DES_PHEMMES | OASI S.R.L.
Last Update: June 2026

INTRODUCTION
Welcome to DES_PHEMMES. We are committed to protecting the privacy of our community and ensuring that all personal information is handled with the utmost care and transparency. This Privacy Policy informs you about how we process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the "GDPR") and applicable Italian data protection law, with a focus on providing a curated and personalised brand experience.
This Policy is provided in a concise, transparent, intelligible and easily accessible form, using clear and plain language. Please read it carefully. This Privacy Policy is provided to you at the time your personal data is collected - for example, when you place an order on our website, subscribe to our newsletter, create an account or otherwise interact with our digital platforms - in accordance with Article 13 GDPR.
By subscribing to our communications or interacting with our digital platforms, you acknowledge that you have read and understood this Privacy Policy.
1. DATA CONTROLLER
The Data Controller is the natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.
Pursuant to Article 13(1)(a) GDPR, the Data Controller for the activities described in this Policy is:
DES_PHEMMES | OASI S.R.L. Via Cadore 32, 20135 Milano (MI), Italy P.IVA: 13125720964 Email: info@desphemmes.com (“Des Phemmes”)
For any queries relating to this Privacy Policy or to the exercise of your rights, you may contact the Data Controller at the above address or email.
2. INFORMATION COLLECTION AND SOURCES
We collect personal data through the following channels:
Direct Interaction: Personal data provided voluntarily when you subscribe to our newsletter, register on our platforms, or contact our team directly.
Service Integration: Personal data provided during your interaction with our digital services and those of our authorised operational partners. This information is synchronised with our database to ensure a consistent brand experience and high-quality communication, subject to your specific consent.
Third-Party Sources: In certain cases, we may receive personal data about you from authorised third-party partners (e.g., event organisers, retail partners) who have collected your personal data in compliance with applicable law and with your consent where required. Where we receive data from third parties, we will inform you of the source and the categories of data received, in accordance with Article 14 GDPR, at the time of the first communication with you and, in any case, within a reasonable period after obtaining the personal data.
Order Processing: Personal data provided when placing an order on our e-commerce website (including name, delivery and billing address, telephone number, email address, and payment details) for the purpose of fulfilling the purchase contract.
Automatic Collection: Technical data automatically generated by the operation of our website servers and infrastructure, including navigation logs, IP addresses, and browser data, for the purpose of ensuring the correct operation and security of the website.
3. TYPES OF DATA PROCESSED AND NATURE OF DATA PROVISION
3.1 Categories of Data
We process the following categories of personal data:
Contact Details: Name, surname, and email address.
User Preferences: Information regarding your interests, interactions with the brand, and preferences manifested through our digital touchpoints.
Engagement Data: Metrics on how you interact with our communications (e.g., email opens and clicks), managed through our marketing platform Klaviyo.
Behavioural Data: Data generated through your browsing and purchasing behaviour on our digital platforms, used to personalise your experience.
Contractual/Identifying Personal Data: Identification and contact details provided when placing an order (name, surname, delivery and/or billing address, telephone number, email address), together with order-related data (items purchased, amount, payment method, and transaction reference). Payment data are processed directly by our designated payment service provider and are not retained by Des Phemmes.
Navigation Data: Technical data automatically generated during website browsing, including IP address, browser type and version, operating system, pages visited, date and time of the visit, and referring URL. These data are collected to ensure the proper functioning of the website and for IT security purposes.
We do not process special categories of personal data (as defined under Article 9 GDPR) unless expressly required and with your explicit prior consent.
3.2 Nature of Data Provision and Consequences of Non-Provision
Pursuant to Article 13(2)(e) GDPR, we inform you of the following regarding whether the provision of personal data is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the data subject is obliged to provide the personal data and the possible consequences of failure to provide such data:

Category: Name, surname, email address
Nature of Provision: Voluntary - no statutory or contractual obligation
Consequence of Non-Provision: Impossibility of subscribing to the newsletter or receiving commercial communications from Des Phemmes

