Privacy policy pursuant to Regulation (EU) 2016/679 (GDPR) and national legislation in force in Italy (D.Lgs.196/03)
1. General information
The undersigned Company (Pettenon Cosmetics S.p.A. SB), hereinafter also indicated simply as the "Company", hereby communicates information on the processing of your data/company data represented by you (e.g. personal data, addresses, tax code, VAT number, data necessary for the management, including administrative management, of customers, the execution of the contract and the fulfilment of legal obligations, data relating to payments, data necessary to defend or enforce a right of the Company). Only the data necessary for the pursuit of the purposes envisaged in this information notice will be requested and processed by the Company. Some data (those contained in Chamber of Commerce searches and those on solvency status found at credit information companies used for contractual and pre-contractual purposes as well as for legitimate interests such as those of verifying the existence and data of the customer as well as any prejudicial circumstances) may also be found in Chamber of Commerce searches and at credit information companies.
If the data subject is a legal person, the GDPR does not apply to it. However, the GDPR, and thus what is stated in this information notice, does apply to employees and also to the legal entity for the activities referred to in points 2 (G) and 2 (E) with regard to e-mails, messages (both text messages and via messaging apps) and automated call or call communication systems without the intervention of an operator..
2. Purposes and legal basis
The Comany may process data for the following purposes:
A) for pre-contractual purposes if a contract has yet to be signed; the legal basis of the processing is the need to execute pre-contractual measures taken at the request of the data subject;
B) for contractual purposes (e.g. order management, administrative-accounting fulfilments, customer management, sending of information notes on new products to be marketed that are part of the brands covered by the contract ...); the legal basis of the processing is the need for the execution of the contract
C) to comply with legal obligations, regulations and EU legislation; the legal basis of the processing is the fulfilment of legal obligations;
D) to assert or defend a right of the Company and therefore for a legitimate interest of the Company itself consisting in allowing the defence and actions for its own protection, including possible debt collection actions; the legal basis of the processing is the pursuit of legitimate interests. In considering these legitimate interests, it has been analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest has been assessed on the basis of a Triple Test available by contacting the Company);
E) to assess possible detrimental effects on the establishment or continuation of the relationship (e.g. company in liquidation) and therefore for a legitimate interest consisting in preventing risky situations; the legal basis of the processing is the pursuit of legitimate interests. In considering these legitimate interests, it has been analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest has been assessed on the basis of a Triple Test available by contacting the Company);
F) to assign or discount receivables (and thus for a legitimate interest of the Company in obtaining liquidity before payment deadlines or pending payment); the legal basis of the processing is the pursuit of legitimate interests. In considering such legitimate interests, it has been analysed that they do not compromise or interfere with the interests or fundamental rights and fundamental liberties of the data subject (the legitimate interest has been assessed on the basis of a Triple Test available by contacting the Company);
G) In order for the Company to carry out marketing communications on its products/services/initiatives, all by the Company to the e-mail address indicated by you or to other addresses including telephone and postal address (please note that the sending of e-mails and SMS/MMS, messaging apps, may also be carried out electronically with the aid of automated tools); the processing has consent as its legal basis;We inform you that you may also communicate that you wish to be subject to the activities only through e-mail or only through telephone or postal communications by writing to privacy@pettenon.it.Please note that these communications do not include the information notes under point 2 letter A, which are communications that are instead necessary to fulfil the contract;
H) for the purpose of carrying out market research and/or interviews to evaluate the Company's products and services, all by the Company at the telephone and e-mail addresses indicated by you in the form (we inform you that e-mails and messages on the telephone may also be sent electronically with the aid of automatic tools). We inform you that you may also communicate that you wish to be subject to the activities only by e-mail or only by telephone communication, by contacting the company at the contact details indicated in point 6. You may revoke your consent for these purposes at any time by contacting the company at the addresses indicated in point 6; consent for these purposes is always freely revocable at any time by contacting the company at the addresses indicated below; the legal basis for the processing is consent;
I) in order to share your data with the other companies of the AGF88 Group for the purpose of coordinating the Group's activities, thus avoiding overlapping of customers and reporting any insolvencies and risks (e.g. bankruptcy, prejudicial) in the interest of the AGF88 Group; all for the legitimate interests of having qualified customers and avoiding commercial overlaps; the legal basis of the processing is the pursuit of legitimate interests. In considering these legitimate interests, it has been analysed that they do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (the legitimate interest has been assessed on the basis of a Triple Test available by contacting the Company);
J) to analyse information relating to commercial activity in order to better understand customer habits and also to guide purchases through marketing communications and specific initiatives (at the addresses provided) all taking into account the analysis itself. Consent for said purposes is always freely revocable at any time by contacting the company at the addresses given; the legal basis for the processing is consent; see also point 10
3. Mandatory nature of the provision
The provision of the requested data is necessary for the purposes indicated in point 2 letter A, B, C, D and therefore any refusal to provide such data in whole or in part may make it impossible for the Company to execute the contract or continue the relationship.
