Privacy policy

Privacy Policy

Last update: October 23, 2025

Introduction

CERRUTI1881 ("we", "us", or "our") is committed to protecting the privacy of our customers and users. This Privacy Policy explains how we collect, use, disclose, and safeguard your personal data in compliance with the General Data Protection Regulation (GDPR) and Belgian data protection law.

Contact Information

Company Name: DISTRI-BRANDS S.A.
Registered Address: 61 rue du sel, 1070 Anderlecht, Belgium
General Inquiries: ecommerce@cerruti.com
Privacy Concerns: ecommerce@cerruti.com

Types of Personal Data We Collect

We collect the following types of personal data:

Title
Name
Address
Phone number
Email address
Payment information (processed securely by our payment providers)
Navigation information (collected through cookies and analytics)
Browser type and version
Device information
IP address
Visit times and pages viewed
Order history
Unfinished orders (abandoned shopping carts)
Communication preferences

We do not collect any special categories of personal data (e.g., health information, racial or ethnic origin, biometric data, genetic data).

Purposes of Data Collection and Processing

We collect and process your personal data for the following purposes:

To process and fulfill your orders
To deliver goods and services
To process payments securely
To provide after-sales service and customer support
To communicate with you regarding your orders
To send marketing communications (if you have opted in)
To manage your customer account
To prevent fraud and ensure security
To conduct marketing studies and statistics
To improve our website and services
To comply with legal obligations

Legal Basis for Processing

We process your personal data based on the following legal grounds:

Performance of a contract: To fulfill your orders and provide services you've requested
Legitimate interests: To provide customer service, improve our services, prevent fraud, and ensure security
Consent: For marketing communications and non-essential cookies
Legal obligation: To comply with accounting, tax, and other legal requirements

Use of Shopify Platform

Our e-commerce website is built on the Shopify platform provided by Shopify Inc., a Canadian company. By using our website and placing orders, your personal data is processed by Shopify as our data processor.

Data shared with Shopify includes:

Contact information (name, email, phone, address)
Order information
Payment information (tokenized, not raw payment details)
Website usage data

Shopify processes this data on our behalf to:

Provide e-commerce platform functionality
Process payments securely
Support website operations
Provide analytics and reporting

Shopify may store and process your data on servers located in Canada and the United States. These data transfers are protected by:

Shopify's compliance with GDPR requirements
Standard Contractual Clauses approved by the European Commission
Shopify's comprehensive data protection measures

For more information about how Shopify handles your data, please visit: https://www.shopify.com/legal/privacy

Payment Processing

We use the following payment processors to handle transactions securely:

Shopify Payments (powered by Stripe)

Processes credit and debit card payments. Your payment information is transmitted directly to Stripe and is not stored on our servers. Stripe is PCI-DSS compliant.

PayPal

Processes payments through your PayPal account. You will be redirected to PayPal's secure platform to complete your transaction.

Klarna

Processes buy now, pay later transactions. Klarna may perform credit checks and assess your eligibility for their payment services.

Important: We never store your complete credit card information. Payment processors use tokenization to protect your payment data.

Shipping and Fulfillment Partners

To deliver your orders, we share necessary information with our logistics partners:

CERRUTI1881

Our primary fulfillment center processes and ships orders within the European Union.

Data shared: Name, delivery address, phone number, email address, order details

Amazon Multi-Channel Fulfillment (MCF)

For certain products, we use Amazon's fulfillment network to process and ship orders.

Data shared: Name, delivery address, phone number, order details

Data location: Amazon may process data in various EU locations and potentially outside the EU (with appropriate safeguards in place)

Our logistics partners only receive the minimum data necessary to process shipments and contact you for delivery purposes. They are contractually obligated to protect your data and use it only for fulfillment services.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience, analyze website traffic, and personalize content.

What are cookies?

Cookies are small text files stored on your device when you visit our website. They help us recognize you, remember your preferences, and improve our services.

Types of cookies we use:

1. Strictly Necessary Cookies These cookies are essential for the website to function properly. They enable core functionality such as security, network management, shopping cart, and checkout processes.

Session management cookies
Authentication cookies
Security cookies

Legal basis: These cookies do not require your consent as they are necessary for providing services you've requested.

2. Performance and Analytics Cookies These cookies collect information about how you use our website to help us improve its performance.

Google Analytics: Tracks visitor behavior, traffic sources, and page views
Shopify Analytics: Monitors e-commerce performance and conversion metrics

Legal basis: Your consent (obtained through our cookie banner)

3. Functional Cookies These cookies enable enhanced functionality and personalization, such as remembering your preferences.

Language preferences
Region/currency preferences
Recently viewed products

Legal basis: Your consent (obtained through our cookie banner)

4. Marketing and Advertising Cookies These cookies track your browsing habits to deliver personalized advertisements and measure campaign effectiveness.

