POLICY REGARDING THE PROCESSING OF PERSONAL DATA OF USERS ONLINE PURSUANT TO REGULATION (EU) 2016/679, (“GDPR”)

DATA CONTROLLER        

WOMO S.r.l., with registered office in Via Giorgio e Guido Paglia n. 1/D, Bergamo, Italy, Tax code 03840760163, postcode 24122, tel. +39035280011 (“Company”).

 

DATA PROTECTION OFFICER (DPO)  

e-mail: dpo.womo@percassi.it


PERSONAL DATA PROCESSED

Personal information.
Contact data.
Data regarding details of the purchases.

 

 PURPOSE OF DATA PROCESSING

LEGAL BASIS OF THE PROCESSING

DATA STORAGE PERIOD

Registration on the website https://store.womostore.com/ enrolment in any loyalty programmes and/or recording of data in the Company CRM

Execution of a contract to which you are party

Duration of the contract and, following termination, for the standard limitation period of 10 years

Participation in competitions, events, award programmes, loyalty programmes, online initiatives and on social networks

Compliance with responsibilities set out by applicable regulations and national and supranational law

The need to perform legal obligations

Duration provided for by law (10 years for administrative-accounting compliance)

If necessary, to ascertain, exercise or defend the rights of the Data Controller in legal proceedings

Legitimate interest (legal protection)

In the case of legal disputes, for the entire duration of the same, until the end of the time limits for the exercising of impugnment

Out-of-court credit recovery

Legitimate interest (legal protection)

Purposes of direct marketing: for example, the sending - either through automatic means of contact (such as sms, mms, e-mail, social networks, instant messaging apps, push notifications) and traditional means (such as telephone calls with an operator and traditional mail) - of advertising and commercial communications regarding services/products offered by the Company or information regarding company events, as well as surveys on customer satisfaction, market research and statistical analysis

Consent (optional and revocable at any time)

Personal and contact data: until revocation of consent

 

Data regarding purchase details: 7 years from the moment of collection of each item of data

Communication/transferring of data to companies in the Odissea Group: your personal and contact data will be communicated to the companies in the Odissea Group to which WOMO S.r.l. belongs ( L’Innominato S.p.A., D-Retail S.r.l., Hexagon S.p.A., Caio S.r.l., W Italia S.r.l., Siren Coffee S.r.l., Casa Maioli S.r.l., Atalanta Bergamasca Calcio S.p.A., KIKO S.p.A., Madina S.r.l., Bullfrog S.r.l., Platinum S.r.l including companies and brands that from time to time will be part of the group) to allow said companies to carry out marketing activities, for example, the sending - either through automatic means of contact (such as sms, mms, e-mail, social networks, instant messaging apps) and traditional means (such as telephone calls with an operator and traditional mail) - of advertising and commercial communications regarding services/products offered by the companies or information regarding company events, as well as market research and statistical analysis regarding their products

Consent (optional and revocable at any time)

Until revocation of consent

 

 

Objectives of profiling: analysis of your preferences, habits, behaviour and interests.

Consent (optional and revocable at any time)

Personal and contact data: until revocation of consent

 

Data regarding purchase details: 7 years from the moment of collection of each item of data

At the end of the aforementioned periods of conservation, the data will be destroyed, cancelled or made anonymous.

 

 

MANDATORY NATURE OF THE PROVISION OF DATA

Personal and contact data is obligatory for the stipulating of contractual relationships.

 

RECIPIENTS OF THE DATA

The data can be processed by external entities operating as autonomous Data controllers such as, for example, supervisory bodies and authorities. All entities offering electronic payment services on their own circuits are also considered autonomous Data controllers.

Your data may also be processed on behalf of the Company by entities designated as Data processors, who are provided with appropriate operating instructions. Said entities are fundamentally included in the following categories:

a. companies offering e-mail services;

b. companies which offer services for the fulfilment of the purposes indicated in this policy (media agencies, IT suppliers, couriers...);

c. companies offering support in the carrying out of market studies.

The data may also be communicated/transferred to other companies in the group owned by Odissea S.r.l. ( L’Innominato S.p.A., D-Retail S.r.l., Hexagon S.p.A., Caio S.r.l., W Italia S.r.l., Siren Coffee S.r.l., Casa Maioli S.r.l., Atalanta Bergamasca Calcio S.p.A., KIKO S.p.A., Madina S.r.l., Bullfrog S.r.l., Platinum S.r.l including companies and brands that from time to time will be part of the group) for the aforementioned purposes and solely with the prior consent of the data subject, which is optional and may be revoked at any time.

 

ENTITIES AUTHORISED FOR PROCESSING

The data may be processed by employees of the business functions charged with the fulfilment of the purposes indicated above, who are expressly authorised for the processing and have received appropriate operating instructions.

 

TRANSFER OF PERSONAL DATA TO COUNTRIES OUTSIDE OF THE EUROPEAN UNION

There is no provision for the transfer of data outside of the European Union.

 

RIGHTS OF THE DATA SUBJECT - LODGING OF COMPLAINTS WITH THE SUPERVISORY AUTHORITY

By contacting the Privacy Office, by mail, at the address WOMO S.r.l., Via Giorgio e Guido Paglia n. 1/D, 24122 Bergamo, Italy, for the kind attention of the Data Protection Officer, by calling +39 035280111 or by e-mail at the address privacy@percassi.com, data subjects may ask the Data controller for access to the data concerning them, their erasure, the rectification of incorrect data, the completion of incomplete data, the restriction of processing in the cases provided for by article 18 of the GDPR, as well as the objection to processing in the eventual legitimate interests of the data controller.

Data subjects also, in the case in which the processing is based on consent or contract and is carried out with automated tools, have the right to receive the data in a structured, commonly used, machine-readable and interoperable format, and, if technically possible, to transmit it to another controller without hindrance.

Data subjects have the right to revoke the consent given at any time for marketing and/or profiling purposes, as well as to object to the processing of data for marketing purposes, including profiling connected to direct marketing. Data subjects who prefer to be contacted for the aforementioned purpose exclusively via traditional methods may express their objection solely for the reception of communications via automated systems.

Data subjects have the right to lodge a complaint with a supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.