APP PRIVACY POLICY

INFORMATION PURSUANT TO ART. 13 OF REGULATION EU N. 2016/679

B810 S.r.l., (Fiscal code and VAT n.: 03378920361) (hereinafter “B810”), in person of its pro tempore legal representative, with registered office in Reggio Emilia, via E. Lazzaretti, 2/1, DIGICOM S.r.l., (Fiscal code and VAT n.: 03488160122) (hereinafter “DIGICOM”), in person of its pro tempore legal representative, with registered office in Legnano (MI), viale Cadorna, 95, and MC REGEM S.r.l., (Fiscal code and VAT n.: 02891380350) (hereinafter “MC REGEM”), in person of its pro tempore legal representative, with registered office in Reggio Emilia, via G. Gutenberg, 3, as Joint Controllers pursuant to art. 26 of Regulation EU n. 2016/679 (GDPR) (as well as being part of same “B810 business group” pursuant to art. 4 n. 19) of GDPR, where B810 holds status of parent company) inform you that, pursuant to art. 13 of GDPR, your personal data described in following art. 1 will be processed, by Joint Controllers, for execution of purposes referred in following art. 3.

  1. Category of personal data processed.

1.1. Joint Controllers will process your personal data pursuant to art. 4 n. 1) of GDPR, including location data pursuant to art. 2 letter c) of Directive n. 2002/58/CE, amended by Directive n. 2009/136/CE (E-Privacy Directive).

 

  1. Information on Joint Controllers and on appointed Data Protection Officer (DPO).

2.1. Joint Controllers are B810, DIGICOM and MC REGEM, who can be contacted at following addresses: info@b810group.it, privacy@digicom.it and mcregem@legalmail.it

2.2. B810 and DIGICOM have appointed, as Data Protection Officer of cd. group pursuant to art. 37 of GDPR, Studio Baldi & Partners of Reggio Emilia, which can be contacted at following addresses: privacydpob810@baldiandpartners.it and privacydpodigicom@baldiandpartners.it

  1. Purpose and legal basis of processing.

3.1. In compliance with art. 6 paragraph 1 letter b) and with Recital n. 44) of GDPR and art. 16 of EU Charter of Fundamental Rights and in force of provisions contained within some soft law acts, such as Opinions n. 2/2013 and 8/2014 of WP Art. 29 and Guidelines n. 2/2019 of EDPB, your personal data will be processed, by Joint Controllers, for execution of following purposes:

  1. Effective and complete use of bluetooth anti-abandonment device “PREEMIO” (so-called wearable computing) and interconnected (and homonymous) mobile software application (“App”), including any available functionality (e.g. sound alarm or via sms; geolocation).

In this regard, Joint Controllers specify that, in compliance with art. 2 quinques of new Legislative Decree n. 196/2003 (Privacy Code), registration on App is allowed only to person over 14 age or, failing that, to holder of parental responsibility of relative underage.

Joint Controllers specify also that, in compliance with art. 13 paragraph 2 letter e) of GDPR, any failure to communicate your personal data for execution of processing purposes referred in previous art. 3.1. letter a) will determine the impossibility of a correct and complete activation of App and consequent use of services available by “PREEMIO” device and by App.

3.2. In compliance with art. 6 paragraph 1 letter f) and with Recital n. 47) of GDPR and in compliance with art. 130 paragraph 4 of Privacy Code, your personal data will be processed, by Joint Controllers, for execution of following purpose:

  1. Direct marketing activities (soft spam), to carry out via e-mail.

3.3. In compliance with art. 6 paragraph 1 letter f) of GDPR and in force of provisions contained within soft law acts, such as Opinion n. 6/2014 and Guidelines n. 251/2018 of WP Art. 29, your personal data will be processed by Joint Controllers for execution of following purpose:

  1. Profiling pursuant to art. 4 n. 4) of GDPR, not based solely on automated processing, aimed to determinate and establish categories/classifications (so-called cluster) based on personal information provided directly or indirectly (data provided and data observed) or aimed to know preferences and characteristics “PREEMIO”’s customers in order to personalize the offer of products and/or services suitable to better meet needs and desires.

