Privacy Policy


Privacy Policy for Users


Triboo Digitale S.r.l., Viale Sarca 336, Building 16, 20126 Milan, VAT/tax identification and Milan Companies Register number IT02387250307 (hereinafter also “Triboo”) and PARIS TEXAS SRL, Via Aliprandi 19, 20900 Monza (MB), tax identification and VAT number IT10771680963, registered with the Milan Monza Brianza Lodi Companies Register under number 10771680963, REA MB - 2556228 (hereinafter also the “Partner” and, together with Triboo, the “Controllers”), acting as Joint Controllers of the Personal Data of users (hereinafter the “Users”) who browse and use the Services available on the website www.paristexasbrand.com (hereinafter the “Website” and the “Services”), provide this Privacy Policy pursuant to Article 13 of Regulation (EU) 2016/679 of 27 April 2016 (hereinafter the “Regulation”, also the “GDPR” or the “Applicable Legislation”).

The Website and Services are intended for persons aged 18 or over. The Controllers do not knowingly collect Personal Data relating to persons under 18. If they become aware that such Data have been collected inadvertently, including following a report, the Controllers will promptly erase them, subject to any statutory retention obligations.

The Controllers attach the utmost importance to their Users’ rights to Privacy and the protection of Personal Data.

For any information concerning this Privacy Policy, Users may contact the Controllers at any time as follows:

For Triboo:

  • By sending a registered letter with acknowledgement of receipt to the Controller’s registered office (Viale Sarca 336, Building 16, 20126 Milan);
  • By sending an email to triboospa@legalmail.it;
  • By sending a fax to 02/64741491.

For Paris Texas SRL:

  • By sending a registered letter with acknowledgement of receipt to the Controller’s registered office at Via Aliprandi 19, 20900 Monza (MB);
  • By sending an email to: privacy@paristexas.it.

Users may also contact:

Paris Texas has designated Nicola Francione, Attorney-at-Law, as its Data Protection Officer (DPO). The DPO may be contacted at privacy@paristexas.it, stating “For the attention of the DPO” in the subject line.


1. Purposes of Processing

Users’ Personal Data will be processed by Triboo pursuant to Article 6 of the Regulation for the following Purposes of Processing, on the legal bases specified for each purpose:

  1. Contractual obligations and provision of the Services, to enable use of the Website, perform the Terms of Use accepted by the User when registering and/or using the Services, and fulfil the User’s specific requests. Data collected may include first name, surname, any chosen username, age, province of residence/domicile, sex, email address and other information voluntarily provided, insofar as relevant and necessary for the requested Service. Without specific Consent for additional Purposes, such Data will be used to provide the Services, verify the User’s identity where necessary, including by validating their email address, and send service communications. Data will not be made public except as expressly provided for in connection with features requested by the User, and may be disclosed to the recipients listed in paragraph 6. The legal basis is Article 6(1)(b) of the Regulation, insofar as Processing is necessary for the performance of a contract or to take pre-contractual steps at the User’s request. Any further checks strictly necessary to prevent fraud and abuse are based, where applicable, on Article 6(1)(f), for the legitimate interest in keeping the Services secure, subject to a balancing assessment of the User’s rights and freedoms;
  2. Administrative and accounting Purposes, to carry out organisational, administrative, financial and accounting activities related to the Services. The legal basis is Article 6(1)(b) of the Regulation for activities necessary to perform the contract, and Article 6(1)(c) for compliance with statutory obligations;
  3. Legal obligations, to comply with obligations under national and European Union law, including tax and accounting obligations, and binding orders of competent authorities. The legal basis is Article 6(1)(c) of the Regulation.

The provision of Personal Data for these Purposes is necessary insofar as Processing is indispensable for the requested Service or to comply with a legal obligation. Failure to provide necessary Data prevents provision of the relevant Service, without in itself affecting the ability simply to browse the Website’s pages.

Personal Data necessary for the Purposes of Processing described in this paragraph 1 are marked with an asterisk in the Website registration form.


