Login

Last updated April 2025

E-COMMERCE PRIVACY POLICY

1. Introduction

This Privacy Notice (together with our terms and conditions and any other documents referred to herein) describes the type of data that we collect from you ("you/your") when you purchase a product or service from us ("Products") and when you use our website: https://www.tomfordfashion.com or local versions of this website (the "Website"), when and why we collect it, how that data may be used or disclosed by us, the choices you have regarding the use of your data, and the safeguards we use to protect it. When used in this Privacy Notice, "we", "our" and similar terms means Tom Ford Distribution S.R.L. – our full contact details are set out in section 3 of this Privacy Notice.

This Privacy Notice includes terms specific to individuals residing in or located in certain jurisdictions, in the section " Additional information for individuals located in certain jurisdictions". In particular:

• If you are located in the European Union or the United Kingdom, please refer to the "Specific information for individuals located in the European Union and the United Kingdom" section of this Privacy Notice for additional information.
• If you are located in Canada, please refer to the "Specific information for individuals located in Canada" section of this Privacy Notice for additional information.
• If you reside in the United States, please refer to the "Specific information for US residents" section of this Privacy Notice for additional information.

Please also note that:

• This Privacy Notice does not apply to Personal Data provided to us or more generally the Tom Ford Fashion Group through physical stores. Please however note that personnel in physical stores may have access to your account and hence to your Personal Data, and this Privacy Notice therefore applies to such access and to the use of your Personal Data by in-store personnel. For US residents, please refer to the "Specific information for US residents" section below for a complete description of our privacy practices regarding your Personal Data, including data collected in-store.
• You must be 18 years old or older to use this Website, including to register with us to receive communications or to purchase a Product. We do not knowingly collect or use Personal Data from persons under the age of 18. If you are the parent or guardian of a minor under 18 years of age and believe that they have disclosed Personal Data to us, please contact us by e-mail so that we may delete the minor's Personal Data. In addition, if we become aware that we have inadvertently received Personal Data from a person under the age of 18, we will delete such Personal Data from our records.
• It is important that the Personal Data we hold about you is complete, accurate and current. Please contact us in accordance with this Privacy Notice if you would like to complete, update or correct your Personal Data during our relationship.

If you have any requests or questions about this Privacy Notice or the collection and use of your Personal Data, please email us at privacy@tomfordfashion.com or write to us at the address indicated in section 3 of this Privacy Notice.

Additionally, we recommend that you familiarize yourself with the other terms and conditions of our Website, accessible through the link "Terms and Conditions" displayed on each page of our Website, as they oversee the usage of our Website and in particular establish applicable disclaimers and limitations of liability.

2. Definitions

• “Personal Data” refers to all kinds of information recorded electronically or otherwise that can be used to, independently or by the combination with other information, identify an individual’s identity, recognize an individual’s activities, or otherwise be linked or related to an individual or household. This can include name, date of birth, mailing address, email address, financial information, IP addresses, location data, aliases, preferences and profiles, amongst other things.
• The term “process” or “processing” means any activity relating to Personal Data, including, by way of example, collection, storage, use, consultation, disclosure, destruction and/or transmission.

3. Who we are

Tom Ford Distribution S.R.L., located at Via delle Calandre 36, 50139 Sesto Fiorentino, Italy, is the entity responsible for the collection, use, and disclosure of your Personal Data under this Privacy Policy. Under some applicable laws, and in particular in the European Union and the United Kingdom, this entity qualifies as a "controller" of your Personal Data, which means that it makes decisions about how and why it is processing your Personal Data and, because of this, it is responsible for making sure it is used in accordance with the applicable data protection laws.

If you have any questions about this Privacy Notice, including any requests to exercise your legal rights, please contact our representative responsible for overseeing questions in relation to this Privacy Notice or protection of Personal Data by email at privacy@tomfordfashion.com or by mail at:

Privacy

Tom Ford Distribution S.R.L.

Via delle Calandre 36

50139 Sesto Fiorentino

Italy

4. The data we collect and process about you

We may collect and process the following different kinds of Personal Data about you:

• Identity data: first name, last name, title, gender, date of birth, passport number, username or similar identifier, password for your account;
• Contact data: email address, postal address (including as applicable billing address and mailing address), telephone number;
• Financial data: credit/debit card number and expiration date through our payment service provider, alternative or additional billing information, and other information we may need to collect to process payment;
• Commercial and transaction data: details about Products you have purchased from us including for example sizes and measurements, message for and information on recipients of gift cards, details about the Products you view on our Website;
• Marketing and communications data: consents to receiving marketing information and any preferences you have indicated in receiving marketing from us and our third parties and your communications preferences;
• Technical, usage and cookie data:  we may collect technical information about our use of our Website and details about how you access and use our Website and Products, including through cookies and other tracers.

Cookies are small text files that websites place on your Internet-connected device to uniquely identify your browser or to store information or settings in your browser. We use cookies (or similar technologies such as pixel tags, web beacons or other tracers, together "cookies") notably to allow us to remember you when you come back to our Website and provide you with personalised experiences and advertisements (see sections 5 and 9 for detailed information about the purposes for which we use cookies). Third parties may also set cookies through our Website. We do not control the privacy practices of such third parties. Please see section 9 of this Privacy Notice for additional information about cookies on our local version of the Website.

The technical, usage and cookie data we collect may include: internet protocol (IP) address, login information, browser type and version, operating system and platform, time zone, location, and other data on the technology you use to access our Website, how you arrived to our Website (including date and time), the pages you visited, products you viewed or searched for, length of visits to certain pages, page interaction information (such as scrolling, clicks and mouse-overs), methods used to browse away from a page, page response times, or download errors.

Please note that such data is sometimes not directly associated with your identity or cannot be related back to you. Hence, under some applicable laws, this information may not be considered as Personal Data (and we will then not treat it as Personal Data) unless they are combined with Personal Data.

5. How we may collect and use your data

1. 1. Collection of Personal Data

When you use our Website, we collect information about you when you create an account, when you fill a data collection form embedded in our Website, when you place an order for a Product, or when you otherwise engage with our Website, services, products, activities and/or the resources we make accessible to our customers or users, including to the extent permissible under applicable laws when you initiate an order without finishing it. For example, you may wish to contact us through our contact form on our Website, or to subscribe through the Website to receive communications from Tom Ford (e.g. newsletters, invitations to promotions or events), or to purchase Products available through the Website, or to give us some Feedback.

