Information on Data Protection for Users

Triboo Digitale S.r.l., with registered office at Viale Sarca 336, Edificio [Building] 10, 25124 Milan, Italy, VAT no. / Tax Code and Milan Companies Register no. IT02387250307 (hereinafter also “Triboo”) and “Serapian Srl”, with registered office at via Benigno Crespi 26, 20159 Milan, (hereinafter also the “Partner” and, together with Triboo, the “Data Controllers”), in their capacity as joint Data Controllers for the processing of the personal data of the users (hereinafter the “Users”), who browse and make use of the services available on the Serapian website (hereinafter the “Website” and the “Services”), hereby issue this information under art. 13 of Regulation (EU) 679/2016 of 27 April 2016 (hereinafter the “Regulation” or also the “Data Protection Law”).

This Website and Services are reserved to individuals who are eighteen years of age and over. The Data Controllers do not collect personal data relating to persons under eighteen years of age. At the request of the Users, the Data Controllers shall promptly erase all personal data involuntarily collected and concerning persons under eighteen years of age.

The Data Controllers are committed to ensuring the right to privacy and protection of personal data of its Users. For any further information related to this privacy notice, Users may contact the Data Controller at any time, using the following methods:

For Triboo:

By sending a registered letter with proof of receipt to the registered office of the Data Controller (viale Sarca 336, Edificio 16, 20126 Milan);
By sending an e-mail to the address triboospa@legalmail.it
By sending a fax to the number 02/64741491

For the Partner:

By sending a registered letter with proof of receipt to the registered office of the Data Controller: Stefano Serapian S.r.l, via Benigno Crespi 26, 20159 Milan
By sending an e-mail to the address stefanoserapian@legalmail.it
By sending a fax to the number 02/280121

Users can also contact

the Data Protection Officer (DPO) designated by Triboo, at the following address: curinigalletti@triboo.it
the Data Protection Officer (DPO) designated by the Partner at the following address: name of partner’s officer, address, telephone number, e-mail

1. Purpose of Processing

Triboo shall lawfully process Users’ personal data pursuant to art. 6 of the Regulation for the following purposes:

contractual obligations and provision of the Services, to allow Users to browse the Website or to implement the Website Conditions of Use, which the User duly accepts when registering on the Website and/or when using the Services and to fulfil specific User requests. The User data collected by Triboo for the aforementioned purposes include: forename, surname, e-mail address and any personal information regarding the User that may be voluntarily published. Unless the User voluntarily chooses to grant Triboo consent to specifically process their data for other purposes, Triboo shall use the User's personal data for the sole purpose of ascertaining the User's identity (also by validating their e-mail address), hence avoiding possible scams or abusive conduct, and for the purpose of contacting the User for service reasons only (e.g. sending notifications concerning the Services). Notwithstanding the provisions specified elsewhere in this privacy notice, under no circumstances shall Triboo allow Users and/or third parties to access other Users’ personal data.
Administrative/accounting purposes, or to carry out activities of an organisational, administrative, financial and accounting nature, such as internal organisational activities and functional activities required to fulfil contractual and pre-contractual obligations;
legal obligations,e. to comply with obligations imposed by a law, authority, regulation or Community legislation;

The provision of personal data for the processing purposes indicated above is optional but necessary, as failure to provide them will make it impossible for the User to browse the Website, register on the Website and use its Services.

The personal data that are necessary to pursue the processing purposes described in paragraph 1 herein are indicated with an asterisk on the Website registration form.

2. Other purposes of processing: marketing (sending advertising material, direct sales and commercial communication)

If the User freely chooses to provide their consent, the Partner may also process some of their personal data (i.e. forename, surname, address, e-mail or telephone number) for marketing purposes (sending advertising material, direct sales and commercial communication), i.e. so that the Partner can contact the User by e-mail, telephone (landline and/or mobile, by way of automated calls or call communication systems with and/or without the involvement of an operator) and/or SMS and/or MMS, in order to propose their products and/or services to the User and/or those of third parties, as well as in order to present offers, promotions and sales opportunities.

Failure to grant consent shall not in any way prevent the User from registering on the Website.

If the User gives their consent, they may choose to withdraw it at any time, submitting a request to the Partner as indicated in paragraph 6 below.

The User can also easily object to receiving further promotional e-mail communications by clicking on the link for withdrawing consent provided in each e-mail communication. After withdrawing consent, the User shall receive an e-mail from the Partner confirming that their consent has been withdrawn. If the User intends to withdraw their consent to receiving promotional communications by telephone, but they wish to continue receiving promotional communications via e-mail, or vice versa, they should send a request to the Data Controller in the manner indicated in paragraph 6 below.

The Partner hereby declares that, after the right to withdraw consent has been exercised with regard to promotional communications being sent via e-mail, it is possible that, for technical and operational reasons (e.g. if contact lists have been drawn up shortly before the Partner receives the withdrawal request), the User will continue to receive some further promotional messages. Should the User continue to receive promotional messages 24 hours after consent was withdrawn, this problem should be reported to the Partner using the contact information indicated in paragraph 6 below.

