Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and the national legislation in force in Italy (D.Lgs.196/03)
1 General information
Pettenon Cosmetics S.p.A. SB (hereinafter also referred to as “Company” or “Pettenon”) informs you that (indicating you hereinafter also as “User”), for the purposes indicated below, it will process your personal data (or of the company it represents if it acts on its behalf) provided by you. Only the data necessary for the pursuit of the purposes indicated in this statement will be requested and processed. Please note that you must indicate only your data and / or data of the company you represent. If you act on behalf of a company, the activities envisaged in this statement will be carried out towards the company using the data communicated by you and therefore consenting to the processing (where consent is required) on behalf of the company you represent.
2 Purpose and legal basis
The data will be processed by the Company:
- in order to allow registration to the “My account” as per the registration conditions shown on the registration page and take advantage of the related benefits. Please note that by registering you are aware that Pettenon, in the event that the User purchases products on the site from Sinergia s.r.l (the company that sells Pettenon products on the site), may have within its area the data relating to such purchases (for example data relating to purchases, shipping data, order management data) and that in case of modification of the data in the private area, the same may be communicated by Sinergia s.r.l. in case of future purchases without having to retype them. The legal basis of the processing is the need for the execution of contractual obligations.
- so that the Company can carry out commercial communications (such as advertising and / or information) on its products / services / initiatives, all by the Company to the e-mail address indicated by you in the form or to other contact details provided also later including telephone and postal address (please note that the sending of e-mails and SMS / MMS can also take place electronically with the aid of automated tools); the processing has consent as its legal basis;
We inform you that you can also communicate that you want to be subject to the activities only through e-mail or only through telephone or postal communications, by writing to privacy@pettenon.it.
- so that the Company can carry out marketing and direct sales activities, in order to be able to offer you dedicated discounts, through the e-mail address indicated by you in the form; the processing has consent as its legal basis;
- so that the Company can create, based on the information relating to the User in possession of the same, a profile of the User (profiling) including the study on habits and consumption choices deriving also for example from the analysis of product choices, purchasing behavior, browsing habits of the sites, interactions with the Pettenon world, aimed at sending the communications indicated in point 2 B, in accordance with the specific needs of the user emerged from the profiling and aimed, moreover, to analyze the choices and consumption habits of customers of Pettenon products. The processing for this purpose will also take place in databases in automated form. Both a profile of the individual user and homogeneous classes of users can be created. The data relating to purchases can also be found for this purpose, also at Sinergia s.r.l. See also point 9 of the information. The legal basis of the processing is consent;
- to fulfill an obligation established by law, by a regulation or by community legislation; the legal basis is the fulfillment of legal obligations;
- for legitimate interests such as asserting or defending Pettenon’s rights; The legal basis is the pursuit of legitimate interests. In considering these legitimate interests, it was analyzed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the interested party (the legitimate interest was assessed on the basis of a Triple Test available by contacting the Company).
3 Mandatory provision
PURPOSE OF POINT 2 lit, A
The communication of data to Pettenon by you/the company you represent is necessary to register on “My account” and without the communication of data you will therefore not be able to register. You can at any time request the cancellation of the account.
PURPOSE OF POINT 2 letter B
You will be free or not to communicate your personal data to us / of the company you represent for the purposes referred to in point 2 (B) of the information as well as you will be free to give consent or not and failure to provide and consent will therefore not entail any consequence other than that of not being subject to the activities referred to in point by Pettenon (there is therefore no consequence on the other purposes) or not to be subject to the activities themselves to the addresses that you will not wish to communicate. Furthermore, if you consent to the processing for the purposes referred to in point 2 (B) of this statement, please note that you can always revoke freely and without any reason the consent given (and therefore oppose the activities in question) by contacting the Company as well as you can communicate that you do not want to receive communications at certain addresses.
PURPOSE OF POINT 2 letter C
You will be free or not to communicate your personal data / that of the company you represent for the purposes referred to in point 2 (C) of the information as well as you will be free to give consent or not and failure to provide and consent will therefore not entail any consequence other than that of not being subject to the activities referred to in point by Pettenon (as there is therefore no consequence on the other purposes). Furthermore, if you consent to the processing for the purposes referred to in point 2 (C) of this statement, please note that you can always revoke freely and without any reason the consent given (and therefore oppose the activities in question) by contacting the Company.
PURPOSE OF POINT 2 letter D
You will be free or not to communicate your personal data / of the company you represent for the purposes referred to in point 2 (C) of the information as well as you will be free to give consent or not and failure to provide and consent will therefore not entail any consequence other than that of not being subject to the activities referred to in point by Pettenon (as there is therefore no consequence on the other purposes) Please note that you can always revoke freely and without any reason the consent given (and therefore oppose the activities in question) by contacting the Company. The processing is based on the following legal basis: consent;
PURPOSE OF POINT 2 letters E and F
Communicating the data to Pettenon for the purposes indicated in point 2 (D) 2 (E) of this information is necessary and failure to provide it could make it impossible for Pettenon to carry out the activities referred to in the previous points.
4 Categories of data recipients
For the purposes indicated in point 2 (A) the data will not be disclosed to third parties (without prejudice to the communication to Sinergia s.r.l. in case of updating of the data as specified in point 2 (A).
For the purposes indicated in point 2 (B), the data may be communicated by Pettenon to carriers and shippers and post offices, for the shipment of any advertising material in paper form.
