Privacy policy

INFORMATION ON THE PROCESSING OF PERSONAL DATA PURSUANT TO EUROPEAN REGULATION (EU) 2016/679 AND THE PRIVACY CODE (LEGISLATIVE DECREE 196/2003) AS AMENDED BY LEGISLATIVE DECREE 101/2018

As required by European Union Regulation no. 679/2016 (hereinafter "GDPR") and in particular by art. 13, we hereby provide the information required by law regarding the processing of personal data.

We do not intentionally process personal data of children under 16 years of age. Should we discover the existence of data belonging to children under 16, we will immediately delete them without any prior notice.

The website (hereinafter "Site") is owned by , with registered office in , VAT number and tax code , pec: (hereinafter "").

This information is provided to users who interact with the web services of the Site (hereinafter "Data Subjects") not only to comply with legal obligations, but also because transparency and fairness towards data subjects are a fundamental part of our business.

Browsing the Site is free and does not require any registration.

To make purchases on the Site, it is necessary to create a personal account, in order to facilitate shopping and access additional services.

1. Data Controller

The data controller pursuant to art. 4, paragraph 7 of the GDPR is with registered office in , VAT number and tax code , pec: (hereinafter "Controller").

2. What is personal data?

Pursuant to Art. 4 of the GDPR, personal data is defined as any information concerning an identified or identifiable natural person (data subject) directly or indirectly, with particular reference to an identifier such as a name, an identification number, location data, an online identifier or one or more characteristic elements of their physical, physiological, genetic, psychological, economic, cultural or social identity.

3. Provision of data

Personal data will be acquired directly from the data subject, through:

3.1) Direct provision of data

(section 4.2 "Data provided voluntarily by the user");

3.2) Automatic acquisition

(sections 4.2 and 4.3 "Browsing data" and "Cookies" or similar technologies).

4. Types of data

The following categories of data may be processed (collectively, the "Data"):

4.1) Browsing data:

the IT systems and software procedures used to operate the Site acquire, during their normal operation, certain personal data (such as IP addresses or domain names of the computers used by users, pages visited and the date/time of the visit) whose transmission is implicit in the use of Internet communication protocols. This information is not collected to be associated with identified data subjects but by its very nature could, through processing and association with data held by third parties, allow users to be identified.

This data, recorded anonymously, is used solely for the purpose of obtaining statistical information on the use of the Site and to check its correct functioning.

The data could be used to ascertain responsibility in case of hypothetical cybercrimes against the Site.

4.2) Cookies:

to make browsing on this Site more efficient and immediate, during user access to this website, cookies are used: small text strings that allow to maintain the connection to the Site.

Please refer to the cookie policy on the webpage of .

4.3) Data provided voluntarily by the user:

this refers to personal data freely provided by the user to access certain freely chosen services. Failure to provide them may make it impossible to obtain the requested service. Specific information and consent requests are reported on the Site pages dedicated to on-demand services.

5. Purpose of processing

the Data are processed for the following purposes:

- manage registrations to the website and manage activities directly connected to registration;

- manage orders, provide products and services, process and manage payments, communicate with the data subject regarding orders, shipments;

- prevent or uncover fraud or abuse against our Site to allow third parties to perform technical, logistical and other activities on our behalf;

- send administration information, marketing communications, advertising and promotional initiatives (in paper format, SMS, e-mail, etc.), promotional offers, periodic customer satisfaction surveys, market research or quality surveys, from the same, from related, connected, controlled, affiliated companies, or from third parties appointed by ;

- analyze consumption habits or choices in order to propose a personalized service in line with the data subject's interests.

Unless otherwise specified in the following provisions, the processing of personal data for "online sales" purposes finds its legal basis in the necessity of executing a contract to which the data subject is a party or for the execution of pre-contractual measures adopted at the request of the same, pursuant to art. 6, paragraph 1, letter b of the GDPR.

The processing of personal data for "marketing" purposes, on the other hand, finds its legal basis in the expression of consent pursuant to art. 6, paragraph 1, letter a of the GDPR.

6. Communication and dissemination of Data

The Data collected as part of the service provision may be communicated to:

- companies that perform functions strictly connected and instrumental to the operation – including technical – of the services of , such as, for example, suppliers that provide services aimed at reviewing and verifying announcements, providers of direct marketing and customer care services, companies that provide archiving, administrative, payment and invoicing services, companies that provide technical components for the provision of certain features of the service;

- freight transport companies, couriers, shipping companies and similar in the freight transport sector;

- credit institutions, to arrange payments or credits;

- administrative and judicial bodies and authorities by virtue of legal obligations;

The Data may be communicated to other companies belonging to the group or in any case connected to it, as well as to other third parties that uses for the optimization of the services offered through the Site.