The provision of data for the purposes indicated in point 2 letter E is optional, but failure to provide such data may result in the impossibility of entering into or continuing the relationship.
The provision of data for the purposes set out in point 2 letter F is optional but failure to provide it may make it impossible to undertake or continue the relationship.
The provision of the data required for the purposes set forth in point 2 letter G and H is optional as is the relative consent (which can always be freely revoked by contacting the Company) and failure to provide the data and consent shall not entail any consequence other than that the Company shall not be able to carry out the activities indicated in the point or shall not be able to carry them out at the addresses not provided;
the provision of the data for the purposes referred to in point 2 letter I is optional but failure to provide it may result in the impossibility of following up the contract or continuing the relationship.
The provision of the data requested for the purposes set forth in point 2 letter L is optional as is the relative consent (which can always be freely revoked by contacting the Company) and failure to provide it and consent shall not entail any consequences other than the fact that the Company shall not be able to carry out the activities indicated in the point or shall not be able to carry them out using the information not provided.
4. Data addressee categories
Without prejudice to further communications (of which you/the company/company you represent will be informed in any case if the communications themselves are not already known) that may be necessary to fulfil legal and contractual obligations, the data collected and processed may be communicated by the Company (communicating the data only if necessary for the pursuit of the purposes indicated in this information notice and communicating only the indispensable data)
- for the purposes indicated in point 2 letter A to public bodies, post offices (communicating the data necessary to send any communications)
- for the purposes indicated in point 2 letter B to banks, professionals (e.g. lawyers), consultants and, auditors), service companies, transporters, forwarding agents judicial authorities and police and supervisory bodies, public bodies, post-couriers (communicating the data necessary to send any communications);
- for the purposes indicated in point 2 letter C to judicial authorities and police and supervisory bodies, public bodies;
- for the purposes indicated at point 2 letter D to professionals (e.g. lawyers), judicial authorities and police and supervisory bodies, public bodies, post-courriers (communicating the data necessary to send any communications);
- for the purposes indicated in point 2 letter F to factoring companies or companies to which credits are assigned, not to banks, to forwarding agents in the case of sending communications/paper material;
- for the purposes of point 2 letter E, H, L the data will not be communicated.
For the purposes indicated in point 2(G) the data may be communicated to carriers and forwarding agents in the case of sending paper material.
For the purposes of point 2(I) the data may be communicated to companies in the AGF 88 group.
The data may also be known by the subjects specifically delegated by the company to process the data (administrative/legal and logistics staff, commercial staff also external to the Company, marketing staff also external to the Company, members of the Board of Directors and Board of Statutory Auditors, agents, area managers, IT technicians and information systems staff, consultants also external to the Company - e.g. quality/certification consultants, IT consultants, lawyers, tax consultants - interns, collaborators of the data processors. quality/certification consultants, IT consultants, legal consultants, tax consultants - interns, collaborators of the data processors) and data processors (companies that perform auxiliary activities to those of the Company such as IT consultants, accountants and tax consultants, consultancy companies in general, companies that send communications) always appointed by the Company and whose list can be found by contacting the data controller.
Please note that for debt collection activities, the Company may make use of debt collection companies and lawyers whose names will be available from the data controller and who may act as data processors or independent data controllers. The names of such persons, if appointed as data processors, will in any case be communicated to you before entrusting the case to them.