Category: Preferences and engagement data
Nature of Provision: Voluntary - subject to your specific consent
Consequence of Non-Provision: Impossibility of receiving personalised communications and a tailored brand experience

Category: Data from third-party sources
Nature of Provision: Voluntary at source - provided to us by authorised partners with your prior consent
Consequence of Non-Provision: Impossibility of being included in Des Phemmes' communications programmes

Category: Contractual/Identifying Personal Data (name, surname, delivery/billing address, telephone number, email address, order details)
Nature of Provision: Mandatory - required for executing the purchase contract
Consequence of Non-Provision: Inability to conclude the contract and receive the purchased products

Category: Navigation data (IP address, technical logs)
Nature of Provision: Automatic - generated by website browsing; no action required from the data subject
Consequence of Non-Provision: As processing is technically necessary for website operation, the only alternative is refraining from accessing the website

The provision of your personal data carries no other adverse consequence beyond those described above. You may at any time withdraw your consent and request deletion of your data without suffering any detriment.
4. PURPOSES AND LEGAL BASIS OF PROCESSING
Processing is lawful only if and to the extent that at least one of the conditions listed in Article 6(1) GDPR applies. We process your personal data for the following specific purposes, each resting on a distinct and identified legal basis:

Purpose: Brand Newsletter
Description: General communications regarding new collections, editorial content, and brand events.
Legal Basis: Consent - Art. 6(1)(a) GDPR

Purpose: Personalised Marketing
Description: Specialised communications based on your profile and previous interactions with the brand, ensuring you receive content that is relevant to your interests.
Legal Basis: Consent - Art. 6(1)(a) GDPR

Purpose: Profiling and Behavioural Analysis
Description: We use Klaviyo to analyse preferences and engagement patterns to optimise the quality and relevance of our digital presence and communications.
Legal Basis: Consent - Art. 6(1)(a) GDPR

Purpose: Platform and Service Improvement
Description: Internal analysis of aggregate, anonymised data to improve our services, detect technical issues, and enhance user experience.
Legal Basis: Legitimate Interest - Art. 6(1)(f) GDPR (see note below)

Purpose: Compliance with Legal Obligations
Description: Processing necessary to fulfil legal, regulatory, or accounting obligations applicable to Des Phemmes.
Legal Basis: Legal Obligation - Art. 6(1)(c) GDPR

Purpose: Execution of the purchase contract
Description: Processing of order data, delivery address, and payment information necessary to fulfil the purchase contract, including order management, shipping, delivery communications, and returns/refund handling.
Legal Basis: Performance of a contract - Art. 6(1)(b) GDPR

Purpose: Website security and operation
Description: Processing of navigation data (IP address, technical logs, browser type) necessary to ensure the proper functioning of the website, prevent fraudulent or unlawful use, and safeguard IT security.
Legal Basis: Legitimate Interest - Art. 6(1)(f) GDPR

