Privacy policy
In compliance with the provisions of Regulation (EU) 679/2016
Most recent update: 02/09/2026
We have the pleasure and duty to provide the following information about the processing of personal data, in accordance with the Privacy Code and Regulation (EU) 2016/679.
1. Type of personal data collected
The following personal data is collected and processed by Bulgari S.p.A. and the companies of the Bvlgari Group in Italy and worldwide (hereinafter referred to as "Bvlgari Group Companies"), for the purposes outlined below:
a) personal and identifying data like your name, surname, date of birth, proof of identity, nationality, images recorded during store visits (where CCTV is in place), voice recorded during calls to Bvlgari sales support services, payment information in the event of purchases made online or in stores;
b) data from interactions: information collected during store visits, including the use of the Wi-Fi system, while participating in events or making online purchases, when signing up to loyalty programs (e.g. date of birth, age group, dates of family events, profession, hobbies, purchases, use of particular social media or social media ID, phone number, email address, photograph, nationality, gender, language, favorite product categories, details of products purchased, sizes, prices, discounts, statistical spending levels, abandoned shopping carts, ways in which services are used), preferences and interests disclosed by the user over the course of interactions with advisors in store (including preferences about our collections or other luxury brands, sizes, lifestyle or basic information about your family circle), responses to contact activities, information relating to the user's interaction with electronic communications sent by Bvlgari, such as the opening of emails, the selecting of links contained therein, and other information collected through tracking technologies, including tracking pixels, and data which may include health-related information regarding potential side effects of our cosmetic products;
c) data collected when browsing or using media applications, including information about the behavior of the user recorded using cookies or similar technology, as described in more detail in the Cookies Policy available online at cookies--page__terms.html, or data contained in your “Wish List”. Furthermore, at the user's discretion, the Website may collect geographical location data through the browser's native functionality (Geolocation API). This access is provided via the browser's pop up window and does not involve the use of cookies or similar storage technologies. Location data is used solely to provide the services requested by the user and is not stored permanently, unless the user chooses otherwise;
d) personal data provided in connection with reports concerning unlawful conduct, violations of the Organization and Control Model pursuant to Italian Legislative Decree 231/2001, as amended, the Code of Conduct and/or applicable whistleblowing legislation. With reference to such processing, the personal data of the whistleblower, the person who is the subject of the report and/or any third parties involved or mentioned in the report may be processed for the purposes of receiving, analyzing and handling the report, carrying out any necessary investigations and taking any resulting action. Depending on the circumstances, the legal basis for processing is: (i) the need to comply with legal obligations to which the Data Controller is subject; (ii) the Data Controller's legitimate interest in protecting the integrity of its corporate assets and in preventing or detecting unlawful conduct; (iii) where necessary, the establishment, exercise or defense of a legal claim; and (iv) the whistleblower's consent, only in cases where disclosure of their identity is required under applicable legislation.
Personal data is collected directly from the user (e.g. when creating an account on our websites/apps, making a purchase or interacting with our in-store advisors or Client Services), collected passively (e.g. using tracking tools like browser cookies), or collected via third parties (e.g. social media platforms). If the user provides information relating to third parties, the user declares that they are authorized to provide such information and undertakes to share the contents of this policy with the interested parties. With reference to the processing of personal data carried out for the purpose of handling whistleblowing reports, both the data relating to the whistleblower and that relating to the person against whom the report is made and/or any third parties mentioned are provided directly by the whistleblower or by third parties during the course of preliminary investigations.