5. Data retention
The data will be stored and processed by the Company for as long as is necessary for the pursuit of the purposes contained in this notice. The period of data retention is as follows:
-for pre-contractual purposes until the eventual approval or formalisation of the contract, unless further retention is required by Italian and European regulations;
- for legal obligations, regulations and EU legislation, for the periods imposed by these regulatory sources;
-for the purposes referred to in point 2 letter E until the data are analysed;
-for the purposes referred to in point 2 letter F for the entire duration of the contract and thereafter if required by legal obligations;
-for the purposes set forth in point 2 letter G and H, until revocation of consent or request for deletion without prejudice to storage for the purposes set forth in point 2 letter C 2 letter D by 31 December of the second year following the year in which you gave your consent, you will in any case be sent a communication to understand whether or not you are still interested in being subject to the activities referred to in point 2(G) and 2 (H) and therefore in the retention of the data by the Company for the purposes indicated in this point and if this interest ceases, the data will be deleted without prejudice to its retention for evidential purposes for the period provided for by Italian law. If, on the other hand, there is still your interest in being subject to the activities referred to in points 2(G) and 2(H) and therefore to the retention of data by the Company for the purposes indicated in that point, by 31 December of the second year from the communication, you will be sent a further communication of the same nature and so on until your interest remains.
-for the purposes indicated in point 2 letter I, for the entire duration of the contract, except for the exercise of the rights indicated in point 7 of this information notice;
-for the purposes referred to in point 2 (L) until the revocation of consent or the request for cancellation (always possible by writing to the Company's contact details) or for a maximum of 12 months after registration, unless the data is truly anonymised so that it does not make it possible, even indirectly or by cross-referencing the information with other databases, to identify the data subjects;
- in any case, all data may be retained for a period necessary to assert or defend a right of the Company, in accordance with Italian civil and criminal law, and therefore for a maximum of 10 years from the termination of the relationship, except in the event of litigation or disputes that require a further retention period and subject to further retention if required by local regulations applicable to the data subjects.
6. Data Controller and Data Protection Officer
The Data Controller of the data provided is: Pettenon Cosmetics S.p.A. SB with registered office in Via del Palù, 7/d, 35018 - San Martino di Lupari (PD), Tel. +39 049 99888 FAX +39 049 9988809, e-mail privacy@pettenon.it.
There is a Data Protection Officer for the Company, who can be contacted at the Company's registered office in Via del Palù, 7/d, 35018 - San Martino di Lupari (PD), as well as at the e-mail address dpo@pettenon.it
7. Rights
Please note that the GDPR provides that the data subject may request (by contacting us at the contact details set out in point 6) access to and rectification of your personal data, erasure of your data or limitation of the processing concerning you, data portability; you may also have the opportunity, again by contacting us, to oppose the processing of your data and to exercise the other rights contained in Chapter 3 Section 1 of the GDPR, including the right to withdraw consent, where applicable: the withdrawal of consent shall not affect the lawfulness of the processing based on the consent given before the withdrawal.
8. Complaints
If you believe that the processing of data is in breach of the provisions of the GDPR, you have the right to lodge a complaint with the Italian Supervisory Authority (whose contact details can be found at www.garanteprivacy.it), as provided for in Article 77 of the GDPR, or to take appropriate legal action (Article 79 of the GDPR).
In addition, he may also apply to the Control Authority of the state where he normally resides or works.
The list of Supervisory Authorities can be found at www.garanteprivacy.it/home/footer/link).
9. Data of collaborators/employees
Please note that should the data subject to whom this information notice is addressed need to communicate to the Company, for reasons inherent to the performance of the contract, the names and contact details of his or her collaborators, the data subject shall inform the collaborator of the information contained in this notice and of the fact that he or she will communicate the data to the Company, which may process the data for reasons inherent to the performance of the contract, obtaining his or her consent to the communication and processing where necessary.
