APP PRIVACY POLICY

ACT OF INFORMATION PURSUANT TO ART. 13 OF EU REGULATION N. 2016/679

 

B810 S.r.l., (Tax Code and VAT n.: 03378920361) (hereinafter “B810”), in the person of its legal representative pro tempore, with registered office in Reggio Emilia, via E. Lazzaretti, 2/1, and MC REGEM S.r.l., (Tax Code and VAT n.: 02891380350) (hereinafter “MC REGEM”), in the person of its legal representative pro tempore, with registered office in Reggio Emilia, via G. Gutenberg, 3, as co-Processors pursuant to art. 4 n. 7) and 26 of EU Regulation n. 2016/679 (GDPR), inform you, pursuant to art. 13 of the GDPR, that your personal data described in art. 1 will be processed, by the co-Processors, for the execution of the processing purposes described in art. 2.

The text of the relevant co-processing agreement is available to you upon request to the co-Processors, also separately, via the contact details described in art. 7.

  1. Category of personal data being processed.

1.1. The co-Processors collect and process, in order to pursue the specific processing purposes described in art. 2, your personal data pursuant to art. 4 n. 1) of the GDPR, known as identification data (e.g. first name; last name; email address), including data relating to the location pursuant to art. 121 paragraph 1a) letter i) of the Privacy Code, used, in fact, only to fully implement the product and related functions described in art. 2.1. letter a) (hereinafter only “personal data”).

  1. Purposes of processing and related legal basis.

2.1. Your personal data are processed, by the co-Processors, for the following purpose:

  1. Effective and full use of the PREEMIO bluetooth anti-candling device and of the interconnected (and homonymous) app, including any available functionality (e.g. sound or text message alarms; geolocation), as well as performance of any legal/regulatory obligations connected, directly or indirectly, to the use of the device in question and of the connected app.

Pursuant to art. 13, paragraph 2), letter e) of the GDPR, the co-Processors inform you that failure to provide your personal data, which is compulsorily requested, may result in the impossibility of a correct and complete activation of the app, and consequent use of the services and functionalities made available by the PREEMIO device and by the related and connected app.

In this regard, the co-Processors specify to you that the legal basis of the processing purpose referred in art. 2.1. letter a) is found in art. 6 paragraph 1) letters b) and c) of the GDPR.

2.2. Your personal data are processed, by the co-Processors, for the following purposes:

  1. Soft spam activities, to be carried out by electronic mail and/or by so-called traditional methods (e.g. paper mail);
  2. Profiling in accordance with art. 4 n. 4) of the GDPR, not based solely on automated processing, aimed at determining and constituting categories/classifications (clusters) on the basis of personal information provided directly, in order to learn about the preferences and characteristics of PREEMIO product customers and, consequently, to personalise offers or offer products/services that best meet their needs and wishes.

In accordance with art. 13 paragraph 2) letter b) of the GDPR, the co-Processors inform you of the existence of your right to object, at any time, to each (or both) of the processing purposes described in art. 2.2, by using the contact details provided in art. 7.

In this regard, the co-Processors specify that the legal basis of the processing purpose referred in art. 2.2. letter b) is found in art. 6 paragraph 1) letter f) of the GDPR and in Art. 130 paragraph 4) of the Privacy Code, and that, instead, the legal basis of the processing purpose referred in art. 2.2. letter c) is found in art. 6 paragraph 1) letter f) of the GDPR.

2.3. Your personal data are processed, by the co-Processors, for the following purposes, subject to your specific, free, informed, granular and unambiguous consent:

  1. Commercial/promotional/advertising/marketing activities (including market research), to be carried out by automated/electronic/telematic means (e.g. email; website; mobile app; social page; newsletter) or by non-automated/traditional means (e.g. paper mail; conference and/or event; telephone: sms; mms; telefax; informative/advertising material);
  2. Acquisition by third parties, belonging to the product/business category of the co-Processors or who may in any case use the services/products offered by the latter, for commercial/promotional/advertising/marketing activities (including market research), to be carried out using automated or traditional methods or in the form of indirect marketing where the co-Processors, for this purpose, as a vehicle for the promotional/commercial/advertising message concerning the goods/products/services of the third-party assignee.