We may also collect data regarding your use of the Website through cookies. Please see the "Cookies" section of this Privacy Notice for more information.

We also collect your Personal Data:

• when you contact us, including by email, telephone or mail; or
• through social media platforms, if you have accepted the communication of some of your data by the social platform.

We may use third-party providers to collect your Personal Data on our behalf, including e-commerce service providers (such as customer service providers, payment service providers and website analytics service providers).

The data we obtain from third parties may also include Personal Data about you, including the data we receive from financial institutions in respect of payments or from delivery companies in respect of deliveries, from our fraud detection service providers or from our insurance companies.

The provision of your Personal Data is not mandatory. However, in some situations, the collection of Personal Data may be a statutory or contractual requirement, and failure to provide certain Personal Data may make it is impossible for us to create an account for you or provide you with our Products or other services in such cases. For example, we need certain information from you to register you, authenticate you, and process your purchases and payments.

If you provide personal information to us about another individual, you are responsible for ensuring that you have their consent to provide that data for the uses set out in this Privacy Notice and for bringing this Privacy Notice to their attention.

1. 2. Reasons for the collection and use of your Personal Data

We may collect and process your Personal Data for the following purposes:

• Contractual and account management purposes:
  • Processing your orders and delivering to you the Products you have purchased, including processing payments and refunds, managing pre- and post-sale services, and otherwise carrying out the contracts we have with you;
  • As applicable, prepare personalised Products for you;
  • Allowing you to access any account you have with us and managing and operating such account;
  • Sending you communications regarding your purchases or other transactional or informational messages (e.g. about your account);
  • With respect to your passport number, only for tax-free purchases or for fraud investigations;
• Commercial, marketing and profiling purposes:
  • Studying and analysing your consumption habits, preferences and choices, to offer you Products and other information (e.g. about events) that best meet your personal tastes and needs, as further detailed below in the section "Specific Information about profiling";
  • Sending you marketing communications, including personalised communications, for example about Products that we think may interest you, questionnaires (e.g. on the satisfaction with our Products) or promotional offers;
  • Sending you and/or administering contests, surveys, questionnaires (e.g. on the satisfaction with our Products), or other features of the Website;
  • Administering the comments you post on the Website;
• Improvement of our Products and processes:
  • Managing availability/inventory of our Products;
  • Internal marketing and research and development purposes, including for improving our Products based on customers' preferences;
• Website operation/improvement purposes, including via cookies:
  • Remembering when you come back to our Website and presenting the content of our Website in the most effective manner for you and you device;
  • As applicable, allowing you to participate in interactive features of our Website and services;
  • Personalising your experience on our Website and allowing us to offer the type of Products, other services and content in which you are most interested;
  • Administering the Website, keeping it safe and secure and allowing for maintenance and troubleshooting;
  • Evaluating and improving the performance of our Website, including through analytics.
• Verifying your identity when necessary, including for security reasons;
• Fraud prevention purposes;
• Responding to the requests you send us;
• Complying with, or evidencing our compliance with, our legal and regulatory obligations (for example accounting and fiscal obligations or legal warranty);
• Exercising, establishing or defending legal rights.

As regards our communications, we may contact you by electronic and traditional means (such as SMS, smart messaging, emails, postal mail, etc.). We will not share your opt-in to an SMS campaign with any third party for purposes unrelated to providing you with the services of that campaign. We may share your Personal Data, including your SMS opt-in or consent status, with third parties that help us provide our messaging services, including but not limited to platform providers, phone companies, and any other vendors who assist us in the delivery of text messages.

Specific information about profiling: In order to offer you products and initiatives that more accurately reflect your tastes and needs, we will also analyse your Personal Data to create a profile reflecting your preferences, with your consent when required under applicable law. By using automated tools, we may process data on the value and frequency of your purchases (including purchases made during sales periods) and the type of products purchased (accessories, clothes, etc.) over a specific period of time. We may also collect and process data about you regarding your preferences, hobbies, habits, lifestyle and favourite sports, directly from you, e.g. through online forms embedded on the Website, or indirectly through certain social media platforms or through the use of cookies placed on the Website if you authorise such collection. In addition, we may supplement, correct and update some of your data with information of a public nature (i.e., data published on social media), to the extent permitted by applicable law and in all cases within the limits of relevance. The sole purpose of this analysis, which will be carried out in a non-invasive manner, is to offer you products, services and initiatives that are in line with your tastes and needs. At any time, you may request to analyse your profile and update or amend it as you see fit.

6. With whom will your data be shared

1. 1. Sharing of your Personal Data within the Tom Ford Fashion Group, Ermenegildo Zegna N.V. Group and Estée Lauder companies

The Personal Data that we collect about you may, when necessary in order to fulfil the purposes listed above, shared with other companies of the Tom Ford Fashion Group and of the Ermenegildo Zegna N.V. Group globally.

[In particular, if you decide to opt-in to receiving Tom Ford Fashion promotional information, your Personal Data will be disclosed to Tom Ford International LLC, and the use of your Personal Data will be governed by this Privacy Notice. Please keep in mind that you can revoke your opt-in request by clicking [here].

In addition, if you decide to opt-in to receiving promotional information from other brands of the Ermenegildo Zegna N.V. Group, your Personal Data will be disclosed to other companies of the Ermenegildo Zegna N.V. Group, and the use of your Personal Data will be governed by the [privacy policy of the Ermenegildo Zegna N.V. Group – hyperlink to be included]. Please keep in mind that you can revoke your opt-in request in accordance with the [privacy policy of the Ermenegildo Zegna N.V. Group – hyperlink to be included

In addition, if you decide to opt-in to receiving Tom Ford Beauty promotional information or agree that we share your Personal Data with Estée Lauder, your Personal Data will be disclosed to companies of the Estee Lauder group, and the use of your Personal Data will be governed by the privacy policy of the Estee Lauder group. Please keep in mind that you can revoke your opt-in request in accordance with the privacy policy of the Estee Lauder group through the following link: Privacy Request Portal.

1. 2. Sharing of your Personal Data outside the Group

We may provide access to or share your Personal Data with third-party service providers, when necessary in order to fulfil the purposes listed above, and in particular providers that assist us in making our Website available to you and providing you with our Products and additional features and services. These providers include e-commerce service providers that provide order fulfilment services, customer service, other sales-related services, marketing communications services, e-commerce platform hosting, analytics services, payment services and fraud prevention services, and suppliers of delivery/shipping services or IT services (including providers that maintain the functioning and security of our Website).

