Privacy Policy

PRIVACY NOTICE

(pursuant to Article 13 of Regulation (EU) 2016/679)

This Privacy Notice has been prepared in accordance with Regulation (EU) 2016/679 (GDPR) and the Italian Personal Data Protection Code (Legislative Decree No. 196 of 30 June 2003, as amended). It has also been drafted taking into account the Guidelines issued by the Italian Data Protection Authority.

 

Data Controller: Principe di Piemonte S.p.A., Piazza Giacomo Puccini, 1 – 55049 Viareggio (LU), registered with the Lucca Chamber of Commerce, VAT No. 01817130469, R.E.A. No. LU 173314, share capital €2,440,500.00 fully paid-up, Telephone: +39 0584 4011, Email: privacy@principedipiemonte.com

 

Website covered by this Privacy Notice: https://www.principedipiemonte.com/ (the "Website").

The Data Controller has not appointed a Data Protection Officer (DPO). Therefore, any requests for information may be addressed directly to the Data Controller.

 

PRIVACY NOTICE

 

This document describes how the Data Controller processes the personal data you provide through the Website, the purposes of the processing, the legal bases relied upon, and the methods by which your personal data are processed, disclosed and retained.

 

1. Types of Personal Data Processed

The Data Controller collects and processes different categories of personal data depending on the purposes pursued.

 

1. a) Data Voluntarily Provided by the User

These are the personal data that you actively provide through the Website for various purposes:

• Registration, purchases, bookings or information requests: Identification data (e.g. first name and last name), contact details (e.g. email address and telephone number), billing and shipping addresses, details of purchases made and bookings completed. Payment card details and other payment information are processed directly by secure payment gateways and are not stored by the Data Controller.
• Submission of a Curriculum Vitae (CV): Any personal, professional and, where applicable, special categories of personal data (within the meaning of Article 9 GDPR) that you choose to include in your CV.
• Marketing and language preference: Your email address and your preferred language (Italian or English).
•  

1. b) Browsing Data

The IT systems and software procedures used to operate this Website automatically acquire certain personal data during their normal operation. The transmission of such data is inherent in the use of Internet communication protocols.

This category of data includes IP addresses or domain names of users' devices, URI/URL (Uniform Resource Identifier/Locator) addresses, the time of the request, the method used to submit the request to the server, the size of the file returned in response, the numerical status code indicating the server's response (successful, error, etc.), and other parameters relating to the user's operating system and IT environment.

These data, which are necessary for the operation of the Website, are also processed for the following purposes:

• obtaining anonymous statistical information on the use of the services (such as the most visited pages, the number of visitors by time slot or day, geographical areas of origin, etc.);
• monitoring and ensuring the proper functioning of the services provided.

 

1. c) Cookies

The Website uses technical, analytical and profiling cookies. For further information regarding the types of cookies used and how to manage them, please refer to the Website's Cookie Policy.

 

2. Purposes and Legal Bases for Processing

 

Website Registration

 

The information and personal data requested during registration will be processed to enable you to access the restricted area of the Website and to use the online services provided by the Data Controller to registered users.

The legal basis for the processing is the necessity to take pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).

Providing your personal data is optional. However, failure to provide the requested information will make it impossible to register on the Website.

 

Purchases through the Website

 

Your personal data will be processed to enable you to make purchases through the Website.

When you place an online purchase order, your personal data will be processed to conclude the purchase agreement and properly perform all related contractual activities.

The legal basis for the processing is the performance of a contract to which the data subject is a party (Article 6(1)(b) GDPR) or compliance with legal obligations, including tax obligations (Article 6(1)(c) GDPR).

The Data Controller may also process your personal data for the purposes of so-called "soft spam", as provided for by Article 130 of the Italian Privacy Code. This means that, solely with regard to the email address you provided in connection with a purchase, the Data Controller may use such data to send direct marketing communications concerning products and/or services similar to those previously purchased, unless you object to such processing.

The legal basis for this processing is the legitimate interest of the Data Controller (Article 6(1)(f) GDPR), which is considered to be balanced against the data subject's interest in receiving such communications.

The Data Controller may also send reminder emails inviting users to complete an unfinished purchase. The legal basis for this processing is the Data Controller's legitimate interest (Article 6(1)(f) GDPR).

 

Responding to Your Requests

 

Your personal data will be processed to respond to your requests for information.

Providing your data is optional; however, failure to provide the requested information will prevent the Data Controller from responding.

The legal basis for the processing is the legitimate interest of the Data Controller in responding to users' requests (Article 6(1)(f) GDPR). This legitimate interest is balanced against the user's interest in receiving a response.

Your personal data will be deleted once the assistance requested has been completed.

 

General Marketing

Subject to your prior consent, the Data Controller may process the personal data you provide in order to send you advertising materials and/or non-personalised newsletters relating to its own products and services.

The legal basis for the processing is your consent (Article 6(1)(a) GDPR).

Providing your consent is optional, and refusing to provide it will not affect your ability to use the other services offered through the Website.

You have the right to object to this processing at any time, free of charge and with ease.

