Privacy Policy

Last update: 26 June 2026

Who We Are

This website, cerruti.com, is operated by DISTRI-BRANDS S.A., a company incorporated in Belgium, acting as an official licensee of the CERRUTI 1881 brand. DISTRI-BRANDS S.A. operates the website on behalf of the CERRUTI 1881 brand and its licensees.

DISTRI-BRANDS S.A. is the data controller responsible for the personal data collected through this website. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and Belgian data protection law.

Where DISTRI-BRANDS S.A. and CERRUTI 1881 jointly determine the purposes and means of processing certain customer data, we act as joint controllers within the meaning of Article 26 GDPR. The essence of that arrangement is summarised in the section "CERRUTI 1881 Brand Analytics and Licensee Marketing Campaigns" below and is available to you on request.

Contact Information

Company Name: DISTRI-BRANDS S.A. Registered Address: 61 rue du Sel, 1070 Anderlecht, Belgium General Inquiries: ecommerce@cerruti.com Privacy Concerns: privacy@distri-brands.com

Types of Personal Data We Collect

We collect the following types of personal data:

• Title
• Name
• Address
• Phone number
• Email address
• Payment information (processed securely by our payment providers)
• Navigation information (collected through cookies and analytics)
• Browser type and version
• Device information
• IP address
• Visit times and pages viewed
• Order history
• Unfinished orders (abandoned shopping carts)
• Communication preferences

We do not collect any special categories of personal data (e.g., health information, racial or ethnic origin, biometric data, genetic data).

Purposes of Data Collection and Processing

We collect and process your personal data for the following purposes:

• To process and fulfil your orders
• To deliver goods and services
• To process payments securely
• To provide after-sales service and customer support
• To communicate with you regarding your orders
• To send marketing communications (where you have opted in)
• To enable CERRUTI 1881 brand-level analytics and to run CERRUTI-branded marketing campaigns that may be funded and operated by other brand licensees on our database, as described below
• To manage your customer account
• To prevent fraud and ensure security
• To conduct marketing studies and statistics
• To improve our website and services
• To comply with legal obligations

Legal Basis for Processing

We process your personal data based on the following legal grounds:

• Performance of a contract: to fulfil your orders and provide the services you have requested.
• Legitimate interests: to provide customer service, improve our services, prevent fraud, and ensure security.
• Consent: for marketing communications, including CERRUTI-branded campaigns that may be funded and operated by other brand licensees on our database, and for non-essential cookies.
• Legal obligation: to comply with accounting, tax, and other legal requirements.

CERRUTI 1881 Brand Analytics and Licensee Marketing Campaigns

cerruti.com is operated by DISTRI-BRANDS S.A. as a licensee of the CERRUTI 1881 brand. We want to be fully transparent about how customer data is used within the CERRUTI 1881 brand ecosystem.

With CERRUTI 1881 (the brand owner): We share customer data with CERRUTI 1881 for brand-level analytics, customer-base insight, and brand management. For these purposes, DISTRI-BRANDS S.A. and CERRUTI 1881 act as joint controllers (Article 26 GDPR), and the legal basis is our and CERRUTI 1881's legitimate interest in understanding and managing the brand's customer base.

Marketing campaigns funded and operated by other brand licensees: Other official CERRUTI 1881 licensees may fund and operate CERRUTI-branded marketing campaigns addressed to our customers. We do not hand over, sell, or give a copy of our customer database to these licensees, and they may not use the data for any independent purpose of their own. The data remains under our control at all times, within our systems; licensees may only access it to operate a specific CERRUTI-branded campaign, acting on our instructions and under a data processing agreement.

• What this means for you: any marketing you receive is CERRUTI-branded marketing, consistent with the marketing you opted into. Different campaigns may be funded by different CERRUTI licensees behind the scenes.
• Legal basis: your consent to receive marketing. You may withdraw it at any time (see "Marketing Communications" and "Your Rights" below), without affecting the lawfulness of processing carried out before withdrawal.
• Capacity of the licensees: licensees operating a campaign do so as our data processors, on our instructions and solely for that campaign, under a data processing agreement (Article 28 GDPR). They never reuse the data for their own independent purposes.
• Location of processing: these campaign operations are carried out within the European Economic Area.

If you do not consent to marketing, you can still place orders and use all functional parts of the website; you simply will not receive these campaigns.

Use of the Shopify Platform

Our e-commerce website is built on the Shopify platform provided by Shopify Inc., a Canadian company. By using our website and placing orders, your personal data is processed by Shopify as our data processor.

Data shared with Shopify includes:

• Contact information (name, email, phone, address)
• Order information
• Payment information (tokenized, not raw payment details)
• Website usage data

Shopify processes this data on our behalf to provide e-commerce platform functionality, process payments securely, support website operations, and provide analytics and reporting.