We share your Personal Data with these providers only under strict conditions of confidentiality and similar security levels as those we apply internally, and will request that these providers handle your Personal Data in accordance with the terms outlined in this Privacy Notice.

We also share your Personal Data with third-parties for targeted advertising purposes, including through the use of cookies and other online trackers on our websites.  Please see section 9 “Usage data and cookies” below for more information.

We may also disclose your Personal Data with banks and public authorities, when necessary in order to fulfil the purposes listed above or permitted or required by applicable law or regulation.

We may also disclose Personal Data we have about you: (i) if we determine that such disclosure is necessary in connection with any investigation or complaint regarding your use of the Website, or (ii) to the extent permitted under applicable law, to identify, contact, or bring legal action against someone who may be causing injury to or interference with (either intentionally or unintentionally) our rights or property, or the rights or property of visitors to or users of the Website, physical harm or financial loss.

We reserve the right at all times to disclose any information that we deem necessary to comply with any applicable law, regulation, legal process or governmental or law enforcement request. We also may disclose your information when we determine that applicable law or regulation requires or permits such disclosure, including exchanging information with other companies and organizations for fraud protection purposes.

We also reserve the right to transfer Personal Data we have about you in the event we sell or transfer all or a portion of our business or assets. Should such a sale or transfer occur, we will use reasonable efforts to direct the transferee to use Personal Data you have provided to us in a manner that is consistent with this Privacy Notice.

7. Confidentiality and security of your data

Data security is of great importance to us, and we will do what we reasonably can to keep your data secure.

Your Personal Data will be accessed by our employees, consultants and service providers only when they have a need to know your Personal Data, and they will be processing your Personal Data on our instructions and subject to a duty of confidentiality.

We, or our third-party service providers, maintain appropriate administrative, technical, and physical safeguards to protect against loss, misuse or unauthorized access, disclosure, alteration, or destruction of your Personal Data in accordance with local legislation where applicable.

We have put in place procedures to deal with any suspected Personal Data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Any electronic payment made by you will be encrypted, and we will not have access to the full information about the cards used to make such a payment. This information will be retained by the payment provider.

When we have given you (or where you have chosen) a password which enables you to access certain parts of our Website, you are responsible for keeping this password confidential. We ask you not to share your password with anyone.

Unfortunately, the transmission of information via the Internet is not completely secure and we cannot guarantee that such transmissions will be free from delay, interruption, interception, or error. Although we will do our best to protect your Personal Data, including using encryption for communications conducted through this Website, we cannot guarantee the security of your Personal Data transmitted and any transmission is at your own risk. Once we have received your Personal Data, we will use strict security procedures and features as set out above.

8. Retention periods of your data

We will retain your Personal Data for as long as we require it in order to fulfil the purpose for which it was collected or provided to us. This period will vary depending on your interactions with us. It will generally be the duration of our relationship and a period of [5] years after our relationship has ended, unless shorter retention periods apply for certain types of Personal Data pursuant to applicable laws or regulations, including regulations from data protection authorities. You may contact us in accordance with section 3 of this Privacy Notice to request additional information on applicable retention periods for your Personal Data.

We may however be required to retain Personal Data for a longer period of time to ensure we comply with our legal and regulatory obligations or if we have other valid legal grounds for doing so, for example in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you.

9. Usage data and cookies

We (or third parties) use 4 different types of cookies on our Website:

• Strictly necessary cookies: these cookies are necessary for the Website to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in or filling in forms. You can set your browser to block or alert you about these cookies, but some parts of the Website will not work if these cookies are blocked.
• Performance (including analytics) cookies: these cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Website. They help us to know which pages are the most and least popular and see how visitors move around the Website, in order to help us improve our Website and services. All information these cookies collect is aggregated and therefore become anonymous. These cookies are set only with your consent. If you do not allow these cookies we will not know when you have visited our site and will not be able to monitor its performance.
• Functional and profiling cookies: these cookies enable the Website to provide enhanced functionality and personalisation, and more generally for profiling purposes. They for example allow us to remind your favourite language or the region in which you are, to know which pages or Products you have seen and which links you click on, and more generally to know about your navigation behaviour. They may be set by us or by third party providers whose services we have added to our pages. These cookies are set only with your consent. If you do not allow these cookies, then some or all of the services (including the Website) may not function properly.
• Targeting cookies: these cookies may be set through our Website by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They do not store directly Personal Data but are based on uniquely identifying your browser and internet device. These cookies are set only with your consent. If you do not allow these cookies, you will experience less targeted advertising. Consent

You can find the full list of cookies placed in our Website (including details on whether they are set by us or third party providers) here.

We will retain the data collected through cookies for the maximum duration permitted by applicable laws. You may contact us in accordance with section 3 of this Privacy Notice to request additional information on applicable retention periods.

You may accept or refuse performance, functional and profiling and/or targeting cookies on the banner that appears on the Website when you first access it. If you access all or part of those cookies, we will rely on such consent for the duration permitted by applicable laws (unless you withdraw your consent or modify your cookie preferences).

You can edit your cookie preferences at any time by editing your browser settings or by [accessing the “Manage Cookies” link at the bottom of our Website]. Through this link, you can find a list of cookies used in connection with our Website websites and modify your previous choices. When editing your cookie preferences, please note that your settings only apply to the browser you use to submit your opt-out request, so if you use multiple browsers or devices, you must opt-out on each browser or on each device. Your opt-out is enabled using cookies, so once you opt-out, if you delete your browser’s saved cookies on a device, you will need to opt-out again on that browser on that device.

More generally, you have the right to withdraw your consent to cookies, including by contacting us as set out in section 3 of this Privacy Notice.

Our Website is not designed to respond to “do not track” signals from browsers.

10. Links to other sites

Our Website may contain links to or otherwise redirect to third party websites or applications, that are not covered by this Privacy Notice. These third-party services accessible via our Website (through hyperlinks or otherwise) have their own privacy policies and practices related to collection, use and disclosure of your Personal Data. When you click on a hyperlink, a new browser window or frame containing a third party's website may appear in the foreground, while our site remains in the background. Whenever you navigate away from the Tom Ford website, including to a new window or frame, neither this Privacy Notice nor our other terms will be applicable. We cannot be and are not responsible for the protection or processing of the Personal Data you provide to other websites or applications. We therefore ask you to review the privacy statements of these websites and applications to understand how and why they collect and process any of your Personal Data.

