Information on the processing of personal data pursuant to Articles 13 and 14 of EU Regulation 2016/679

Dear User,

in accordance with current legislation, we would like to provide you with information regarding the processing of your personal data in relation to registration on our site/App and any purchase of products/services.

1. Data Controller and DPO contact details

The Data Controller of your personal data is Ventis S.r.l. with registered office in Bellaria-Igea Marina, via Augusto Urbinati, 7, C.F and VAT No. 06853120969, R.E.A.: MI-1919156 (hereinafter, for brevity, "Company").

DPO (Data Protection Officer): a figure expressly provided for by EU Regulation 2016/679 (hereinafter, for brevity, "GDPR") whom you can contact to request explanations about this Information or to exercise the rights provided for by data protection legislation.

DPO contact details:

• via email: dpo@ventis.it
• via ordinary mail: Ventis – DPO office, via Augusto Urbinati, 7 - 47814 Bellaria-Igea Marina.

You can contact us at any time at the above references.

For any communication, it is necessary to include your contact details in the request, which are essential to identify and contact you.

2. Categories of personal data and processing methods

For registration on our site/App and access to related services (receiving commercial communications, subject to your specific consent), it is necessary to provide an email address and gender (except for iOS); if the user wishes, a mobile phone number can also be provided. To proceed with the purchase of goods/services, however, it is necessary to provide personal and contact information (name, surname, phone, address, etc.) and data necessary for credit card payment and invoicing (card data, C.F. etc.). Without such data, the Company would not be able to provide the requested services. In some cases, such as assistance or return requests, the Company may request one or more images proving the condition of the goods. These images should only contain the goods, and it is the user's responsibility to ensure that no people appear in the images. The Company reserves the right to delete inappropriate and out-of-context images.

The personal data used to register on the site/App is acquired directly from you, unless you expressly request registration through online services and social networks (e.g., Facebook and Google) on first access, or for subsequent logins if you are already registered; in this case, the data will be acquired from these, and therefore this information is also provided pursuant to and for the effects of Article 14 of the GDPR.

If you should indicate personal data of third parties (e.g., in case of indication of the details and address of another person to whom the purchased goods should be delivered), it will be your responsibility to inform them about the processing of their data in accordance with this information, which is also provided for this purpose pursuant to and for the effects of Article 14 of the GDPR.

The processing of personal data takes place with procedures and measures suitable for protecting security, in terms of integrity, confidentiality, and accessibility, in compliance with the applicable data protection legislation.

The Company will process your data using paper-based methods and electronic tools.

3. Purpose and legal basis of processing

The Company processes your personal data for the following purposes:

a) Provision of services and performance of contracts

The provision of data for registration on the site/App is necessary as refusal would make it impossible for the Company to provide the service of purchasing goods/services.

Similarly, and for the same reasons, data provision is necessary for the completion and execution of any contracts for the purchase of goods/services as well as to provide you with the call center service; in fact, failure to provide it would make it impossible both to complete the purchase and to fulfill the related contractual obligations and to provide you with the assistance service.

In both cases, therefore, the legal basis of the processing is the necessity to perform a contract or pre-contractual measures, and no consent is required.

b) Compliance with regulatory obligations

Data processing to fulfill regulatory obligations is mandatory and, therefore, does not require any consent; the need to fulfill a legal obligation represents the legal basis of the processing. In particular, by way of example, think of the obligations provided by tax legislation.

c) Development and sale of products and services

Personal data may be used – subject to your consent – for: sending advertising material, conducting surveys and market research as well as direct sales and commercial communications relating to the Company's products or services and those of other third-party companies that have commercial agreements with the Company, with traditional contact methods (such as postal mail and operator phone calls) and automated methods (such as SMS, MMS, fax, automated phone calls, email, PEC, messages via IT channels, networks, and web applications).

For these purposes, the Company may use the collaboration of trusted external subjects and specialized companies, which may process some user data.

The use of data for the aforementioned purposes requires the consent of the interested party and does not affect the proper performance of services, but serves to improve them and update the user on products, services, and offers of possible interest. The legal basis of the processing, therefore, is consent, in the absence of which the Company will not be able to use the data for the purposes just described.

In every commercial communication, as well as on the site/App, simple and free ways to revoke consent will be indicated. Once the request is fulfilled, the Company will only send communications necessary to fulfill the contractually provided services.

The company may process, in electronic form, with your specific consent, personal data (for example, data relating to purchases made, pages visited, products/services added to the cart) for the analysis of user behaviors and preferences to be used for commercial purposes for the identification and offering of products and services of interest.

