Privacy and Cookies Policy

OUR PRIVACY POLICY AT A GLANCE
This Privacy Policy regulates the processing of the personal data of Tiffosi Denim Club customers and users (hereinafter, jointly, the “User”, “Users”, "Customer" or “Customers”) by COFEMEL – Sociedade de Vestuário, S.A. (hereinafter “TIFFOSI”), as the data controller and holder of the “TIFFOSI” brand. The privacy of our Customers, as well as full respect for our legal obligations regarding data protection, is one of our priorities, adopting the necessary measures to protect their personal data. In this Privacy Policy you will find all relevant information applicable to our use of our Customers' personal data, regardless of how they interact with us (online or in person), and to which this Policy will apply. Hence, the information regarding data processing presented here also applies, with the necessary adaptations, to data processing carried out within the scope of product purchases made at physical stores of TIFFOSI. Henceforth, when we refer to our "Platform", we will be referring, in general, to any of the channels, digital or in person, that you can use to interact with us, namely, our Website, our App or in person, at any of our physical TIFFOSI stores (as applicable). The provision of personal data in the context of the use of the Platform implies knowledge and acceptance of the conditions contained in this Privacy Policy, as well as the attendant General Terms of Sale.
1. YOUR DATA CONTROLLER
Your Data Controller is COFEMEL – Sociedade de Vestuário, S.A., a company holding NIPC 501329684 and whose registered office is situated at Rua Fernão de Magalhães, n.º 2, Fração C, 4400-629 Vila Nova de Gaia.

2. WHY DO WE PROCESS YOUR PERSONAL DATA

Access to and use of the Platform does not necessarily imply the provision of personal data by the User. However, the use of certain features of the Platform, namely the creation of a Tiffosi Denim Club Customer account as well as subscribing to newsletters and any possible commercial initiatives, may imply the provision of personal data by the User.

TIFFOSI is responsible for the collection and subsequent processing of the personal data of Platform Users, including, as already mentioned, physical stores, under the terms and for the purposes indicated in the personal data protection legislation in force.

Depending on the processing purposes in question, and depending on the availability of each feature at any given time, the following categories of personal data may be processed, in particular:

- Identification data;
- Contact data;
- Data related with transactions and payments made (e.g. information about your purchases, orders, returns);
- Billing data;
- Connection, geolocation and/or browsing data;
- Data related with your tastes and preferences (where applicable);
- Image (video), namely, at physical stores where a video surveillance system is in operation.

Depending on the feature or service in question, some personal data will be mandatory and essential for the provision of the service or feature requested. If you decide not to provide us with this data, it may not be possible, for example, to complete your registration as a Tiffosi Denim Club Customer at the Platform or provide you with access to another service or feature that you may wish to use.

So, depending on how you use our Platform and interact with us, we will process your personal data, namely, for the following purposes:

