Loyalty Privacy Policy
INFORMATION ON THE PROCESSING OF PERSONAL DATA
FABIANI GROUP SPA with registered office in VIA COLLATINA 858 ROME, tax code and VAT number 01611280478, as Data Controller, provides information on the processing of personal data pursuant to art. 13 EU Regulation no. 2016/679 – GDPR.
1. Type of data processed
The Controller processes personal data, referred to as “identifying” data - for example: name, surname, date of birth, tax code, address, telephone, e-mail - provided by you.
2. Legal Basis and Purpose of processing
The "identifying" personal data are processed without your express consent to allow the execution of the contract concerning our goods and/or services and related activities (registration, billing, customer assistance, etc.), including fulfilling legal obligations and requests from Authorities.
The provision of identifying personal data is mandatory and essential, and in its absence, we will not be able to guarantee the service contractually requested.
The Controller may process "identifying" data, with your express and specific consent, for registration to the loyalty program, through the sending of newsletters, commercial communications and/or advertising material via email, SMS, push notifications (on App), WhatsApp concerning products or services offered by the Controller, as well as for accumulating points on the fidelity card and for any instant win or draw competitions dedicated exclusively to Fidelity Card holders. These data, with your consent, will be processed for direct profiling purposes aimed at analyzing consumption habits and choices in order to improve the commercial offer and proposed services.
Consent can be revoked at any time by communicating this will to the Data Controller, using the contacts referred to in the following art. 7.
The processing carried out prior to such revocation remains valid and lawful.
3. Processing Methods and Retention Period
Processing is carried out using electronic and manual systems according to the principles of fairness, lawfulness and transparency required by law through technical and organizational security measures to ensure an adequate level of security. No automated decision-making processes are used.
The processing of personal data is carried out by means of the operations indicated in art. 4 no. 2) GDPR and specifically: collection, recording, organization, storage, consultation, processing, extraction, communication, erasure and destruction.
The Controller will retain personal data for the time necessary to fulfill contractual purposes not subject to consent and in any case for a period of 10 years from the conclusion of the contract, according to the terms determined by current regulations. Personal data relating to the loyalty program will be retained for the entire duration of participation; subsequently, they will be retained for the prescription period provided by law to eventually assert or defend a right in court. Data collected for marketing purposes will be anonymized after 24 months from registration; data collected for profiling purposes will be anonymized after 12 months from registration. Data collected for any prize competitions will be retained for the duration of the operation and in any case for no more than 24 months.
4. Data Access
Personal data may be made accessible for the purposes referred to in art. 2:
- to employees and collaborators of the Controller, in their capacity as persons authorized to process data;
- to third-party companies or other subjects - for example: subjects who provide services for the management of the IT system; professionals in the context of assistance and consulting relationships; private subjects directly involved in the fulfillment of the service or authorized to know the data according to the law, in their capacity as external Data Processors.
5. Data Communication
The collected data will not be disseminated; without the need for express consent - art. 6 letters b) and c) GDPR - the Controller may communicate personal data, for the purposes referred to in art. 2 to: Inspection Bodies, Judicial Authorities, as well as to those subjects to whom communication is mandatory by law and/or for the execution of the mandate. These subjects will process the data in their capacity as independent Data Controllers.
6. Data Transfer
Personal data are stored in paper archives located at the Company's headquarters and on servers located within the European Union.
It is in any case understood that the Controller, where necessary, will have the right to move the servers also outside the EU. In this case, the Controller hereby ensures that the transfer of data outside the EU will take place in accordance with the applicable legal provisions, after signing the standard contractual clauses provided by the European Commission, as well as verifying the eventual presence of adequacy decisions.
7. Rights of the data subject
In relation to the processing of personal data, you have the following rights:
-to obtain, from the Controller or the Processor, without delay:
1) confirmation of the existence of processing of your personal data and their communication in an intelligible form;
2) the erasure of your personal data, when: I) they are no longer necessary for the purposes for which they were collected, II) consent has been revoked and there is no other legal basis for processing, III) the data have been processed in violation of the law, IV) the data subject has objected to the processing and there is no prevailing legitimate reason to proceed with the processing V) the controller is subject to the legal obligation to erase personal data;
3) the updating, rectification or, if interested, the integration of the data;
4) certification that the operations referred to in numbers 2) and 3) have been brought to the attention, also as regards their content, of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment proves impossible or involves a manifestly disproportionate use of means compared to the protected right;
- to object, for reasons related to your particular situation, to the processing of personal data concerning you, pursuant to art. 6, paragraph 1, letters e) or f);
- to object to the processing of personal data concerning you, for direct marketing purposes;
- to lodge a complaint with a supervisory authority;
- to receive the personal data concerning you in a structured, commonly used and machine-readable format and to transmit those data to another Data Controller without hindrance from the Controller to whom you originally provided them. In exercising your rights regarding data portability, the data subject has the right to obtain the direct transmission of personal data from one Controller to another, if technically feasible;
- not to be subjected to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.
- to withdraw consent at any time without affecting the lawfulness of processing based on consent given before its withdrawal.
The Controller provides a copy of the personal data undergoing processing; in case of further copies requested by the data subject, the Controller may charge a reasonable fee based on administrative costs.
8. Methods for exercising rights
You may at any time exercise the above rights by sending to the attention of the Data Controller
- an e-mail to: fabianigroupsrl@pec.it
or alternatively to the Data Protection Officer (DPO)
- an e-mail to: l.cianidpo@gmail.com
9. Controller and Processor
The Data Controller is FABIANI GROUP SPA VIA COLLATINA 858 ROME
The Data Processor is Lorenzo Ciani, contact: l.cianidpo@gmail.com
The updated list of Processors and persons authorized to process data is kept at the Data Controller's headquarters.