Shopify may store and process your data on servers located in Canada and the United States. These transfers are protected by Shopify's GDPR compliance and by Standard Contractual Clauses approved by the European Commission.

For more information: https://www.shopify.com/legal/privacy

Payment Processing

We use the following payment processors to handle transactions securely:

Shopify Payments (powered by Stripe) — processes credit and debit card payments. Your payment information is transmitted directly to Stripe and is not stored on our servers. Stripe is PCI-DSS compliant. Privacy Policy: https://stripe.com/privacy

PayPal — processes payments through your PayPal account. You will be redirected to PayPal's secure platform to complete your transaction. Privacy Policy: https://www.paypal.com/myaccount/privacy/privacyhub

Klarna — processes buy now, pay later transactions. Klarna may perform credit checks and assess your eligibility for their payment services. Privacy Policy: https://www.klarna.com/international/privacy-policy/

Important: we never store your complete credit card information. Payment processors use tokenization to protect your payment data.

Shipping and Fulfilment Partners

To deliver your orders, we share the minimum necessary information with our logistics partners:

Our fulfilment operations process and ship orders within the European Union. Data shared: name, delivery address, phone number, email address, order details.

Amazon Multi-Channel Fulfilment (MCF) — for certain products, we use Amazon's fulfilment network. Data shared: name, delivery address, phone number, order details. Amazon may process data in various EU locations and potentially outside the EU, with appropriate safeguards in place. Privacy Policy: https://www.amazon.com/gp/help/customer/display.html?nodeId=GX7NJQ4ZB8MHFRNJ

Our logistics partners only receive the data necessary to process shipments and contact you for delivery, are contractually obligated to protect your data, and use it only for fulfilment services.

Cookies and Tracking Technologies

We use cookies and similar tracking technologies to enhance your browsing experience, analyse website traffic, and personalise content.

What are cookies? Cookies are small text files stored on your device when you visit our website. They help us recognise you, remember your preferences, and improve our services.

Types of cookies we use:

1. Strictly Necessary Cookies — essential for the website to function (security, network management, shopping cart, checkout). These include session management, authentication, and security cookies. Legal basis: not subject to consent, as they are necessary to provide the service you requested.

2. Performance and Analytics Cookies — collect information about how you use our website to help us improve it (Google Analytics, Shopify Analytics). Legal basis: your consent.

3. Functional Cookies — enable enhanced functionality and personalisation (language, region/currency, recently viewed products). Legal basis: your consent.

4. Marketing and Advertising Cookies — track browsing habits to deliver personalised advertisements and measure campaign effectiveness (Facebook Pixel, Google Ads, TikTok Pixel, Pinterest Tag). Legal basis: your consent.

Cookie duration: session cookies are deleted when you close your browser; persistent cookies remain for a set period (typically 1–24 months depending on the cookie type).

Managing your preferences: when you first visit our website, a cookie banner allows you to accept or customise your preferences. You can also configure your browser to block all cookies, block third-party cookies, delete cookies on close, or warn you before accepting. Blocking necessary cookies may prevent certain features (such as adding items to your cart or completing purchases).

Opt-out of specific tracking:

• Google Analytics: https://tools.google.com/dlpage/gaoptout
• Facebook: https://www.facebook.com/settings/?tab=ads
• Google Ads: https://adssettings.google.com/

Marketing Communications

With your explicit consent, we may send you promotional emails about new products, offers and sales; newsletters with fashion trends and styling tips; personalised product recommendations; and abandoned cart reminders.

How to unsubscribe: click the "unsubscribe" link in any marketing email, contact us at privacy@distri-brands.com, or update your preferences in your customer account. Withdrawing your marketing consent also stops any CERRUTI-branded campaigns funded or operated by other brand licensees from being addressed to you.

Even if you unsubscribe from marketing, we will still send transactional emails related to your orders (order confirmations, shipping notifications, customer service responses).

Third-Party Services and Data Sharing

We may share your personal data with the following categories of third parties:

Service providers: e-commerce platform (Shopify), payment processors (Stripe, PayPal, Klarna), shipping and logistics partners, email service providers, customer service platforms, analytics providers.

Brand ecosystem: the CERRUTI 1881 brand owner (for brand-level analytics) and, as our processors and on our instructions, other official brand licensees that fund and operate CERRUTI-branded marketing campaigns on our database (see "CERRUTI 1881 Brand Analytics and Licensee Marketing Campaigns"). We do not give these licensees a copy of the database or allow any independent reuse of the data.

Advertising and marketing partners: social media platforms (Facebook/Instagram, TikTok, Pinterest), Google Ads, influencer marketing platforms.

Legal and compliance: we may disclose your data if required by law, court order, or governmental authority, or to protect our legal rights and prevent fraud.