Purpose	Description
To manage your registration as a User of the Platform	If you decide to register as a User at the Platform, we need to process your data to identify you as a User and give you access to the various features, products, services and content that are available to you as a registered Tiffosi Denim Club Customer. When you create a User account you automatically become part of the Tiffosi Denim Club programme and, under these terms, your personal data may be used to grant you possible benefits and/or exclusive advantages.
For the development, fulfilment and performance of the purchase and sale contract for products or services that you have entered into with us	This purpose refers to the processing of your data, namely, so that it is possible to: Contact you or send you informative communications related with the features, products or services contracted; Manage payment for the products you purchase, regardless of the payment method used; Manage any possible returns or refunds after you have made a purchase and manage requests for information on the availability of items or product reservations via the Platform; Billing purposes and to provide you with receipts and invoices for any purchases made.
Customer Support	If you send us a request for information, suggestion, complaint or request to exercise rights, via our Customer Support channels, we will process the personal data strictly necessary to address your request. When you interact with us via social media pages such as Facebook and Instagram, all text messages and images are shared with us and the provider of the platform in question. In this context, the User will share this information in accordance with the terms of use and privacy policy of the platform in question, which he/she accepted when he/she created a user account at the latter. TIFFOSI assumes no responsibility for the processing of your personal data by the platform provider. If you choose to use WhatsApp as a channel to communicate with Customer Support, your phone number will be shared with WhatsApp Inc. (a company located in the USA). We recommend that you check your privacy settings and read WhatsApp's privacy policy.
For the analysis and detection of any possible fraud situations or other malicious activities	We may process your data for the purpose of activating the mechanisms necessary to prevent potential fraud against you and TIFFOSI during the purchasing process. If we consider that the transaction may be fraudulent, this processing may result in the transaction being blocked.
For marketing purposes	When the User has subscribed to the TIFFOSI newsletter, we will process their personal data to manage their subscription, including the sending of more accurate information about our products or services via different media (such as e-mail, push notifications or SMS). In this regard, we may analyse your User or Customer profile to determine what your preferences are when we send you information. For example, based on your purchase and browsing history (in other words, the items you have clicked on), we will make suggestions about products that we think you may be interested in and, where applicable, we will also offer you suggestions about any products that you may be interested in, and if your are a Registered user, we will provide the "cart recovery" feature. The User may cancel the newsletter subscription at any time via the "unsubscribe" section to be found in all our newsletters or by contacting Customer Support or e-mailing privacy@grupovnc.com. When promotional actions are carried out which you participate in, with your consent, we will process the personal data that you provide to us for each promotional action, authorising its communication via different media and platforms, such as social media or at the Platform itself. In each promotional action in which you participate, you will have access to the terms and conditions where we will give you more detailed information about the processing of your personal data. We may also publish at the Platform, or via our social media channels, any photos or images that you have shared publicly, provided that you give us your consent to do so. As a Tiffosi Denim Club Customer (Registered user) your personal data may be used to send communications related with the programme, including the allocation of benefits, birthday offers and other information associated with the programme based on our legitimate interest. You may choose not to receive these communications at any time by using the unsubscribe link included in the communications themselves or by contacting Customer Support or e-mailing privacy@grupovnc.com.
Feature and quality analysis to improve our services	We may process data related with browsing at the Platform for analytical and statistical purposes, in other words, to understand how Users interact with the Platform and to proceed with the continuous improvement thereof. We may also carry out surveys and quality actions aimed at understanding the level of satisfaction of our Customers and Users, identifying potential opportunities for improvement.
Video surveillance	A video surveillance system can be found in operation at TIFFOSI stores to protect people and property.

The lawful basis that allows us to process your personal data is linked to the purpose for which we process them. Hence:

Purpose	Legitimacy
To manage your registration as a User of the Platform	As described in the Terms and Conditions of the Platform, in order to register as a User, we need to process your personal data, otherwise we would not be able to manage your registration. Your registration is thus carried out in the context of the performance of a contract to which the User is a party, or for pre-contractual procedures at the User's request. There is also a legitimate interest in associating your account with your purchases and the data collected via different channels (Website, App, physical stores) regarding your activity, so that it is possible to maintain your history.
For the development, fulfilment and performance of the purchase and sale contract for products or services that you have entered into with us	The processing of your data is necessary for the conclusion and performance of the purchase and sale or service agreement with the Customer. Your data may also be processed based on your consent when you request an operation that is dependent on your prior authorisation (such as storing payment data for future purchases). We will process your location data whenever you give us your consent to do so, so that we can provide you with specific services via the Platform.
Customer Support	When you contact us regarding issues related with your order or products/services purchased via the Platform, your data will be processed based on your need to perform the sale and purchase agreement entered into. When you wish to submit a request related with the exercising of your rights, as a data subject, or file a complaint related with our products or services, we will process your data for the purposes of complying with legal obligations. In addition, when you send us requests for information or suggestions through our Customer Support channels, these will be addressed based on the legitimate interest in responding to your request, allowing us to provide you with any support you may require.
For the analysis and detection of any possible fraud situations or other malicious activities	We will process your data based on the pursuit of a legitimate interest in order to carry out the necessary checks to detect and prevent possible fraud, in particular fraudulent use of the Platform or other illegal activities when you make a purchase. The processing of data for this purpose is intended to safeguard all the parties involved, allowing us to take measures to protect you from any fraud attempts carried out by third parties.
For Marketing Purposes	We process your data for the purpose of sending and marketing actions (via SMS, e-mail, push notifications etc.) based on the consent you have provided us with, for example, when you subscribe to the TIFFOSI newsletter, when you accept the use of cookies at the Platform, or when you accept the terms and conditions to participate in a TIFFOSI promotional action in which you authorise the publication of images where you may appear at the Platform or on our social media channels. Where applicable, based on legitimate interest, taking into account your status as a Tiffosi Denim Club Customer and, in this context, having obtained your contact information, we may also send you commercial communications relating to similar products or services that you have purchased, communications to grant you exclusive advantages (such as, for example, discounts on future purchases and birthday offers), and the Customer may, at any time, exercise their right to object to receiving these communications. We may also define a profile with information about you (such as your browsing history, preferences or purchases) and the personal data you have provided us with, such as age range or language, allowing the processing of these data to improve your experience as a User and to access information according to your preferences.
Feature and quality analysis to improve our services	This purpose is carried out based on the pursuit of TIFFOSI's legitimate interests, as the processing of your data to analyse the functionality of the platform and the level of customer satisfaction allows us to improve your experience as a User and provide you with an increasingly higher quality service.
Video surveillance	To protect people and property, there may be video surveillance systems in operation at TIFFOSI stores, based on the pursuit of legitimate interests and the defence of vital interests of the data subjects (Customers and Employees).