Advertisements for our Products or other services may appear on third party websites around the Internet. Some websites and services deliver these advertisements based upon data that has been previously collected about your past behaviour online. For example, if you have viewed websites about shoes, these websites or services may display to you an advertisement for our shoes. This kind of targeted advertising is sometimes called interest-based or online behavioural advertising. It is generally not based upon your Personal Data, but rather, upon your online activities. We do not control such third-party websites or services on which these advertisements appear. Further, we do not control how they collect and use data about your online activities. However, you may opt-out of being tracked online by certain companies by visiting HTTP://WWW.ABOUTADS.INFO/CHOICES/ or HTTP://WWW.NETWORKADVERTISING.ORG/MANAGING/OPT_OUT.ASP. If you opt-out, you may still receive advertisements, but they will not be delivered to you upon your behavioral data possessed by the companies from whom you have opted-out. This process relies upon an opt-out cookie, so if you delete your cookies or use a different computer, you will have to repeat this process.

11. Changes to this Privacy Notice

This Privacy Notice may be updated from time to time. The latest version will always be available on this page of our Website, hence please check this page for our current Privacy Notice. We will notify you if we make any substantial changes to this Privacy Notice.

12. Additional information for individuals located in certain jurisdictions

1. 1. Specific information for individuals located in the European Union and the United Kingdom

If you are located in the European Union or the United Kingdom, please review this section carefully, as it supplements the rest of the Privacy Notice. In the event of any conflict or inconsistency between the terms set out in sections 1 through 10 of this Privacy Notice and the terms set out in this Section 11.1, if you are located in the European Union or the United Kingdom, the terms in this section will take priority to the extent of such conflict or inconsistency.

In addition:

• If you are a resident of France, please also refer to the "Specific information for French residents" section of this Privacy Notice for additional information (section 12.1.6).
• If you are a resident of Germany, please also refer to the "Specific information for German residents" section of this Privacy Notice for additional information (section 12.1.7).
• If you are a resident of Italy, please also refer to the "Specific information for Italian residents" section of this Privacy Notice for additional information (section 12.1.8).
• If you are a resident of Spain, please also refer to the "Specific information for residents of Spain" section of this Privacy Notice for additional information (section 12.1.9).
• If you are a resident of the United Kingdom, please also refer to the "Specific residents of the United Kingdom " section of this Privacy Notice for additional information (section 11.1.10).

1. 1. 1. Legal basis for the collection and processing of your Personal Data and purpose limitation

Our legal bases for the collection and processing of your Personal Data for the purposes indicated in this Privacy Notice (including related communications and interactions) are as follows:

• Performance of our contract with you (including pre- and post- contractual obligations) for contractual and account management purposes and responding to your requests;
• Compliance, or evidencing compliance with, our legal or regulatory obligations;
• As regards marketing, either your express consent, or our legitimate interests in providing you with communications on Products similar to those you have already purchased when we are allowed to rely on this legal basis pursuant to applicable laws;
• Your consent for performance, functional and profiling, and targeting cookies;
• For other processing operations, our legitimate interests (provided that they are not overridden by your interests or your fundamental rights and freedoms) in;
  • Offering an efficient and personalised customer experience and services to our customers;
  • Improving our Products, Website or other services;
  • Ensuring the proper functioning and security of our Website and other services;
  • Ensuring fraud prevention.

When we collect Personal Data from you, we will only process it as needed for the fulfilment of the purposes set out in this Privacy Notice. We will use your Personal Data for the purpose(s) for which we collected it, and for reasons compatible with the original purpose(s). If you wish to get an explanation as to how the processing for further purposes is compatible with the original purpose, please contact us by email at privacy@tomfordfashion.com. If we need to use your Personal Data for an unrelated purpose, we will notify you and we will explain our purpose and the legal basis which allows us to do so.

1. 1. 2. Personal Data sent outside of the EEA or the United Kingdom

Your Personal Data may be transferred (including collected from, stored and/or processed) outside the European Economic Area (the "EEA") or the United Kingdom (the "UK") in view of the transnational nature of the Tom Ford Fashion Group and of our activities and services, including to other companies of the Tom Ford Fashion Group, to companies of the Estée Lauder group when you consent to receive communications from them or consent to us sharing your Personal Data with them and to our partners or service providers located abroad.

In particular, your Personal Data will be stored in secure servers operated by our service providers in the United States.

In all cases, transfer of your Personal Data will take place with adequate levels of protection. When your Personal Data is transferred to a country that that has not been recognized by the European Commission or the United Kingdom as providing an adequate level of data protection within the meaning of European or UK data protection laws, such transfer will be made subject to appropriate safeguards to ensure the protection of your Personal Data in accordance with applicable laws. In particular, we may implement for transfers from the EEA Standard Contractual Clauses and, for transfers from the UK, the UK addendum or UK International Data Transfer Agreement for the transfer of your Personal Data or transfer your Personal Data to entities located in the United States certified under the EU-U.S. Data Protection Framework or the UK Extension to the EU-U.S. Data Protection Framework.

In the absence of an adequacy decision and where appropriate safeguards are unavailable, transfers may take place on the basis of your consent. In such a situation, we will inform you of the possible risks associated with such a transfer. Alternatively, we may transfer your Personal Data where necessary (i) for reasons of public interest, or (ii) in connection with a legal claim.

You may always contact us at privacy@tomfordfashion.com to know about the location of your Personal Data and to obtain a copy of the safeguards implemented for transfers of your Personal Data.

1. 1. 3. Your rights over your Personal Data

You have the right to request to exercise the following legal rights over your Personal Data. Please note that not all these rights are absolute and that, in some situations, we may not be able to comply with a request to exercise one of your rights, either in full or in part. If this is the case, we will respond to you with the reasons why we are unable to comply with your request.

1. Right of access:

You may contact us at any time to request access to the Personal Data we hold about you. We will confirm whether we are processing your Personal Data and provide you with information of the Personal Data concerned and the reasons for our processing. You may also ask us for a complete list of the recipients of your Personal Data.

We can also provide you with a copy of your personal information on request.

2. Right of rectification

You may contact us to correct or complete the Personal Data we hold about you. To the extent possible, we will inform any recipient of your Personal Data of any corrections that you request.

