VIP CLUB and E-COMMERCE Policy
Information pursuant to Art. 13 of Regulation (EU) 2016/679 on the Processing of Personal Data
The company Whitebridge Pet Brands S.r.l., hereby informs you of the information regarding the processing of your personal data acquired by the Data Controller when you registered in the VIP CLUB by filling in the relative form on the Company's website, of the personal data subsequently acquired as part of the activities and initiatives connected to this registration and of the personal data you provide when making purchases through the Company's website by filling in the relative forms.
Please note that the purchase of products via the Company's website is reserved for VIP Club members.
The Data Controller is Whitebridge Pet Brands S.r.l., with registered office in Milan (MI), post code 20122, Viale Bianca Maria no. 25, and with operating office in Genoa (GE), post code 16122, Via Martin Piaggio no. 13/a, VAT number 03765340967, in the person of its legal representative pro tempore (hereinafter referred to as the "Company" or "the Data Controller").
Contact details of the Data Protection Officer (DPO)
The Data Protection Officer (DPO) may be contacted by e-mail at firstname.lastname@example.org and/or by ordinary mail, by writing to the attention of the DPO at the Company's operational headquarters at Via Martin Piaggio no. 13/a, 16122, Genoa.
Categories of data processed
The Company will process your personal data, which may include, but is not limited to:
- identifying data: first name, surname, address;
- contact data: e-mail address, telephone number, delivery address for any products purchased and/or otherwise shipped by the Data Controller;
- data relating to the account created (username and password);
- data on the number and type of your pets that you have provided on the website;
- data on the eating habits of your pets that you have provided on the website;
- data relating to products or services purchased;
- data on the payment system used;
- data acquired by the Data Controller during the execution of a contract for the purchase of a product offered by the Data Controller;
- data on your pet's eating habits deduced from any purchases;
- the result of your profiling based on your purchase history, where you have given your consent to such processing;
- data on your transactions and actions performed by opening links in promotional e-mails.
Purpose of data processing
Your personal data will be processed on the basis of the provisions of Regulation (EU) 2016/679, the relevant laws and regulations and the provisions of the Data Protection Authority and other Supervisory Authorities for the following purposes:
- to register for VIP CLUB membership, by means of which you will be able to access the benefits provided in the VIP CLUB reserved area, participate in events and receive prizes reserved for members;
- to deliver to you the prizes awarded following your participation in the prize events reserved for VIP CLUB members;
- to fulfil legal obligations to which the company is subject;
- for the sending of commercial proposals by the Company, by means of the e-mail address provided upon registration;
- log data generated when you open links in promotional e-mails sent to you and associated with your e-mail address will be processed to profile your behaviour in relation to the operations you perform. Based on the number of operations (clicks) you perform on the links, which are detected by the computer systems, your e-mail address will be included in a profiling band on the basis of which it will be automatically determined how many links will be included in the promotional e-mails that are subsequently sent to you;
- the data on your pet which you provide by filling in the form on the site will be used for profiling activities aimed at sending commercial information;
- to enable you to proceed with the purchase of the Company's products via its website;
- to enable you to receive products purchased via the Company's website;
- for any communications relating to the shipment of the order;
- for the sending of commercial proposals by the Company, by means of the e-mail address provided by you at the time of purchase, concerning products similar to those purchased by you;
- the data relating to your purchases will be processed by the Company, subject to your consent, to carry out profiling activities and to send you commercial proposals, by e-mail, based on the result of the profiling carried out;
- your personal data may be processed for the protection of the Data Controller's rights.
Legal basis for processing
The legal basis for the processing of your personal data necessary for thepurposeof your membership in the VIP CLUB, which enables you to receive the benefits and participate in the initiatives connected with such membership (the purposes of points 1 and 2 above), is the execution of the contract, i.e. membership in the VIP CLUB and related events.
The legal basis for the processing of your personal data for the purpose of point 3 above is the legal obligations to which the Data Controller is subject.