3. RETENTION OF PERSONAL DATA

The retention period for your personal data will vary depending on the purpose for which they are processed. Generally, Customers' personal data is kept in a format that allows their identification only for the period strictly necessary to pursue the purposes underlying the processing thereof.

Purpose	Retention period
To manage your registration as a User of the Platform	We will process your data for as long as you remain a registered User, unless, in compliance with a legal obligation or instruction issued by a judicial or supervisory authority, we are required to observe an additional retention period.
For the development, fulfilment and performance of the purchase and sale contract for products or services that you have entered into with us	We will process your data for the period strictly necessary to manage and meet your orders, including any possible returns, complaints or claims associated with the purchase of the product or service in question. There may be legal obligations, particularly of a tax or commercial nature, to which we are bound and which require us to retain your data for a longer period of time. When we process your data based on previously obtained consent, they will be processed for as long as the Customer so wishes, and they may withdraw their consent at any time.
Customer Support	We will process your data for the period necessary to deal with your request or order, without prejudice to the need to retain them for any additional periods that may arise from compliance with legal obligations.
For the analysis and detection of any possible fraud situations or other malicious activities	We will process your data for the period strictly necessary to pursue the purposes of detecting any fraudulent and malicious situations that may harm TIFFOSI and the Customer.
For Marketing Purposes	We will process your data until you ask us to cancel/oppose your subscription to the newsletter and any other communications with commercial content. In this regard, when we process your data based on previously obtained consent, they will be processed for as long as is wished and the Customer may withdraw their consent at any time. In the event that we send you communications based on a previously identified legitimate interest, we will process your data until you exercise your right to object (opt-out) to these communications.
Feature and quality analysis to improve our services	We will process your data for the period strictly necessary to pursue the purposes of feature and quality analysis.
Video surveillance	Images are kept for a maximum period of 30 days, in accordance with applicable legislation, unless there is an instruction from a judicial or supervisory authority to keep them for an additional period.

4. COMMUNICATION OF PERSONAL DATA
In order to fulfil the purposes indicated in this Privacy Policy, it is necessary for us to communicate your personal data to entities of the Vila Nova Carneiro Group (“VNC Group”), to which TIFFOSI belongs, and to other entities that provide us with support in the services we offer you, for example:
- - financial Institutions;
  - fraud detection and prevention entities;
  - technology service providers;
  - logistics, transportation and delivery service providers;
  - service providers related with customer support;
  - partners and service providers related with marketing and advertising.
The protection of your personal data will always be safeguarded in any contract entered into with entities subcontracted by TIFFOSI.
We may also transmit our Customers' personal data to third parties when we believe that such data communications are necessary or appropriate (i) in light of applicable law, (ii) in compliance with legal obligations/court orders and (iii) to respond to requests from public or government authorities.
5. INTERNATIONAL DATA TRANSFERS
On the grounds of service efficiency, some of the providers mentioned in the previous chapter may be located in territories outside the European Economic Area (“EU/EEA”). Should this occur, we hereby inform you that we transfer your data with adequate guarantees and always maintaining their security, using the procedures provided for in the applicable legislation, namely:
- Some providers are certified under the Privacy Shield, a certification that you can consult at the following link: https://www.privacyshield.gov/welcome;
- With other providers, we have entered into Standard Contractual Clauses approved by the Commission, whose content can be found at the following link: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/standard-contractual-clauses-scc_en
6. SECURITY MEASURES
TIFFOSI makes every effort to protect Users' personal data from unauthorised access. To this end, it uses security systems and implements rules and other procedures in order to guarantee personal data protection, namely by preventing unauthorised access, improper use, disclosure, loss or destruction.
Your data will always be processed in accordance with the legal regime in force and in accordance with appropriate standards in terms of security and confidentiality.
In this regard, and taking into account the state of the art, the associated implementation costs and the nature, scope, context and purposes of data processing, as well as the risks of varying probability and extent to the rights and freedoms of data subjects, TIFFOSI adopts appropriate technical and organisational measures with a view to ensuring a level of security adjusted to such risks.
In any case, please note that, as data circulates on an open Internet network, it is not possible to completely eliminate the risk of unauthorised access and use, and it is the Users’ responsibility to guarantee and ensure that the devices and equipment used to access the Platform are suitably protected from malware, computer viruses and other threats. In this regard, TIFFOSI suggests that Users should always keep their devices, browser, operating system and antivirus software updated.