Facebook Pixel: Tracks conversions and enables retargeting on Facebook/Instagram
Google Ads: Tracks ad performance and enables retargeting
TikTok Pixel: Tracks conversions from TikTok campaigns
Pinterest Tag: Tracks Pinterest ad performance

Legal basis: Your consent (obtained through our cookie banner)

Cookie Duration

Session cookies: Deleted when you close your browser
Persistent cookies: Remain on your device for a set period (typically 1-24 months depending on the cookie type)

Managing Your Cookie Preferences

Cookie Consent Banner: When you first visit our website, a cookie banner powered by Shopify will appear, allowing you to accept or customize your cookie preferences.

Browser Settings: You can configure your browser to:

Block all cookies
Block third-party cookies only
Delete cookies when you close your browser
Warn you before accepting cookies

Note: Blocking necessary cookies may prevent you from using certain features of our website, such as adding items to your cart or completing purchases.

Opt-out of specific tracking:

Google Analytics: https://tools.google.com/dlpage/gaoptout
Facebook: https://www.facebook.com/settings/?tab=ads
Google Ads: https://adssettings.google.com/

For more detailed information, please refer to our Cookie Policy (separate detailed document).

Marketing Communications

With your explicit consent, we may send you:

Promotional emails about new products, special offers, and sales
Newsletters with fashion trends and styling tips
Personalized product recommendations
Abandoned cart reminders

How to unsubscribe:

Click the "unsubscribe" link in any marketing email
Contact us at ecommerce@cerruti.com
Update your preferences in your customer account

Note: Even if you unsubscribe from marketing emails, we will still send you transactional emails related to your orders (order confirmations, shipping notifications, customer service responses).

Third-Party Services and Data Sharing

We may share your personal data with the following categories of third parties:

Service Providers

E-commerce platform (Shopify)
Payment processors (Stripe, PayPal, Klarna)
Shipping and logistics partners
Email service providers (for transactional and marketing emails)
Customer service platforms
Analytics providers (Google Analytics)

Advertising and Marketing Partners

Social media platforms (Facebook/Instagram, TikTok, Pinterest)
Google Ads
Influencer marketing platforms

Legal and Compliance

We may disclose your personal data if required by law, court order, or governmental authority, or to protect our legal rights and prevent fraud.

We do not sell your personal data to third parties.

International Data Transfers

While we are based in Belgium and primarily operate within the European Union, some of our service providers (such as Shopify, payment processors, and cloud services) may transfer and process your data outside the European Economic Area (EEA), including in:

Canada (Shopify)
United States (payment processors, cloud services, analytics)

When data is transferred outside the EEA, we ensure appropriate safeguards are in place:

Standard Contractual Clauses (SCCs): EU-approved contractual terms that require adequate data protection
Adequacy Decisions: Transfers to countries recognized by the EU as providing adequate protection
Service Provider Certifications: Partners comply with GDPR and international data protection standards

Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy:

Active customer data: 3 years after your last purchase or account activity
Order and transaction records: 10 years (Belgian accounting and tax law requirements)
Marketing consent records: Until you withdraw consent, then retained for 3 years as proof of consent
Abandoned cart data: 90 days
Website analytics data: 26 months (Google Analytics default)

After the retention period expires, your personal data will be securely deleted or anonymized.

Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

1. Right to Access

You can request a copy of the personal data we hold about you.

2. Right to Rectification

You can request that we correct inaccurate or incomplete personal data.

3. Right to Erasure ("Right to be Forgotten")

You can request that we delete your personal data in certain circumstances, such as when:

The data is no longer necessary for the purposes it was collected
You withdraw your consent (where consent was the legal basis)
You object to processing and there are no overriding legitimate grounds
The data has been unlawfully processed

Note: We may be required to retain certain data for legal or accounting purposes.

4. Right to Restrict Processing

You can request that we limit how we use your personal data in certain situations.

5. Right to Data Portability

You can request a copy of your personal data in a structured, commonly used, and machine-readable format.

6. Right to Object

You can object to processing based on legitimate interests or for direct marketing purposes.

7. Right to Withdraw Consent

Where processing is based on your consent, you can withdraw it at any time.

8. Right Not to Be Subject to Automated Decision-Making

We do not currently use automated decision-making or profiling that produces legal or similarly significant effects.

How to Exercise Your Rights

To exercise any of these rights, please contact us at: Email: ecommerce@cerruti.com
Mail: DISTRI-BRANDS S.A., 61 rue du sel, 1070 Anderlecht, Belgium

We will respond to your request within one month. In complex cases, we may extend this by two additional months and will inform you of the delay.