10. Logic used for profiling
The profiling referred to in point 2(L) is carried out by the Company through the analysis, also in an automated way, of the data (e.g. category of activity, target clientele, geographical area) and of the characteristics and actions of the data subject (e.g. adhesion to an event, adhesion to particular initiatives, purchase of certain products, filling in questionnaires, actions carried out while surfing the Company's websites if the data subject has accepted profiling cookies on the websites themselves, various actions such as, for example, the evaluation of the actions carried out when receiving marketing e-mails such as whether or not to open them). A profile is then created, which is also placed in specific groups (clusters). Profiling has the purposes indicated in point 2(L) and therefore to better understand the customer's propensity to purchase and also to propose services and products in line with the customer's needs through specific communications and initiatives; this processing, however, does not constitute a particular risk for the customer given the type of basic profiling that does not require data of a particularly delicate nature or that would allow particularly confidential aspects of private life to be reconstructed in detail. In any case, the data subject will always have the right to obtain human intervention, to express his opinion, to obtain an explanation of the decision taken and to contest the decision
11. Processing procedures
The data may be processed by the Company in paper, manual, computer and telematic form (thus storing and processing the data on both paper and computer). The data will be stored and processed by the Company, adopting all the measures necessary for their protection, in compliance with all the regulations in force (and therefore also in compliance with the principles of correctness, lawfulness and transparency and protection of confidentiality and rights) and with logics strictly related to the purposes indicated in this information notice. Only the operations necessary for the pursuit of the purposes indicated in this statement will be carried out on the data. The data will be stored, as far as the Company is concerned, at the offices of the Company and at the data processors appointed by the Company (as well as at the third parties indicated in this notice to whom the data are communicated and who process them as autonomous data controllers). The data will also be organised in databases - databases including computerised databases.
Informative note updated on 28/02/2024. This update is carried out as part of a policy of constant revision of the information notice. Versions of previous disclosures can be obtained by contacting the Data Controller
CLIENTS' INFORMATION IN ACCORDANCE WITH REGULATION (EU) 2016/679, hereinafter also GDPR
- General information: The undersigned Company (Pettenon Cosmetics S.p.A S.B.) hereinafter also referred to simply as the "Company", hereby communicates information on the processing of your data/data of the company/firm represented by you (e.g. master data, addresses, tax code, VAT number, data necessary for the management including administrative management of customers, contract execution and fulfillment of legal obligations, data related to payments, data necessary to defend or enforce a right of the Company). Only data necessary for the pursuit of the purposes set forth in this privacy policy will be requested and processed by the Company. Some data (those contained in chamber of commerce visas and those on solvency status retrieved from credit information companies used for contractual and pre-contractual purposes as well as for legitimate interests such as those of verifying the existence and data of the customer as well as any prejudicial.
- Purpose and legal basis: The data may be processed by the Company:
A) for pre-contractual purposes if a contract has yet to be signed; the legal basis for processing is the need for execution of pre-contractual measures taken at the request of the data subject;
B) for contractual purposes (e.g. order management, administrative accounting fulfillment, customer management, sending information notes on new products to be marketed falling under the brands referred to in the contract ...); the legal basis of processing is the need for the execution of the contract;
C) to comply with legal obligations, regulations and EU regulations; the legal basis for processing is the fulfillment of legal obligations;
D) to assert or defend a right of the Company and thus for a legitimate interest of the Company consisting in enabling the defense and actions for its own protection; the legal basis for the processing is the pursuit of legitimate interests. In considering such legitimate interests, it has been analyzed that the same do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (legitimate interest has been assessed based on a Triple Test available by contacting the Company);
E) to assess possible detriments to the establishment or continuation of the relationship (e.g., companies in bankruptcy) and thus for a legitimate interest consisting in preventing risky situations; the legal basis for the processing is the pursuit of legitimate interests. In considering such legitimate interests, it has been analyzed that the same do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (legitimate interest has been assessed based on a Triple Test available by contacting the Company);
F) to assign or discount receivables (and thus for a legitimate interest of the Company consisting of obtaining liquidity before payment deadlines or pending payment); the legal basis for the processing is the pursuit of legitimate interests. In considering such legitimate interests, it has been analyzed that the same do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (legitimate interest has been assessed based on a Triple Test available by contacting the Company);
G) in order for the Company to carry out marketing communications about its products/services/initiatives, all by the Company to the e-mail address you have provided or other contact details including telephone and postal address (please note that e-mail and SMS/MMS may also be sent electronically with the help of automated tools); the processing has consent as its legal basis;
Please note that you may also communicate that you wish to be subject to the activities only through e-mail or only through telephone or postal communications by writing to privacy@pettenon.it.