3.4. In compliance with art. 6 paragraph 1 letter a) of GDPR, your personal data will be processed by Joint Controllers for execution of following purposes:

  1. Marketing activities (e.g. commercial/advertising communication; market research), to carry out with traditional and/or automated means;
  2. Acquisition by third party companies (to the “B810 business group”).

In compliance with art. 13 paragraph 2 letter c) of GDPR, Joint Controllers inform you of your right to withdraw, at any time, any consent given for one or both of purposes described in art. 3.4., without this event being able, however, to prejudice lawfulness of processing based on consent provided prior to revocation.

  1. Communication and diffusion.

4.1. In compliance with art. 13 paragraph 1 letter e) of GDPR, Joint Controllers inform you that your personal data may be communicated in favour of third parties (e.g. marketing, advertising, analysis, IT, cloud computing companies) for correct execution of processing described in previous articles from 3.1. to 3.4.

Conversely, Joint Controllers inform you that your personal data will not be disseminated, with possible exception of execution of processing referred in letter d) of previous art. 3.4.

  1. Retention period.

5.1. In compliance with art. 13 paragraph 2 letter a) of GDPR, Joint Controllers inform you that: i) the retention period of your personal data, processed for execution of purposes referred in art. 3.1. letter a), will coincide with a term not exceeding the pursuit of underlying purposes (identifiable, approximately, until user unequivocally communicates to Joint Controllers that he/she no longer wishes to use “PREEMIO” device and connected App), possibly extendable in order to comply with regulatory and/or judicial requirements; ii) the retention period of your personal data, processed for execution of purposes referred in articles 3.2. letter b) and 3.3. letter c), will last until you decide to communicate the opposition pursuant to art. 21 of GDPR to one or both aforementioned processing purposes; iii) the retention period of your personal data, processed for execution of purposes referred in art. 3.4. letters d) and e), will last until you decide to communicate the revocation pursuant to art. 17 of GDPR to one or more consents that may have been previously given, without, as mentioned above, such event affecting lawfulness of processing based on consent previously provided.

  1. Processing methods.

6.1. The processing, by Joint Controllers, of your personal data will carry out, primarily, through electronic/IT tools and, only alternatively, by traditional tools.

  1. Transfer outside EU.

7.1. Your personal data will be stored through use of a public cloud computing service (whose relative provider has been fully appointed, by Joint Controllers, as Processor pursuant to art. 28 of GDPR), suitable to transfer such information, through one or more appointed sub-Processor pursuant to art. 28 paragraph 4 of GDPR, in one or more extra EU countries (in particular, USA): in this regard, Joint Controllers specify that the appropriate guarantee for any such transfer is found in art. 46 paragraph 2 letter c) of GDPR.

  1. Data subject’s rights.

8.1. In relation to your personal data, Joint Controller inform you that you have faculty to exercise rights provided in articles from 15 to 22 and from 77 to 79 of GDPR.

8.2. In compliance with art. 12 paragraph 1 of GDPR, Joint Controllers undertake to provide you with communications referred in articles from 15 to 22 and 34 of GDPR in a concise, transparent, intelligible, easily accessible form and in simple and clear language: such information will be provided in writing or by other possibly electronic means or, at the request of data subject, will be provided orally, as long as the identity of data subject is proven by other means

8.3. In compliance with art. 12 paragraph 3 of GDPR, Joint Controllers inform you that undertake to provide you with information relating to action taken regarding a request pursuant to articles from 15 to 22 of GDPR without undue delay and, in any case, at latest within 1 month of receipt of the request (however, this deadline can be extended by 2 months if necessary, and taking into account the complexity and number of requests received).

8.4. In order to exercise the rights described above (with exception of those provided by articles from 77 to 79 of GDPR), Joint Controllers inform you that you can use contact details specified in previous art. 2.

Reggio Emilia/Legnano, 12.11.2020.

B810 S.r.l., DIGICOM S.r.l. and MC REGEM S.r.l.

(in person of their respective pro tempore legal representatives)