Pursuant to art. 13 of the 2016/679 European Regulation on the protection of personal data (GDPR), we inform you that the personal data you provide or otherwise acquired upon signing the Loyalty Card will be processed in compliance with current legislation and principles of correctness , lawfulness, transparency and protection of confidentiality provided for by it.
HOLDER OF THE TREATMENT
The Data Controller is Cardamomo Srl, based in Lecco, Via F.lli Cairoli 15 / C, in the person of its pro tempore legal representative who, within the scope of its prerogatives, may avail itself of the collaboration of specifically identified managers or agents. The owner can be contacted at the e-mail address firstname.lastname@example.org
The data collected by the Data Controller are those provided by the user (for example, name, surname, gender, date of birth, social security number, document, e-mail, telephone, purchases made).
METHOD OF TREATMENT
The data will be processed with the aid of IT and / or paper tools, according to logic strictly related to the purposes indicated above and in any case adopting procedures and measures suitable to protect their security and confidentiality.
PURPOSE OF THE TREATMENT
The data processing will be aimed at carrying out the activities listed below:
a) issue of the Loyalty Card and management of activities that cannot be exercised anonymously and necessary to allow subscribers to use and recognize discounts and promotions, offer and send rewards, participate in point collections and access to other ancillary services that can be used through the Card;
b) carrying out, with your express written consent, direct marketing activities, such as the sending - also by e-mail, SMS and MMS - of advertising material and communications with informative and / or promotional content in relation to products or services provided and / or promoted by the Owner or by its commercial partners, including free gifts and free samples;
c) carrying out, with your express written consent, individual or aggregate profiling activities and market research aimed, for example, at the analysis of consumption habits and choices, the processing of statistics on the same or the assessment of the degree of satisfaction with respect to the products and services offered.
NATURE OF DATA CONFERENCE
For the purposes referred to in letter a) of the previous point, the provision of data is optional, but it is a necessary and indispensable condition for the issue of the Loyalty Card: failure to provide it therefore makes it impossible for the applicant to obtain the Card itself. For the purposes referred to in letters b) and c) of the previous point, the provision of data is optional and any refusal to provide such data and to give the relative consent makes it impossible for the Data Controller to follow up on the marketing activities direct and profiling indicated therein, but does not affect the possibility for the applicant to obtain the release of the Loyalty Card and to access the benefits connected to it.
SCOPE OF DISCLOSURE OF DATA
Data processing will be carried out by personnel directly employed by the Data Controller and / or by natural or legal persons specifically identified by the latter as data processors or persons in charge of processing. The data provided will in no case be disseminated or communicated to third parties, except for the subjects whose right to access the data is recognized by law or by order of the authorities as well as the subjects, even external and / or foreign, of which the Data Controller uses to carry out instrumental and / or accessory activities for the management of the Loyalty Card and the provision of the services and benefits connected to it, including suppliers of software solutions, web applications and storage services also provided through Cloud Computing systems, all resident in the European Economic Area, and used for this purpose.
PERIODS OF CONSERVATION
The Personal Data will be kept by the Data Controller for a period of six months. The Data Controller may be obliged to keep the customer's Personal Data for a longer period in compliance with a legal obligation or by order of an authority.
At the end of the retention period, the Personal Data and the acquired data of the customer will be deleted. Therefore, at the end of this term the right of access, cancellation, rectification and the right to data portability can no longer be exercised.
RIGHTS OF THE INTERESTED PARTIES
The subjects to whom the personal data refer may at any time exercise their recognized rights towards the Data Controller, pursuant to European Regulation 679/2016 (GDPR) and national legislation. In particular they can:
a) have confirmation of the existence or not of personal data concerning them, even if not yet registered, and have communication in intelligible form;
b) obtain information on the origin of personal data, the purposes and methods of processing; of the logic applied in case of treatment carried out with the aid of electronic instruments; the identity of the owner, manager and the designated representative c) obtain the updating, rectification or integration of the data;
d) obtain the cancellation, transformation into anonymous form or blocking of data processed in violation of the law, including data which need not be kept for the purposes for which the data were collected or subsequently processed;
e) have attestation that the aforementioned operations have been brought to the attention of those to whom the data have been communicated or disseminated, except in the case in which this fulfillment proves impossible or involves the use of means manifestly disproportionate to the protected right;
f) object, in whole or in part, for legitimate reasons, to the processing of personal data concerning them, even if pertinent to the purpose of the collection, and to the processing of personal data concerning them for the purpose of sending advertising or direct sales material or for carrying out market research or commercial communication.
g) receive your data and those entered in the application, in a structured and readable form by a data processor and in a format commonly used by an IT device (data portability);
To exercise these rights, the interested party may directly contact the Data Controller.