INFORMATION NOTICE PURSUANT TO ART. 13 AND 14 OF REG. (EU) 2016/679 (“GDPR”)
Please find below the information required by the GDPR concerning the processing of personal data provided as part of the registration to thePlease find below the information required by the GDPR concerning the processing of personal data provided as part of the registration to the e-commerce e-commerce portalportal (“(“PortalPortal”)”) and the and the use of the related services by use of the related services by userusers (“s (“UserUser/s/s”) ”) – – in particular, the purchase of Benetton gift cards (also in in particular, the purchase of Benetton gift cards (also in favorfavor of a of a third partythird party beneficiary, beneficiary, ““BeneficiaryBeneficiary”) - as better regulated by the general terms and conditions available on the Portal”) - as better regulated by the general terms and conditions available on the Portal..
Categories and source of the data processedCategories and source of the data processed
As indicated in the terms of use, to purchase gift cards on the Portal, the As indicated in the terms of use, to purchase gift cards on the Portal, the UserUser must register by completing the appropriate form, entering their first and last name, email address, and phone number, and creating a password. During the purchase process, they will also need to provide the necessary payment information (first and last name, address, phone number, credit card details, and, if an invoice is requested, the tax code). must register by completing the appropriate form, entering their first and last name, email address, and phone number, and creating a password. During the purchase process, they will also need to provide the necessary payment information (first and last name, address, phone number, credit card details, and, if an invoice is requested, the tax code).
If the If the UseUserr decides to gift the decides to gift the ggift ift ccard to a Beneficiary, ard to a Beneficiary, he/shehe/she will provide will provide the data to the data to Amilon for delivery purposes (Amilon for delivery purposes (name, surnamename, surname, email address) , email address) together withtogether with anan ““inscriptioninscription”” for him/her. for him/her.
Information on the processing of navigation data and those relating to the use of cookies can be consulted in the “privacy e cookie policy” made available in the cookie banner that appears at the first access and in the footer of the PortalInformation on the processing of navigation data and those relating to the use of cookies can be consulted in the “privacy e cookie policy” made available in the cookie banner that appears at the first access and in the footer of the Portal. .
Identity and contact details of the controllerIdentity and contact details of the controller
The controller is The controller is Amilon Amilon SrlSrl, Tax ID and VAT number 05921090964, with registered office in via Natale Battaglia 12, Milan, e-mail address , Tax ID and VAT number 05921090964, with registered office in via Natale Battaglia 12, Milan, e-mail address HYPERLINK "mailto:privacy@amilon.it"privacy@amilon.itprivacy@amilon.it (“(“AmilonAmilon” or “” or “Data Data ControllerController”)”)..
Contact details of the data protection officer Contact details of the data protection officer (DPO)(DPO)
The DPO can be contacted at the e-mail address The DPO can be contacted at the e-mail address HYPERLINK "mailto:dpo-ext@amilon.it"dpo-ext@amilon.itdpo-ext@amilon.it..
Purpose of processing, legal basis and retention timesPurpose of processing, legal basis and retention times
| why is personal data processed?why is personal data processed? | what is the condition that makes the processing lawful?what is the condition that makes the processing lawful? | how long do we keep personal data?how long do we keep personal data? |
| To To allow the registration on the Portal and the use of the related servicesallow the registration on the Portal and the use of the related services.. | The execution of a contract The execution of a contract of which the User is a party (or for which the contract is concluded, in the case of the Beneficiary), pursuant to art. 6.1, of which the User is a party (or for which the contract is concluded, in the case of the Beneficiary), pursuant to art. 6.1, lettlett. b) of the GDPR. b) of the GDPR. . | For the entire duration of the contractual relationship with Amilon (registration on the Portal) and, as an ordinary limitation period, for the following 10 years.For the entire duration of the contractual relationship with Amilon (registration on the Portal) and, as an ordinary limitation period, for the following 10 years.In the event of litigation, the data are kept until the deadlines for the appeal are exhaustedIn the event of litigation, the data are kept until the deadlines for the appeal are exhausted.. |
| To establish, exercise or defend the rights of AmilonTo establish, exercise or defend the rights of Amilon..In order to mitigate the risk of payment fraud on the Portal, the following are provided forIn order to mitigate the risk of payment fraud on the Portal, the following are provided for::the identification of Users (via e-mail confirmation); the identification of Users (via e-mail confirmation); the verification of creditthe verification of credit or debit or debit card data entered during the purchase process by the User card data entered during the purchase process by the User.. | The pursuit of the The pursuit of the legitimate interest of the legitimate interest of the Data Data ControllerController, pursuant to art. 6.1, , pursuant to art. 6.1, lettlett. f) of the GDPR. f) of the GDPR.. | |
| To fulfill administrative-accounting, tax and other legal obligations,To fulfill administrative-accounting, tax and other legal obligations, in accordance with the requirements of current legislation in accordance with the requirements of current legislation.. | The fulfillment of a legal obligation to which the Data Controller is subjectThe fulfillment of a legal obligation to which the Data Controller is subject, , pursuant topursuant to art. 6.1, art. 6.1, lettlett. c) . c) ofof the the GDPRGDPR.. | The data will be kept for 10 years, as a general ten-year retention period prescribed by lawThe data will be kept for 10 years, as a general ten-year retention period prescribed by law.. |
| To send To send – to the e-mail address provided by the – to the e-mail address provided by the UUser ser – promotional communications regarding products supplied by Amilon similar to those purchased on the Portal – promotional communications regarding products supplied by Amilon similar to those purchased on the Portal (e.g.(e.g.,, regarding the addition of a new gift card in the catalogs of Amilon e regarding the addition of a new gift card in the catalogs of Amilon e--commerce sites or relating to a particular discount applied to a certain brand of commerce sites or relating to a particular discount applied to a certain brand of ggift ift ccards sold therein).ards sold therein). | The cd. "The cd. "soft spamsoft spam" pursuant to art. 130, c. 4 of d. " pursuant to art. 130, c. 4 of d. lgslgs. 196/2003 ("Privacy Code").. 196/2003 ("Privacy Code"). | Until the possible opposition of the Until the possible opposition of the data subjectsdata subjects (by clicking on the "unsubscribe" link present in each communication(by clicking on the "unsubscribe" link present in each communication)).. |
Once the storage terms indicated above have elapsed, the data will be destroyed, deleted or made anonymous, compatibly with the technical timing of cancellation and backupOnce the storage terms indicated above have elapsed, the data will be destroyed, deleted or made anonymous, compatibly with the technical timing of cancellation and backup..