2. Processing purpose
Bvlgari processes the data provided by you for the following purposes:
a) The data referred to in points 1.a), 1.b) and 1.c) is processed by Bvlgari and Bvlgari Group Companies for contractual purposes (Article 6, paragraph 1, sub-section b) of the GDPR), namely (i) managing the sale of its products and providing sale and after-sale services (including, for example, fraud prevention, returns, product warranties and customer support); (ii) in the context of Bvlgari's online activities, creating and maintaining your customer account and providing the services offered via its website, including clienteling services (which call for a personalized service from your trusted advisor); (iii) consulting the production chain of certain items purchased by you, registering or transferring ownership, as well as downloading—and later giving to third parties—possible NFTs associated with said product; and (iv) checking your information requests; (v) ensuring compliance with applicable regulations, including those relating to combating money laundering, countering the financing of terrorism, international sanctions, fraud prevention, and the prevention of unlawful or unauthorized activities and service security, as well as complying with legitimate requests from competent authorities, judicial authorities, law enforcement agencies or financial institutions. Such processing is carried out, as applicable, in order to comply with legal obligations to which Bvlgari is subject pursuant to Article 6, paragraph 1, sub-section c) of the GDPR and/or for the purposes of pursuing Bvlgari's legitimate interests pursuant to Article 6, paragraph 1, sub-section f) of the GDPR. Where required by applicable legislation or justified by risk management requirements, Bvlgari may refuse, suspend or terminate the supply of products or services, in accordance with applicable legislation.
b) The data referred to in points 1.a) and 1.d) is processed by Bvlgari and Bvlgari Group Companies to fulfil legal obligations to which Bvlgari is subject, including the performance of so-called “Know Your Customer” activities (Article 6, paragraph 1, sub-section c) of the GDPR);
c) The data referred to in points 1.a), 1.b) and 1.c) is processed by Bvlgari and Bvlgari Group Companies for marketing and profiling purposes, i.e. to send you, with your prior consent (Art. 6, paragraph 1, sub-section a)), commercial communications relating to Bvlgari's exclusive products, services and activities through electronic means (such as, for example, email, SMS, MMS, mobile phone, social networks and chat) or paper-based means (such as classic mail); to offer personalized sales services (including, for example, personal shopping services, free assistance services and courtesy services); to measure satisfaction levels with products and/or services provided, including those provided by third parties; to analyze the user’s preferences, interests and purchasing habits based on information collected over the course of interactions with Bvlgari, including interactions with electronic communications sent (such as email openings, selection of related content and other information collected through tracking pixels), in order to personalize commercial communications, offers and services provided and improve the service offered; and to use Virtual Try-On tools. The user's geographical location data may be collected exclusively with prior consent given via the specific request displayed by the browser, for the sole purpose of providing services specifically requested by the user (e.g. locating the nearest points of sale);
d) The data referred to in points 1.a), 1.b), 1.c) and 1.d) is processed for the pursuit of a Legitimate Interest of Bvlgari and/or the Bvlgari Group Companies (Article 6, paragraph 1, sub-section f of the GDPR), namely to defend Bvlgari's rights in court or out of court.
3. Provision of data
The provision of personal data in relation to the purposes outlined in paragraph 2, sub-sections a) and b) is obligatory, and if it is not provided, Bvlgari Group Companies cannot proceed with the contractual services requested. For the purposes detailed in paragraph 2, sub-section c), provision of data is free and optional and the use of such data is subject to the consent of the interested party. Denial thereof would not allow Bvlgari Group Companies to achieve the indicated purposes. Providing personal data for the purposes outlined in paragraph 2, sub-section d), is optional. However, failure to do so could compromise or limit the provision of the services offered by Bvlgari. The provision of data relating to the reports referred to in point 1.d) is necessary; otherwise, it will not be possible to process such reports. Any anonymous reports will only be considered if they are adequately substantiated, based on concrete evidence and provided with sufficient detail to make the reported facts appear credible.
4. Conditions applicable to the consent of minors
Processing the personal data of minors is lawful provided they are at least 16 years of age. If a minor is younger than 16 years of age, processing this data is only lawful if, and where, consent is provided or authorized by the holder of parental responsibility. We do not knowingly collect personally identifiable information from minors without permission from a parent or guardian, unless permitted by law.
