Privacy Policy

Information on the processing of personal data pursuant to Article 13 of Regulation (EU) 2016/679

Last updated: 12 August 2026

1. DATA CONTROLLER

The Data Controller responsible for the personal data collected through www.braendon.com is:

The Golden Octagon di Bergamo Mauro
Sole proprietorship
Registered office: Via Masserano 35/C, 21023 Besozzo (VA), Italy
VAT number: IT03959730122
Italian tax code: BRGMRA89R05L682K
Email: customercare@braendon.com

Brændon is the trading brand through which the Data Controller presents and sells its products.

The Golden Octagon determines the purposes and means of the processing of personal data carried out through the website and is responsible for compliance with the applicable data protection legislation.

2. PERSONAL DATA PROCESSED

This Privacy Policy applies to personal data processed when the user:

- visits or browses the website;
- creates or uses a personal account;
- adds products to the shopping cart or wishlist;
- places an order;
- requests assistance or sends a communication;
- subscribes to the newsletter;
- interacts with communications or promotional campaigns;
- submits an application for the HERO programme;
- expresses or changes preferences relating to cookies and other tracking technologies.

The Data Controller may process the following categories of personal data:

- first name, surname and other personal details;
- email address and telephone number;
- shipping and billing address;
- Italian tax code, VAT number and information required for invoicing;
- information relating to orders, purchased products, returns and deliveries;
- information regarding payment status and transaction references;
- account information, wishlist, shopping cart and order history;
- information contained in requests sent to customer service;
- information provided when applying for the HERO programme;
- IP address, date and time of access, pages visited, browser, device, operating system, technical identifiers and browsing data;
- information relating to interactions with the website, advertising campaigns and communications sent, where the relevant consent has been given;
- information relating to preferences expressed through the consent management system.

Personal data is collected directly from the user, generated during use of the website or received from providers required to supply the requested services, such as payment providers, couriers and technology platforms.

3. PURPOSES, LEGAL BASIS AND RETENTION PERIODS

3.1 Website browsing, operation and security

Technical and browsing data is processed in order to:

- display the website correctly;
- maintain browsing sessions;
- manage accounts, shopping carts, wishlists and personal areas;
- ensure the security and stability of the platform;
- prevent unauthorised access, spam, abuse, fraud and malfunctions;
- carry out technical maintenance and error-resolution activities.

The legal basis is the performance of the services requested by the user and the legitimate interest of the Data Controller in ensuring the security, integrity and proper operation of the website.

Technical data is retained for the period strictly necessary for the operation and security of the platform. In the event of anomalies, attempted fraud or security incidents, the relevant data may be retained for a longer period in order to carry out investigations and protect the rights of the Data Controller.

3.2 Creation and management of user accounts

The user’s personal data is processed in order to:

- create and manage the account;
- provide access to the personal area;
- display the order history;
- manage wishlists, shopping carts and services linked to the account;
- send technical communications relating to the service.

The legal basis is the performance of the service requested by the user.

Account data is retained for the entire duration of the account and until its deletion, without prejudice to information that must be retained for a longer period in order to comply with legal obligations, manage orders or protect the rights of the Data Controller.

3.3 Orders, payments, deliveries and returns

Personal data is processed in order to:

- receive and manage orders;
- verify payment status;
- prepare and deliver products;
- manage returns, refunds, complaints and warranties;
- send order confirmations and delivery updates;
- comply with tax, accounting and administrative obligations.

The legal basis is the performance of the sales contract and compliance with legal obligations.

Accounting, tax and order data is retained for 10 years, without prejudice to any longer period required in connection with disputes, proceedings or other legal obligations.

Full payment card details are processed directly by the relevant payment service providers. The Golden Octagon only receives the information required to determine the result and status of the transaction.

3.4 Customer assistance and contact requests

Personal data provided by email, telephone, WhatsApp, chat, contact form or any other available communication channel is processed in order to:

- respond to requests;
- provide information about products;
- manage assistance, orders, returns and complaints;
- take any pre-contractual steps requested by the data subject.

The legal basis is the performance of pre-contractual or contractual measures and, in relation to general requests, the legitimate interest of the Data Controller in managing communications received.

Requests are normally retained for no longer than 24 months after they have been dealt with. In the event of complaints or disputes, they may be retained for the period required to protect the rights of the Data Controller.

3.5 Newsletter and marketing communications

With the user’s consent, the email address is used to send:

- news concerning the brand and its products;
- promotions and offers;
- communications relating to collections, initiatives and events;
- invitations and other marketing content.

The legal basis is the consent of the data subject.

Consent is optional and may be withdrawn at any time by using the unsubscribe link contained in each communication or by writing to customercare@braendon.com.