For the purposes indicated in point 2 (C), the data will not be disclosed to third parties by Pettenon.
For the purposes indicated in point 2 (D) of this statement, the data will not be disclosed to third parties.
For the purposes referred to in point 2 (E) of this statement, the data may be communicated by Pettenon to public bodies, judicial bodies and police bodies.
For the purposes referred to in point 2 (F) of this statement, the data may be communicated by Pettenon to lawyers-legal consultants, public bodies, judicial bodies and police bodies and to the post office (being able to see the address for sending any written communications).
Pettenon will communicate only the data necessary for the pursuit of the individual purposes indicated in this statement.
They will then be able to know the data on behalf of Pettenon, each for his role, all the subjects delegated by the Company (public relations officers also external to the Company, information systems employees also external to the Company and who can sometimes perform system administrator tasks and are in this case appointed as such, consultants also external to the Company – such as IT technicians who can sometimes perform system administrator tasks and in this case are appointed as such, legal consultants-interns, employees in charge of managing the website also external to the Company, marketing employees also external to the Company, legal practice staff, collaborators of data processors) and data processors appointed by Pettenon (e.g. marketing consulting companies, IT outsourcers, companies responsible for sending newsletters or communications). The list of data processors is always available by contacting the company at the addresses indicated in point 6. The Data Processors will process only the data necessary for the performance of the assigned tasks.
5 Data retention
The data will be kept for the entire period necessary to pursue the purposes contained in this statement. The data retention period is as follows:
- for legal obligations, regulations and community legislation, the data may be kept for the periods imposed by these regulatory sources;
- for the purposes referred to in point 2 (A) of this statement, the data may be kept until the request for cancellation from My account without prejudice to conservation for legal obligations;
- for the purposes referred to in point 2 (B), until the withdrawal of consent and / or the request for cancellation without prejudice to the conservation for evidential purposes for the period provided for by law; within 24 months from the release of consent you will in any case be reminded of the right to cancel if you no longer have interest in being subject to the activities indicated in this point;
- for the purposes referred to in point 2 (C), up to 24 months from the date of consent issued; in any case, before this deadline you will be reminded of the right to confirm your consent again;
- for the purposes referred to in point 2 (D) until the withdrawal of consent / request for cancellation or at most for 12 months from their registration, except for the actual transformation into anonymous form that does not allow, even indirectly or by connecting other databases, to identify the interested parties;
- in any case, all data may be kept for a period necessary to assert or defend a right of the Company according to Italian and European regulations.
6 Data Controller and Data Protection Officer
The data controller is: Pettenon Cosmetics S.p.A. SB with registered office in Via del Palù, 7d, 35018 San Martino di Lupari PD, Tel. +39 049 99888 FAX +39 049 9988809, privacy@pettenon.it.
There is a Data Protection Officer of the Company, who can be contacted at the Company’s headquarters in Via del Palù, 7/d, 35018 – San Martino di Lupari (PD), as well as at the e-mail address dpo@pettenon.it
7 Rights
We inform you that the GDPR provides for the possibility for the User to ask the Company (at the addresses indicated above) for access to personal data and the correction of data, the cancellation of the same or the limitation of the processing that concerns him, the portability of data; the user may also have the possibility, always by contacting the company, to oppose the processing of data and to exercise the other rights contained in Chapter 3 section 1 of the GDPR including that of withdrawing consent, where provided: the withdrawal of consent does not affect the lawfulness of the processing based on the consent given before the withdraw.
8 Complaints
If you believe that the processing of data is in violation of the provisions of the GDPR, you have the right to lodge a complaint with the Italian Supervisory Authority (whose references can be found on the website www.garanteprivacy.it), as required by Article 77 of the GDPR, or to take the appropriate judicial offices (Article 79 of the GDPR). In addition, you can also contact the Supervisory Authority of the state in which you habitually reside or work. The list of the Supervisory Authority can be found at the link www.garanteprivacy.it/home/footer/link).
9 Logic used for profiling
The profiling referred to in point 2 (D) takes place by the Company through the analysis, also in an automated manner, of the User’s data and characteristics (for example age, geographical area, gender, adhesion to an event, adhesions to particular initiatives, purchase of certain products, compilation of questionnaires, actions carried out while browsing the Company’s websites if the User has accepted profiling cookies on our websites). A consumption profile is then created that is also included in specific groups (clusters). The profiling has the purposes indicated in point 2 (D); however, this processing does not constitute a particular risk for the User considering the type of basic profiling that does not require data of a particularly delicate nature or that allows the detailed reconstruction of particularly confidential aspects of private life. The User always has the right to obtain human intervention, to express his opinion, to obtain an explanation of the decision reached and to contest the decision.
10 Processing methods
The data will be processed with the aid of IT and paper / manual tools adopting protection systems suitable for the protection of confidentiality. All data will be stored and processed in full compliance with confidentiality in compliance with all current regulations (and therefore also in compliance with the principles of correctness, lawfulness and transparency and protection of confidentiality and rights) and with logic strictly related to the purposes indicated in this statement. Only the operations necessary for the pursuit of the purposes indicated in this statement will be carried out on the data. The data will be stored, with regard to the Company at its headquarters or server farm and as regards the data processors at their offices or server farms. The data communicated to third parties will be stored and processed independently by them. The data will also be organized in databases – databases including computer databases.
Information updated to 20/03/2023. Previous versions of the information can be found by contacting the Company at the addresses referred to in point 6.
