PRIVACY POLICY
This policy describes how personal data of users interacting with the David Halfon website (the “Site”) is processed, in accordance with Regulation (EU) 2016/679 (“GDPR”) and applicable data protection laws.
Users may be simple visitors, customers, newsletter subscribers, or individuals interacting with the services offered through the Site.
1. Data Controller
The data controller is Almavida Halfon S.A., with registered office at Via Attilio Friggeri 129, 00136 Rome (Italy), VAT number 17291931008 (the “Controller”).
2. Categories of data processed
The Controller may process the following categories of personal data:
- identification and contact data (name, surname, email address, telephone number);
- data relating to orders and purchases;
- navigation and usage data relating to the Site;
- data voluntarily provided through forms or direct contact;
- data relating to user preferences and interactions with the Site.
3. Cookies and similar technologies
The Site uses cookies and similar technologies for technical, functional, analytical and, where applicable, marketing purposes.
Such tools may collect information relating to user navigation, preferences and methods of use of the Site.
For a detailed description of the types of cookies used, their purposes and how to manage preferences, please refer to the Cookie Policy available here.
4. Purposes of processing and legal basis
Personal data is processed for the following purposes:
- order management and online sales (performance of a contract);
- customer account management (performance of a contract);
- customer support and request handling (performance of a contract or pre-contractual measures);
- compliance with legal and tax obligations (legal obligation);
- fraud prevention and security (legitimate interest);
- direct marketing and commercial communications (consent or legitimate interest within legal limits);
- analysis and improvement of services (legitimate interest);
- personalisation of the user experience and communications, where permitted by applicable law.
5. Processing methods
Processing is carried out using appropriate technical and organisational measures, in compliance with applicable security requirements, in order to prevent unauthorised access, loss or unlawful use of data.
6. Data disclosure
Personal data may be disclosed to third parties that support the Controller in providing services, including:
- technology providers and e-commerce platforms;
- payment service providers;
- couriers and logistics operators;
- marketing and communication service providers;
- legal and tax advisors.
Such parties process data as data processors or independent controllers, depending on the circumstances.
7. Data transfers
Some personal data may be transferred to countries outside the European Economic Area. In such cases, the transfer will take place in compliance with applicable legal safeguards, including standard contractual clauses approved by the European Commission or other appropriate legal mechanisms.
8. Data retention
Personal data is retained for as long as necessary to fulfil the purposes for which it was collected and, subsequently, for the period required by applicable law.
In particular:
- contractual data: for the duration of the contractual relationship and thereafter as required by law;
- marketing data: until consent is withdrawn or an objection is raised;
- security-related data: for the time strictly necessary.
9. Data subject rights
Users may exercise, at any time, the rights provided under Articles 15–22 GDPR, including:
- access to personal data;
- rectification or erasure;
- restriction of processing;
- objection to processing;
- data portability;
- withdrawal of consent;
- lodging a complaint with the competent supervisory authority.
10. How to exercise rights
To exercise their rights, users may contact the Controller through:
- the dedicated form available on the Site
11. Changes
This policy may be updated over time. Any changes will be published on the Site.
Last updated: January 2026