Data used for newsletters is retained until consent is withdrawn and, in any event, for no longer than 24 months from the user’s last meaningful interaction with the communications sent, unless consent is renewed.

3.6 Statistical analysis and performance measurement

With the user’s consent, the website uses Google Analytics 4 and the statistical features made available by Wix in order to:

- understand how the website is used;
- measure visits, page views and interactions;
- analyse browsing paths;
- identify technical or usability issues;
- improve content, products and features;
- produce statistics concerning the website’s performance.

The information processed may include online identifiers, browser and device information, pages visited, browsing events, traffic source, date, time and approximate geographical location.

Google Tag Manager and Google Tag Services may be used to manage tags technically and apply the preferences expressed by the user.

The legal basis is the consent of the data subject.

Non-essential analytics tools remain disabled until the user gives the relevant consent.

User-level and event-level data held in Google Analytics is retained for the period configured in the relevant property and, in any event, for no longer than 14 months. Aggregated statistics that no longer directly identify an individual user may be retained for a longer period.

The user may withdraw consent at any time through the privacy preferences icon available on the website.

3.7 Meta Pixel and Conversions API

With the user’s consent to the Marketing category, the website uses Meta Pixel and Meta Conversions API, provided by Meta Platforms Ireland Limited.

Meta Pixel enables the detection of events generated through the user’s browser. The Conversions API may enable events to be transmitted through the server systems used by the website.

The information processed may include:

- pages and products viewed;
- interactions with the website;
- products added to the shopping cart;
- initiation and completion of purchases;
- value and currency of transactions;
- traffic originating from advertising campaigns;
- IP address, browser, device and online identifiers;
- information concerning commercial events required to measure conversions.

The processing is carried out in order to:

- measure the effectiveness of advertising campaigns;
- attribute visits and conversions to campaigns;
- generate advertising statistics;
- create or update campaign audiences;
- display more relevant advertising through Meta services.

The legal basis is the consent of the data subject.

Meta Pixel and non-essential advertising tools remain disabled until the user gives consent to the Marketing category.

With regard to the collection and transmission to Meta of data generated through Meta Business Tools, The Golden Octagon and Meta Platforms Ireland Limited operate in accordance with their respective responsibilities under Meta’s Controller Addendum.

Any subsequent processing carried out directly by Meta is governed by Meta’s own privacy policy.

3.8 Consent management and documentation

The website uses Usercentrics for Wix to collect, store and document preferences relating to cookies and other tracking technologies.

The following information may be processed:

- a technical identifier relating to the user’s choice;
- the date and time of the choice;
- the categories accepted or rejected;
- the version of the information presented;
- technical information required to recognise and apply the preference.

The legal basis is compliance with obligations relating to the management and demonstration of consent and the legitimate interest of the Data Controller in correctly documenting users’ choices.

Tools used exclusively to store and apply the user’s choice are considered necessary.

Information relating to consent is retained for the period required to demonstrate the choice expressed, manage any withdrawal or dispute and comply with applicable obligations.

3.9 Google reCAPTCHA

The website may use Google reCAPTCHA to protect forms, accounts and online features against spam, automated access, abuse and fraudulent activities.

The service may process technical information concerning the device, browser, IP address and manner in which the user interacts with the website in order to assess the risk associated with a request.

The legal basis is the legitimate interest of the Data Controller in protecting the website, its users and its systems against abuse and unlawful activities.

Google reCAPTCHA is used exclusively for security purposes and is classified as a necessary service.

3.10 Internal customer analysis

The Data Controller may analyse information concerning the frequency and value of purchases, product categories purchased, shipping and billing country and returns made in order to:

- prepare internal statistics;
- understand sales performance;
- improve products, product ranges and services;
- organise commercial and customer support activities.

The legal basis is the legitimate interest of the Data Controller in understanding and improving its commercial activities.

Data used in a form directly attributable to a customer for these analyses is retained for a maximum of 12 months. After that period, it is removed from the specific analysis or used in aggregated form.

These activities do not result in decisions based exclusively on automated processing that produce legal or similarly significant effects on the data subject.

The user may object to this processing at any time by writing to customercare@braendon.com.

3.11 HERO programme

Personal data provided by applicants to the HERO programme is processed in order to:

- receive and assess applications;
- contact applicants;
- organise any interviews or checks;
- manage subsequent participation in the programme.

The legal basis is the performance of pre-contractual measures requested by the applicant and, where the applicant is selected, the performance of the relevant relationship.

Unsuccessful applications are retained for a maximum of 12 months. Data relating to selected participants is retained for the duration of the relationship and subsequently for the periods required to comply with legal obligations and protect the rights of the Data Controller.

3.12 Legal obligations, fraud prevention and protection of rights

Personal data may be processed and retained in order to:

- comply with legal obligations;
- respond to requests from competent authorities;
- prevent and investigate fraud or unlawful use;
- establish, exercise or defend legal claims in judicial or out-of-court proceedings.