3. Right to restriction of processing

In certain circumstances, it may be possible to require us to limit the way we process your Personal Data (i.e., require us to continue to store your personal information, but not otherwise process it without your consent). Such circumstances include:

• • where you think the Personal Data we hold about you is inaccurate, processing can be restricted while it is being rectified;
  • where you object to us processing your Personal Data on the grounds that it is necessary in the public interest or for our legitimate interests, such processing can be restricted while we determine whether such grounds override your interests;
  • where a processing is unlawful but you oppose the erasure and instead request restriction of the use of your Personal Data; or
  • where we no longer need to use your Personal Data but you require this data in order to establish, exercise or defend a legal claim, our processing can be restricted.

4. Right of erasure

You may contact us to request the deletion of the Personal Data we hold about you.

You may ask to have the Personal Data relating to your account deleted or removed. We will try to do so promptly, and, to the extent possible, we will inform any recipient of your Personal Data who has received your Personal Data of your request. Since we must keep track of certain information, for example past purchases and similar information, for compliance with our legal obligations, we may not be able to fully delete your Personal Data in certain circumstances.

5. Right to receive/transfer your Personal Data (data portability)

In certain circumstances, you may ask us to send you the Personal Data we hold on you in an electronic, structured, and user-friendly format, or you may ask us to send this data to another entity. Please note that if you choose to ask us to transfer your Personal Data to you or another party, this may impact our ability to provide you with our Products.

6. Right to object

Where we are processing your personal information without your consent to pursue our legitimate interests, you may object to us processing your Personal Data.

In particular, where we are using your Personal Data to contact you for marketing purposes, you may object at any time to the processing of Personal Data for such marketing purpose. Notably, any promotional or marketing email we send to you will include a link to our privacy policy and an "unsubscribe" link to use to opt-out of receiving further promotional or marketing emails from us.

Opt-out or objection to marketing will not cover non-promotional transactional or informational messages from us (such as communications about your purchases and changes to our terms, conditions, and policies).

7. Right to withdraw your consent

Where our processing of your Personal Data is based on your consent, you have the right to withdraw your consent at any time.

For example, if you have given your consent for the processing of your Personal Data for marketing and/or profiling purposes, you may withdraw your consent or limit your consent to specific contact methods.

If you do decide to withdraw your consent we will stop processing your Personal Data for that purpose, unless there is another lawful basis we can rely on, which we will let you know about. Your withdrawal of your consent won’t impact any of our processing up to that point.

8. How to exercise your rights

If you wish to exercise any of your rights, please contact us at privacy@tomfordfashion.com or write to us at the address indicated in section 3 of this Privacy Notice.

If you wish to be removed from our email distribution list, please be sure to include in your request the email address with which you have registered with us.

Where necessary, we may ask you for additional information to confirm your identity.

Upon receipt of your request, or proof of identity, we will seek to respond to your request within one calendar month. However, in certain situations, we may have to extend this deadline to three calendar months. if this is the case, we will contact you within the first month following receipt of your request or proof of identity to indicate the reasons for the extension and the new deadline.

You will not normally have to pay a fee to access your Personal Data or to exercise any of the other rights. However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive to cover our administrative costs involved in complying with your request. Alternatively, we could refuse to comply with your request in these circumstances.

1. 1. 4. Complaints

You may lodge a complaint regarding the processing of your Personal Data, in particular if you believe that the rights set out in this Privacy Notice have not been complied with, with the data protection authority in your jurisdiction.

0. 1. 5. Specific information for residents of France
1. Right to issue post-mortem directives

You are entitled to issue post-mortem directives concerning the processing of your Personal Data after your death.

If you wish to exercise this, please contact us at privacy@tomfordfashion.com or write to us at the address indicated in section 3 of this Privacy Notice.

2. Additional information on the exercise of your rights

When you contact us to exercise one of your rights in accordance with this Privacy Notice, you must justify of your identity by any means. If we have reasonable doubts as to the identity of the person contacting us, we may request any additional information that appears necessary, including where required a copy of an identity document bearing your signature.

A request for the exercise of rights may be submitted by another person to whom you have given a specific authorisation for this purpose, provided that they can provide evidence of their identity and your identity, of the authorisation you have given them and of the duration and purpose of this authorisation. You must also expressly specify in the authorisation if you wish that you or this other person receive the response to our request.

3. Data Protection Authority in France

Should you wish to lodge a complaint pursuant to section 12.1.4 of this Privacy Notice, you may contact the Commission Nationale de l’Informatique et des Libertés (“CNIL”) at: Commission Nationale de l’Informatique et des Libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 PARIS CEDEX 07. More contact information can be found on the CNIL’s website (https://www.cnil.fr/).

0. 1. 6. Specific information for residents of Germany
1. Data Protection Authorities in Germany

Should you wish to lodge a complaint pursuant to section 12.1.4 of this Privacy Notice, you may particularly contact the data protection authority at your habitual residence, place of work or place of alleged infringement (Art. 77 para. 1 GDPR).  Contact information of the data protection authorities of the federal states can be found on the website of the Federal Commissioner for Data Protection and Freedom of Information (https://www.bfdi.bund.de/EN/Service/Anschriften/Laender/Laender-node.html).

2. Specific information under German law

To the extent that the German Data Protection Act and/or the German Act against Unfair Competition is applicable, please note the following:

1. Right of access

We have the right to refuse to respond to your access request in circumstances where your Personal Data are only being held: (i) pursuant to a legal obligation to retain them; or (ii) for the purposes of monitoring data protection or safeguarding data, in each case where providing the information would require a disproportionate effort, and appropriate technical and organisational measures make processing for other purposes impossible.

2. Right of erasure

We have the right to refuse to erase your Personal Data if we have reason to believe that such erasure will adversely affect your legitimate interests, or if such erasure would cause us to breach any legal obligation to retain your Personal Data for a specific period. Instead, in these circumstances, processing of your data will be restricted in the particular ways envisaged by the GDPR.

3. Marketing using electronic mail

We are entitled to rely on "soft-opt-in" consent in respect of certain marketing messages that we wish to send to you using electronic mail. The conditions that apply to our using of soft-opt-in consent are that: (i) we have obtained your electronic mail address in connection with the sale of goods or services; (ii) we use that address only for direct advertising of our own (or substantially similar) services; (iii) you have not objected to this use; and (iv) we clearly advise you, in each such communication, of your right to opt-out.

In all other e-marketing circumstances, we are required to obtain your specific "opt-in" consent and we are required to keep records of such consent having been received. To comply with our obligations under the German Act Against Unfair Competition, we undertake what is commonly known as the "double-opt-in" consent procedure, which is where we first ask you to opt-in to receive e-marketing, and we then send you an email asking you to confirm that you have given your consent. We may only add you to our marketing list once we have received this second email confirmation.