The legal basis for the processing of your personal data for the purposes of points 4, 5 and 6, i.e. for the sending of commercial communications and profiling activities by the Company for marketing purposes as a result of your membership to the VIP CLUB, is the legitimate interest of the Data Controller, balanced against the impairment of the rights and freedoms of the data subject, which has been found to prevail on the basis of the balancing test carried out by the Data Controller and available at the end of this notice.
The legal basis for the processing of your personal data necessary to proceed with the purchase of the Company's products through its website and for the shipment of the same, the purposes of points 7, 8 and 9 above, is the execution of the purchase contract.
The legal basis for the processing of your personal data for the purpose of point 10 above, i.e. for sending commercial communications relating to products similar to those purchased by means of your e-mail address used at the time of purchase to conclude the order, is that provided for in Article 130 of Legislative Decree 196/2003 (the so-called Soft spam).
The legal basis for the processing of your personal data for the purpose of point 11above, i.e. to carry out profiling activities based on your purchases, is your consent.
The legal basis for the processing of your personal data for the purpose of point 12 above is the legitimate interest of the Data Controller in the protection of its rights. Such processing is not actual but potential, so the Data Controller will perform the relevant balancing when the need for such processing actually arises, but before performing it.
Cancellation from the VIP CLUB
You may, at any time, ask to be cancelled from the VIP CLUB by clicking on the link for this procedure on the confirmation e-mail received at the time of registration or by writing to email@example.com.
As a consequence of cancellation from the VIP CLUB, processing activities related to this membership will cease, except for data that the Company is obliged to retain to fulfil legal obligations, and the processing of anonymised data.
Objection to the sending of commercial information
You may, at any time, request that commercial communications no longer be sent to you via the e-mail address you provided at the time of your registration, by clicking on the "CANCEL ME" button at the bottom of each communication or by writing to the e-mail address firstname.lastname@example.org.
Consequences of not providing data.
The providing of personal data by filling in the VIP CLUB membership form and the form for the purchase of products marked with an asterisk* is compulsory in order to be able to register for the VIP CLUB and, therefore, by means of such registration, to have access to the benefits reserved for members, to be able to participate in the prize competitions organised by the Company and to receive communications relating to them, as well as to be able to proceed with the purchase of products via the Company's website. Consequently, failure to provide such data will make it impossible to register with the VIP CLUB, to receive information on initiatives and benefits reserved for members, to participate in related initiatives and to proceed with the purchase of products.
Data processing methods
Processing will also be carried out using computerised and electronic means.
Transfer of data to a third country
The company does not transfer data to third countries. Should such a circumstance occur, the Company shall, in advance, supplement this notice to that effect.
The profiling system adopted by the Company as a consequence of your registration in the VIP Club, and on the basis of which your data may be processed, is based on saving the logs generated by the clicks on the links present in the promotional e-mails sent, and associated with your e-mail address. Based on the number of operations detected by the system, you will be automatically assigned a certain profile on the basis of which a greater or lesser number of links will be included in subsequent promotional e-mails in relation to your interest in viewing them, as detected by the system.
The profiling activity based on the data you provide by filling in the forms on the Company's website in the area dedicated to the VIP CLUB is carried out, also using automated systems, by means of key words relating to your PET (e.g.: dog/cat, weight, age, type of diet followed, etc.) used to create homogeneous groups of users based on the types of PETS they possess and, therefore, send commercial communications profiled on the preferences thus identified.
The profiling system adopted by the Company and on the basis of which data relating to products purchased by you may be processed, subject to your consent, is based on the analysis of your purchases made through the Company's website. In detail, based on the products you purchase, homogeneous groups of customers are created who purchase certain products, and targeted commercial communications will be sent to these groups based on the preferences they have shown.
Period of data storage and validity of consent given
Your personal data processed for the purpose of VIP CLUB membership will be stored until your request for cancellation and, in any case, for the duration of validity of your VIP CLUB membership, as stated in the General Terms and Conditions. The data may be stored for a period longer than the one indicated above, if necessary to fulfil legal obligations to which the company is subject (e.g. accounting and tax obligations).
