This Policy is valid from the date of publication (last update: June 22, 2026). The Data Controller may make changes and/or additions to this Policy, including as a result of any subsequent regulatory changes and/or additions.

 

DATA CONTROLLER

 

Cap Design S.p.A. a socio unico ("Cappellini" or "Owner"), a company subject to management and coordination activity by Haworth Italy Holding S.r.l. VAT no. 04311900965 with registered office in Via Busnelli, no. 5, 20821 Meda (MB) E-mail [email protected].

DATA PROTECTION OFFICER

 

The Data Controller has appointed a Data Protection Officer ("DPO"), who can be contacted at the following address: [email protected].

 

DATA COLLECTION SOURCE

 

The collection of your personal data (the "Personal Data" or the "Data") may occur directly when you visit one of our showrooms located in the various countries of the world (the "Showroom"), during our events, when you browse on our website (the "Website"), or when you purchase one of our products (the "Products") at our Showrooms. 

 

***

 

1 - DESCRIPTION OF TREATMENTS

 

The collected data will be entered into our centralized database and processed by us, as the independent data controller, to manage the sale of Products and for marketing and profiling purposes. The data may also be collected by our affiliates and/or subsidiaries and by our resellers or commercial partners operating in Italy and abroad, and in this case, they will be designated by us as data processors.

 

With reference to the sole management of sales and after-sales activities at some of our showrooms, the companies listed below will collect and process the Data as independent data controllers, as indicated in this information notice, where applicable (points 1.A and 1.D).

1.A - DATA PROCESSING CARRIED OUT FOR THE MANAGEMENT OF SALES AT THE SHOWROOM

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA: name, surname, tax code, email, address, telephone number, shipping address, passport data for the Tax Free/Refund service - PURCHASE DATA: type and price of the Products purchased. 

 

PURPOSE OF THE PROCESSING - To carry out the sale of Products at its Showrooms and to manage after-sales services (for example, returns, refunds, repairs, etc.).

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. If you do not wish to provide your Data, the Data Controller will not be able to process the corresponding purchase order or manage after-sales services for the Products.

 

LEGAL BASIS FOR PROCESSING - The need to execute pre-contractual and contractual obligations to which you are a party, in addition to the need to comply with legal obligations.

 

PERIOD IN WHICH PERSONAL DATA WILL BE STORED: The Data Controller undertakes to delete from its systems your Data provided for the execution of the sale and the management of after-sales services after 10 years from the date of the last purchase or from the last interaction with the Data Controller.

 

***

 

1.B - DATA PROCESSING CARRIED OUT ON THE WEBSITE

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA name, surname, email, address, telephone number - OTHER DATA contractual and project documentation relating to you.

PURPOSE OF THE PROCESSING - To allow you to register as a customer on the Website, and to access to the reserved areas of the Website in order to use the respective services (such as downloading 3D files of single products).

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. If you do not wish to provide your data, you will not be able to register as a customer or use the related services in the reserved areas of the Website.

LEGAL BASIS FOR PROCESSING - The need to execute pre-contractual and contractual obligations to which you are a party, in addition to the need to comply with legal obligations. 

PERIOD IN WHICH PERSONAL DATA WILL BE STORED - The Data Controller undertakes to delete from its systems the Data provided for your registration and access to the reserved areas of the Website and the use of the related services, 10 years after the date of cancellation of the relevant registration.

 

***

 

DATA CATEGORIES - PERSONAL DATA AND CONTACT DETAILS: name, surname, email address, telephone number, country, region, city. Personal data provided in the appropriate text box on the Website or to the Data Controller's email address. 

 

PURPOSE OF THE PROCESSING - Management of contact requests made via the dedicated page of the Website ("contacts") or via email to the Data Controller.

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. Failure to provide such data will prevent the Data Controller from processing your requests.

 

LEGAL BASIS FOR PROCESSING - The need to execute pre-contractual and contractual obligations to which you are a party, in addition to the need to comply with legal obligations.

 

PERIOD IN WHICH PERSONAL DATA WILL BE STORED - The Data Controller undertakes to delete from its systems your Data provided in relation to requests forwarded via the Website or by email after 1 year from the date of provision.