However, the Company may use – without the need for any consent – the email coordinates provided by the user within the context of the sale of a product or service for the purpose of selling products/services similar to those for which the data were provided (so-called soft spam). The legal basis of the processing is represented by the legitimate interest of the data controller (the Company), who has legitimately obtained the electronic coordinates of its customers, to continue to use them for commercial purposes. If the user does not wish to receive such communications, they may object initially and at each subsequent message, by sending a request to the contacts indicated in paragraph no. 1 of this information.

d) Satisfying a legitimate interest of the Company

For certain specific purposes, the legal basis of the processing is represented by the need to satisfy a legitimate interest of the Company. In particular, the following purposes fall into this category:

• documenting transactions executed and orders received from the user;
• managing the technological and organizational infrastructures through which it is possible to provide products, deliver services, and apply security measures;
• conducting analyses for the purpose of fraud risk prevention;
• establishing aggregate statistics, tests, and models to improve existing products and services or create new ones;
• administrative-accounting purposes;
• purposes of selling the Company's products/services similar to those already sold, using the email coordinates provided by the user in the context of the previous sale of a product or service (so-called soft spam), without prejudice to the possibility of opposing and no longer receiving such communications;
• improving the quality of the products or services offered, studying new ones, through the creation of aggregated profiles, based on available user data, defined based on broad categories such as, for example, the city of residence.

e) Other purposes for which consent is required

For further processing not described in this information, you will be provided with the Information from time to time, and requested to express your consent when this will be the adopted legal basis.

4. Categories of data recipients

Data may be communicated and processed by specialized companies entrusted with technical and organizational tasks necessary for managing the relationships with users – such as, for example, IT service managers, marketing and document archiving services, administrative-accounting services, auditing and consulting services in general, control services, etc. – which act as "data processors" or operate independently as distinct "data controllers."

Data may also be communicated to those subjects to whom such communication must be made in compliance with an obligation provided by law, regulation, or community legislation.

5. Transfer of data outside the EU

The user's personal data may be transferred to third countries outside the European Union under one of the following conditions: that it is either a third country deemed adequate pursuant to Art. 45 of EU Regulation 2016/679 or a country for which the Company provides adequate or appropriate guarantees regarding data protection pursuant to Art. 46 and 47 of the aforementioned EU Regulation, and always provided that the data subjects have actionable rights and effective remedies, or one or more of the derogations pursuant to Art.49 of the aforementioned EU Regulation paragraph 1 letters a) - g) are applicable from time to time.

6. Period of retention of personal data

The Company retains your data until any request for deletion; in this case, the deletion will occur within 30 days from the request, unless a different retention period is provided (for example, in the case of disputes or to comply with a legal obligation such as tax obligations) that could be shorter or longer than this term; in particular, billing data will be retained for a period of 10 years from the date of the last purchase made. In any case, data will be retained for a period not exceeding the achievement of the purposes for which they are processed. During this period, appropriate technical and organizational measures will be implemented to protect the rights and freedoms of the data subject.

7. Rights of the data subject

Privacy legislation grants the data subject certain rights regarding the use of data concerning them:

• Access: the user has the right to know, at any time, what data is held by the Company, where it comes from, how, and by whom it is used;
• Rectification, Limitation, Deletion, and Opposition: the user has the right to have the data updated, integrated, and rectified, if inaccurate or incomplete, as well as the right to request their deletion or limitation of processing and to object to their processing for legitimate reasons; in addition, concerning direct marketing, the user has the right to object at any time to the processing of personal data concerning them – including related profiling – carried out for this purpose;
• Revocation of consent: the user has the right to revoke consent to processing, where required and provided, without affecting the legality of processing prior to revocation.
• Portability: the user has the right to receive, in a structured, commonly used, and machine-readable format, their personal data and has the right to transmit such data to another controller, subject to the conditions and limits established by law; in such cases, the user, if technically possible, has the right to obtain the direct transmission of the data.

These rights can be exercised by the user directly against the Company, Data Controller, by addressing any requests to the DPO at the contacts and in the manner indicated in paragraph 1 of this information agency/branch of reference.

The user also has the right to lodge a complaint with the Data Protection Authority of the Member State in which they reside, work, or the alleged violation occurred.

The exercise of rights is not subject to any formality and is free, except for cases provided by the legislation in which the Company may establish the amount of any cost contribution to be requested.

8. Data deletion

Data deletion requests can be sent:

• via email: dpo@ventis.it
• via ordinary mail: Ventis – DPO office, via Augusto Urbinati, 7 - 47814 Bellaria-Igea Marina (RN)

Requests will be processed within 30 days from the date of receipt unless Ventis has retention obligations.

9. Consent Modification

You can modify consents for the processing of your data for marketing purposes at any time through the following methods:

• • Clicking on the unsubscribe link at the bottom of the commercial communication email
• • Accessing the “Modify consents” section of your user area and changing the choices

10. Email communication tracking

Newsletters and promotional communications sent by Ventis may contain tracking pixels, i.e., small images embedded in messages that allow for detecting their opening.

With the User's consent, these technologies allow for collecting information about email openings, including whether the email was opened and the related date and time. Such information may be associated with the User's profile and is used to measure the effectiveness of communications, understand interest in the proposed content, and personalize newsletters and offers.

The processing is carried out through the SALESmanago (Manago) platform, used by Ventis for managing contacts and email communications.

Consent to tracking can be revoked at any time via the “Disable tracking” link present in the emails or through the “Modify consents” section of your account. Revocation concerns the individual tracking of subsequent communications and does not entail the cancellation of the newsletter subscription: the User will continue to receive the communications for which they have given the corresponding consent.

To also stop receiving newsletters, the User can use the distinct “Unsubscribe” link present in the emails or modify the email marketing consent in their personal area.

The other rights described in this information remain exercisable through the Data Controller's contacts.