0. 1. 7. Specific information for residents of Italy
1. Right to issue post-mortem directives

You are entitled to issue post-mortem directives concerning the processing of your Personal Data after your death according to Article 2-terdecies of the Italian Legislative Decree No. 196/2003, as amended. In any case, please note that your directives cannot hinder third parties' ability to exercise their rights or defend their interests in court.

If you wish to exercise this, please contact us at privacy@tomfordfashion.com or write to us at the address indicated in section 3 of this Privacy Notice.

2. Additional information on the exercise of your rights

When you contact us to exercise one of your rights in accordance with this Privacy Notice, if we have reasonable doubts as to the identity of the person contacting us, we may request any additional information that appears necessary and proportionate.

A request for the exercise of rights may be submitted by another person to whom you have given a specific authorisation for this purpose, provided that they can provide evidence of their identity and your identity, of the authorisation you have given them and of the duration and purpose of this authorisation. You must also expressly specify in the authorisation if you wish that you or this other person receive the response to our request.

3. Data Protection Authority in Italy

Should you wish to lodge a complaint pursuant to section 12.1.4 of this Privacy Notice, you may contact the Garante per la protezione dei dati personali (“Garante”) at: Garante per la protezione dei dati personali, Piazza Venezia, 11 – 00187, Rome.

More information on the procedure to lodge a complaint can be found on the Garante's website (https://www.garanteprivacy.it/home/docweb/-/docweb-display/docweb/4535524).

0. 1. 8. Specific information for residents of Spain
1. Blocking of Personal Data

We will proceed with the "blocking" of your Personal Data when its rectification or deletion is required, in accordance with the provisions of this Privacy Notice. Blocking of Personal Data consists of identifying and securing Personal Data by adopting technical and organizational measures to prevent its processing, including viewing, except for making the data available to judges and courts, the public prosecutor’s office, or competent public administrations, particularly data protection authorities, for the purpose of determining possible liabilities arising from the processing of the Personal Data and only for the statutory limitation period of such liabilities.

In addition, it should be noted that (i) once this period has expired, the data will be destroyed; and (ii) blocked Personal Data cannot be processed for any purpose other than those specified in the above paragraph.

2. Data Protection Authority in Spain

Should you wish to lodge a complaint pursuant to section 12.1.4 of this Privacy Notice, you may contact the Agencia Española de Protección de Datos (AEPD) can be contacted at: https://www.aepd.es.

1. 1. 9. Specific information for residents of the United Kingdom

Data Protection Authority in the United Kingdom: Should you wish to lodge a complaint pursuant to section 12.1.4 of this Privacy Notice, you may contact the Information Commissioner's Office by: (i) phone, 0303 123 1113; (ii) email, casework@ico.org.uk; or (iii) post, Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF.

1. 2. Specific information for individuals located in Canada

If you reside in Canada, please review this section carefully, as it supplements the rest of the Privacy Notice. In the event of any conflict or inconsistency between the terms set out in sections 1 through 10 of this Privacy Notice and the terms set out in this Section 11.2, if you are a Canadian resident, the terms in this section will take priority to the extent of such conflict or inconsistency.

1. 1. 1. Consent

In Canada, the only legal basis that we rely upon to process your Personal Data is your implied or express consent, except where permitted or required by law. Therefore, we will only collect, use and disclose your Personal Data based on your consent to the purposes identified in sections 5.2 and 6 of the Privacy Notice (or any other purpose that we have identified to you).

1. 1. 2. Your rights

Subject to certain exemptions, you may have some or all of the following rights in relation to the Personal Data we hold about you.

1. Right of access

You have the right to access the Personal Data we hold about you and to receive a general account of our uses of that Personal Data by submitting a request to us.

If you are a Quebec resident, you may also ask us to provide you with computerized Personal Data that we have collected directly from you in a structured, commonly used technological format. Upon our receipt of a written access request from you, we will endeavour to comply with your request in accordance with applicable privacy law. In certain limited circumstances, we may not be able to make all relevant Personal Data available to you, for example, where that Personal Data also relates to another individual. In such circumstances, we will, upon your request, provide you with our reasons for such refusal. We will endeavour to deal with all requests for access of Personal Data in a timely manner.

2. Right to rectification

If the Personal Data we hold about you is inaccurate or incomplete, you have the right to rectify such inaccuracies. We will endeavor to deal with any of your requests to rectify your Personal Data in a timely manner. Where appropriate, such rectified Personal Data will be provided to the parties to whom we are authorized to disclose your Personal Data.

3. Right to withdraw consent

You have the right to withdraw your consent to our processing of your Personal Data at any time. However, this will not affect the lawfulness of any processing of such information carried out before you withdrew your consent or if your consent is not required.

1. 1. 3. Contact information and challenging compliance

We have procedures in place to receive and respond to inquiries about our handling of personal information, our compliance with this Privacy Notice, and with applicable privacy laws. You may contact us with any questions, comments or requests regarding our processing of your Personal Data, in particular, if you believe that the rights set out in this Privacy Notice have not been complied with in accordance with applicable privacy laws. Please contact us:

By email to: privacy@tomfordfashion.com;

By mail to the address indicated in section 3 of this Privacy Notice.

1. 3. Specific information for US residents

This section contains additional information relevant to residents of certain states (listed below). This section is part of, and should be read in conjunction with, this entire Privacy Notice.  This section also serves as our notice at collection for Personal Data collected online or that you submit by email or phone.

If you are a resident of California, Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah or Virginia, you may have certain rights regarding the use of your Personal Data. This section of the Privacy Notice describes those rights and how you can exercise them.  Not all privacy laws provide equal privacy rights.  While we endeavour to respond to all privacy rights requests, we reserve the right to limit our response or deny your request if we determine that it is fraudulent, made in bad faith, or if the law otherwise does not require a response.