5. Processing method
Personal data will be processed using IT-based tools and/or processed manually for the length of time needed to achieve the purpose for which it was collected. In particular, personal data collected for the purposes outlined in paragraph 2 will also be processed with the help of automated tools, according to procedures and reasoning strictly related to the purposes specified above.
With specific reference to the processing of personal data carried out for the purpose of handling whistleblowing reports, the Company implements appropriate technical and organizational measures to ensure a higher level of protection, in accordance with applicable legislation.
In particular, the processing is carried out in a manner that ensures: (i) the confidentiality of the identity of the whistleblower, the persons reported and any other person involved in the report; (ii) access to the data is restricted exclusively to individuals who are expressly authorized and responsible for handling reports; (iii) the application of the data minimization principle with respect to data processed during investigative activities; (iv) the traceability of all operations performed on the data; (v) the use of dedicated channels and tools, including IT systems, designed to ensure the security and confidentiality of reports. Reports are also managed via IT platforms provided by the LVMH Group.
6. Entering of data in the CRM system
The entering of personal data in the CRM system is optional and only takes place if expressly requested by the Client, by filling out the appropriate form. Once in the CRM system, Bvlgari employees across the world, tasked with data processing, will automatically be able to view, change and revise the information. The data may be used for marketing and profiling purposes only upon receipt of the specific consent referred to in point 2. c).
7. Scope of communication, transfer abroad and publication of data
We do not disclose or share the personal data we collect, except with Bulgari S.p.A., its parent companies, subsidiary companies, associate companies, companies under the same control, or companies that are part of the same group that Bulgari S.p.A. belongs to (a complete list of which can be requested by emailing: privacy@bulgari.com), in order to offer users the same level of services worldwide. In this regard, it should be noted that the ‘Standard Contractual Clauses’ prepared by the European Commission for the transfer of personal data outside the European Economic Area or other conditions for transfer provided for in Articles 45 et seq. of the GDPR may be applied. Personal data is processed only by authorized personnel, who have access to the information and are tasked with or responsible for data processing.
The user's personal data may also be processed by companies performing services on our behalf (including companies that provide shipping/delivery services for catalogs and/or products; companies that deliver newsletters, marketing material and promotional communications; companies that provide customer care services; companies that carry out analyses and market research; companies that maintain IT systems; companies that manage web session replay tools to ensure the best end-user experience).
Data collected may also be processed by third parties acting as independent data controllers, for example:
• banks or other payment management companies through credit card and tax-free services;
• individuals, companies, associations or professional studios that provide assistance or consultancy services (lawyers, accountants, auditors);
• when required to do so in order to comply with applicable law, to respond to a court order or—more generally—any request from a competent authority;
• companies that assist in performing KYC procedures;
• companies that manage the so-called Virtual Try-On experience.
With specific reference to the processing of personal data carried out for the purpose of handling whistleblowing reports, the disclosure of and access to such data are restricted exclusively to individuals expressly authorized by Bulgari and LVMH Hennessy Moët Louis Vuitton SE.
A complete list of third parties responsible for processing personal data on behalf of Bvlgari, or as independent third-party data controllers, can be requested by emailing: privacy@bulgari.com. The data will, under no circumstances, be published.
8. Data retention period
The user's personal data will not be stored in a way that allows them to be identified and for no longer than is deemed reasonably necessary by Bvlgari for achieving the purposes for which it was collected or processed, or as established by current legislation on data retention. Data collected for the reasons outlined in paragraph 2, sub-section a) will be stored by Bulgari S.p.A. and Bvlgari Group Companies for the time period necessary for the performance of a contract, with legal and conventional guarantees provided for, or in accordance with legal requirements regarding data retention. For the purposes stated above, data concerning Bvlgari customers will be retained for 10 years from the date of the last interaction with the Company (e.g. a purchase, repair or product assistance); and data concerning Prospects will be retained for 3 years from the date of registration or from the last interaction with the Company (e.g. a repair or assistance for a product purchased from third parties). Data collected for the purposes outlined in paragraph 2, sub-section c) will be stored until the client withdraws their consent to processing and in any case, with particular reference to data collected for the purposes outlined in paragraph 2, sub-section c), for no more than ten years (in compliance with the measure issued by the Italian Data Protection Authority on 24 April 2013, following the request for preliminary verification submitted by Bulgari S.p.A.). If consent is withdrawn or the retention period for the data collected for the purposes outlined in paragraph 2, sub-section c) expires early, this data will be automatically deleted or made permanently anonymous.