ProvisionProvision of data of data
The provision of data marked with and asterisk in the aforThe provision of data marked with and asterisk in the aforeementioned form is nementioned form is necessary for cessary for registraregistration on the tion on the PortalPortal or with the purchase of or with the purchase of ggift ift ccardsards..
Therefore, failure to provide such data will make it impossible for the User Therefore, failure to provide such data will make it impossible for the User to use the services offered by to use the services offered by Amilon Amilon on theon the Portal Portal..
CategorieCategoriess of data of data recipientsrecipients
The data may be communicated to other third parties operating as independent data controllers, such as, for example, public authorities The data may be communicated to other third parties operating as independent data controllers, such as, for example, public authorities and professional firms, entitled to receive them. and professional firms, entitled to receive them. Furthermore, the data will be disclosed to theFurthermore, the data will be disclosed to the so-called acquirer, i.e. the payment service provider handling the payment.so-called acquirer, i.e. the payment service provider handling the payment.
The data may also be processed, on behalf of the Data Controller, by third parties, designated as data processors pursuant to art. 28 of the GDPR, which carry out activities functional to the pursuit of the aforementioned purposes (e.g., IT service providers, customer care and marketing)The data may also be processed, on behalf of the Data Controller, by third parties, designated as data processors pursuant to art. 28 of the GDPR, which carry out activities functional to the pursuit of the aforementioned purposes (e.g., IT service providers, customer care and marketing)..
Furthermore, the data are processed by Amilon employees - belonging to the company departments responsible for pursuing the aforementioned purposes - who have been expressly authorized to process and who have received adequate operating instructionsFurthermore, the data are processed by Amilon employees - belonging to the company departments responsible for pursuing the aforementioned purposes - who have been expressly authorized to process and who have received adequate operating instructions..
Rights of data subjectsRights of data subjects
The The data subjectsdata subjects (i.e., the subject (i.e., the subjectss to whom the data refer; th to whom the data refer; that isat is, , User and User and BeneficiarBeneficiaryy) ) can exercise the rights referred tocan exercise the rights referred to in articlesin articles 15-22 15-22 of theof the GDPR, GDPR, by sending a communication to the contact points indicated in parby sending a communication to the contact points indicated in par. 2. 2..
In particular, the In particular, the data subjectdata subjectss can: can:
obtain obtain from the Data Controller confirmation that personal data concerning them are being processed and, in this case, access to them and to the information referred to in art. 15from the Data Controller confirmation that personal data concerning them are being processed and, in this case, access to them and to the information referred to in art. 15 of the of the GDPR (purpose of processing, categories of GDPR (purpose of processing, categories of personal personal data, etc.);data, etc.);
obtain obtain the the rectificationrectification of inaccurate data or the integration of incomplete data of inaccurate data or the integration of incomplete data pursuant to artpursuant to art. 16 . 16 of theof the GDPR; GDPR;
obtain obtain the the erasure erasure of data in the cases provided for by art. 17 of data in the cases provided for by art. 17 of theof the GDPR; GDPR;
obtain obtain the limitation of processing (i.e. the temporary subjecting of data to storage only), in the cases provided for by art. 18 of the GDPR; the limitation of processing (i.e. the temporary subjecting of data to storage only), in the cases provided for by art. 18 of the GDPR;
objectobject, for reasons related to their particular situation, the processing carried out for the legitimate interest of the owner,, for reasons related to their particular situation, the processing carried out for the legitimate interest of the owner, pursuant to pursuant to art. art. 21 21 of the of the GDPR;GDPR;
if the processing is based on consent or contract and is carried out with automated tools, the data subject may request to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without hindrance ("right to portability") pursuant to art. 20 of the GDPRif the processing is based on consent or contract and is carried out with automated tools, the data subject may request to receive the data in a structured format, commonly used and readable by automatic device, as well as, if technically feasible, to transmit them to another holder without hindrance ("right to portability") pursuant to art. 20 of the GDPR..
As indicated above, data subjects may, at any time, As indicated above, data subjects may, at any time, objectobject the processing for direct marketing purposes (also by clicking on the "unsubscribe" link in each e-mail communication). the processing for direct marketing purposes (also by clicking on the "unsubscribe" link in each e-mail communication).
In any case, the data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State where they habitually reside or work or in the State where the alleged infringement occurredIn any case, the data subjects have the right to lodge a complaint with the competent supervisory authority in the Member State where they habitually reside or work or in the State where the alleged infringement occurred..