 

***

 

APPLICATIONS - If you wish to submit your application for a job position with the Data Controller or one of the companies in the group to which the Data Controller belongs via the Website, your data will be processed in accordance with the relevant privacy policy, available at the following link: https://careers.poltronafrau.com/

 

***

 

1.C - DATA PROCESSING CARRIED OUT BY MEANS OF THE "CRM" CUSTOMER RELATIONSHIP MANAGEMENT SYSTEM

 

1) CUSTOMER REGISTRATION

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA name, surname, date of birth, email, address, telephone number. 

 

PURPOSE OF PROCESSING - To allow you to register as a customer and to use the respective services (such as participation in one of our events). You may make this registration to our Website, at one of our showrooms or during one of our events. 

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Necessary. If you do not wish to provide your data, you will not be able to register as a customer or use the related services. 

 

LEGAL BASIS FOR PROCESSING - The need to execute pre-contractual and contractual obligations to which you are a party, in addition to the need to comply with legal obligations.

 

PERIOD IN WHICH PERSONAL DATA WILL BE STORED - The Data Controller undertakes to delete your data provided for your registration from its systems 10 years after the date of cancellation of the relevant registration.

 

2) MARKETING

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA: name, surname, email, address, telephone number. 

 

PURPOSE OF DATA PROCESSING - To communicate commercial information about collections, exhibitions, and events, including through our newsletter, or to allow you to participate in customer satisfaction surveys and market research for Product improvement. These communications will be sent via email or telephone, including by automated means (SMS, social media messaging systems). We will communicate via automated means approximately no more than twice a month or during special events (e.g., the Salone del Mobile). You also have the option to prefer to be contacted exclusively through traditional means, expressing your opposition only to receiving communications via automated means by writing to [email protected].

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you do not wish to provide your Data, the Data Controller will not be able to keep you constantly updated on offers and promotions reserved for its customers, nor will it be able to use the Data for market research and statistical analysis or customer satisfaction. 

 

LEGAL BASIS FOR PROCESSING - Your explicit consent to the processing of your data for this purpose. If you have given your consent, you may withdraw it at any time by clicking the unsubscribe button in the emails or newsletters you receive, or by writing to [email protected].

 

PERIOD FOR WHICH PERSONAL DATA WILL BE RETAINED - The Data Controller has decided to delete the Data processed for the purpose of sending you commercial information, including personalized information, following categorization or profiling based on the parameters described herein, on collections, exhibitions, and events, as well as for participation in customer satisfaction surveys and market research, 10 years after the Data collection, or until you object. To this end, the Data Controller has taken into account the type of goods offered, for which an average customer purchase frequency of one or a maximum of two products per capita every 6-7 years is assumed. Therefore, shorter data analysis times would not allow for the provision of personalized services. In any case, the Data will be retained for 10 years for the purposes of sales management and after-sales services.

 

3) COMMUNICATION OF DATA TO GROUP COMPANIES FOR MARKETING PURPOSES

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA name, surname, email, address, telephone number 

 

PURPOSE OF THE PROCESSING - To communicate your data to other companies in the group to which the Data Controller belongs so that they can send you commercial information on collections, exhibitions, and events, including via newsletters, in relation to their products and services, and to participate in any customer satisfaction surveys and market research for the improvement of the Products.

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you do not wish to provide your Data, the Data Controller will not be able to communicate the Data to other group companies for these purposes. 

 

LEGAL BASIS FOR PROCESSING - Your explicit consent to the processing of your data for this purpose. If you have given your consent, you may withdraw it at any time by clicking the unsubscribe button in the emails or newsletters you receive or by writing to [email protected]. 

 

PERIOD FOR WHICH PERSONAL DATA WILL BE RETAINED - The Data Controller has decided to delete the Data processed for the purpose of sending you commercial information, including personalized information, following categorization or profiling based on the parameters described herein, on collections, exhibitions, and events, as well as for participation in customer satisfaction surveys and market research, 10 years after the Data collection, or until you object. To this end, the Data Controller has taken into account the type of goods offered, for which an average customer purchase frequency of one or a maximum of two products per capita every 6-7 years is assumed. Therefore, shorter data analysis times would not allow for the provision of personalized services. In any case, the Data will be retained for 10 years for the purposes of sales management and after-sales services.