Your personal data will be retained for marketing purposes until you withdraw your consent.

For inactive users, personal data will be deleted two years after the last marketing email opened.

 

Profiling

 

The Data Controller does not carry out profiling activities aimed at analysing your purchasing choices or consumer habits.

Subject to your prior consent (Article 6(1)(a) GDPR), the Data Controller may process solely your preferred language (Italian or English) in order to send communications in your chosen language.

Providing such consent is optional. Failure to provide consent will simply prevent the Data Controller from guaranteeing that communications will be sent in your preferred language.

 

Transfer of Personal Data

 

The Data Controller does not sell or otherwise transfer your personal data to third parties acting as independent data controllers.

 

Geolocation

 

The Website does not use tools to geolocate users through their IP addresses.

 

Curriculum Vitae

 

You may submit your Curriculum Vitae (CV) through the Website.

The legal basis for the processing is the legitimate interest of the Data Controller (Article 6(1)(f) GDPR) in assessing the possibility of establishing an employment relationship. This legitimate interest is balanced against your interest in being contacted for recruitment purposes.

Your personal data will be retained until the end of the recruitment process and, in any event, for no longer than six months.

Providing your personal data is optional but necessary to enable the Data Controller to contact you.

 

Appointment Booking

 

The personal data requested to book an appointment or service will be used solely for the purpose of processing the booking.

The legal basis for the processing is the necessity to take pre-contractual measures at the request of the data subject (Article 6(1)(b) GDPR).

Providing your data is optional; however, failure to provide the requested information will make it impossible to complete the booking.

 

3. Processing Methods

 

Your personal data will primarily be processed by electronic or automated means, using methods and technical measures appropriate to ensure their security and confidentiality in accordance with the GDPR.

 

4. Disclosure of Personal Data

 

The Data Controller may disclose your personal data to specific categories of recipients.

For the purposes of this Privacy Notice, "disclosure" of personal data differs from "transfer": in the case of disclosure, the recipient may process the personal data solely for the specific purposes established by its relationship with the Data Controller; in the case of transfer, the recipient becomes an independent data controller.

Your personal data may be disclosed to:

• entities (including public authorities) authorised to access personal data pursuant to legal or administrative provisions;
• public and/or private entities, natural or legal persons (such as legal, administrative and tax advisors, judicial authorities, Chambers of Commerce, etc.), where such disclosure is necessary or appropriate for compliance with legal obligations;
• employees and/or collaborators of the Data Controller where necessary for the proper operation of the Website;
• companies, consultants or professionals responsible for managing the Data Controller's hardware and software systems, acting as data processors;
• external companies (CRM platforms) engaged to send communications, limited to your email address and any other personal data strictly necessary for that purpose.

The Data Controller does not engage external customer care providers.

The Data Controller reserves the right to update the above list and therefore recommends that you consult this Privacy Notice regularly.

 

5. Data Retention

 

This section describes the periods for which the Data Controller retains your personal data.

Your personal data will be retained only for as long as necessary to provide the services offered through the Website.

For marketing purposes, personal data will be retained until you withdraw your consent.

For inactive users, personal data will be deleted two years after the last marketing email opened.

For the purpose of performing the sales contract, personal data will be retained for ten years from the date the purchase order is received. This retention period enables the Data Controller to exercise its rights of defence and demonstrate the proper performance of the contract.

Personal data processed for customer support purposes will be deleted once the assistance requested has been completed.

Pursuant to Article 2220 of the Italian Civil Code, invoices and accounting records must be retained for at least ten years from the date of registration so that they may be produced in the event of inspections or audits.

Without prejudice to the foregoing, the Data Controller may retain your personal data for any longer period required by applicable law, as amended from time to time.

 

6. International Transfers of Personal Data

 

The Data Controller is established within the European Union.

Your personal data may be transferred to the following countries:

• United Kingdom: By its Adequacy Decision of 28 June 2021, the European Commission determined that the United Kingdom ensures an adequate level of protection within the meaning of the GDPR.
• United States of America (USA): In order to ensure the proper functioning of the Website and the delivery of communications, your personal data may be transferred to the United States. In such cases, the Data Controller will implement appropriate contractual safeguards, including the Standard Contractual Clauses adopted by the European Commission on 4 June 2021.

Upon request, the Data Controller will apply any more favourable data protection provisions provided for under the applicable national legislation of the data subject.

7. Rights of the Data Subject

Pursuant to Article 13 GDPR, you have the right to:

• request access to your personal data and request their rectification or erasure, restriction of processing, object to processing, and exercise your right to data portability;
• withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal;
• lodge a complaint with the competent supervisory authority (e.g. the Italian Data Protection Authority).

The above rights may be exercised by contacting the Data Controller using the contact details provided at the beginning of this Privacy Notice.

8. Amendments to this Privacy Notice

The Data Controller reserves the right to amend this Privacy Notice at any time by providing appropriate notice to users of the Website. You are therefore encouraged to review this Privacy Notice regularly. Where material changes are made, the Data Controller may also notify users by email.

 

Check-in privacy policy

Wellness centre privacy policy