This privacy notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “Regulation”) and is addressed to those who interact with the services of the website www.etilika.it and of the related app (the “Website”), whether by simply consulting the Website or by using specific services made available through the Website (for example, purchasing products, filling in the online forms to subscribe to the newsletter service, reading our reviews).
In accordance with data protection legislation, the processing of your personal data will be based on the principles of lawfulness, fairness, transparency, purpose limitation, storage limitation, data minimisation and confidentiality, as well as on the principle of accountability set out in Article 5 of the Regulation.
1. data controller and contact details
The data controller is Vintalia S.r.l. (the “Controller”), with registered office in Rome, Via Lussimpiccolo, 94. The Controller may be contacted at any time with reference to this privacy notice and for any question concerning the processing of your data by sending an e-mail to the following address: privacy@vintalia.it.
2. personal data processed
The personal data processed may consist of an identifier such as your name, an identification number, an online identifier (username), billing address and details, shipping address and details, age, gender and photograph for your account, purchase history, IBAN in the event of a refund, and any further data you wish to provide to us (hereinafter “Personal Data”).
In addition, the following categories of data are processed through the Website:
a. Browsing data
The IT systems and software procedures used to operate the Website acquire, in the course of their normal operation, certain personal data whose transmission is implicit in the use of Internet communication protocols. This information is not collected in order to be associated with identified data subjects, but by its very nature could, through processing and association with data held by third parties, allow users to be identified. This category of data includes the IP addresses or domain names of the computers used by users connecting to the Website, the URI (Uniform Resource Identifier) addresses of the requested resources, the time of the request, the method used to submit the request to the server, the size of the file obtained in response, the numerical code indicating the status of the response given by the server (successful, error, etc.) and other parameters relating to the user’s operating system and IT environment. These data are used solely to obtain anonymous statistical information on the use of the Website, to check that it is working properly and to identify anomalies and/or abuse; in any case, they are deleted immediately after processing. The data may be used to establish liability in the event of hypothetical computer crimes against the Website or third parties.
b. Data voluntarily provided by the user
Without prejudice to any reference to specific notices contained therein, this privacy notice also applies to the processing of data that you voluntarily enter in the forms on the Website. With regard to such forms, we ask you not to enter any information that may fall within the special categories of personal data referred to in Article 9 of the Regulation ([…]personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation).
c. Third-party data voluntarily provided by the user
When using the services of the Website, Personal Data of third parties that you provide to the Controller may be processed (for example, when purchasing products to be shipped to third parties). In such cases, you act as an independent data controller and assume all the related legal obligations and responsibilities. Accordingly, you fully indemnify the Controller in this respect against any dispute, claim, demand for compensation for damage arising from processing, etc. that the Controller may receive from third parties whose personal data have been processed through your use of the services of the Website in breach of the applicable rules on the protection of Personal Data. In any case, if you provide or otherwise process personal data of third parties when using the Website, you warrant as of now, assuming all related responsibility, that such processing is based, where necessary, on your having previously obtained the third party’s consent to the processing of the information concerning them.
d. Cookies and other tracking technologies
Information on the cookies served by the Website is available here: https://www.etilika.it/info/cookie-policy.
3. purposes of the processing
Your Personal Data will be processed, with your consent where required, for the following purposes:
i. to enable browsing of the Website and the provision of the services made available by the Controller, including the management of the Website’s security, as well as of contractual, administrative and accounting relations;
ii. to respond to specific requests addressed to the Controller, including customer service requests;
iii. to comply with any obligations laid down by applicable laws, regulations or EU legislation, or to meet requests from the authorities;
iv. to carry out direct marketing by e-mail for products similar to those you have purchased, pursuant to Article 130, paragraph 4 of Legislative Decree no. 196/2003, unless you expressly refuse to receive such communications, which you may do when registering on the Website or on subsequent occasions;
v. to send you promotional and marketing communications, including newsletters and market research, by automated means (SMS, MMS, e-mail, push notifications) and non-automated means (paper mail, telephone calls with an operator); please note that the Controller collects a single consent for the marketing purposes described here, in accordance with the General Provision of the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) "Guidelines on promotional activities and combating spam” of 4 July 2013; in any case, should you wish to object to the processing of your data for marketing purposes carried out by the means indicated here, you may do so at any time by contacting the Controller at the contact details indicated in the "Contacts" section of this notice, without affecting the lawfulness of processing based on consent given before its withdrawal;
vi. to disclose your Personal Data to other companies of the group so that they may send promotional and marketing communications, including newsletters and market research, by automated means (SMS, MMS, e-mail, push notifications) and non-automated means (paper mail, telephone calls with an operator);
vii. for statistical purposes, without it being possible to trace your identity.
Specific security measures are in place to prevent the loss of data, unlawful or improper use and unauthorised access.
4. legal basis and mandatory or optional nature of the processing
The legal basis for the processing of Personal Data for the purposes referred to in points 3(i) and 3(ii) is Article 6(1)(b) of the Regulation, according to which “[…]processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract”, since the processing is necessary for the provision of the services. Providing Personal Data for these purposes is optional, but failure to provide them would make it impossible to respond to your requests.