2. Additional Purposes of Processing: Marketing (advertising materials, direct sales and commercial communications)

With the User’s freely given and optional Consent, pursuant to Article 6(1)(a) of the Regulation and, where applicable, Article 130 of the Italian Privacy Code, the User’s identification and contact Data may be processed by the Partner for Marketing Purposes (advertising materials, direct sales and commercial communications). The Partner may contact the User by post, email, landline and/or mobile telephone, including automated systems and/or human operators, SMS and/or MMS, through the channels for which the necessary Consent has been obtained, to offer products and/or services supplied by the Partner and/or third-party businesses and present offers, promotions and commercial opportunities.

Refusal to give Consent will not affect the ability to register on the Website.

Where Consent has been given, the User may withdraw it at any time by contacting the Partner as set out in paragraph 7 below.

The User may also easily object to further promotional emails by clicking the Consent withdrawal link included in each promotional email. Following withdrawal, the Partner will email the User to confirm it. Users wishing to withdraw Consent to promotional telephone calls while continuing to receive promotional emails, or vice versa, should contact the Controller as set out in paragraph 7 below.

Upon withdrawal of Consent or an objection to Marketing, the Partner ceases further promotional communications through the relevant channels and promptly applies the choice to campaigns and automated communications. Messages already transmitted before receipt of the request may be delivered later; this does not authorise new communications after withdrawal or objection. Any issues may be reported using the contact details in paragraph 7.


3. Additional purposes of Processing: newsletter

With the User’s freely given and optional Consent, pursuant to Article 6(1)(a) of the Regulation and, where applicable, Article 130 of the Italian Privacy Code, the Partner may process their email address and any further identification Data necessary to send the newsletter.
 The User will receive a periodic newsletter containing news, invitations to events and promotions relating to the Website and/or the Partner’s initiatives.

Refusal to give Consent will not affect the ability to register on the Website.

Where Consent has been given, the User may withdraw it at any time by contacting the Controller as set out in paragraph 7 below.

The User may also easily object to further promotional communications by clicking the Consent withdrawal link included in each newsletter email. Following withdrawal, the Partner will email the User to confirm it.

For any tracking of promotional communications and newsletters, and withdrawal of Consent to tracking alone, please refer to paragraph 3 bis below.

3 bis. Tracking in email communications

In the promotional communications and newsletters referred to in paragraphs 2 and 3, Paris Texas may use tracking pixels: small images hosted on remote servers which, when images in the message are loaded, allow its opening to be detected and associated with the recipient.

Depending on the features enabled, recipient and message identifiers, opening dates and times, and technical information such as IP address and device or email client type may be processed. Blocking the loading of images may prevent the pixels from operating.

Paris Texas uses individual tracking to measure email opens and assess the effectiveness of its promotional communications. Individual tracking is optional and is based on the User’s Consent under Article 122 of Italian Legislative Decree No. 196/2003 and Articles 6(1)(a) and 7 of the Regulation. For new Processing activities, Consent may be collected together with Consent to promotional communications, provided that the request expressly explains the tracking. Consent to Website cookies does not, in itself, constitute Consent to tracking in emails.

For tracking-related Processing already in progress when the Italian Data Protection Authority’s Guidelines of 17 April 2026 entered into force, and based on Consent or another valid legal basis, the relevant transitional provisions apply: Paris Texas promptly brings this addition to Users’ attention and makes withdrawal of Consent to tracking alone available. This regime does not remedy any previously unlawful Processing or permit new Processing without the required Consent.

The User may at any time choose to stop receiving promotional communications or disable tracking alone while continuing to receive communications without tracking pixels. These choices may be exercised through the preference management link in the emails or by writing to: privacy@paristexas.it. Refusing or withdrawing Consent to tracking does not restrict access to the Website, purchases or other Services.
Withdrawal does not affect the lawfulness of Processing based on Consent before its withdrawal. Paris Texas records preferences and applies them to subsequent mailings, including automated communications.

Information on email opens is not used to infer the User’s tastes, interests or purchasing habits without the separate Consent to Profiling referred to in paragraph 4.