In particular, data relating to prize competitions in which you participate will be stored for the duration foreseen by industry regulations.
In compliance with the EDPB's May 2020 guidelines on consent according to Regulation 2016/679 adopted on 4 May 2020, point 110, in view of the close connection between VIP CLUB membership and the sending of commercial communications aimed at learning about the initiatives and benefits reserved for members, and your expectation of receiving them, precisely as a result of your request for membership, the data communicated or collected for marketing purposes, or for profiling activities aimed at marketing, will be stored for the entire duration of the VIP CLUB initiative and, in any case, for the entire duration of your membership in the VIP CLUB and/or until your request for cancellation from the VIP CLUB and/or until your request to oppose the sending of commercial communications.
In the event of inactivity of your account for a period of more than 24 months, such circumstance will be considered as your loss of interest in the Company's products and initiatives and, consequently, your account will be deactivated, resulting in your cancellation from the VIP CLUB, and you will no longer be sent any communications relating to the Company's products and services.
The data provided by filling in the form relating to the purchase of products via the Company's website will be stored, depending on the purposes for which it is acquired, for the following periods:
- data required to fulfil legal obligations in tax matters will be stored for a period of 10 years after it has been provided;
- data required for the protection of the Data Controller's rights (in contractual and non-contractual matters) will be stored for a period of 10 years after it has been provided;
- the data required for sending commercial communications will be stored for 24 months after it has been provided;
- data relating to the details of your purchases processed for profiling purposes will be stored for a period of 12 months after it is acquired.
In order to carry out certain activities, the Company may communicate your personal data to the following categories of recipients:
- companies entrusted with the support and maintenance of the Data Controller's IT systems;
- communication companies entrusted with the organisation and management of the Company's prize events;
- marketing companies entrusted with the organisation and management of the Company's marketing campaigns;
- company entrusted with management of the Company's website;
- company that owns the platform used for sending commercial communications;
- company entrusted with sending commercial communications;
- communication companies entrusted with the organisation and management of the Company's prize events;
- company entrusted with managing shipments of prizes or promotional products;
- company entrusted with managing shipments of products purchased through the Data Controller's website;
- company entrusted with invoicing on behalf of the Data Controller.
These parties act as specially appointed data processors, for the sole purpose of carrying out the services connected with the performance of the aforementioned activities.
The complete list of appointed data processors, which by its nature is changeable, is available in an up-to-date version by submitting a request to the Data Controller, at any time, by writing to email@example.com.
Employees of the Company, defined as data processors, may also have access to your personal data if the duties of those employees requires this. Each processor is specifically identified, authorised and trained, and acts on the basis of specific instructions provided by the Company regarding the purposes and methods of data processing.
Rights of the Data Subject
The Data Controller informs you that you have the right, pursuant to Art. 15 et seq. of Regulation (EU) 2016/679 and within the limits prescribed by the same, to:
- a) object, at any time, to the processing of data and, in particular, to the processing of data processed for direct marketing purposes, also in relation to services identical to those already provided by the Company, and for profiling purposes (so-called right to object);
(b) obtain data and information on the processing, in particular in relation to the type of data processed, the purposes for which the personal data is processed, the period of processing and the persons to whom the data is disclosed (so-called right of access);
- c) obtain the rectification or supplementing of inaccurate personal data concerning him/her (so-called right to rectification);
- d) obtain the erasure of personal data concerning him/her, in the following cases: (i) the data is no longer necessary for the purposes for which it was collected; (ii) the Data Subject has withdrawn his or her consent to the processing of the data where it is processed on the basis of his or her consent; (iii) the Data Subject has objected to the processing of personal data concerning him or her where it is not processed for a legitimate interest of the Company; (iv) the processing of personal data does not comply with the law. However, the storage of personal data by the Company is lawful if it is necessary to enable it to fulfil a legal obligation or for the establishment, exercise or defence of a legal claim (so-called right to erasure);
- e) obtain that the personal data concerning the Data Subject is only stored, without any other use being made of it, in the following cases: (i) the Data Subject disputes the accuracy of the personal data, for the period necessary to allow the Company to verify the accuracy of such personal data; (ii) the processing is unlawful but the Data Subject nevertheless objects to erasure of the personal data by the Company (iii) the personal data is necessary for the establishment, exercise or defence of a legal claim; (iv) the Data Subject has objected to the processing and verification as to whether our legitimate reasons for processing prevail over those of the Data Subject is being awaited (so-called right to restriction);
- f) receive in a commonly used, machine-readable and interoperable format the personal data concerning the Data Subject, if it is processed by virtue of a contract or on the basis of the Data Subject's consent and/or transmit the data to another data controller, if feasible (so-called right to data portability).