The personal data referred to in paragraph 2, sub-section d) will be retained for the time necessary to process the report and, in any event, no longer than five years from the date on which the outcome of the reporting procedure is communicated, in accordance with confidentiality obligations and the storage limitation principle set out in Article 5, paragraph 1, sub-section e) of the GDPR.
9. Rights of data subjects
Information may be requested at any time regarding the processing of your personal data and how it is carried out. It is also possible to correct or delete data, limit its processing, object to its processing and/or request that the data be sent to another controller. Bulgari S.p.A. and its subsidiaries must respond to requests within deadlines provided for by applicable regulations; they must also correct incorrect data, ensure that incomplete data is completed, and update data that is no longer correct; and finally, if requested, they must delete data and limit and/or stop its processing, or ensure that it is, where technically possible, sent to another controller. To exercise their statutory rights stated above or to request further information, and/or to report any errors or issues, the data subject may proceed as follows in order to receive a prompt reply: send an email to privacy@bulgari.com; fill in the online form using the following link; or send a written request to the Data Protection Officer (DPO) at Bulgari S.p.A., Lungotevere Marzio 11, Rome. If the data subject is not satisfied with the response they receive, they may address the data protection Supervisory Authority.
With respect to the processing of personal data carried out for the purpose of handling whistleblowing reports, the exercise of the above rights may be restricted, in accordance with applicable legislation, where doing so could cause actual and substantial prejudice to the confidentiality of the whistleblower's identity or to the proper conduct of review and investigative activities. In such cases, the rights in question may be exercised through the Italian Data Protection Authority (in accordance with the procedures set out in Article 160 of the Italian Data Protection Code), which shall inform the data subject that it has carried out all necessary checks or conducted a review, and of the data subject’s right to bring judicial proceedings.
10. Personal data protection
Bvlgari has obtained the international BS 10012:2017 certification for the compliance of its data protection management system as proof of the ever-constant attention it pays to protecting personal data and its commitment to respecting current data protection legislation.
With specific reference to the Philippines, Bulgari Philippines Inc. has obtained the National Privacy Commission (NPC) Certificate and Seal of Registration, in accordance with the Philippine Data Privacy Act.
The NPC Seal of Registration can be consulted at the following link.
Further information is available in the dedicated section of our Privacy Center: “Privacy Seal – Philippines.”
11. Data controllers and processors
The website www.bulgari.com is managed by Bulgari S.p.A., with registered office at Via dei Condotti 11, Rome, acting in their capacity as Data Controller for personal data in accordance with Regulation (EU) 679/2016 (GDPR). The processing of personal data carried out as part of Customer Management activities is performed by Bvlgari and Bvlgari Group Companies, which act as Joint Controllers on the basis of the joint controller agreement entered into pursuant to Article 26 of the GDPR. The joint controllers undertake to ensure that anyone acting under their authority has access to personal data, and processes such data only after receiving instructions from the respective joint controller and in compliance with the company policies adopted. For further details on joint data processing and the Bvlgari Group Companies involved, as well as for the purposes of exercising their rights, data subjects may contact Bvlgari using the contact details provided in paragraph 9. In relation to the processing of personal data for the management of whistleblowing reports, the data controllers are both LVMH Moët Hennessy Louis Vuitton SE and the individual companies of the Bvlgari Group. A complete list of data processors designated by controllers may also be requested by sending an email to privacy@bulgari.com.