Informativa sulla privacy

This privacy policy is drawn up in accordance with Articles 13-14 of EU Reg. 2016/679, and is intended for all users and visitors of the website www.coverlab.com. This document cancels and completely replaces previously published documents. Please be informed that this site complies with EU Reg. 2016/679 (GDPR), which protects individuals with regard to the processing of personal data. The processing of your data will therefore take place in compliance with the principles of fairness, lawfulness and transparency, protecting your privacy and your rights. 1 Who processes the data? By using the site, your personal data will be processed by the Data Controller: COVERLAB SRL with registered office in Via Mantova 91A, 43122 Parma (PR), Italy, VAT number 04407230400; owner of the website; e-mail: privacy@coverlab.com 2 For what purposes, on what legal basis and for how long? A) MANAGE USER ACCESS AND NAVIGATION Information on the processing of navigation data and cookies is detailed in the Cookie Policy available at the following link: https://coverlab.com/cookie-policy B) PLATFORM REGISTRATION By registering on the website, the user can use all services dedicated to members and available in their reserved area. Legal basis The legal basis for processing such data is the contract between the user and COVERLAB SRL, for the use of our services, including making purchases on the site. Retention period The processing of data relating to the registered account will take place until the user requests the account's deletion. C) MANAGEMENT OF THE PURCHASE CONTRACT, PAYMENTS AND ADMINISTRATIVE PURPOSES Through e-commerce purchases, COVERLAB SRL will collect the data necessary to complete the requested order. Contact information may be shared with external companies and carriers responsible for deliveries. Information related to economic transactions is managed through external payment services (e.g., PayPal, Stripe, Klarna). Legal basis The legal basis for the processing of such data is the execution of contractual measures adopted at the request of the data subject. The retention of administrative documents by COVERLAB SRL is carried out on the basis of a legal obligation. Retention period Data relating to orders placed by the user will be processed for the time necessary to complete the requested order, and subsequently retained according to legal requirements (10 years). D) MARKETING ACTIVITIES D1) SENDING DEM AND NEWSLETTERS Newsletter subscription is entirely optional. The newsletter and DEM sending service will be carried out through automated systems and mailing tools provided by Klaviyo, an external company appointed as Data Processor. The content of marketing communications may concern, for example: products, contexts of use of products in the online shop catalog, images, videos or other multimedia content related to COVERLAB SRL's products or brands. Legal basis The legal basis for this data processing is the consent given at the time of requesting newsletter subscription or during the purchase flow. Retention period The processing of contact data for this purpose will take place until the user expresses the wish not to subscribe to the service anymore (through a specific link in each communication, or, in case of a registered user, through the preference center accessible in their reserved area) or if the email address is no longer active. D2) AUTOMATIC CART RECOVERY FUNCTION Cart recovery invitations are addressed to users who have initiated the purchase process without finalizing it. The service involves sending communications via marketing automation tools managed by Klaviyo, an external company appointed as Data Processor. Legal basis The legal basis for this data processing is the consent given at the time of requesting newsletter subscription or during the purchase flow. Retention period Data related to products added to the cart and the user's contact details are processed for this purpose for a maximum of 96 hours after the cart abandonment on the e-commerce site. D3) UP-SELLING AND CROSS-SELLING ACTIVITIES Up-selling and cross-selling activities involve promotional and marketing communications aimed solely at registered users who have used the e-commerce site logged in and have completed a purchase. The service involves sending communications via marketing automation tools managed by Klaviyo, an external company appointed as Data Processor. The content of the communication may concern products marketed on the platform, also related or connected to purchases made by the user. Legal basis This data is collected based on consent for profiling purposes, expressed by the user during registration and absolutely optional. The data subject retains the right to object to receiving these communications through the unsubscribe option available in the received communications or in the preference center accessible in the reserved area. Any refusal to give consent may result in the inability to receive information on promotions, discounts, and offers. Retention period Data relating to purchases made and the user's contact data are processed for this purpose for a maximum of 6 months after the purchase made on the e-commerce site, or until the user expresses the wish not to subscribe to the service anymore, or if the email address is no longer active. E) CUSTOMER SERVICE AND MANAGEMENT OF USERS' EXERCISE OF RIGHTS REQUESTS In case of a request to exercise a right, as indicated in point 7 of this policy, identifying data of the applicant may be requested, which will be processed based on the legal obligations to