PRIVACY POLICY IN ACCORDANCE WITH ARTICLE 13 OF EU REGULATION 2016/679

per e-commerce Customers, in relation to the purchase and delivery of products Euthalia as well as customer care services, To the conduct of marketing, profiling and market research activities

 

For us, data protection is a very serious subject so we would like to inform you about thee mode with thee whatidata are processed andd to the rights you may exercise under thea current normativa On data protection, in particular of the EU Regulation 2016/679 (hereinafter also: “GDPR”).

This disclosure covers the activities related to the purchase of products Marketed through the e-commerce channel “Pamper yourself”, accessible from the website https://coccolatevi.it/ (hereinafter referred to as: “the Site”), as well as acustomer care services and atthe Activities of a promotional and advertising nature (sending marketing communications, profiling and market research). For processing activities not made explicit in this policy, please refer to the appropriate policy general for users of the Website.

Data processing is carried out:

 

Co-owner 1 Euthalia Ltd. Registered Office: Ignazio Ciampi Street No. 18, 00162 - Rome (RM) E-mail contact: privacy@euthalia.it

Co-owner 2 AFA Ltd.s. Registered Office: Matteotti Street, No. 6, 25010 - Montirone (BS) E-mail contact: coccolatevi@afaitalia.it

* The essential contents of the co-ownership agreement are available to interested parties upon explicit request.

 

The categories of “personal data” (ex Art. 4.1 of the GDPR) processed by the co-owners may be, merely by way of example but certainly not exhaustively:

 

Personal data is processed in accordance with the provisions of the General Data Protection Regulation (GDPR) and any other applicable data protection legislation. Details are provided below:

 

 

The period of preservation Of personal data, relative to the purposes set forth in this section is:

For the purpose: a, 10 years from the end of the contractual relationship – commercial, i.e. from carrying out eachpurchase.

 

These times may lengthen in the event of litigation, findings by public or judicial authorities, as well as any special legal provisions.

 

 

The period of preservation Of personal data, relative to the purposes set forth in this section is:

For the purposes: a, c, 10 years after the end of the rapcontractual - commercial port, viz. from making each purchase.

For the finality: b, until the request is fulfilled, unless the feedback provided and the information exchanged, is necessary to demonstrate the fulfillment of contractual obligations or arising from the legal relationships established (in which case the retention period will be equal to that indicated above for letters a, c).

These time frames may lengthen in the event of litigation.

 

 

For thea purpose: a, 10 years from the end of the contractual relationship - commercial, i.e. from carrying out each Purchase.

 

 

The period of preservation Of personal data, relative to the purposes set forth in this section is:

For thee purpose: a, 10 years from the end of the contractual - business relationship, i.e. from the making of each purchase.

For the purpose: b, 5 years from the occurrence of the event subject to legal protection.

For the purpose: c, data are aggregated at the time of collection.

For the purpose: d, for the duration of the contractual - commercial relationship established and, in any case, up to 24 months from the last purchase made, unless the person concerned objects. In this regard, it is specified that any denial or withdrawal of consent for other marketing purposes, other than the aforementioned purpose a, does not amount to opposition to the same and will not result in the termination of this purpose and related activities.

 

These time frames may lengthen in the event of litigation or legal provision.

 

The purposes Requiring consent are:

 

The period of preservation Of personal data, relative to the purposes set forth in this section is:

For the purpose: a, 24 months, from release Of consent, unless revoked.

For the finality: b, c: 12 months, from issuance of consent, unless revoked.

 

Within the framework of the above purposes, the Co-owners treatment mayyear convey the syour data a:

 

* The complete and updated list of the Addressees (ex art. 4.9 of the GDPR) è disponibile at the co-owners Of the processing of personal data at the above contact details.

 

The co-owners inform you. which under thethe purposes stated above, will be able to transfer the his data in countries outside the EU and the EEA, including through third parties engaged by it, acting as Data Processors, as well as through the latter's Sub-providers. In such cases, the transfer will take place in accordance with the provisions of Articles 44 et seq. of the GDPR and applicable legal provisions by entering into agreements, if necessary, that guarantee an adequate level of protection Or providing other guarantees of adequacy among those expressly provided for in the above articles. Therefore, as often as the his personal data were to be transferred outside the EEA and, in particular, to states that do not benefit from an adequacy decision of the European Commission **, the Controller will adopt one of the conditions of legitimacy for this purpose provided for in the applicable Regulations.