In accordance with art. 13 paragraph 2) letter c) of the GDPR, the co-Processors inform you of your right to withdraw, at any time, any consent you may have given to each (or both) of the processing purposes described in art. 2.3. by using the contact details in art. 7.

In this regard, the co-Processors specify to you that the legal basis of the processing purposes referred in art. 2.3. letters d) and e) is found in art. 6 paragraph 1) letter a) of the GDPR.

  1. Retention period.

3.1. In accordance with art. 13 paragraph 2) letter a) of the GDPR, the co-Processors inform you of the following retention periods/criteria, after which your personal data will be erased, destroyed or anonymised: (i) for the processing purpose referred in art. 2.1. letter a): a time limit not exceeding the pursuit of the underlying (macro) processing purpose (whose time criterion is, however, identifiable, approximately, until the user communicates, unequivocally, to the co-Processors, also separately, that he/she does not want/can no longer use the PREEMIO device and the related app), which may be extended, if necessary, in order to comply with legal requirements, including those that have arisen or in order to assert or defend a right, including in court; (ii) for the purpose of the processing referred to in art. 2.2 letter b): until opposition by the data subject, a time criterion that may be extended in order to comply with a legal obligation, even if unexpected, or to assert or defend a right, even in court; (iii) for the purpose of the processing referred in art. 2.2. letter c): up to the objection of the data subject, a time criterion which may be extended in order to comply with a legal obligation or to assert or defend a right, also in court; (iv) for the purpose of the processing referred in art. 2.3. letter d): until revocation of consent, a time criterion that may be extended if necessary in order to comply with a legal obligation, even if already existing, or to assert or defend a right, even in court; (v) for the purpose of the processing referred to in art. 2.3. letter e): until revocation of consent, a time criterion that may be extended if necessary in order to comply with a legal obligation, even if already existing, or to assert or defend a right, even in court.

  1. Target audience.

4.1. In compliance with art. 13(1)(e) of the GDPR, the co-Processors hereby specify that your personal data may be communicated, where appropriate or necessary, to one or more recipients pursuant to art. 4(9) of the GDPR, identified in general terms, by category as follows: (i) for the processing purpose referred to in art. 2.1. letter a): subjects authorised to process by the co-Processors, even separately; consultants or companies of various kinds that provide, however, services and/or performances (including professional ones) connected, even indirectly, to the fulfilment of the purpose in question (e.g. IT/cloud computing companies); (ii) for the processing purpose referred in art. 2.2. letter b): persons authorised to process data by the co-Processors, also separately; consultants or companies of various kinds that provide, in any event, services and/or performances (including professional ones) connected, also indirectly, to the performance of the purpose in question (e.g. marketing companies); (iii) for the processing purpose referred to in Art. 2.2. letter c): persons authorised to process data by the co-Processors, also jointly and severally; consultants or companies of various kinds that provide, in any event, services and/or performances (including professional ones) connected, also indirectly, to the performance of the purpose in question (e.g. analysis companies); (iv) for the processing purpose referred in art. 2.3. letter d): parties authorised to process the data by the co-Processors, also jointly and severally; consultants or companies of various kinds that provide, in any event, services and/or performances (including professional ones) connected, also indirectly, to the performance of the purpose in question (e.g. marketing companies); (v) for the processing purpose referred in art. 2.3. letter e): parties authorised to process the data by the co-Processors, also jointly and severally; third-party assignees.

  1. Transfer.

5.1. Your personal data are stored in automated, partially automated and/or non-automated archives belonging or otherwise traceable, even indirectly, to the co-Processors, and located, as regards automated archives (public cloud computing), outside the European Economic Area (EEA): with regard to the latter aspect, the co-Processors specify, in compliance with art. 13(1)(f) of the GDPR, that the appropriate guarantee consists in the measure pursuant to article 46(2)(c) of the GDPR.