The legal basis is compliance with legal obligations and the legitimate interest of the Data Controller in preventing unlawful activities and protecting its rights.

Data is retained for the period required by law or necessary to manage the relevant dispute or proceeding.

4. NATURE OF THE PROVISION OF PERSONAL DATA

The provision of personal data required to create an account, make a purchase, complete payment, arrange delivery and manage requests is necessary in order to provide the requested services.

Without this information, the Data Controller may be unable to create the account, complete the order, deliver the products or respond to the request.

The provision of personal data for newsletters, analytics tools and marketing tools is optional.

Refusal does not prevent the user from browsing the website normally or making purchases.

5. COOKIES AND OTHER TRACKING TECHNOLOGIES

The website uses necessary technical cookies and tools and, with the user’s consent, functional, analytics and marketing tools.

The user may accept, reject or personalise the relevant choices through the consent banner.

Choices may be changed or withdrawn at any time through the privacy preferences icon, represented by a fingerprint and available on the website.

Further information is provided in the Cookie Policy.

6. RECIPIENTS OF PERSONAL DATA

Personal data may be processed by or disclosed, to the extent necessary, to the following categories of recipients:

- personnel and collaborators authorised by the Data Controller;
- Wix.com Ltd. and its affiliated companies, for hosting, ecommerce platform, account, database, communication and technical services;
- Usercentrics and providers involved in the consent management system;
- Google and other companies in the Google group, in connection with Google Analytics, Google Tag Manager, Google Tag Services and Google reCAPTCHA;
- Meta Platforms Ireland Limited, only where the consent required for marketing tools has been given;
- providers responsible for the technical management, maintenance, security and support of the website, appointed as Data Processors where they act on behalf of the Data Controller;
- payment service providers and banks;
- couriers, shipping providers and logistics operators;
- email and newsletter service providers;
- accountants, consultants, lawyers and other professional advisers;
- public, administrative or judicial authorities, where required by law.

Entities that process personal data on behalf of The Golden Octagon receive documented instructions and are bound by confidentiality and data protection obligations.

Some recipients, including payment providers, couriers, professional advisers and advertising platforms, may act as independent Data Controllers in relation to processing activities determined directly by them.

An up-to-date list of Data Processors may be requested by writing to customercare@braendon.com.

7. TRANSFERS OUTSIDE THE EUROPEAN ECONOMIC AREA

The use of international providers may involve the processing of personal data in countries outside the European Economic Area.

Where applicable, such transfers are carried out using one of the safeguards provided for by the GDPR, including:

- adequacy decisions adopted by the European Commission;
- the EU-US Data Privacy Framework, where applicable to the provider;
- Standard Contractual Clauses approved by the European Commission;
- other safeguards provided for under Articles 44 and following of the GDPR.

8. AUTOMATED DECISION-MAKING

The website does not make decisions based exclusively on automated processing that produce legal effects or similarly significantly affect the data subject.

Any statistical and commercial analyses are used to support internal activities and do not automatically exclude the user from services or rights.

9. RIGHTS OF THE DATA SUBJECT

Where applicable, the data subject may exercise the following rights:

- obtain confirmation as to whether personal data concerning them is being processed;
- access their personal data;
- obtain the rectification of inaccurate data;
- obtain the erasure of personal data;
- obtain restriction of processing;
- receive personal data in a structured, commonly used and machine-readable format;
- object to processing based on legitimate interests;
- withdraw consent at any time;
- not be subject to a decision based solely on automated processing in the cases provided for by law;
- lodge a complaint with the Italian Data Protection Authority;
- seek a judicial remedy before the competent courts.

Withdrawal of consent does not affect the lawfulness of processing carried out before consent was withdrawn.

To exercise these rights, the data subject may write to:

customercare@braendon.com

The Data Controller may request the information strictly necessary to verify the identity of the person making the request.

10. SECURITY

The Data Controller adopts technical and organisational measures appropriate to the level of risk in order to protect personal data against loss, destruction, unauthorised access, alteration or disclosure.

Access to personal data is restricted to persons who require it for the performance of their assigned duties, using personal credentials and defined roles and permissions.

11. CHANGES TO THIS PRIVACY POLICY

This Privacy Policy may be updated when the services, tools used, processing activities or applicable legislation change.

The date of the latest update is indicated at the beginning of this document.

Where changes are significant, the Data Controller may inform users through the website or other available communication channels.

12. CONTACT DETAILS

For questions concerning this Privacy Policy or the processing of personal data:

The Golden Octagon di Bergamo Mauro
Via Masserano 35/C
21023 Besozzo (VA), Italy

Email: customercare@braendon.com