 

 

4) CUSTOMER CATEGORIZATION

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA: name, surname, age group, email, telephone number, country of residence - OTHER DATA: profession.

 

PURPOSE OF THE PROCESSING - Categorization of customers based on a series of parameters, for the purpose of sending promotional communications targeted to the needs of a certain category or group to which you belong (e.g., customers aged between 50 and 70, residents of a specific region, etc.).

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you wish to object to the processing of your data, the Data Controller will not be able to keep you updated on offers and promotions dedicated to certain customer categories. If you have given your consent to receive promotional information, you may therefore only receive generic newsletters. 

 

LEGAL BASIS FOR PROCESSING - The Data Controller's legitimate interest in maximizing the efficiency of its marketing activities. We will send promotional communications based on your segment or category only with your consent, which you may withdraw at any time and without prejudice. You may exercise your right to object to receiving these communications at any time, immediately or subsequently, by clicking the unsubscribe button in the emails or newsletters you receive or by writing to [email protected].

 

PERIOD FOR WHICH PERSONAL DATA WILL BE RETAINED - The Data Controller has decided to delete the Data processed for the purpose of sending you commercial information, including personalized information, following categorization or profiling based on the parameters described herein, on collections, exhibitions, and events, as well as for participation in customer satisfaction surveys and market research, 10 years after the Data collection, or until you object. To this end, the Data Controller has taken into account the type of goods offered, for which an average customer purchase frequency of one or a maximum of two products per capita every 6-7 years is assumed. Therefore, shorter data analysis times would not allow for the provision of personalized services. In any case, the Data will be retained for 10 years for the purposes of sales management and after-sales services.

 

 

5) CUSTOMER PROFILING

 

DATA CATEGORIES - PERSONAL AND CONTACT DATA: name, surname, date of birth, age group, email, telephone number, country of residence - OTHER DATA: profession, frequency of purchase of Products, products viewed, catalogues requested, interests and data relating to your behaviour on our Website.

 

PURPOSE OF THE PROCESSING - Customer profiling to evaluate your preferences, interests, characteristics and consumption habits based on a series of parameters, for the purpose of sending personalized promotional communications or for a personalized shopping experience at our Showrooms.

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you do not wish to provide your data, the Data Controller will not be able to keep you updated on offers and promotions tailored to your preferences, interests, characteristics, and consumer habits, nor will it be able to offer you a personalized shopping experience at our showrooms. If you have given your consent to receive promotional information, you may therefore only receive generic newsletters. 

 

LEGAL BASIS FOR PROCESSING - Your explicit consent to the processing of your data for this purpose. If you have given your consent, you may withdraw it at any time by writing to [email protected].

 

PERIOD FOR WHICH PERSONAL DATA WILL BE RETAINED - The Data Controller has decided to delete the Data processed for the purpose of sending you commercial information, including personalized information, following categorization or profiling based on the parameters described herein, on collections, exhibitions, and events, as well as for participation in customer satisfaction surveys and market research, 10 years after the Data collection, or until you object. To this end, the Data Controller has taken into account the type of goods offered, for which an average customer purchase frequency of one or a maximum of two products per capita every 6-7 years is assumed. Therefore, shorter data analysis times would not allow for the provision of personalized services. In any case, the Data will be retained for 10 years for the purposes of sales management and after-sales services.

***

 

1.D - DATA PROCESSING CARRIED OUT FOR COMMERCIAL PURPOSES FOLLOWING A SALE AT THE SHOWROOM 

 

DATA CATEGORIES - PERSONAL DATA AND CONTACT DATA name, surname, email - PURCHASE DATA type of Products purchased.

 

PURPOSE OF THE PROCESSING - Sending communications containing commercial offers relating to Products similar to those already purchased (soft spam).

 

MANDATORY OR OPTIONAL PROVISION OF DATA - Optional. If you wish to object to the processing of your data, the Data Controller will not be able to keep you updated on offers and promotions for products similar to those you have already purchased.