it is recalled that these communications do not include the information notes in point 2 letter A, which are communications instead necessary to fulfill the contract;
H) in order to share your data with the other AGF88 Group Companies in order to coordinate the Group's activities thus avoiding overlapping of customers and reporting any defaults and risks (e.g., bankruptcy, prejudicial) in the interest of the AGF88 Group; all therefore for legitimate interests consisting of having qualified customers and avoiding business overlaps; the legal basis for the processing is the pursuit of legitimate interests. In considering such legitimate interests, it has been analyzed that the same do not compromise or interfere with the interests or fundamental rights and freedoms of the data subject (legitimate interest has been assessed based on a Triple Test available by contacting the Company).
- Is it Obligatory to Provide Personal Data? The provision of the requested data is necessary for the purposes of point 2 letter A, B, C, D and therefore any refusal to provide them in whole or in part may make it impossible for the Company to execute the contract or continue the relationship.
The provision of data for the purposes referred to in point 2 letter E of this information is optional but failure to provide it may result in the impossibility of undertaking or continuing the relationship.
The provision of data for the purposes of point 2 lett F of this privacy policy is optional but failure to provide it may result in the inability to enter into or continue the relationship.
The provision of the data requested for the purposes set out in point 2 lett G is optional as is the relevant consent (always, however, freely revocable by contacting the Company) and failure to provide and consent will not result in any consequence other than that the Company will not be able to carry out the activities referred to in the point or will not be able to carry them out at the addresses not provided.
The conferment for the purposes referred to in point 2 letter H is optional but failure to confer it may result in the impossibility of following up the contract or continuing the relationship.
- Categories of Recipients of your Personal Data: Without prejudice to further communications (of which you/the company/firm you represent will be informed in any case if the communications themselves were not already known) that may be necessary in fulfillment of legal and contractual obligations, the data collected and processed may be communicated by the Company (communicating the data only if necessary for the pursuit of the purposes indicated in this privacy policy and communicating only the indispensable data):
- for the purposes referred to in point 2 letter A to public bodies, postal-courier (communicating the data necessary to send any communications);
- for the purposes referred to in point 2 letter B to banks, professionals (e.g., lawyers), consultants and, auditors), service companies, transporters, shippers judicial authorities and police and supervisory bodies, public bodies, post-couriers (communicating the data necessary to send any communications);
- for the purposes of point 2 lett C to judicial authorities and police and supervisory bodies, public entities;
- for the purposes referred to in point 2 lett. D to professionals (e.g., lawyers), judicial authorities and police and supervisory bodies, public entities, postal-courier services (communicating the data necessary to send any communications);
- for the purposes of point 2 lett F to factoring companies or companies to which receivables are assigned not that to banks, forwarding carriers in case of sending communications/paper material;
- for the purposes of point 2 letter E, the data will not be communicated.
Persons specifically delegated by the Company to process the data (administrative/legal and logistics employees, business practice employees also external to the Company, marketing employees also external to the Company, members of the Board of Directors and the Board of Statutory Auditors, agents, area managers, computer technicians and information system employees, consultants also external to the Company - e.g., quality/certification consultants, computer consultants, lawyers, tax consultants- interns, collaborators of data processors, quality/certification consultants, IT consultants, lawyers, tax consultants- interns, collaborators of the data processors) and data processors (companies that carry out activities auxiliary to that of the Company such as IT consulting companies, accountants and tax consultants, consulting companies in general,) always appointed by the Company and whose list can be found by contacting the Data Controller.
Please note that for debt collection activities, the Company may use debt collection companies and lawyers whose names will be available from the Data Controller and who may act as data controllers or autonomous data controllers. The names of these individuals, if appointed as Data Controllers, will in any case be communicated to you prior to entrusting the case to them.