7. RIGHTS OF THE DATA SUBJECT

Pursuant to the applicable data protection legal regime, the User, as the data subject, may, at any time, request access to any personal data pertaining to him/her, as well as the rectification, erasure or limitation of their processing, the portability of his/her data, or opposition to their processing.

The table below provides a brief description of the rights granted to you, in light of the applicable legislation in the field of data protection:

Rights of the Data Subject
Right of Access	Right to obtain confirmation of which of your personal data are being processed, as well as to obtain a copy of your personal data being processed. If you are a registered user at the Platform, you can also consult this information in the section pertaining to your personal data. The right to obtain any such copy does not prejudice the rights and freedoms of third parties, including trade secret or intellectual property and, in particular, the copyright protecting the software.
Right of Rectification	Right to request the rectification any of your personal data which are inaccurate or request that incomplete personal data be completed. If you are a registered User at the Platform, you can also access the section pertaining to your personal data to modify or update your personal data. The User, by actively providing his/her personal data to TIFFOSI, by any means, guarantees that such data are correct and accurate, and must rectify it with TIFFOSI in the event of any change or alteration thereof.
Right to Erasure	Right to obtain the erasure of your personal data. This right will not apply when the processing of data is necessary for compliance with a legal obligation to which TIFFOSI is subject or for the purposes of declaring, exercising or defending a right in legal proceedings.
Right to Restriction of Processing	Right to request the limitation of the processing of your personal data, requesting the suspension of the processing or the limitation of the scope of the processing to certain data categories or processing purposes.
Right to Portability	Right to receive the data you provided to TIFFOSI in a commonly used, machine-readable digital format or to request the direct transmission of your data to another entity which becomes the new controller of your personal data, if the processing of your data is based on your consent or the performance of a contract.
Right to Opposition	Right to object to data processing, such as in the case of data processing for the purpose of sending marketing communications or sending targeted advertising, based on TIFFOSI's legitimate interests.

Under the terms of the law, and where applicable, you are also guaranteed the right to withdraw your consent to the processing of your data. Hence, when the processing of personal data is based on consent, this may be withdrawn at any time. However, this does not invalidate the processing of data carried out up to that date based on consent provided previously.

If you believe that the way we process your data fails to comply with the data protection legislation in force, we hereby inform you that, without prejudice to any other administrative or judicial remedy, you have the option of filing a complaint with the National Data Protection Commission, or with another supervisory authority in this field.

The above provisions apply, with the necessary adaptations, to the exercising of rights by the holder of parental responsibilities or guardian, in the name and on behalf of data subjects who are under 16 years of age or incapacitated.

8. INFORMATION ABOUT COOKIES

In order to provide its Users with a better browsing experience and update the Platform with relevant functions, when accessing the Platform, small files may be installed on the User's computer or mobile device called cookies.

Please read our Cookies Policy to learn more about the cookies and similar devices we use, their purpose and other useful information.

COOKIES POLICY

What is a Cookie?

Cookies are small information files that a website, mobile app or other platform stores on your computer, tablet, smartphone or any other similar device, with information about your browsing, intended to optimise a better user experience. It is in this regard that, for a certain period of time, the Platform may maintain the actions and preferences of Users, namely those related with the language in which they wish to browse or other relevant settings related with the Platform interface andcookies are responsible for implementing these features.

What are cookies used for on the Platform?

The main purpose of cookies is to improve the User experience. They are used, for instance, to remember your preferences (language, country etc.) during browsing and on future visits, as well as to help determine the usefulness, interest and number of uses of the Platform, allowing faster, more efficient navigation, eliminating the need to repeatedly enter the same information.

The information collected by cookies also allows us to improve the Platform through statistics and usage patterns, providing greater adaptation of the Platform to Users’ interests.

Who uses the information stored in cookies?