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Belgian Data Protection Authority:

Autorité de protection des données (APD) / Gegevensbeschermingsautoriteit (GBA)
Rue de la Presse 35, 1000 Brussels, Belgium
Phone: +32 (0)2 274 48 00
Email: contact@apd-gba.be
Website: https://www.dataprotectionauthority.be/

Security Measures

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, loss, destruction, or alteration:

Encryption: Data transmitted through our website is encrypted using SSL/TLS protocols (HTTPS)
Secure servers: Personal data is stored on secure servers with restricted access
Access controls: Only authorized personnel have access to personal data on a need-to-know basis
Regular security audits: We regularly review and update our security practices
Employee training: Staff members are trained on data protection and privacy principles
Payment security: Payment data is processed by PCI-DSS compliant providers and never stored on our servers

Data Breach Notification

In the unlikely event of a data breach that poses a risk to your rights and freedoms, we will:

Notify the Belgian Data Protection Authority within 72 hours of becoming aware of the breach
Notify affected individuals without undue delay if the breach is likely to result in high risk to their rights
Provide information about the nature of the breach, potential consequences, and measures taken to address it

If you suspect unauthorized access to your account or personal data, please contact us immediately at: privacy@cerruti.com

Children's Privacy

Our website and products are intended for adults (18 years and older) or for use by minors under adult supervision.

We do not knowingly collect personal data from children under 13 years old (the age of digital consent in Belgium) without verifiable parental consent
Any purchases made by individuals under 18 must be made with the knowledge and consent of a parent or guardian
If we become aware that we have collected personal data from a child under 13 without parental consent, we will take steps to delete that information as quickly as possible

If you believe we have inadvertently collected data from a child without proper consent, please contact us at privacy@cerruti.com

Data Protection Officer

Our Data Protection Officer is responsible for overseeing our data protection strategy and ensuring compliance with GDPR:

Antoine Marlot (CTO)
Email: privacy@cerruti.com

You may contact our DPO directly with any questions or concerns about how we handle your personal data.

Updates to This Privacy Policy

We review and update this Privacy Policy regularly to reflect changes in:

Our business practices
Legal requirements
Technology and security measures

Review frequency: Annually, or as needed when significant changes occur

The date of the last update is indicated at the top of this document. We encourage you to review this Privacy Policy periodically.

Significant changes: If we make material changes that affect how we use your personal data, we will:

Update the "Last update" date
Notify you by email (if you have an account)
Display a prominent notice on our website
Request your consent again if required by law

Intellectual Property

Cerruti.com is a property of the company CERRUTI1881. All intellectual property rights of the Cerruti.com website, including its structure, design, presentation, content, logos, and trademarks, belong to CERRUTI1881.

Users are prohibited from:

Copying, reproducing, or distributing website content without permission
Extracting, transferring, or storing information from the site for commercial purposes
Using our trademarks, logos, or brand elements without authorization

Third-Party Links and Content

Our website may contain links to third-party websites (such as brand websites, payment processors, or social media platforms). We are not responsible for the privacy practices or content of these external sites.

When you click on a third-party link, you leave our website and are subject to the privacy policy and terms of that third-party site. We encourage you to review their privacy policies before providing any personal data.

We exclude any warranty regarding:

The content, information, products, or services provided by external sites
The security or privacy practices of third-party websites
Any damages or losses resulting from the use of third-party sites

Disclaimer of Liability

While we strive to ensure the security and proper functioning of our website:

Cerruti.com will not be held responsible for technical problems encountered when accessing or using the website
Users are responsible for protecting their devices with appropriate security software (antivirus, firewall, etc.)
We cannot guarantee uninterrupted or error-free operation of the website
We are not liable for any indirect, incidental, or consequential damages arising from website use

Information Accuracy

The information provided on the Cerruti.com website (including product descriptions, images, prices, and availability) is for general information purposes and is subject to change without notice.

We make every effort to ensure accuracy, but:

Product images are for illustration purposes and may differ slightly from actual items
Prices and availability are subject to change
Product specifications are provided by manufacturers and may be updated

Users should regularly consult the website for the most current information.

Access Conditions and Eligibility

Our website and services are intended for individuals who are at least 18 years old or the age of majority in their jurisdiction
By using our website, you represent that you meet these age requirements
Purchases made by minors must have the consent and supervision of a parent or legal guardian
Products purchased on this site are for personal use and may not be resold for commercial purposes without authorization

Product Availability and Offer Amendments

Product selection, pricing, and promotional offers are subject to change at any time without notice
A product displayed on the website may become unavailable before you complete your purchase
We reserve the right to limit quantities, discontinue products, or modify offers
All prices are subject to change, but changes will not affect orders already confirmed
In case of pricing errors, we reserve the right to cancel orders and notify affected customers

Applicable Law and Jurisdiction

This Privacy Policy and all relationships between Cerruti.com and users of the website are governed by Belgian law.

In the event of a dispute:

We encourage you to contact us first to resolve the matter amicably
If resolution is not possible, only the courts of Brussels, Belgium have jurisdiction
This does not affect your statutory rights as a consumer under Belgian or EU law

How to Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data protection practices, please contact us:

DISTRI-BRANDS S.A.
61 rue du sel
1070 Anderlecht, Belgium

Email:

General inquiries: ecommerce@cerruti.com
Privacy matters: ecommerce@cerruti.com

Response time: We aim to respond to all inquiries within 5 business days.

Effective Date: 20th April, 2026

By using the Cerruti.com website, you acknowledge that you have read, understood, and agree to this Privacy Policy.