Note on Legitimate Interest: Processing is lawful where it is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data. We have conducted and documented an internal balancing test (available in our Record of Processing Activities pursuant to Article 30 GDPR) and concluded that our legitimate interests are not overridden by your fundamental rights and freedoms. This legal basis covers: (i) the internal analysis of aggregated or anonymised data for the purpose of maintaining and improving our digital services; and (ii) the processing of navigation data (including IP addresses and technical log data) for the purpose of ensuring the security and correct functioning of the website. This legal basis does not extend to direct marketing, personalised communications, or profiling activities, all of which require and are based on your explicit consent. You have the right to object to processing based on legitimate interest at any time - see Section 8 below.
5. AUTOMATED PROFILING
We use Klaviyo to analyse your preferences and engagement patterns. This involves automated processing of your personal data to evaluate certain aspects of your behaviour, such as your interests, interaction frequency, and content preferences.
Logic of the profiling: Based on your engagement data (e.g., which emails you open, which links you click, and your browsing behaviour on our platforms), we build a profile of your interests and preferences. This profile is used to determine which content and communications are most likely to be relevant to you.
Significance and envisaged consequences: The profiling is used solely for the purpose of tailoring our marketing communications to your interests. It does not result in any automated decision that produces legal effects or similarly significantly affects you within the meaning of Article 22 GDPR. No decision producing legal effects or similarly significant effects on you is taken on the basis of automated processing alone.
You may at any time withdraw your consent to profiling and object to this processing by contacting us at info@desphemmes.com or by clicking the relevant link in any of our communications - see Section 8 below.
6. DATA SHARING, PROCESSORS AND INTERNATIONAL TRANSFERS
6.1 General Principle
Your data is stored securely and is never sold to third parties. It is shared only with the following categories of recipients:
6.2 Data Processors (Article 28 GDPR)
Where processing is to be carried out on behalf of a controller, the controller shall use only processors providing sufficient guarantees to implement appropriate technical and organisational measures in such a manner that processing will meet the requirements of the GDPR and ensure the protection of the rights of the data subject. The processing by a processor shall be governed by a contract or other legal act under Union or Member State law, that is binding on the processor with regard to the controller and that sets out the subject-matter, duration, nature and purpose of the processing, the type of personal data and categories of data subjects, and the obligations and rights of the controller.
All third parties acting as data processors on our behalf are bound by Data Processing Agreements (DPAs) that are fully compliant with Article 28 GDPR, including provisions on documented instructions, confidentiality obligations, security measures, sub-processor authorisation, cooperation with supervisory authorities, and deletion or return of data upon termination. A list of our current data processors is available upon request.
Our principal data processors include:
Klaviyo Inc. - marketing automation platform (see Section 6.3 for international transfer information);
Technical and IT service providers - providers of hosting, CRM, and e-commerce infrastructure services, bound by DPAs and prohibited from using your data for any purpose other than providing agreed services to Des Phemmes;
Analytics providers - providers of web analytics services, operating on aggregated or anonymised data where possible.
6.3 International Transfers
Any transfer of personal data to a third country or an international organisation may take place where the Commission has decided that the third country, a territory or one or more specified sectors within that third country, or the international organisation in question ensures an adequate level of protection. In the absence of an adequacy decision, a controller or processor may transfer personal data to a third country or an international organisation only if the controller or processor has provided appropriate safeguards, and on condition that enforceable data subject rights and effective legal remedies for data subjects are available.
Klaviyo Inc. is headquartered in the United States of America and officially participates in the Data Privacy Framework program, ensuring compliant data transfer for EU.
Any other transfer of personal data to a country outside the EEA is carried out only where an adequate level of protection is ensured by means of appropriate safeguards pursuant to Article 46 GDPR. You may request a copy of the applicable transfer mechanisms by contacting us at info@desphemmes.com.
For further information on Klaviyo's data processing practices, please refer to Klaviyo's Privacy Policy.
6.4 Competent Authorities
Where required by law, regulation, or binding court order, we may disclose your personal data to competent public authorities or law enforcement bodies. In such cases, we disclose only the minimum data necessary to comply with the legal obligation.
7. DATA RETENTION
Personal data shall be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data are processed. We retain your personal data only for as long as is strictly necessary to fulfil the purposes for which it was collected, in accordance with the following criteria:

Category: Newsletter and marketing data (consent-based)
Retention Period: Until you withdraw your consent or unsubscribe, and for a maximum of 24 months from your last active interaction with our communications, unless you request earlier deletion.

Category: Profiling and behavioural data
Retention Period: Until you withdraw your consent, and in any case for no longer than 12 months from collection.

Category: Data processed to comply with legal obligations
Retention Period: For the period required by applicable law (e.g., 10 years for accounting and tax records under Italian law - Art. 2220 Codice Civile).

Category: Data processed on the basis of legitimate interest
Retention Period: For the period strictly necessary to achieve the legitimate interest pursued, and in any case for no longer than 24 months from collection.

Category: Data received from third-party sources
Retention Period: Subject to the same retention periods as above, based on the applicable processing purpose.