(g) withdraw consent, at any time, to the processing for which it is required. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
The aforementioned rights may be exercised upon request, to be sent to the dedicated e-mail address firstname.lastname@example.org or by writing, by ordinary mail, to the operational headquarters of the company Whitebridge Pet Brands S.r.l. in Via Martin Piaggio no. 13/a, post code 16122, Genoa.
You also have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or significantly affects you in a similar way.
Right to lodge a complaint
If you consider that the processing of your personal data carried out by the Data Controller is in breach of the provisions of the Regulation, you have the right to lodge a complaint with the Office of the Personal Data Supervisory Authority (by e-mail, to the address: email@example.com, or by post, to the Garante per la protezione dei dati personali [Personal data Supervisory Authority], located in Rome (Italy), at Piazza Venezia 11 Scala B, post code 00187), as provided for in Art. 77 of Regulation (EU) 2016/679, or to bring proceedings before the appropriate courts, as provided for in Article 79 of Regulation 2016/679.
LEGITIMATE INTEREST OF THE DATA CONTROLLER
TYPE OF DATA PROCESSED
E-mail address of the user registering for membership of the VIP Club.
Purchasing habits of the user acquired by filling in (optional) specific forms.
PURPOSE OF PROCESSING
Sending of targeted commercial communications, and profiling activities.
CONTEXT IN WHICH PROCESSING IS CARRIED OUT
Processing limited to VIP Club members.
NEED FOR PROCESSING
The Data Controller is in the process of making substantial investments in the digital field, in order to engage as many people as possible who are interested in its products. Failure to process the personal data collected through VIP Club membership for the purpose of sending commercial communications, targeted on the basis of the result of user profiling, would nullify the entire investment in the digital campaign.
IMPACT ON THE DATA SUBJECT AND THEIR REASONABLE EXPECTATION AS TO WHAT WILL HAPPEN TO THEIR PERSONAL DATA
When registering for VIP Club membership, the data subject is aware that the specific purpose of such registration is to access the benefits and participate in the initiatives reserved to VIP Club members, and also has a reasonable expectation and interest that their e-mail address will be used to receive the information for which they have registered for the VIP Club, as well as a reasonable expectation that such communications will be related not to any type of product, but only to those that are plausibly of interest to them, based on the preferences that emerge from the profiling activity carried out by the Data Controller.
ADDITIONAL DATA PROTECTION MEASURES TO LIMIT THE IMPACT OF PROCESSING ON THE DATA SUBJECT
- Sending of an e-mail summarising VIP Club membership;
- automatic deletion from the VIP Club in the event of account inactivity for more than 24 months;
- erasure of data in the event of termination of the VIP Club initiative;
- adoption of a procedure to ensure the implementation of the right to object;
- performance of a DPIA on the computer system that handles the processing of e-mail addresses.
In view of the type of data processed, the context, the purposes, the necessity of the processing, the user's reasonable expectation that their e-mail address will be used to receive the information for which they have registered for VIP Club membership, targeted on the basis of the preferences expressed, and the additional measures adopted, the Data Controller considers that, given the result of the balancing carried out, its interest in carrying out the processing described is overriding with respect to the impact that such processing has on the interests, rights and fundamental freedoms of the Data Subjects.
Drafted on 25.05.2022