 

LEGAL BASIS FOR PROCESSING - The Data Controller's legitimate interest in developing customer relationships and increasing the volume of requests and sales of Products. You may exercise your right to object to receiving these communications at any time, immediately or subsequently, by clicking the unsubscribe button in the emails or newsletters you receive or by writing to [email protected].

 

PERIOD IN WHICH PERSONAL DATA WILL BE STORED - The Data Controller has decided to delete the Data processed for the purpose of sending communications containing commercial offers relating to Products similar to those already purchased (soft spam), after 24 months from the date of each purchase, unless objected to before this deadline and without prejudice to their retention for 10 years for the purposes of carrying out the sale and managing after-sales services.

 

***

 

2 – DATA PROCESSING METHODS AND POSSIBLE FURTHER DATA STORAGE 

 

The Data will be collected and processed in compliance with the principles of fairness, legality, and transparency, using manual or automated methods, always within the limits of the processing purposes described in this policy and, in any case, in a manner that guarantees the security and confidentiality of the Data. With respect to data retention, the Data Controller has indicated the relevant periods for each processing operation and undertakes, in any case, to base the processing of the Data on the principles of adequacy and minimization, annually verifying the need for retention for a period of time no longer than necessary to achieve the purposes for which the Data was collected and processed. It is understood that the Data Controller may retain the Data to comply with regulatory obligations, or to ascertain, exercise, or defend legal claims. Once the purposes for which the Data was collected and processed have been achieved, the Data Controller will take appropriate measures to anonymize the Data, thus preventing your identification. However, the Data may continue to be used anonymously.

 

3 - ANY AUTOMATED DECISION-MAKING PROCESSES

 

As indicated above, the Data Controller, based on its legitimate interest, categorizes its customers in order to send commercial information on collections, exhibitions, and events tailored to the needs of a certain category or segment to which you belong. This process is carried out by dividing data subjects into minimally invasive and non-discriminatory categories, such as country of residence (residents of the Lombardy region, for example, if identifying a category of individuals interested in opening a new store in Milan), age group (e.g., customers aged 50 to 70, if, for example, the product is statistically targeted at this age group). Following this analysis, which may also be performed automatically, the user may be classified into one or more groups with different characteristics and receive communications from the Data Controller that are targeted to that category, as deemed appropriate by the Data Controller. In relation to this processing, the Data Controller has successfully conducted a balancing test to determine that the processing related to the categorization in question is conducted on the legal basis of the Data Controller's legitimate interest in achieving maximum efficiency in its marketing activities. The Data Controller may also, with your consent, analyze your consumer habits over time to assess, in a more thorough manner than could be achieved with simple categorization, which products or initiatives match your tastes and preferences (for example, if over a period of two years you demonstrate interest in a particular product of ours or a line created by one of our designers, we will send you offers dedicated to that type of product and not others that are not of interest to you or that differ from your tastes and preferences). This way, we can offer you a unique and personalized shopping experience even if you visit us at one of our showrooms. In this case, our sales assistant will be able to recognize you and direct you more efficiently to the product you prefer. Of course, you can always ask our sales staff to evaluate different offers. Please note that the Data Controller has conducted a specific data impact assessment on the processing of personal data required for profiling purposes to ensure compliance with the principles of the GDPR, including non-discrimination, effectiveness, and the absence of harmful consequences for the data subject. 

 

4 - SUBJECTS AUTHORIZED TO PROCESS DATA

 

The Data may be processed by the Data Controller's representatives, who have been expressly authorized and have received adequate operating instructions in relation to the processing purposes set out above.

 

5 - POSSIBLE RECIPIENTS OF THE DATA

 

The Data will not be disclosed. The following parties may become aware of the Data in relation to the processing purposes set out above and may process it independently as separate Data Controllers or as Data Processors specifically appointed by the Data Controller (the list of these parties can be requested from the Data Controller by writing to [email protected]):

 

• Resellers or business partners of the Data Controller or companies in the Data Controller's group who, on our behalf, will collect the Data to be entered into our customer relationship management (CRM) system; these entities will act as data processors. 