In particular, For the purposes 3.2, (a) and 3.4(a), his data will come relocated in the United States of America to society Stripe Payments Europe Ltd and to the company parent company Stripe Inc, adhering to the Data Privacy Framework, as well as to additional countries not included in the EU and EEA at which these companies and their subcontractors operate.

For more details, the interested party can apply to. to the co-owners via the contacts listed in Section 1 of this policy.

 

* The complete and updated list of Recipients (ex art. 4.9 of the GDPR) is available from the Data Controllers at the contact details above.

** The updated list of suitable non-EEA countries deemed adequate by the European Commission can be obtained on the website: Adequacy decisions (europa.eu)

 

The person concerned may assert the following rights:

 

Further information about the data subject's rights can be obtained by requesting to one of the co-owners Full excerpt of the above articles. 

I The aforementioned rights may be exercised in accordance with the Regulations by sending, also, an e-mail to the Owners, also individually, to the following addresses:

 

In accordance with Article 19 of the EU Regulation, the co-owners proceedsono ad Inform recipients to whom personal data have been disclosed, any rectification, deletion or restriction of processing required where possible.

To enable faster response to your requests made in the exercise of the above rights, they may be addressed to to the Joint Owners, including individually, addressing them to the contact details given in 1.

 

If a data subject believes that his or her rights have been compromised, he or she has the right to lodge a complaint with the Data Protection Authority in the manner specified by the Authority at the following address Internet http://www.garanteprivacy.it/web/guest/home/docweb/-/docweb-display/docweb/4535524 or by sending communication inscription all’ Data Protection Authority.

 

It is informed which where the processing purposes have as their legal basis a legal or contractual (or even pre-contractual) obligation, the data subject must necessarily provide the requested data.

Otherwise there will be an inability on the part of the of the co-owners To proceed with the pursuit of the specific processing purposes.

 

Similarly, with respect to purposes based on a legitimate interest and not requiring consent, the data subject's objection results or will result in the impossibility of proceeding with the realization of the respective purposes and any related services to which the data subject has objected, respectively, without prejudice to overriding compelling legitimate reasons of the Data Controller or aimed at the protection of rights in court.

 

8.3​In case of consent of the person concerned

For other purposes, for which consent is required, the Data Subject may revoke his or her consent at any time and the effects will run from the time of revocation, subject to the time limits provided by law. In general terms, revocation of consent has effect only for the future. Therefore, processing that was carried out prior to the revocation of consent will not be affected and will retain its legitimacy.

Failure or partial consent may not guarantee full delivery of the services, with reference to to individual Purposes for which consent is withheld.

 

When data are no longer needed, Taking into account the conservation periods above, these are regularly deleted. Qhen their deletion is impossible or possible only with disproportionate effort due to a particular storage mode the data may not be processed and must be stored in inaccessible areas.

 

The use of purely automated decision-making processes as detailed in Article 22 of the GDPR. If in the future it is decided to establish such processes for individual cases, the data subject will be notified separately if this is required by law or updated in this policy.

It should be noted that, in relation to the purpose 3.4, letter a), partially automated decision-making processes are adopted that do not fall within the scope of Article 22 GDPR: anti-fraud controls related to e-commerce involve the use of systems that report any suspicious activities of users when they make purchase orders. These alerts have a support function and do not involve automatic blocking of users, but are instrumental to assessments and decisions made independently by the Data Controllers.

It should be noted also That in relation to purpose 3.5 lett. b), subject to the consent of the person concerned, are adopted automated decision-making processes that fall outside the scope of Article 22 of the GDPR, as effettuati With exclusive reference to advertising or promotional (marketing) activities.

Personal data will be processed in paper, computerized and telematic form and entered in the relevant databases that can be accessed, and thus come to the knowledge of, the expressly designated employees from individual co-owners as Data Processors and Authorized Persons in charge of the processing of personal data, who may carry out consultation, use, processing, comparison and any other appropriate operation, including automated operations, in compliance with the provisions of the law necessary to ensure, among other things, the confidentiality and security of the data as well as the accuracy, updating and relevance of the data to the stated purposes.