pursuant to EU Regulation No. 679/2016 (“GDPR”) and Legislative Decree No. 196/2003
as amended by Legislative Decree No. 101/2018
This policy (hereinafter the “Policy”) describes how MM Profumi S.r.l. (hereinafter the “Data Controller”) collects and processes the personal data of users who browse and/or interact (hereinafter the “Data Subjects”) with the website www.montaleparfums.com/ita/en (hereinafter the “Website”).
The Policy may be subject to change; therefore, the Data Controller invites users to consult it regularly.
Please note that this Policy applies solely to the aforementioned Website and not to any other websites that the user may access via links.
EXTENDED PRIVACY POLICY
1. Data subject to processing
The Data Controller collects certain categories of personal data (hereinafter referred to as the “Data”) through browsing and use of the Website. In particular:
1. personal data, both identifying and non-sensitive (in particular, first name, surname, tax code, VAT number, email address, telephone number) provided directly by Data Subjects when registering on the Website and/or requesting to use the e-commerce service and other individual services offered;
2. data provided directly by Data Subjects – and in any event collected within the limits set out in Article 14(5) of the GDPR – the transmission of which is linked to the use of Internet communication protocols (by way of example only: page views, volume of data transferred, status messages regarding access events, session ID numbers, IP addresses, URLs, etc.) . For further information on this type of data and its processing, please refer to the cookies policy: https://montaleparfums.com/ita/en/content/17-cookies-policy
2. Purposes and legal basis for the processing of Data
The Data Controller processes the Data of Data Subjects for one or more of the purposes set out below.
A) Registration on the Website and/or the management of purchase orders and related activities (provision of the e-commerce service, sales and after-sales customer support, communications with the customer regarding the status of the order (including via the online ‘guest order tracking’ form), payment processing, complaints, and home delivery); as well as to ensure proper compliance with legal obligations.
Legal basis: processing is necessary: (i) for the performance of a contract to which the data subject is a party or for the implementation of pre-contractual measures taken at the data subject’s request; (ii) to comply with a legal obligation to which the data controller is subject (Articles 6(1)(b) and (c) of the GDPR).
B) Sending commercial communications via traditional means (ordinary post and telephone with an operator) or automated means (email, automated telephone calls, SMS, RCS, MMS, fax, social media, WhatsApp, Telegram) relating to the data controller’s products and activities
Legal basis: Consent (Article 6(a) of the GDPR): the data subject has given their consent to the processing of their data.
C) Responding to requests for information made by the data subject by completing the relevant form in the ‘Contact’ section.
Legal basis: the processing is necessary for the performance of pre-contractual measures taken at the request of the data subject (Article 6(1)(b) of the GDPR).
3. Data retention period
Personal data will be processed for as long as is necessary to fulfil the purposes set out above. Once this period has elapsed, in accordance with the principle of necessity, the data will be retained for the period required by Italian law for the retention of invoices (10 years pursuant to Article 2220 of the Civil Code), as well as for the period necessary to fulfil any further legal obligations.
Subject to the above, the data subject may delete their account at any time. Deleting the account does not entail the deletion of data retained for the purposes set out in the previous paragraph. If the user does not voluntarily delete their account, the data relating to it will in any case be deleted three years after the last recorded access to the online platform.
Data processed for the purposes referred to in point (b) above are retained until consent is withdrawn, and in any event for no longer than two years from the last expression of interest in the content of the advertising communication sent (click on the email or on internal links).
Data processed for the purposes referred to in point (c) above is retained only until the purpose of responding to the requests for information submitted has been fulfilled, and is retained for a maximum period of one month from the date on which the request is finally dealt with.
4. Methods of Data Processing
Data processing is carried out by means of the operations set out in Article 4(2) of the GDPR, namely: collection, recording, organisation, storage, consultation, processing, modification, selection, retrieval, comparison, use, interconnection, blocking, disclosure, erasure and destruction of data. The processing of Data shall be based on the principles of fairness, lawfulness and transparency and may also be carried out using automated means designed to store, manage and transmit the Data; it shall be carried out using appropriate tools, insofar as is reasonable and in accordance with the state of the art, to ensure security and confidentiality through the use of suitable procedures that prevent the risk of loss, unauthorised access, unlawful use and disclosure.