• Companies within the group to which the Data Controller belongs to, to which we will disclose the Data for the purpose of sending commercial information on collections, exhibitions, and events, by the aforementioned companies, in relation to their products and services; these entities will act as independent controllers of the Data and will receive the same only if you have consented to the disclosure of the Data.

• Companies in the group to which the Data Controller belongs for administrative and accounting purposes; these entities will act as data processors. 

• Parties who may access the Data pursuant to legal provisions established by European Union law or by the law of the Member State to which the Data Controller is subject; these parties will act as independent data controllers. 

• Companies that perform and provide additional services related to the purposes of processing, banking operators, electronic payment carriers, credit card issuers, internet providers, couriers and freight forwarders, companies that organize events or send newsletters or conduct market research, companies that offer data analysis services, companies that offer IT infrastructure and IT assistance and consultancy services, law firms, accountants, and auditors; these entities will act as data processors or, in some cases, as independent data controllers; 

• Purchasers or successors of the Data Controller in the event of a merger, divestiture, restructuring, reorganization, dissolution, or other sale or transfer of some or all of the Data Controller's assets, in which the Data would be transferred; these parties will act as independent data controllers, and we will disclose to them only the Data necessary to evaluate the transaction based on our legitimate interest. 

 

6 - TRANSFER OF PERSONAL DATA ABROAD

 

Your data will be processed and stored in our management database and CRM, whose servers are located within the European Union.

 

The Data Controller may share your Data with parties who may be located both within and outside your country of residence and both within and outside the EEA, as the Data Controller offers its products to customers in all countries where it operates. Specifically, your Data may be accessible to showroom managers and/or sales staff for marketing and profiling purposes. For example, if you visit a showroom in a country other than your country of residence, your personal information will also be accessible by that showroom, so that they can offer you the product best suited to your needs. In this case, the Data Controller undertakes to: 

• Ensure that the country to which the Data will be sent guarantees an adequate level of protection, as required by Article 45 GDPR; or

• Use the standard contractual clauses for data protection approved by the European Commission for the transfer of personal information outside the EEA pursuant to Article 46.2 GDPR. For further information on the subjects and countries involved, please send a request to the following email address: [email protected].

 

7 - YOUR RIGHTS AS AN INTERESTED PARTY - COMPLAINT TO A SUPERVISORY AUTHORITY

 

In relation to the aforementioned data processing, you may exercise the following rights at any time by email to [email protected], under the conditions and within the limits set forth in Articles 12 and 13 of the GDPR:

• Right of access (Art. 15 GDPR). 

• Right of rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR). 

• Right to erasure of Data (Art. 17 GDPR). 

• Right to restriction of processing (Art. 18 GDPR). 

• Right to object to processing pursuant with Art. 6, paragraph 1, letters e) or f) GDPR.

You user also has the right to lodge a complaint with the supervisory authority, namely the Italian Data Protection Authority (the "Privacy Guarantor") and/or other competent supervisory authorities (Article 77 of the GDPR).

Furthermore, if the processing is based on consent or a contract and is carried out using automated tools, you may exercise the right to receive your data in a structured, commonly used, and machine-readable format, as well as, if technically feasible, to transmit it to another controller without hindrance pursuant to Art. 20 GDPR.

You also have the right to object at any time to the processing of your Data, immediately or after providing the Data, in relation to the sending by the Data Controller of unsolicited communications containing commercial offers relating to Products similar to those already purchased (soft spam) sent directly to the email address provided when purchasing Products, pursuant to art. 130, paragraph 4, of Legislative Decree no. 196/2003, as amended by Legislative Decree no. 101/2018. 

You retain the right to prefer to be contacted for marketing purposes exclusively through traditional methods, expressing your opposition only to receiving communications through automated means.

The user has the right to withdraw consent given for marketing and/or profiling purposes at any time.


8 – MINORS

 

The Website and the Products are not intended for anyone under the age of 18; therefore, the Data Controller does not collect and/or process personal data relating to minors. If personal data relating to minors is entered into the Website, the Data Controller will delete it.