Category: Contractual/Identifying data (order, shipping, payment)
Retention Period: 10 years from the conclusion of the contract (pursuant to Art. 2946 c.c. and Art. 2220 c.c.).

Category: Navigation data (IP address, technical logs)
Retention Period: No longer than 12 months from collection, save where a longer period is strictly necessary for IT security purposes and duly documented.

At the end of the applicable retention period, your data will be securely deleted or irreversibly anonymised. You may request early deletion at any time by exercising your rights as described in Section 8 below.
8. YOUR RIGHTS
Pursuant to Articles 15 to 22 GDPR, and subject to the conditions and limitations set out therein, you have the following rights in relation to your personal data:
Right of Access (Art. 15 GDPR): You have the right to obtain confirmation as to whether or not personal data concerning you is being processed, and where that is the case, to access the data and receive detailed information about the processing (purposes, categories of data, recipients, retention period, etc.).
Right to Rectification (Art. 16 GDPR): You have the right to obtain the rectification of inaccurate personal data concerning you and to have incomplete personal data completed, without undue delay.
Right to Erasure / "Right to be Forgotten" (Art. 17 GDPR): You have the right to obtain the erasure of your personal data where one of the grounds listed in Article 17 GDPR applies (e.g., the data is no longer necessary for the purposes for which it was collected, or you withdraw your consent and there is no other legal basis for the processing).
Right to Restriction of Processing (Art. 18 GDPR): You have the right to obtain the restriction of processing in certain circumstances (e.g., where you contest the accuracy of the data, or where you have objected to processing pending verification of the legitimate grounds of the controller).
Right to Data Portability (Art. 20 GDPR): Where processing is based on your consent or on a contract, and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to transmit it to another controller without hindrance.
Right to Object (Art. 21 GDPR): You have the right to object, on grounds relating to your particular situation, to processing based on legitimate interest (Art. 6(1)(f) GDPR). Where processing is for direct marketing purposes, you have an unconditional right to object at any time, without the need to provide specific reasons, whereupon we will cease processing your data for that purpose.
Right to Withdraw Consent (Art. 7(3) GDPR): Where processing is based on your consent, you have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent can be effected at any time by clicking the "unsubscribe" or "manage preferences" link in any of our communications, or by contacting us at info@desphemmes.com. Withdrawal of consent is entirely free of charge and carries no adverse consequence.
Right to Lodge a Complaint (Art. 77 GDPR): Without prejudice to any other administrative or judicial remedy, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work or place of the alleged infringement if you consider that the processing of personal data relating to you infringes the GDPR. In Italy, the competent supervisory authority is:
Italian Data Protection Authority, Piazza Venezia 11, 00187 Roma - Italy Tel.: +39 06 696771 Fax: +39 06 69677 3785 Email: garante@gpdp.it Certified email (PEC): protocollo@pec.gpdp.it Website: www.gpdp.it

How to exercise your rights: To exercise any of the above rights, please contact us at info@desphemmes.com or in writing at the address indicated in Section 1, providing sufficient information to identify yourself and the right you wish to exercise. We will respond to your request without undue delay and in any event within one month of receipt of the request. That period may be extended by two further months where necessary, taking into account the complexity and number of the requests; in that case, we will inform you of any such extension within one month of receipt of the request, together with the reasons for the delay. This service is provided free of charge, unless your requests are manifestly unfounded or excessive.
9. COOKIES AND TRACKING TECHNOLOGIES
Our digital platforms may use cookies and similar tracking technologies to analyse your browsing behaviour and personalise your experience. Certain cookies require your prior consent; others are strictly necessary for the functioning of our platforms and do not require consent. For detailed information on the types of cookies we use, their purposes, the retention periods applicable, and your choices in relation to them (including how to withdraw your consent), please refer to our Cookie Policy, available on our website.
10. CHANGES TO THIS PRIVACY POLICY
The up-to-date version of this Privacy Policy is published from time to time on the www.desphemmes.com. The date of the most recent update is indicated at the top of this document. Users are encouraged to consult the website periodically to review the version currently in force.