Privacy Policy

PURPOSE

CATEGORIES OF PERSONAL DATA

PRINCIPLE OF LAWFULNESS

PERIOD OF STORAGE

REFERENCE ON RECORDS OF PROCESSING ACTIVITY

Online sale as a guest user (with no registration on the website)

Name

Surname

Correo electrónico

Phone number

City

Country

Credit card information

Cookies and IP address (EC4)

- Execution of a contract

- Legal obligation of the Data Controller

Execution of a contract

10 years from the last access

EC1

Registration on the website with the purpose to facilitate a future purchase or registration at the same time of the purchase

EC2

Replying to the enquiries of the users (both, for pre-sale and post-sale matters as doubts, returns, withdrawals, non-compliance problems)

EC3

Facilitation in navigation / Cookies

Legitimate Interests

Up to the end of the session

EC4

PURPOSE

CATEGORIES OF PERSONAL DATA

PRINCIPLE OF LAWFULNESS

PERIOD OF STORAGE

REFERENCE ON RECORDS OF PROCESSING ACTIVITY

Marketing communications

Name

E-mail

Consent

Up to the withdrawal of the consent

M1

Social Media Marketing (Interaction with the customers on the Facebook and Instagram fan page of Playtomic). Please consider that, with reference to the function “Insight” of Facebook, related to your visit statistics, we are joint controller with Facebook Ireland Limited (“Facebook Ireland”).

M5

Marketing communications (so called “soft-spam”) aimed to communicate to the users information related to a product similar to the one that you purchased.

Name

E-mail

- Section 7.2.2 (a) Spanish Code of conduct for data processing in the advertising business

- Section 130, p. 4 Italian Privacy Code

- Section 21, p. 2 Ley 34/2002 (Spanish law of 11th July 2002 on information society services and electronic commerce)

Up to the users subscribes

M6

PURPOSE

CATEGORIES OF PERSONAL DATA PERSONALES

PRINCIPLE OF LAWFULNESS

PERIOD OF STORAGE

REFERENCE ON RECORDS OF PROCESSING ACTIVITY

Research and Development of new products / features

Name

Surname

E-mail

Phone number

Legitimate interest

Up to the end of the intervention

RD1

Maintenance, operation and security of IT services

All your personal data

Legitimate interest

Legal obligation

Up to the end of the intervention

CT1

Identification, analysis and management of company data for a proper performance of the business

Name

Surname

E-mail

Legitimate interest

Up to the end of the intervention

B1

DATA PROVISION

- In all those cases in which we ask for consent to the processing of Your personal data, their provision is purely optional. Consequently, failure to provide Your personal data will have no consequences, other than in terms of the impossibility of processing the data for such specific purposes.

- In all other cases where we do not ask for consent to the processing of Your personal data, their provision is mandatory and necessary to comply with contractual or legal provisions and for the purpose of the proper conduct of business. Consequently, failure to provide such information would not make it possible to comply with these requirements and to carry out business activities properly.

- If the User is a legal person, Playtomic does not deem it necessary to possess personal data relating to its representatives or collaborators; however, in the awareness that the characteristics of the email address entered during registration (for example, consisting of the name-surname string), may lead to the occurrence of this circumstance, it will also process such data in the manner indicated in this information that the User therefore undertakes to deliver to all his representatives / collaborators who, for the reasons highlighted above, find themselves transmitting their personal data to Playtomic.

CATEGORIES OF RECIPIENTS

In addition to the Data Processors above mentioned, your personal data could be shared with further Data Controllers:

(i) subsidiaries and affiliates companies;

(ii) revenue authorities or other authorities, if it is required by the applicable law;

(iii) legal consultants;

(iv) banks / payment-services providers.

AUTOMATED DECISION- MAKING PROCESS

There are no automated decision-making procedures

TRANSFERS EXTRA EU OR TO INTERNATIONAL ORGANIZATIONS

Some Data Processors, in providing their services to the Data Controller, may transfer your personal data to servers located in non-EU territory. Please note that not all non-EU countries guarantee the same European safety standards; by giving consent to the processing of your data, where applicable, you also consent to their transfer to servers located in these territories.

LEGITIMATE INTEREST OF DATA CONTROLLER

The legitimate interest of the Data Controller indicated for the following purpose:

(i) Facilitation in navigation / cookies (ref. EC4): is the correct and fluid operation of the site;

(ii) Research and Development of new products / features (ref. RD1) and Identification, analysis and management of company data for a proper performance of the business (B1): is the ordinary interest in the evolution of the company;

(iii) (iii) Maintenance, operation and security of IT services (ref. CT1): is the proper and safe conduct of the business activity.

SOURCE ORIGINATING THE DATA

Your data could be provided by IT providers (e.g. Google Login) and social networks (e.g. Facebook Login, Fan Page).

RIGHTS

DESCRIPTION

ACCESS

(see Article 15 GDPR)

The data subject shall have the right to obtain from the Data Controller confirmation as to whether or not personal data concerning him are being processed, and, where that is the case, access to the personal data and to the following information: purpose of management, categories of processed data, recipients (if any), transfer and adequate guarantees (if any), period for which personal data will be stored, rights of data subjects, existence of an automated decision-making process (if any). The Data Controller provides a copy of personal data. If the request is made by electronic means, information are supplied in a commonly used electronic format, unless otherwise indicated.

RECTIFICATION

(see Article 16 GDPR)

The data subject has the right to obtain the rectification of wrong personal data and the integration of incomplete personal data.

ERASURE

(see Article 17 GDPR)

The data subject shall have the right to obtain from the Data Controller the erasure of his personal data in the following cases: the personal data are no longer necessary in relation to the purpose for which they were collected or otherwise processed, withdrawal of consent (and there is no other legal bases for the processing), he opposes the processing for the reasons related to his particular situation (and the are no overriding legitimate grounds for the processing), he opposes the processing for direct marketing purposes, the personal data have been unlawfully processed, the personal data have to be erased for compliance with legal obligation, the data have been collected in relation to the offer of information society services. The right shall not apply if the processing is necessary for exercising the right of freedom of expression and information, for compliance with legal obligation, for the performance of a task carried out in the public interest or in the exercise of official authority, for reasons of public interest in the area of public health, for archiving purpose in the public interest, scientific and historical research purpose or statistical purpose, for the establishment, exercise or defence of legal claim.

RESTRICTION OF PROCESSING

(see Article 18 GDPR)

The data subject shall have the right of object to processing of personal data if (i) it is based on public interest or legitimate interest and (ii) if personal data are processed for direct marketing purpose, including profiling.

DATA PORTABILITY

(see Article 20 GDPR)

The data subject shall have the right to receive the personal data concerning him or her, which he or she has provided to a Data Controller, in a structured, commonly used and machine- readable format (applicable to automated decision- making processes).

OBJECTION

(see Article 21 GDPR)

The data subject shall have the right of object to processing of personal data if (i) it is based on public interest or legitimate interest and (ii) if personal data are processed for direct marketing purpose, including profiling.

WITHDRAWAL

(see Article 7, d3)

The data subject has the right to withdraw the consent any time without affect the lawfulness of processing based on the consent before withdrawal.

COMPLAINT

(see Article 13, d.2, d)

The data subject has the right to pledge a complaint with a supervisory authority.