1. 1. 1. Notice of collection, disclosure, and selling or sharing Personal Data

In addition to the processing of Personal Data described in sections 4 through 6 of this Privacy Notice, which apply to you, some US privacy laws require us to disclose certain details of our data processing activities in the last 12 months. The following chart identifies the categories of Personal Data that we’ve collected within the last 12 months, the sources of that data, the business or commercial purposes for its collection, the categories of third parties to whom we’ve disclosed it, and the business or commercial purposes for such disclosure:

Category of Personal Data	Source	Business or commercial purposes for collection	Categories of third parties with which information is disclosed	Business or commercial purposes for disclosure
Identifiers: name, title, postal address, unique personal identifier, internet protocol address, email address, account name	You (and when you use our website to make purchases, your computer)	Verifying your identity and communicating with you regarding your order and responding to your requests Sending you a confirmation email in connection with an order you make through the website and providing you with updates in connection with such order Processing your order and delivering the products you purchase to you Processing any refunds / returns in the event that you need to return an item to us Managing and operating your account with us Ensuring that website content is presented in the most effective manner for you and for your computer Allowing you to participate in interactive features of our service, when you choose to do so, including identifying you when we post your comments on our website As part of our efforts to keep our site safe and secure For internal research, marketing, and website development Administering the site and for internal operations, troubleshooting, data analysis, testing, research, statistical and survey purposes Direct marketing purposes, for example, to provide you with information about other goods and services that we offer that are similar to those that you have already enquired about, or to provide you with personalised offers and product selections. Notifying you about changes to our products or services, notifying you about upcoming features available on the site, and sending you service emails relating to your account Managing and operating your account with us Responding to your requests for information Processing survey results and contest entries	Ecommerce service providers that provide fulfillment, customer service, ecommerce platform hosting, fraud prevention, and maintenance Point of sale service provider  Communications service providers Common carrier and courier services Our affiliates, including other companies of the Tom Ford Fashion Group, Estée Lauder companies, and companies of the Ermenegildo Zegna group	Fulfill orders, customer service requests, maintenance and fraud prevention Processing payments and managing inventory Provide email communications technology Assist in processing order Direct and affiliate marketing purposes, for example, to provide you with information about other goods and services or offers that may interest you
Commercial information: products or services purchased, obtained, or considered, or other purchasing or consuming histories or tendencies	You (and when you use our website to make purchases, your computer)	Analyzing and monitoring customer patterns so that we can improve our products and services Managing product availability (stock levels), resource allocation, and staffing requirements. Marketing purposes, for example, to provide you with information about other goods and services that we offer that are similar to those that you have already enquired about, or to provide you with personalised offers and product selections. Processing made to measure orders or items requiring alteration Processing purchases and refunds	Ecommerce service providers that provide fulfillment, customer service, ecommerce platform hosting, fraud prevention, and maintenance Point of sale service provider as part of records of purchases Our affiliates, including other companies of the Tom Ford Fashion Group, Estée Lauder companies, and companies of the Ermenegildo Zegna group	Fulfill orders, customer service requests, maintenance and fraud prevention Processing payments and managing inventory Direct and affiliate marketing purposes, for example, to provide you with information about other goods and services or offers that may interest you
Internet or other electronic network activity information: internet protocol address; login information; browser type; operating system; time zone; browser plug-in types and version; operating system and platform; url; clickstream to, through and from our side (including date and time); page response times; download errors; products you viewed or searched for; length of visits to certain pages; page interaction information (such as scrolling, clicks, and mouse-overs); methods used to browse away from the page	You (and your computer)	Ensuring that website content is presented in the most effective manner for you and for your computer Allowing you to participate in interactive features of our service, when you choose to do so As part of our efforts to keep our site safe and secure For internal research, marketing, and website development Administering the site and for internal operations, troubleshooting, data analysis, testing, research, statistical and survey purposes Allowing you to participate in interactive features of our service, when you choose to do so	Service providers that maintain the functioning and security of our website Website analytics service providers	Maintenance of website and improvement of user experience Improvement of user experience
Geolocation data for general geographic location	You (and your computer)	As part of our efforts to keep our site safe and secure	Ecommerce service providers that provide fulfillment, customer service, ecommerce platform hosting, fraud prevention, and maintenance	Fulfill orders, customer service requests, maintenance and fraud prevention
Audio information	You	Assisting in your telephone inquiries	Customer service providers	Provide customer service
Video information	You (via security cameras)	Security monitoring in our physical stores	Security service providers	Security monitoring in our physical stores
Inferences drawn from any of the information identified above to create a profile about a consumer reflecting the consumer’s preferences	You	Our sales staff draw on their experiences providing services to you in order to suggest new products that have become available or in order to respond to your inquiries about our products	Our affiliates, including other companies of the Tom Ford Fashion Group, Estée Lauder companies, and companies of the Ermenegildo Zegna group	Direct and affiliate marketing purposes, for example, to provide you with information about other goods and services or offers that may interest you
Sensitive personal information including categories listed in Cal. Civ. Code § 1798.80(e) - passport number	You	Verifying your identity in order to process tax-free purchases or to carry out fraud investigations	Ecommerce service providers that provide fulfillment, customer service, and fraud prevention	Fulfill orders, customer service requestsand fraud prevention
Sensitive personal information including categories listed in Cal. Civ. Code § 1798.80(e) - financial account information	You	Processing purchases and refunds	Ecommerce service providers that provide fulfillment, customer service, ecommerce platform hosting, fraud prevention, and maintenance	Fulfill orders and refunds
Sensitive personal information including protected class characteristics under California or federal law  - date of birth and gender	You	Identifying you and personalizing communications with you Verifying your identity for security reasons	Ecommerce platform hosting, fraud prevention, and maintenance Point of sale service provider  Communications service providers Our affiliates, including other companies of the Tom Ford Fashion Group, Estée Lauder companies, and companies of the Ermenegildo Zegna group	Provide email communications technology Direct and affiliate marketing purposes, for example, to provide you with information about other goods and services or offers that may interest you

While we do not exchange any Personal Data for money, we do engage in cross-context behavioural and targeted advertising.  Sharing Personal Data for these purposes may be deemed by some US privacy laws as a “sale” of Personal Data. You may opt-out of the sale or sharing of your Personal Data for behavioural or targeted advertising by clicking the “Do Not Sell or Share My Personal Information” link or by exercising your privacy rights as described below.

In the preceding 12 months, we have sold or shared Personal Data to third parties, and we continue to sell or share it to third parties, as specified below.

