COMARI

PRIVACY INFORMATION NOTE - Art. 13 Leg. Decree 196/2003

This statement provides information on the processing of personal data of users after registration and/or use of the services provided on the www.luisaspagnoli.it (“Site”) site, accordance with the requirements of the Personal Data Protection Code, including the security and confidentiality profiles of data and additional information provided via the Privacy Policy and the Cookies Policy of the Site, which users are kindly invited to read.

The Personal data collected will be processed for different purposes by the various Controllers listed below, according to the service to be provided.

The data collected during the Site registration process and product purchasing phases are first processed to manage such operations The Data controller is Triboo Digitale S.r.l., with registered office in Viale Sarca, 336 - 20126, Milan (MI) Italy (“TD”), who can be contacted at the following email address: ecare@luisaspagnoli.it. More specifically, TD only processes personal data as is strictly necessary to manage the purchasing operations and execute the orders placed via the Site, including the management of the sales and other transactions performed on the Site, delivery of products, returned materials and warranties, and all further activities necessary to the sale of its products via the Site, replies to any communications sent to TD via the site. Moreover, TD can personal data collected to fulfil all obligations as foreseen by the laws, regulations and EC norms and standards in force, and to exercise its rights at a judicial level. Conferral of data is required for all such activities and failure to confer the same will make it impossible to fulfil its contractual obligations and process the orders of requests sent by users or provide the services requested via interaction with the Site. Pursuant to Article 24 of the Privacy Code, the consent of users for such processing purposes is not necessary.

With the consent of the users, free and optional, the data can also be processed for marketing purposes, i.e. the sending of information and promotional materials on Site products, special offers and/or promotions by standard mail, email, newsletters and text messages by SMS and MMS. The Data controller for such marketing activities is Luisa Spagnoli S.p.A., with registered office in [Strada Santa Lucia 71], (" Luisa Spagnoli S.p.A."), who can be contacted at the following email address: ecare@luisaspagnoli.it. Conferral of data for marketing purposes is optional and any refusals will not have any consequence on the possibility for Users to effect purchases, send orders and enjoy the services and functions provided by this Site. If, in future, the users should decide to cancel such communications, they can oppose receipt of the same following the instructions provided in the relative communications. Users can also contact [Luisa Spagnoli S.p.A.] at any moment in time at the contacts indicated above, to express the means of contact they prefer and to revoke any consent previously provided for one or all the means of contact illustrated above.

The personal data collected for all the above illustrated purposes are processed using digital and sometimes hard copy documentation, using procedures and logics functional to the aforementioned purposes. If users should provide third-party personal data on the Site, they must take all necessary precautions to ensure the communications of such data, and the subsequent use for the purposes indicated each time, comply with the Privacy Code and applicable legislations (e.g. before providing third-party personal data, the same must be informed and their consent obtained, where required by the Privacy Code).

As fare as the TD and [Luisa Spagnoli S.p.A.] organisations are concerned, the personal data can be accessed by the designated data officers and the Chief Processors, if appointed. Please contact the Data Controllers at their respective email addresses above to receive an updated list of the Chief Processors appointed by the same.

Both Data Controllers can communicate the respective personal data collected and processed to authorities and public entities; professionals, freelancers, including associates and commercial partners (i.r. third-parties providing Site management services of a commercial, professional and technical nature and to pursue the aforementioned purposes); third-parties in cases of mergers, acquisitions, corporate or business branch spin-offs or other extraordinary transactions. These third-party subjects only receive the information needed for them to implement their designated functions. In particular, TD communicates the personal data to Arcese Logistic S.r.l., appointed as the Chief External Processor, for the execution of logistic activities concerning shipping and the return of purchased products. The subjects to whom such data is communicated undertake to use them for the aforementioned processing purposes only, and keep them secure and confidential, in accordance with the requirements of the applicable privacy code. In addition, personal data may be communicated to legitimate recipients under the laws or regulations in force. Except for the foregoing, personal data are not shared with third-parties who do not provide any service at a commercial, professional and technical level to the Data Controllers. The third-parties, i.e. Data Controllers, Chief Processors or Processing Officers, as the case may be, to whom such data is communicated shall process the same for the aforementioned purposes only, in accordance with the requirements of the applicable privacy code.

It is possible to exercise, at any moment in time, the rights granted by Art. 7 of the Privacy Code - the text of which is provided at the end of this document - such as for instance obtaining confirmation as to whether or not their personal data exists; access such data; verify the contents, origin and accuracy; request integration, updates, rectification, erasure, anonymisation, blocking of data processed in violation of the law; oppose data processing for legitimate reasons, such as for marketing purposes. Users can contact the Data Controllers at the addresses indicated above to exercise their rights.

LEGISLATIVE DECREE no.196/2003 dated June 30th 2003 “Personal Data Protection Code”.

ARTICLE no. 7:

(Rights to access personal data and other rights)

1. The Data Subject has the right to request confirmation as to whether or not personal data concerning you exists, regardless of their being already recorded, and communication of such data in an intelligible form.

2. In particular, the subject has the right to obtain indications on:

a) the source of the personal data;

b) the purposes and methods of the processing;

c) the logic applied to the processing, if the latter is carried out with the help of electronic means;

d) the identification data concerning data controller, data processors and the representative designated as perarticle 5paragraph 2;

e) the entities or categories of entity to whom or which the personal data may be communicated and who or which may get to know said data in their capacity as designated representative(s) in the State’s territory, data processor(s) or person(s) in charge of the processing.

3. The Data Subject has the right to obtain indications on :

a) updating, rectification or, where interested therein, integration of the data;

b) erasure, anonymisation or blocking of data that have been processed unlawfully, including data whose retention is unnecessary for the purposes for which they have been collected or subsequently processed;

c) certification to the effect that the operations as per letters a) and b) have been notified, as also related to their contents, to the entities to whom or which the data were communicated or disseminated, unless this requirement proves impossible or involves a manifestly disproportionate effort compared with the right that is to be protected.

4. The Data Subject is entitled to oppose, totally or partially:

a) on legitimate grounds, to the processing of personal data concerning him/her, even though they are relevant to the purpose of the collection;

b) to the processing of personal data concerning him/her, where it is carried out for the purpose of sending advertising materials or direct selling or else for the performance of market or commercial communication surveys.

The personal details of a third party recipient (name and email address) to whom you wish to send a "Gift Card" to during the purchase process, shall be processed exclusively to allow Triboo Digitale to send the "Gift Card" via email to the recipient, to unlock the card and fulfil all consequent services and obligations assigned to Triboo Digitale. The details (name and email address of the recipient) shall only be retained until confirmation is received that the recipient has unlocked the Gift Card, following the instructions provided on the Site or, whichever occurs later, until the date within which the Buyer is entitled to exercise his right of withdrawal expires: once the Gift Card has been unlocked, or, whichever occurs later, once the date within which the Buyer is entitled to exercise his right of withdrawal has expired, the details of the recipient processed for the purposes illustrated herein will be erased.