal data by accessing your personal account or by sending an e-mail to dpo@liujo.it or, alternatively, to privacyconsumer@liujo.it.