which COVERLAB SRL is subject in order to confirm the taking charge of the request, verify its suitability, and carry out the necessary activities to proceed. Any refusal to provide data for this purpose will make it impossible for COVERLAB SRL to satisfy the user's request, who will therefore not be able to exercise their rights. Legal basis Processing of data necessary to provide a service requested by the data subject, and/or to fulfill a legal obligation. Retention period The data requested from the data subject for this purpose will be processed for the time necessary to manage and close the case and may be stored for the time necessary to certify the fulfillment of the advanced request. F) PURSUING JUSTICE Personal data collected through website navigation and through the use of its functions may be processed by COVERLAB SRL for the purpose of ascertaining, exercising or defending its own right. Legal basis For the purpose in question, data initially collected for a different purpose are used, the processing of which is based on the legitimate interest of the controller (Article 6 letter f EU Reg. 2016/679). Retention period Up to a maximum of 10 years from their collection or from the achievement of the purpose for which they were originally collected. 3 How will it be processed? The platform is developed in a Shopify environment, which processes data as a Data Processor. In relation to the stated purposes, the processing of personal data takes place through manual/analog and IT/electronic/telematics supports and tools, and also by resorting to automatic tools suitable for connecting the data in question with those of other subjects based on qualitative, quantitative, and temporal criteria, recurring or definable from time to time, with logics and forms of data organization strictly correlated to the purposes of the processing, always in order to guarantee the security and confidentiality of the data itself. 4 Am I obliged to provide the data? Apart from what is specified for navigation data, the user is free to provide their personal data. Given that COVERLAB SRL has organized its activity by limiting the collection of personal data according to a principle of strict necessity, in the execution of certain operations, such as filling out forms, the failure to provide the data indicated as necessary may make it impossible to complete the requested operations. We also remind you that any consent you may have given for marketing activities can be withdrawn at any time through the preference center accessible in your reserved area. 5 To whom will it be communicated? Will the data be disseminated? Dissemination: Your personal data will NOT be disseminated in any other case. Communication: Data may be communicated to those subjects, including public authorities, who have access to data by virtue of regulatory or administrative provisions. Furthermore, your personal data may be made accessible to: • Employees and/or authorized collaborators appointed as data processors; • Cellularline Group companies, of which Coverlab Srl is a part, within the scope of administrative and strategic support activities; • Shopify, as a PaaS (Platform As A Service) provider of e-commerce services; • Other third-party companies, consultants, or professionals appointed as Data Processors, including IT providers of modules and services integrated into the Shopify environment, or who carry out maintenance activities, mailing and marketing automation services, cloud services, including, in particular: o Klaviyo – marketing and marketing automation activity management o ZenDesk – customer service activity management The complete list of data recipients is available at the headquarters of COVERLAB SRL. 6 Where will it be stored? The data will be stored mainly at the Controller's offices in the European Union, and at its suppliers, also located outside the European Union. Specifically, for marketing and marketing automation operations (purposes D1, D2 and D3), as well as customer service management and data archiving, the involvement of suppliers based in the United States is foreseen. Such data transfers are made compliant with Chapter V of EU Reg. 2016/679 through security measures and contractual agreements based on the Standard Contractual Clauses approved by the European Commission. 7 What are your rights? As a data subject, you have a series of rights, pursuant to Articles 15-22 of Regulation (EU) 2016/679, such as: • Right to access your personal data (once confirmed that the data is being processed by the Controller); • Right to obtain the rectification and integration of your data; • Right to obtain the erasure of your data; • Right to obtain restriction of processing of your personal data under certain conditions; • Right to receive personal data provided to the Controller in a structured, commonly used format, and to transmit it to a different Controller; • Right to object to the processing of personal data where there are reasons related to your personal situation; • Right not to be subject to automated decision-making; • Right to obtain communication in the event that your data suffers a serious breach; • Right to withdraw consent to processing at any time; • Right to lodge a complaint with a supervisory authority The Controller undertakes to make the exercise of rights by data subjects as easy as possible. To request the exercise of rights, or for any doubt or need related to the processing of personal data, you can contact COVERLAB SRL by e-mail at privacy@coverlab.com. 8 Update of this policy Date of last update of this policy: June 8, 2022