We do not sell your personal data to third parties.

International Data Transfers

While we are based in Belgium and primarily operate within the European Union, some service providers (Shopify, payment processors, cloud services) may transfer and process your data outside the EEA, including in Canada and the United States. Marketing campaigns operated by brand licensees are carried out within the EEA.

When data is transferred outside the EEA, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms requiring adequate data protection.
• Adequacy decisions: transfers to countries recognised by the EU as providing adequate protection.
• Service provider and recipient certifications: partners comply with GDPR and international data protection standards.

Data Retention

We retain your personal data for as long as necessary to fulfil the purposes outlined in this policy:

• Active customer data: 3 years after your last purchase or account activity.
• Order and transaction records: 10 years (Belgian accounting and tax law requirements).
• Marketing consent records: until you withdraw consent, then retained for 3 years as proof of consent.
• Abandoned cart data: 90 days.
• Website analytics data: 26 months (Google Analytics default).

After the retention period expires, your personal data is securely deleted or anonymised.

Your Rights Under GDPR

Under the GDPR, you have the right to:

1. Access — request a copy of the personal data we hold about you.
2. Rectification — request correction of inaccurate or incomplete data.
3. Erasure ("right to be forgotten") — request deletion in certain circumstances (e.g. the data is no longer necessary, you withdraw consent, you object with no overriding grounds, or the data was unlawfully processed). We may be required to retain certain data for legal or accounting purposes.
4. Restrict processing — request that we limit how we use your data in certain situations.
5. Data portability — request a copy of your data in a structured, commonly used, machine-readable format.
6. Object — object to processing based on legitimate interests or for direct marketing.
7. Withdraw consent — where processing is based on consent, withdraw it at any time, including consent to receive marketing.
8. Not be subject to automated decision-making — we do not currently use automated decision-making or profiling that produces legal or similarly significant effects.

How to exercise your rights: Email privacy@distri-brands.com, or write to DISTRI-BRANDS S.A., 61 rue du Sel, 1070 Anderlecht, Belgium. We will respond within one month; in complex cases we may extend this by two further months and will inform you of the delay.

Right to Lodge a Complaint

If you believe we have not handled your personal data properly, you have the right to lodge a complaint with the Belgian Data Protection Authority:

Autorité de protection des données (APD) / Gegevensbeschermingsautoriteit (GBA) Rue de la Presse 35, 1000 Brussels, Belgium Phone: +32 (0)2 274 48 00 — Email: contact@apd-gba.be Website: https://www.dataprotectionauthority.be/

Security Measures

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, loss, destruction, or alteration:

• Encryption: data transmitted through our website is encrypted using SSL/TLS protocols (HTTPS).
• Secure servers: personal data is stored on secure servers with restricted access.
• Access controls: only authorised personnel have access on a need-to-know basis.
• Regular security audits: we regularly review and update our security practices.
• Employee training: staff are trained on data protection and privacy principles.
• Payment security: payment data is processed by PCI-DSS compliant providers and never stored on our servers.

Data Breach Notification

In the unlikely event of a data breach posing a risk to your rights and freedoms, we will notify the Belgian Data Protection Authority within 72 hours of becoming aware of it, notify affected individuals without undue delay where the breach is likely to result in high risk, and provide information about the nature of the breach, its potential consequences, and the measures taken.

If you suspect unauthorised access to your account or personal data, please contact us immediately at privacy@distri-brands.com.

Children's Privacy

Our website and products are intended for adults (18 years and older) or for use by minors under adult supervision.

• We do not knowingly collect personal data from children under 13 (the age of digital consent in Belgium) without verifiable parental consent.
• Any purchase by an individual under 18 must be made with the knowledge and consent of a parent or guardian.
• If we become aware that we have collected data from a child under 13 without parental consent, we will delete it as quickly as possible.

If you believe we have inadvertently collected such data, please contact us at privacy@distri-brands.com.

Privacy Contact

For any question or concern about how we handle your personal data, you can contact our privacy team at privacy@distri-brands.com. We have not appointed a formal Data Protection Officer, as we are not required to do so; the privacy contact above handles all data protection matters.

Updates to This Privacy Policy

We review and update this Privacy Policy regularly to reflect changes in our business practices, legal requirements, and technology and security measures (annually, or as needed when significant changes occur).

The date of the last update is indicated at the top of this document. If we make material changes affecting how we use your personal data, we will update the "Last update" date, notify you by email (if you have an account), display a prominent notice on our website, and request your consent again where required by law.

How to Contact Us

DISTRI-BRANDS S.A. 61 rue du Sel, 1070 Anderlecht, Belgium General inquiries: ecommerce@cerruti.com Privacy matters: privacy@distri-brands.com Response time: we aim to respond within 5 business days.