  1. Data subject’s rights.

6.1. In relation to the user’s personal data, the co-Processors informs that the relevant data subject pursuant to art. 4 n. 1) of the GDPR has the right to exercise the following rights which may be subject to the limitations provided for in art. 2 undecies and 2 duodecies of the Privacy Code: right of access pursuant to art. 15 of the GDPR: right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred in art. 15 of the GDPR (e.g. purpose of processing, storage period); right to rectification under art. 16 of the GDPR: right to correct, update or supplement personal data; right to erasure under art. 17 of the GDPR: right to obtain erasure or destruction or anonymisation of personal data, where, however, the conditions listed in the same article apply; right to restriction of processing under art. 18 of the GDPR: right to obtain the restriction of the processing of personal data in the cases governed by art. 18 of the GDPR; right to data portability under art. 20 of the GDPR: right to obtain the personal data provided to the co-Processors in a structured, commonly used and machine-readable format (and, where required, to transmit them directly to another Data Controller), where the specific conditions set out in that article are met (e.g. legal basis of consent and/or execution of a contract; personal data provided by the data subject); right to object under art. 21 of the GDPR: right to obtain the cessation, on a permanent basis, of a specific processing of personal data; right to lodge a complaint with the Privacy Guarantor under art. 77 of the GDPR: right to lodge a complaint where it is considered that the processing under analysis violates national and EU legislation on the protection of personal data. 

6.2. In addition to the rights described in art. 6.1., the co-Processors specifies that, in relation to the personal data of the data subject, there is, where possible and conferring, the right to exercise, on the one hand, the (sub)right provided for art. 19 of the GDPR (“The controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectification or erasure or restriction of processing carried out pursuant to article 16, article 17(1) and article 18, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests”), to be considered connected and related to the exercise of one or more of the rights regulated in articles 16, 17 and 18 of the GDPR; on the other hand, the co-Processors specifies that, in relation to the personal data of the data subject, there is, where possible and conferring, the right to exercise the right provided for in art. 22(1) of the GDPR (“The data subject shall have the right not to be subject to a decision which is based solely on automated processing, including profiling, and which produces legal effects concerning him or her or significantly affects him or her in a similar way”), subject to the exceptions provided for in paragraph 2 below.)

6.3. Pursuant to article 12 paragraph 1) of the GDPR, the co-Processors undertakes to provide the User with the communications referred in art. from 15 to 22 and 34 of the GDPR in a concise, transparent, intelligible, easily accessible and plain language form: such information shall be provided in writing or by other electronic means, or, at the User’s request, orally provided that the User’s identity is proven by other means.

6.4. In accordance with article 12 paragraph 3) of the GDPR, the co-Processors informs you that it undertakes to provide you with information regarding the action taken in respect of a request pursuant to art. from 15 to 22 of the GDPR without undue delay and, in any event, at the latest within one month of receipt of such request; this period may be extended by n. 2 months if necessary, taking into account the complexity and number of requests (in this case, the Controller undertakes to inform the user of such extension and the reasons for the delay, within one month of receipt of the request).

6.5. The user may exercise the above-described rights at any time (with the exception of the right under art. 77 of the GDPR) by using the contact details set out in art. 7.

 

  1. Contact details.

7.1. The co-Processors can be contacted at the following addresses: info@b810group.it; mcregem@legalmail.it

7.2. The Data Protection Officer (DPO) pursuant to Article 37 of the GDPR, appointed by the co-Processors, can be contacted at the following addresses: privacydpo810@baldiandpartners.it; dpomcregem@baldiandpartners.it

 

Reggio Emilia, 3.2.2022 (date of last update)

B810 S.r.l. and MC REGEM S.r.l.

(in the person of their respective pro tempore legal representatives)