The purpose referred to in point 3(iii) constitutes lawful processing of Personal Data pursuant to Article 6(1)(c) of the Regulation, according to which “[…] processing is necessary for compliance with a legal obligation to which the controller is subject”. Once the Personal Data have been provided, the processing is in fact necessary to comply with legal obligations to which the Controller is subject.
The processing carried out for the purposes of marketing and disclosure to group companies described in points 3(v) and 3(vi) is based on your consent pursuant to Article 6(1)(a), according to which “[…] the data subject has given consent to the processing of his or her personal data for one or more specific purposes”, and Article 22(2)(c) of the Regulation. Providing your Personal Data for these purposes is therefore entirely optional and does not affect your use of the services. Should you wish to object to the processing of your Personal Data for marketing or disclosure purposes, you may do so at any time by contacting the Controller at the e-mail address: privacy@vintalia.it.
With reference to the purpose referred to in point 3(iv), please note that where the Controller uses, for the direct sale of its own products or services, the e-mail address provided by the data subject in the context of the sale of a product, it may, pursuant to Article 130, paragraph 4 of the Code, refrain from requesting the data subject’s consent, provided that the products are similar to those sold and the data subject, having been adequately informed, does not refuse such use, either initially or on the occasion of subsequent communications.
Please also note that the processing referred to in point 3(vii) is not carried out on Personal Data and may therefore be freely carried out by the Controller.
5. recipients of the personal data
Vintalia s.r.l. puts privacy first. For this reason, it does not transfer your Personal Data to third parties for commercial purposes; your Personal Data are processed exclusively by the Controller and, where you consent, by the companies of the group.
For the purposes indicated above, your Personal Data may be disclosed exclusively to the following recipients (the “Recipients”):
i. parties typically acting as data processors pursuant to Article 28 of the Regulation, namely: i) individuals, companies or professional firms providing assistance and advice to the Controller in accounting, administrative, legal, tax and financial matters; ii) parties appointed to carry out technical maintenance of the website and of the information system; iii) service providers used by the controllers to achieve the purposes referred to in point 4 (e.g. app developers and providers of server hosting, mailing list, electronic communication system, chatbot and shipping services); always in compliance with the principle of data minimisation, limiting the processing to the data strictly necessary to achieve the specific purpose;
ii. parties, bodies or authorities to which your Personal Data must be disclosed by virtue of legal provisions or orders of the authorities;
iii. persons authorised by the Controller, pursuant to Article 29 of the Regulation, to process the personal data necessary to carry out activities strictly related to the provision of the services, who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
iv. group companies, solely for the pursuit of the purposes referred to in point (vii), subject to your explicit consent (as further specified in point 4).
The full list of data processors is available upon written request to the Controller.
6. retention of personal data
Personal Data processed for the purposes referred to in points 3(i) and 3(ii) will be retained until your account is closed or, in the case of requests made without creating an account, for the time strictly necessary to achieve those purposes. In any case, with reference to point 3(i), since the processing is carried out for the provision of services, the Controller will retain the Personal Data for the period of time provided for and permitted by Italian law to protect its own interests (Art. 2946 et seq. of the Italian Civil Code).
Personal Data processed for the purposes referred to in point 3(iii) will be retained for the period required by the specific applicable legal obligation or provision of law.
For the purposes referred to in point 3(iv), your Personal Data will be processed until you object to the processing.
For the purposes referred to in point 3(v), your Personal Data will be processed until your account is closed or, in the case of requests made without creating an account, for a maximum of 24 months from your last interaction on the Website or, in any case, until you withdraw your consent to the processing for those purposes.
In any case, the Controller may retain your Personal Data for the period of time provided for and permitted by Italian law to protect its own interests (Art. 2947(1)(3) of the Italian Civil Code).
7. rights of the data subject
Pursuant to Articles 15 to 22 of the Regulation, you have the right at any time to obtain confirmation as to whether or not your Personal Data exist and to know their content and source, to verify their accuracy or request that they be supplemented, updated or rectified; you have the right to request the restriction of processing in the cases provided for by Article 18 of the Regulation, where technically possible; to request the erasure of the Personal Data concerning you in the cases provided for by Article 17 of the Regulation; to receive the Personal Data concerning you in a structured, commonly used and machine-readable format in the cases provided for by Article 20 of the Regulation; and to object to their processing in the cases provided for by Article 21 of the Regulation.
In any case, you always have the right to lodge a complaint with the competent supervisory authority (Garante per la protezione dei Dati personali), pursuant to Article 77 of the Regulation, if you consider that the processing of your Personal Data infringes the legislation in force.
8. changes
The Controller reserves the right to amend or simply update the content of this privacy notice, in part or in full, including as a result of changes in the applicable legislation. The Controller therefore invites you to visit this section regularly in order to be aware of the most recent and up-to-date version of the privacy notice, so that you are always informed about the Personal Data collected and how they are used.