Category of Personal Data	Business or commercial purposes for sharing Personal Data	Categories of receiving third parties
Identifiers (including name, title, postal address, unique personal identifier, internet protocol address, email address, telephone numbers, account name, cookies)	Provide analytic services for cross-context behavioural or targeted advertising	Service providers (in particular, website analytics and fraud detection service providers) Third-party advertising partners (see the section above titled “usage data and cookies” for more information) Our affiliates, including other companies of the Tom Ford Fashion Group, Estée Lauder companies, and companies of the Ermenegildo Zegna N.V. Group
Commercial information (including products or services purchased)
Internet or other electronic network activity information (including internet protocol address; login information; browser type; operating system; time zone; browser plug-in types and version; operating system and platform; url; clickstream to, through and from our side (including date and time); page response times; download errors; products you viewed or searched for; length of visits to certain pages; page interaction information (such as scrolling, clicks, and mouse-overs); methods used to browse away from the page)

For all of the categories listed above, we do not use this Personal Data or Sensitive Personal Data to create profiles on individuals that produce legal or similarly significant effects We do not use or disclose Sensitive Personal Data for the purpose of inferring characteristics about you or to perform targeted advertising. We do not collect Personal Data or Sensitive Personal Data of individuals under eighteen (18). We retain Personal Data as described in section 8 above titled “Retention periods of your data.”

1. 1. 2. Your privacy rights

Depending on your state of residence, you may have the right to:

• Request to know more about the Personal Data that we collect, use, and disclose.  Once we receive and verify your request, we may disclose:
  • The categories of Personal Data we’ve collected about you
  • The categories of sources for the Personal Data we’ve collected about you
  • Our business or commercial purpose for collecting and/or sharing or selling that Personal Data
  • The categories of Personal Data that we’ve shared with or sold to third parties
  • The categories of third parties with whom we’ve shared, or to whom we’ve sold, that Personal Data (residents of Delaware, Minnesota and Oregon have the right to request a list of such third parties)
  • The specific pieces of Personal Data we’ve collected about you
• Request to access your Personal Data, including in a portable format
• Request deletion of your Personal Data
• Request correction of inaccurate Personal Data
• Opt-out of the sale or sharing of Personal Data for targeted or cross-context behavioural advertising, or limit the use of Sensitive Personal Data, and
• Not be discriminated against for exercising these rights.

1. 1. 3. Exercising your privacy rights

In order to exercise your privacy rights, kindly submit your request by filling out the form at the “Contact Us” page of our website and choosing “Privacy” under the “Your Topic” drop down menu. Alternatively, you may make the same requests by calling (888) TOM-FORD, or sending an e-mail to privacy@tomfordfashion.com.

1. 1. 4. Opting out of Personal Data sales, sharing, and targeted advertising

You may opt-out of processing that constitutes “targeted advertising,” “sharing,” or “sales” of Personal Data under US privacy laws at any time by changing your cookie preferences in our cookie banner (to opt out of cookie-based activities), or by clicking on the “Do Not Sell or Share My Personal Information” link here or at the footer of our webpages. Your opt-out choice will be linked to your browser only; therefore, you will need to renew your opt-out choice if you visit our website from a new device or browser, or if you clear your browser’s cookies.

You may opt out of non-cookie-based targeted advertising disclosures associated with your email address or other Personal Data by exercising your privacy rights through the methods described above, including by phone, email, or by filling out the form at the “Contact Us” page of our website.

1. 1. 5. Universal Opt-Out Mechanisms and Do Not Track Signals

You may also choose to install Universal Opt-out Mechanisms (UOOMs) on your browser. UOOMs are browser signals that indicate a user’s intent to opt-out of some uses of their Personal Data on websites they visit. If our site recognizes that your browser is expressing a UOOM, we will treat it as a request to opt-out of the sharing of your Personal Data and limit the use of your sensitive Personal Data collected by our site. Although we will respond to UOOMs, please note that we do not alter our website’s data collection and use practices when we see a Do Not Track signal from your browser.

In some cases, we may not be able to link the UOOM of your browser to other Personal Data that we have collected from you by other means. To express your intent to opt-out of our processing of Personal Data that we may have collected from you outside of our website, please see the section titled “Exercising your privacy rights” above.

1. 1. 6. Process for verifying a privacy rights request

We will verify any consumer’s request to exercise the right to know or the right to request deletion using the following process:

• Wherever possible, we will compare the identifying information you provide with the Personal Data we already have in our systems, or we may employ a third-party identification verification service to perform this matching.
• We will, as a general practice, refrain from requesting additional information for verification purposes. Only when we cannot verify your identity or residency based on the information already in our possession will we seek additional information from you. The supplementary Personal Data collected will be utilized solely for the accurate verification of your identity to facilitate the exercise of your privacy rights and for the purpose of preventing fraud.
• If you are an account holder with us, we will request your email address. However, in cases where we suspect fraudulent or malicious activity on a password-protected account, we will not fulfill requests to know or delete Personal Data until additional verification procedures have been successfully completed.
• For individuals who do not have an account with us, we will ask for specific data points that enable us to reasonably verify your consumer request.

Exercising the right to know. If you are requesting to know the categories of Personal Data collected, we may require two data points to be provided by you that match two of the data points that we maintain.  However, if you request to know specific pieces of information, a higher bar for verification is required (a reasonably high degree of certainty), which may require us to match three data points of information provided by you with three data points that we maintain in our records, together with a signed declaration under penalty of perjury that you are the individual whose Personal Data is the subject of the request. We will maintain all signed declarations as part of our record-keeping obligations under the ccpa.

Exercising the right to request deletion. When you make a request to delete your Personal Data, the level of reasonable certainty required during our verification process will vary depending on the nature of the Personal Data you wish to have deleted. Specifically, for sensitive Personal Data, we will necessitate that three data points provided by you align with three data points already stored in our records, and a signed declaration under penalty of perjury will be mandatory. For all other types of Personal Data subject to a deletion request, we will gather the necessary data points in accordance with the reasonable degree of certainty standard outlined previously. We will act in good faith when determining what standard to apply when verifying all consumer requests.

You may designate an authorized agent to act on your behalf to make a privacy request. If you use an authorized agent, we may require that you provide your authorized agent with written permission to exercise your privacy rights, and that you verify your own identity with us through the processes described above.  If your authorized agent does not submit proof that they have been authorized by you to submit these requests, we reserve the right to deny such a request that we have received and will explain to your authorized agent why we have denied the request.

1. 1. 7. Your right to appeal

Residents of Colorado, Connecticut, Minnesota, Montana, Oregon, Texas, and Virginia have the right to appeal our decisions in response to the exercise of your privacy rights requests. To initiate an internal appeal, kindly fill out the form at the “Contact Us” page of our Website and choose “Privacy” under the “Your Topic” drop down menu. Alternatively, you may make the same requests by calling (888) TOM-FORD, or sending an e-mail to privacy@tomfordfashion.com. We will respond to your request for an internal appeal within 45 days. If you are unhappy with the results of your appeal, you may contact your state attorney general.