The possibility of dispensing with Consent for exclusively aggregate statistics is limited to the cases provided for in Article 122 of the Italian Privacy Code and the Authority’s Guidelines: individual recipients’ behaviour must not be measured and the associated technical data must be effectively anonymised. Merely aggregating Data previously collected and retained at individual level does not exempt tracking from Consent. Paris Texas does not regard Data as anonymous where they still allow the recipient to be identified, even indirectly.

This paragraph concerns tracking in emails and does not introduce pixels into order-related transactional communications managed by Triboo. Any other Processing or tools used on the Website remain subject to the relevant notice and applicable conditions.


4. Additional purposes of Processing: Profiling

With the User’s freely given and optional Consent, pursuant to Article 6(1)(a) of the Regulation, the User’s Personal Data (identification data, browsing data, location Data and information on devices used to access the Website, within the scope of features actually enabled and the necessary consents) may be processed by the Partner for Profiling Purposes, to infer tastes and consumption habits and establish a consumer profile, enabling commercial offers consistent with that profile to be sent. This Consent does not replace any Consent required for cookies or other tracking tools.

Refusing or withdrawing Consent to Profiling does not affect the ability to use the Website, create an account, make purchases or use the requested Services; optional Profiling will not be carried out. Where Consent has been given, the User may withdraw it at any time by contacting the Partner as set out in paragraph 7 below.


5. Methods of Processing and Data retention periods

The Controllers will process Users’ Personal Data using manual and electronic tools, in a manner closely related to the Purposes and ensuring the security and confidentiality of the Data.

Users’ Personal Data will be retained for as long as strictly necessary for the primary Purposes described in paragraph 1 above, or as otherwise necessary to protect the interests of both Users and Triboo in civil proceedings.

For Marketing and newsletter Purposes under paragraphs 2 and 3, Data are retained for as long as necessary and in any event no longer than 24 months from collection; for Profiling under paragraph 4, no longer than 12 months from collection, subject to earlier withdrawal of Consent. Continuation beyond these periods requires a new valid legal basis and does not result merely from sending or opening a communication. Email tracking is subject to the specific period set out below.

Individual opening Data collected through pixels under paragraph 3 bis are retained for a maximum of 12 months from the recording of each event, and for a shorter period where no longer necessary or where Consent to the relevant Processing is withdrawn. An individual opening does not renew the retention period for Data previously collected. Data used for Profiling remain subject to the 12-month limit under paragraph 4. Only evidence strictly necessary to document consents and withdrawals and respect the User’s choices is retained separately, for as long as necessary for those purposes and the protection of rights, with restricted access and no promotional reuse of Data for which Consent has been withdrawn.

 

6. Disclosure and dissemination of Data

Personal Data may be processed by providers located in the European Economic Area (EEA) and, where necessary, transferred to recipients in third countries, including the United States of America. Transfers outside the EEA take place only in accordance with Chapter V of the Regulation: on the basis of a European Commission adequacy decision under Article 45, where applicable to the recipient and transfer, or subject to appropriate safeguards under Article 46, such as the European Commission’s standard contractual clauses and any necessary supplementary measures. The User may request information on recipients, destination countries and applicable safeguards, and a copy of those safeguards, using the contact details in paragraph 7.

Users’ Personal Data may be accessed by the Controllers’ employees and/or other personnel assigned to manage the Website and all services connected with the provision of the Services. Such persons, who have received instructions under Article 29 of the Regulation, will process Users’ Data solely for the Purposes stated in this Notice and in accordance with the Applicable Legislation.

For mailing, preference management and tracking activities under paragraph 3 bis above, Paris Texas uses email delivery and campaign management providers, appointed as Processors under Article 28 of the Regulation where the relevant conditions are met. An up-to-date list of providers and information on safeguards for any transfers outside the European Economic Area (EEA) may be requested from Paris Texas using the contact details above. The parties’ roles depend on the activities actually performed; joint controllership of Website-related Processing does not automatically mean that Triboo determines the purposes and means of campaigns and tracking managed by Paris Texas.