The information stored in cookies from the Platform is used exclusively by us, with the exception of that identified as “third-party cookies”, which are used and managed by external entities to provide services requested from us for the purpose of improving the User's experience when using the Platform.

What types of cookies are there?

There are various types of cookies.

Depending on the lifetime of cookies, these may be:

1. 1. Session cookies – these are temporary cookies, which are deleted from the cookie file when the Platform or browser is closed to access the Platform. Through this type of cookies, it is possible to analyse Internet traffic patterns, allowing us to identify problems and provide a better browsing experience.
  2. Permanent cookies – They differ from session cookies as they are not deleted when the browser or application closes, remaining saved on the User's devices. They are used whenever a new visit is made to the Platform, allowing, amongst other functions, the customisation of the browsing experience, according to the User's interests.

Depending on the domain they belong to, cookies may be:

First-party cookies – these are cookies sent to the User’s device through equipment or domains managed by TIFFOSI and from which the service requested by the User is provided.
Third-party cookies – these are cookies sent to the User’s device from a device or domain managed by a third party. In these cases, it is this third party that processes the data collected through these cookies.

Depending on the purpose, we may have the following types of cookies:

Essential cookies - These cookies are necessary for the functioning of the Platform and cannot be deactivated in our systems. You can configure your Platform to block or alert you to the presence of these cookies, although, as a result, some parts of the Platform may stop working. These cookies do not store any personally identifiable information.
Performance Cookies - These cookies allow us to analyse website traffic patterns for statistical analysis and to improve the offering of products or services.
Advertising Cookies - These are cookies that, whether processed by us or by third parties, allow us to analyse your usage habits on the Platform so that we can show you advertising related with your interests.

What cookies do we use and for what purposes?

The cookies identified below are required to provide the service requested by the User:

NAME	SUPPLIER	VALIDITY	PURPOSE
PHPSESSID	Redicom	Session	Cookie ensuring basic functionality at the site.
_see*	Redicom	1 year	Popup management to determine whether the pop up has already been displayed or not
_sui	Redicom	1 year	User preference management.
_sau	Redicom	1 year	User preference management.
_sic	Redicom	1 year	Website actions management.
_sicv	Redicom	1 year	Website actions management.
_FNNL	Redicom	30 days	Website actions management
_WCG*	Redicom	4 months	Welcome offer management.
CPN-*	Redicom	30 days	Website actions management.
plg_*	Redicom	2 years	Cookies preference management.
ntfbarshow	Redicom	Session	Notification Bar.
sh	Redicom	1 year	Homepage preference management.
active	Redicom	5 min	Chat activity management.

TIFFOSI also uses other cookies, subject to your consent provided when you access the Platform. Such cookies are:

Type of cookie

Purpose

Retention period

Origin

Google Analytics (__utma,__utmt, __utmb, __utmz,__utmv

This allows you to monitor the Platform using the Google Analytics (GA) tool. GA is a Google analysis tool, whose purpose is to understand visitors' engagement with the Platform, by collecting information and usage statistics without individually identifying visitors.

The configuration of these cookies is predetermined by the service provided by Google. We suggest you consult the GA privacy page (https://developers.google.com/analytics/devguides/collection/analyticsjs/cookie-usage) for more information about the cookies used and how to disable them. Please remember that we are not responsible for the content or operation of third party websites.

1 year

Third-Party Cookies

9. QUESTIONS AND SUGGESTIONS
The User may contact TIFFOSI regarding all issues related with the processing of his/her personal data and the exercising of the rights granted to him/her by applicable legislation and, in particular, referred to in this Privacy Policy, through the following contacts:
E-mail: privacy@grupovnc.com
Address: Rua Fernão de Magalhães, n.º 2, Fração C, 4400-629 Vila Nova de Gaia
10. COMPLAINTS
If you believe that the way TIFFOSI processes your data fails to comply with the data protection legislation in force, we hereby inform you that, without prejudice to any other administrative or judicial remedy, you have the option of filing a complaint with the National Data Protection Commission, or with another supervisory authority with competence in this field.
11. ALTERATIONS TO THE PRIVACY POLICY
TIFFOSI may implement changes or updates to this Privacy Policy at any time. Any changes implemented will always be duly publicised via the Platform itself. If these changes or updates entail any substantial change in the way your data will be processed, TIFFOSI will notify you of such changes, using the contact details you have provided.
In any case, we would suggest that you read this Privacy Policy in case any slight changes or improvements are made related with the use of the Platform.