Under no circumstances do we transfer personal data to third parties for any reason (including sale).

Should the Controller entrust processing operations to third parties, the latter will be appointed as data processors pursuant to Article 28 of the GDPR, after verifying the compliance of their activity with the provisions on personal data protection.

The Controller will only use data processors who provide sufficient guarantees to implement adequate technical and organizational measures, so that the processing meets the requirements of the GDPR and ensures the protection of the data subject's rights.

7. Mandatory or optional nature of Data provision

The provision of personal Data is mandatory exclusively for the processing necessary for the provision of services offered by (any refusal for the purpose of service provision makes it impossible to use the service itself); it is instead optional for promotional and profiling purposes and any refusal to give consent has no negative consequences on the provision of the service offered within the Site.

8. Processing methods and duration

Personal data will be processed by persons authorized to process who act under the authority of the Controller, adequately instructed by the Controller, in compliance with the provisions of art. 29 of the GDPR through automated tools for the time strictly necessary to achieve the purposes for which they were collected, as well as for any further period necessary to fulfill specific legal obligations.

Except in cases of investigation of liability for hypothetical cybercrimes against the Site, data relating to browsing on the Site will not be stored for more than 30 (thirty) days.

Data may be processed both on electronic and paper support.

For analysis purposes aimed at service development and improvement, user personal data will be stored for 36 (thirty-six) months.

Data relating to electronic traffic, excluding in any case the content of communications, will be stored for a period not exceeding 6 years from the date of communication, pursuant to art. 24 of Law no. 167/2017, which transposed EU Directive 2017/541 on anti-terrorism.

For direct marketing purposes, we store your data for a maximum period equal to that provided by applicable law, equal to 24 (twenty-four) months.

Invoices, accounting documents and transaction data are stored for 10 (ten) years as required by law (including tax retention obligations).

guarantees the lawful and fair processing of personal data provided through the Site, in full compliance with current legislation, as well as the utmost confidentiality of the data provided during registration.

All Data is collected according to the indications of the reference legislation, with particular regard to the security measures provided by art. 32 of the GDPR for their processing using IT, manual and automated tools and with logic strictly related to the purposes indicated in article 4 and in any case in such a way as to guarantee the security and confidentiality of the data itself.

9. Transfer of Data abroad

This Site may share some of the data collected with services located outside the European Union. In particular with Google, Facebook and Instagram, through social plugins and the Google Analytics service. The transfer is authorized based on specific decisions of the European Union and the Personal Data Protection Authority, in particular decision 1250/2016 (Privacy Shield), for which no further consent is required. The aforementioned companies guarantee their adherence to the Privacy Shield.

10. Rights of Data Subjects

At any time you may exercise, by written request sent to the address, or to the PEC , pursuant to art. 7 of Legislative Decree 196/2003 and articles 15-22 of the GDPR, the right to:

• request confirmation of the existence or otherwise of your personal data
• obtain information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data have been or will be communicated and, where possible, the retention period
• obtain the rectification and erasure of data
• obtain the restriction of processing
• obtain data portability, i.e. receive them from a data controller and transmit them to another data controller without hindrance
• object to processing at any time
• object to an automated decision-making process relating to natural persons including profiling
• ask the data controller for access to personal data and the rectification or erasure thereof or the restriction of processing concerning them or to object to their processing, in addition to the right to data portability
• withdraw consent at any time without affecting the lawfulness of processing based on consent given before withdrawal.

Any requests will be processed at the latest within one month of receipt, subject to the possibility of extending this period for a further two months, if necessary, taking into account the complexity and number of requests received by the Controller.

Furthermore, you may file a complaint with the judicial authority (in accordance with the provisions of art. 80 of the GDPR and art. 13 of Legislative Decree 101/2018) or a complaint with the Personal Data Protection Authority, by:

- registered mail with return receipt addressed to Garante per la Protezione dei Dati Personali, Piazza di Monte Citorio, 121, 00186 Rome

- e-mail to the address: garante@gpdp.it or protocollo@pec.gpdp.it

- fax to the number: 06696773785

It should be noted that a complaint to the Guarantor cannot be filed if, for the same subject and between the same parties, an appeal has been filed with the Judicial Authority.

Any request relating to the Data processed by the Data Controller may be sent by email to the following address .

11. Revision Clause

This policy may be subject to changes. If substantial changes are made to the use of user Data by the Data Controller, the latter will notify the user by publishing them prominently on its pages or by alternative or similar means.