Marketing Data Privacy Information

  1. JOINT DATA CONTROLLERS

PINALLI srl Unipersonale

Registered office: Via Giovanni Boccaccio, 39 - 20123 Milan (MI)

VAT No. / Fiscal Code / Business Reg. 08836820962 Share Cap. €2,400,000.00 fully paid in E.A.B.R. MI 2052155

Administrative/Operational Headquarters: Via Gandhi, 7 - 29017 Fiorenzuola d'Arda (PC)

PINALLI Natural Touch srl

Registered office: Via Indipendenza, 170 - 20821 Meda (MI)

VAT Number / Tax Code / Business Reg. 10782080963 Share Cap. € 10,000.00 fully paid in E.A.B.R. MB 2556966

Administrative/Operational Headquarters: Via Gandhi, 7 - 29017 Fiorenzuola d'Arda (PC)

PINALLI & Wellness srl

Registered office: Via Pertusio, 7 - 26100 Cremona (CR)

VAT No. / Tax Code / Business Reg. 01660470194 Share Cap. € 10,000.00 fully paid in E.A.B.R. CR 191349

Administrative/Operational Headquarters: Via Gandhi, 7 - 29017 Fiorenzuola d'Arda (PC)

PINALLI Dimensione Bellezza srl

Registered office: Via Indipendenza, 170 - 20821 Meda (MI)

VAT Number / Tax Code / Business Reg. 10785570960 Share Cap. € 10,000.00 fully paid in E.A.B.R. MB 2557784

Administrative/Operational Headquarters: Via Gandhi, 7 - 29017 Fiorenzuola d'Arda (PC)

PINALLI Beauty Experience srl

Registered office: Via Luigi Carlo Farini, 11 - 40124 Bologna (BO)

VAT No. / Tax Code / Business Reg. 03822291203 Share Cap. € 10,000.00 fully paid in E.A.B.R. BO 548922

Administrative/Operational Headquarters: Via Gandhi, 7 - 29017 Fiorenzuola d'Arda (PC)

 

The Data Controllers have entered into a joint data controller agreement, pursuant to Article 26 of EU Reg. 2016/679, whereby they have undertaken to:  ∙ Jointly determine the purposes and methods of processing the Personal Data of the data subjects, as indicated in point 2 below; ∙ Jointly determine, in a clear and transparent manner, the procedures to provide you with timely feedback should you wish to exercise your rights, as provided for in Articles 15 and following of EU Reg. 2016/679: to exercise such rights, consult the relevant point; ∙ to jointly create the present information notice in accordance with EU Reg. 2016/679.

Pursuant to Article 13 of EU Regulation 2016/679, the following information is provided: 

 

  1. PROCESSING MODALITIES

The processing of personal data will consist of the operations provided for in art. 4 par. 2 of the GDPR, namely: collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, deletion and destruction of data. The processing may take place in paper and/or digital form.

 

  1. PERSONAL DATA PROCESSED

Personal identification data. Contact data. Data relating to the details of purchases of products and/or services offered by all/some of the joint data controllers.

  1. PURPOSES OF PROCESSING

 

4.1      PURPOSE OF PROCESSING 

LEGAL BASIS OF PROCESSING

DATA RETENTION PERIOD

Purchase of goods or services online and/or at merchants through registration at www.pinalli.it or membership in the merchants’ stores; membership of any loyalty programs and/or data registration on the website of companies. Activation of any exclusive services solicited (gift card, order tracking, wishlist, etc.). Participation in competitions, online or on-site events, prize operations, loyalty programs, online and social initiatives. Management of reporting activities and complaints, customer care

Performance of a contract to which you are a party

Contractual term understood as the period after the last purchase, for the ordinary limitation period of 10 years.

Fulfilling obligations under applicable national and supranational regulations and legislation.

Need to fulfill legal obligations

Duration foreseen by law (10 years for administrative-accounting obligations)

If necessary, to ascertain, exercise or defend the rights of the Controllers in judicial proceedings

Legitimate interest (judicial protection)

In the event of legal proceedings, for the entire duration of the same, until the time limits for appeals have been exhausted.