5. Recipients or categories of recipients of the Data
The Data provided will be disclosed to recipients who will process the data in their capacity as data processors (Article 28 of EU Regulation 2016/679) and/or as natural persons acting under the authority of the Data Controller and the Data Processor (Article 29 of EU Regulation 2016/679), for the purposes listed above.
Specifically, the data will be disclosed to: - entities providing services for the management of the information system and communication networks (including email); - firms or companies in the context of assistance and consultancy relationships; - competent authorities for the fulfilment of legal obligations and/or provisions issued by public bodies, upon request; - for administrative and accounting purposes, the data may, where necessary, be transmitted to credit reference agencies for the assessment of creditworthiness and payment habits and/or to entities for debt recovery purposes. Entities belonging to the above categories act as Data Processors, or operate entirely independently as separate Data Controllers. The complete and up-to-date list of Data Processors may be requested from the Data Controller using the contact details set out in Article 10 below.
The recipients of the data also include other companies that provide services essential to the proper processing of the order, acting as independent data controllers (e.g. payment service providers, etc.).
The data may also be disclosed to public bodies in compliance with legal obligations (including the Italian Revenue Agency).
6. Data transfers to a third country
The use of our website and its features may involve data transfers to countries outside the European Union.
In such cases, where those countries do not benefit from an adequacy decision under the GDPR, various measures are put in place to ensure that Personal Data transferred to those countries is adequately protected in accordance with the provisions of the GDPR.
Indeed, if we transfer Personal Data to third parties outside the European Union, this is always in accordance with the provisions of the GDPR and, consequently, we take all appropriate measures to protect Personal Data, in particular by using standard contractual clauses approved by the European Commission.
The transfer of Personal Data from the European Union to the USA also provides for an adequate level of data protection under the Data Privacy Framework adopted by the European Commission on 10 July 2023.
7. Nature of the provision of data
The provision of data for the purposes referred to in points (a) and (c) is necessary for the proper fulfilment of pre-contractual and contractual obligations with the Data Controller; therefore, failure to provide such data will preclude the possibility of concluding contracts between the data subject and the Data Controller.
The provision of data for the purposes referred to in point (b) is optional, as failure to provide such data will result in the inability to send commercial communications, without any impact on the normal performance of the contractual relationship.
8. Absence of automated decision-making
The Data Controller does not use any automated decision-making processes, including profiling as referred to in Article 22(1) and (4) of the GDPR
9. Rights of data subjects
Subject to the cases provided for in Article 23 of the GDPR, you may exercise the rights set out in Articles 15–22 of the GDPR vis-à-vis the Data Controller by sending an email to privacy@mmprofumi.it, and thereby request:
- confirmation as to whether or not your personal data is being processed and, if so, the right to access it (right of access) – Article 15;
- the rectification of inaccurate personal data, or the completion of incomplete personal data (right to rectification) – Article 16;
- the erasure of such data, where one of the grounds set out in the Regulation applies (right to be forgotten) (Article 17);
- the restriction of processing where one of the circumstances set out in the Regulation applies (right to restriction) (Article 18);
- to receive, in a structured, commonly used and machine-readable format, the personal data you have provided to the data controller and to transmit such data to another data controller (right to data portability) (Article 20);
- to object to the processing of personal data (right to object) (Article 21).
- the right not to be subject to a decision based solely on automated processing, including profiling (automated decision-making relating to natural persons) – Article 22.
In addition to the above, should you consider that your rights have been infringed, you may lodge a complaint with the Data Protection Authority using the following contact details:
a) by registered letter with acknowledgement of receipt addressed to: Garante per la protezione dei dati personali, Piazza Venezia, 11 - 00187 Rome
b) by certified email addressed to: protocollo@pec.gpdp.it
10. Data Controller
MM Profumi S.r.l., with its registered office at Corso Garibaldi 50, Milan
The Data Controller’s contact email address is privacy@mmprofumi.it