Users’ Personal Data may also be accessed by third parties processing Personal Data on behalf of the Controllers as “Processors”, including, for example, IT and logistics providers supporting the Website and/or Services, outsourcing or cloud computing providers, and professional advisers and consultants.

Users are entitled to obtain a list of any Processors appointed by each Controller, by contacting the relevant Controller as set out in paragraph 7 below.

Triboo may also disclose Users’ Personal Data, insofar as necessary and essential for the performance of contractual obligations, to third-party independent Controllers, such as payment service providers and logistics providers necessary to deliver goods sold through the Website. Such independent Controllers will process the User’s Data solely to fulfil orders relating to the Services correctly.


7. Data Subjects’ Rights

Users may exercise their rights under the Applicable Legislation by contacting the Controllers as follows:

  • By sending a registered letter with acknowledgement of receipt to the Controllers’ registered offices:
    • For Triboo: Viale Sarca 336, Building 16, 20126 Milan;
    • For Paris Texas SRL: Via Aliprandi 19, 20900 Monza (MB).
  • By sending a fax to:
    • Triboo: 02/64741491.

Triboo will handle Users’ requests relating to Processing under paragraph 1, while Paris Texas will handle requests under paragraphs 2, 3, 3 bis and 4. For paragraph 3 bis, the User may disable tracking alone while remaining subscribed to communications, using the preference management link in the emails or writing to privacy@paristexas.it. For jointly controlled Processing, the User may exercise their rights against each Joint Controller under Article 26(3) of the Regulation and request the essence of the joint controllership arrangement using the same contact details.

Subject to the conditions and limits of the Regulation, Users may obtain information on the source of Personal Data not collected from them, the Purposes and legal bases of Processing, categories of Data, recipients, retention and transfer safeguards. Where decisions are based solely on automated Processing and produce legal or similarly significant effects under Article 22 of the Regulation, the required information on the logic involved, significance and envisaged consequences, and applicable safeguards is also provided.

Users are also entitled to obtain:

  1. Access to Personal Data and rectification of inaccurate Data, and to have incomplete Data completed, including by providing a supplementary statement;
  2. Erasure of Personal Data in the cases set out in Article 17 of the Regulation and restriction of Processing in the cases set out in Article 18;
  3. Communication of rectification, erasure or restriction of Processing to recipients under Article 19 of the Regulation, unless this proves impossible or involves disproportionate effort, and information on those recipients upon request;

Users also have:

  1. The right to withdraw Consent at any time where Processing is based on their Consent;
  2. Where applicable, the right to Data portability (the right to receive Personal Data concerning them in a structured, commonly used and machine-readable format), the right to restriction of Processing of Personal Data and the right to erasure (“right to be forgotten”);
  3. The right to object:
    1. On grounds relating to their particular situation, to Processing based on Article 6(1)(e) or (f) of the Regulation, including Profiling based on those provisions, subject to Article 21(1);
    2. In whole or in part, to Processing of their Personal Data for advertising materials, direct sales, market research or commercial communications;
    3. Where Personal Data are processed for direct Marketing Purposes, at any time to Processing of their Data for such Purposes, including Profiling insofar as related to such direct Marketing.
  4. Where they consider that Processing concerning them infringes the Regulation, the right to lodge a complaint with a supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement. The Italian supervisory authority is the Garante per la Protezione dei Dati Personali (GPDP), located at Piazza Venezia 11, 00187 Rome (https://www.garanteprivacy.it/).

The Controllers ensure that information necessary to exercise rights is accessible and up to date. If any links do not work, Users may request documents or information directly using the contact details in paragraph 7, without any restriction of their rights. 

[1] The retention periods in this Privacy Policy are limits adopted by the Controllers in accordance with the principles of necessity, proportionality and storage limitation.

The Italian Data Protection Authority’s decision of 24 February 2005 on loyalty programmes does not impose mandatory general time limits for all Marketing and Profiling activities.