3. Other purposes of processing: newsletter

If the User freely chooses to provide their consent, the Partner may process some of their personal data (i.e. forename, surname, address, e-mail address) for the purposes of sending out newsletters. Therefore, the User will receive a periodic newsletter from the Partner that will contain information on news and promotions on the Website and/or initiatives organised by the Partner.

Failure to grant consent shall not in any way prevent the User from registering on the Website.

If the User gives their consent, they may choose to withdraw it at any time, submitting a request to the Data Controller as indicated in paragraph 6 below.

The User can also easily object to receiving further promotional material by clicking on the link for withdrawing consent provided in each e-mail newsletter. After withdrawing consent, the User shall receive an e-mail from the Partner confirming that their consent has been withdrawn.

4. Data processing procedures and retention times

The Data Controllers shall process Users’ personal data using manual and electronic instruments, with logic that is strictly related to the aforementioned purposes, in a way which guarantees that these data are kept secure and confidential.

Users’ personal data shall be retained for the time strictly necessary to carry out the primary purposes described in paragraph 1 above, or however long is necessary for the interests of both the Users and Triboo to be protected in civil law.

In the cases referred to in paragraphs 2 and 3 above, Users’ personal data shall be retained for the time strictly necessary to carry out the purposes described therein and, in any case, for no more than twenty-four (24) months^[1].

5. Disclosure and dissemination of data

Users’ personal data may be disclosed to employees and/or collaborators of the Data Controllers who are in charge of managing the Website and all aspects of Service provision. These parties, who have received due information from the Data Controllers as per art. 29 of the Regulation, shall exclusively process Users’ data for the purposes indicated in this privacy notice and in compliance with the provisions of Data Protection Law.

Users’ personal data may also be disclosed to third parties, who may process these personal data on behalf of the Data Controllers as “External Data Processors”. These may be, for example, IT and logistic service providers who play a role in the operations of the Website and/or the Services, outsourcing or cloud computing service providers, professionals and consultants.

Users have the right to obtain a list of any data processors appointed by each Data Controller, and may do so by submitting a request to the relevant Data Controller as indicated in paragraph 6 below.

Furthermore, Triboo may disclose Users' personal data, to the extent that this is necessary and essential in order to execute contractual obligations, to third parties who are independent data controllers, such as providers of the payment and logistics services required for the goods sold through the Website to be delivered. These independent Data Controllers shall exclusively process Users’ data for the purpose of correctly processing orders relating to the Services.

6. Rights of Data Subjects

Users may exercise their rights granted by the applicable Regulations by contacting the Data Controllers in the following ways:

By sending a registered letter with proof of receipt to the registered office of the Data Controllers

for Triboo: Viale Sarca 336 Edificio 16, 20126 Milan

for the Partner: Stefano Serapian S.r.l, via Benigno Crespi 26, 20159 Milan

By sending an e-mail to the addresses below:

for Triboo: triboospa@legalmail.it

for the Partner: stefanoserapian@legalmail.it

By sending a fax to the numbers below:

for Triboo: 02/64741491

for the Partner: 02/280121

Triboo shall comply with requests made by Users regarding the processing referred to in paragraph 1, while the Partner shall comply with requests made by Users relating to the processing referred to in paragraph 2.

In accordance with Data Protection Law, the Data Controller hereby declares that Users are entitled to obtain information on (i) the origin of personal data; (ii) the purpose of processing and the methods used; (iii) the logic used if data are processed using electronic equipment; (iv) the personal data of the Data Controller and data processors; (v) the persons in charge and the parties or categories of parties to whom personal data may be disclosed or who may become aware of such data.

Users are always entitled to request:

a) access to their data, and that their data be updated, rectified or, where applicable, supplemented;
b) that any data processed unlawfully, including data which do not need to be kept for the purposes for which they were collected or data which do not need to be processed further, be erased, anonymised or blocked;
c) certification, to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a hugely disproportionate effort compared to the right that is to be protected.

Furthermore, Users have:

a) the right to withdraw consent at any time, if processing is based on their consent;
b) (where applicable) the right to data portability (right to receive all personal data concerning them in a format which is structured, commonly used and can be read by automatic devices), the right to request restriction of personal data processing and the right to be forgotten);
c) the right to object:
i) partially or completely, for legitimate reasons, to the processing of personal data, despite it being relevant to the purpose for which data were collected;
ii) partially or completely, to the processing of personal data for the purposes of distributing advertising materials, direct sales, market research or business communication;

iii) where personal data are processed for direct marketing purposes, the data subject shall have the right to object, at any time, to their personal data being processed for this kind of marketing, including profiling to the extent that it is related to direct marketing.

d) if they believe that their personal data are being processed in such a way that violates the Regulation, the right to lodge a complaint with a Supervisory Authority (in the Member State in which they usually reside, work or in which the alleged violation occurred). The Italian Supervisory Authority is the Data Protection Supervisor, with headquarters in Piazza Venezia n. 11, 00187 - Rome (http:www.garanteprivacy.it/).

^[1]As required by the general provisions of the Data Protection Supervisor called the “Fidelity card” and guarantees for consumers. The Data Protection Supervisor’s regulations for the loyalty programmes dated 24 February 2005.