- Data retention: Data may be retained and processed by the Company for as long as is necessary for the pursuit of the purposes contained in this privacy policy. The period of data retention is as follows:
-for pre-contractual purposes until the eventual approval or formalization of the contract unless further storage is required by Italian and European regulations;
- for legal obligations, regulations and EU regulations, for the periods imposed by these regulatory sources;
- for the purposes referred to in point 2 letter E until the data analysis;
- for the purposes mentioned in point 2 lett F for the entire duration of the contract and thereafter if required by legal obligations;
- for the purposes set forth in 2(G), until you withdraw your consent or request deletion subject to retention for the purposes set forth in 2(C) 2(D) ; by December 31 of the second year following the year in which you gave your consent, you will in any case be sent a communication to understand whether there is still your interest in being subject to the activities referred to in point 2(G) and therefore to the retention of the data by the Company for the purposes indicated in that point and in the event that this interest ceases, the data will be deleted subject always to retention for evidentiary purposes for the period provided for by Italian law. If, on the other hand, there is still your interest in being subject to the activities referred to in point 2(G) and therefore to the retention of the data by the Company for the purposes indicated in that point, by December 31 of the second year after the communication, you will be sent a further communication of the same nature and so on as long as your interest remains;
- for the purposes mentioned in point 2 letter H, for the entire contractual period except for the exercise of the rights indicated in point 7 of this privacy policy;
- in any case, all data may be retained for a period necessary to assert or defend a right of the Company, in accordance with Italian civil and criminal law and therefore for a maximum of 10 years from the termination of the relationship, except for litigation or disputes that make a further retention period necessary and subject to further retention if required by local regulations applicable to the data subjects.
- Data Controller and Data Protection Officer: The Data Controller is Pettenon Cosmetics S.p.A. SB with registered office in Via del Palù, 7d, 35018 San Martino di Lupari PD, Tel. +39 049 99888 FAX +39 049 9988809, privacy@pettenon.it.
There is a Data Protection Officer of the Company, contactable at the Company’s headquarters in Via del Palù, 7/d, 35018 - San Martino di Lupari (PD), as well as at dpo@pettenon.it.
- Rights: We inform you that the GDPR stipulates that you may request from the Company (at the contact details given in Section 6) access to and rectification of your personal data, deletion of your data or restriction of the processing that concerns you, data portability; you may also have the option, again by contacting the Company, to object to the processing of your data and to exercise the other rights contained in Chapter 3 Section 1 of the GDPR.
- Compliants: Where you believe that data processing is taking place in violation of the provisions of the GDPR, you have the right to lodge a complaint with the Italian Supervisory Authority (whose references can be found at www.garanteprivacy.it), as provided for in Article 77 of the GDPR, or to take appropriate legal action (Article 79 of the GDPR). In addition, he or she may also turn to the Control Authority of the state where he or she normally resides or works. A list of the Supervisory Authority can be found at the link www.garanteprivacy.it/home/footer/link).
- Data of collaborators/employees: It is recalled that if the data subject to whom this privacy policy is addressed has to communicate to the Company for reasons inherent in the performance of the contract, of the names and contact details of their collaborators, the data subject must inform the collaborator of the information contained in this privacy policy and of the fact that they will communicate the data to the Company, which may process the data for reasons inherent in the performance of the contract, obtaining their consent to the communication and processing where necessary.
- Processing method: The data may be processed by the Company in paper, manual, computer and telematic mode (thus storing and processing the data on both paper and computer). The data will be stored and processed by the Company, taking all necessary measures for their protection, in accordance with all current regulations (and therefore also in compliance with the principles of correctness lawfulness and transparency and protection of confidentiality and rights) and with logics strictly related to the purposes indicated in this information. On the data will be carried out only the operations necessary for the pursuit of the purposes indicated in this statement. The data will be stored, as far as the Company is concerned, at the offices of the Company and at the data processors appointed by the Company (as well as at the third parties indicated in this statement to whom the data are communicated and who process them as autonomous data controllers). The data will also be organized in databases - databases including computerized databases.
Information updated to 26/06/2023. Previous versions of the information can be found by contacting the Company at the addresses referred to in point 6.