Personal and contact details are required for the establishment of contractual relations.

 

4.2       PURPOSE OF PROCESSING 

LEGAL BASIS OF PROCESSING

DATA RETENTION PERIOD

Direct marketing purposes: by way of example, the sending - by automated contact methods (such as SMS, MMS, WhatsApp, e-mail, social media, instant messaging apps, push notifications) and traditional methods (such as telephone calls with an operator and traditional mail) - of promotional and commercial communications relating to the services/products offered by the companies or notification of company events, as well as the detection of the degree of customer satisfaction, market research and statistical analysis.

Consent (optional and revocable at any time).

Personal data and contact details: until consent is revoked. Data relating to the details of purchases: 10 years from the collection of each piece of data

 

4.3      PURPOSE OF PROCESSING

LEGAL BASIS OF PROCESSING

DATA RETENTION PERIOD

Profiling purposes: analysis of your preferences, habits, behaviors, interests in order to send you personalized commercial communications/targeted promotional initiatives/offers and services tailored to your needs/preferences.

Consent (optional and revocable at any time).

Personal data and contact details: until consent is revoked. Data relating to the details of purchases: 10 years from the collection of each piece of data

 

Once the above retention periods have expired, the Data will be destroyed, erased or made anonymous.

 
  1. DATA RECIPIENTS

The data of the data subject may be communicated to the subjects foreseen by the contractual regulations and the subjects required by the applicable laws. The data may be processed by external parties operating as autonomous controllers, such as, for example, authorities and supervisory and control bodies.

All subjects offering electronic payment services through their own circuits are also autonomous data controllers.

The data may also be processed, on behalf of the Companies, by external parties designated as data processors, who are given appropriate operating instructions. These subjects are essentially included in the following categories:

a. companies that offer e-mail delivery services;

b. companies that offer services instrumental to the pursuit of the purposes indicated in this notice (media agencies, IT suppliers, shippers, etc.);

c. companies that provide support in conducting market research.

 

  1. SUBJECTS AUTHORIZED FOR PROCESSING

The data may be processed by the employees of the company divisions assigned to the pursuit of the purposes indicated above, who have been expressly authorized to process the data and who have received adequate operating instructions, and by the external parties indicated above.

   
  1. TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE THE EUROPEAN UNION

In view of the global nature of the Companies' activities, data may be transferred abroad to countries inside and outside the European Union, to subjects who, depending on the case, will operate as autonomous controllers or data processors. It is understood, in any case, that the transfer of personal data to countries outside the European Union will be carried out in accordance with the measures established by the applicable legislation, ensuring an adequate level of protection for the data subjects.

 

  1. RIGHTS OF THE DATA SUBJECT - COMPLAINTS TO THE SUPERVISORY AUTHORITY

The data subject may exercise his/her rights and contact the Joint Data Controllers by sending an email to: privacy@pinalli.it.

The data subjects may request access to the data pertaining to them, its deletion, the rectification of inaccurate data, the updating of incomplete data, the limitation of processing in the cases provided for by art. 18 of the GDPR, as well as opposition to processing in the case of a legitimate interest of the controller.

Moreover, in the event that the processing is based on consent or contract and is carried out by automated means, the data subjects have the right to receive the data in a structured, commonly used and machine-readable format, as well as, if technically feasible, to transmit it to another data controller without hindrance.

The data subjects have the right to revoke the consent given at any time for marketing and/or profiling purposes, as well as to oppose the processing of data for marketing purposes, including profiling related to direct marketing. It remains possible for a data subject who prefers to be contacted for the above-mentioned purposes exclusively through traditional methods to express their opposition exclusively against receiving communications through automated methods. Data subjects have the right to lodge a complaint with the competent supervisory authority of the Member State in which they usually reside or work or of the state in which the alleged breach occurred. Data subjects may request the essential content of the agreement between the joint controllers.

 

  1. DATA PROTECTION OFFICER (DPO)

email address dpo@pinalli.it