OFFLINE POLICY

PRECONDITIONS

Why this document? National and international legislation on personal data protection require that the data subject is informed on personal data that are processed and on who will process them, in order to guarantee that the processing will be fair and transparent.
 
Hereinafter we will therefore see clearly listed who will process your data, which personal data will be processed, the purposes for which the personal data will be processed, for how long the data will be processed, which are your rights and how to exercise them.

Which laws are referred to in this document? The policy is offered by taking in conjunction with:

• The General Data Protection Regulation (GDPR) EU n. 2016/679 (hereinafter the “Regulation”)
• Italian Legislative Decree n. 196/2003 as amended by the Legislative Decree n. 101/2018 (hereinafter “Code")

POLICY

1)        DATA CONTROLLER

Teddy S.p.A., via Coriano n. 58, Grosrimini, blocco 97, 47924 Rimini (RN), Tel. (+39) 0541 301411, Fax (+39) 0541 383430, E-mail help@calliope.style

2)        PURPOSES, LEGAL BASIS, STORAGE RETENTION PERIOD AND NATURE OF THE PROCESSING

Personal data, depending on the actions carried out by the data subject, will be processed for the following purposes:

a. Reply to applications received:

• The legal basis of this process is the need to perform pre-contractual measures adopted upon request by the data subject of which is party;
• The data retention period for this purpose is equal to the time necessary to process the request and in any event until the statute of limitations has run out for any legal action against the Controller by the Data Subject;
• Personal data is essential to execute the request and the eventual rejection will determine the inability to reply to the data subject.

b. Calliope loyalty program membership:

• The legal basis of this processing is the need to perform a contract of which the data subject is party, pursuant to the “General Terms and Conditions for Calliope loyalty program” (hereinafter “T&C”). This includes, by way of example but not limited to, the issuance of the fidelity card, the creation of the master data in the Controller's database, the sending of technical (non-promotional) communications necessary to comply with the T&C or its annexes, other activities necessary to comply with the T&C and not executable anonymously. If the data subject is a person under 18 (eighteen) years old, the subscription will be carried out by the holder of parental responsibility;
• The retention period of personal data processed for this aim is all the contract period and, in case of litigation, for the whole duration of it, until all the appeal actions terms will be exhausted and in any event until the statute of limitations has run out for any legal action against the Controller by the Data Subject;
• Personal data is essential to execute the request and the eventual rejection will determine the inability to activate the Fidelity Card.

c. “Community Tester” membership:

• The legal basis of this process is the explicit consent of the data subject to be contacted in taking part to products satisfaction test;
• The data retention period for this purpose is valid until the data subject does not revoke the consent. We remember that the consent could be revoked at any time without that the lawfulness of processing based on consent before its withdrawal is affected;
• Additional information on the logic applied and on protection provided for the data subject are available by sending a written request to the Data Controller;
• The provision of personal data is optional and the eventual rejection will determine the inability to participate in product satisfaction tests.

d. Prize contests membership:

• The legal basis of this process is the need to perform a contract of which the data subject is party, pursuant to the specific regulation set up for the prize contests. If the data subject is a person under 18 (eighteen) years old, the subscription will be carried out by the holder of parental responsibility;
• The retention period of personal data processed for this aim is all the contract period and, in case of litigation, for the whole duration of it, until all the appeal actions terms will be exhausted;
• Personal data are necessary to process the membership to the prize contests and the eventual rejection will determine the inability to join in.

e. Send brochures and marketing material (direct marketing), also by email or SMS (mailing list, offers, etc.):

• The legal basis of this process is the explicit consent of the data subject. If the data subject is a person under 18 (eighteen) years old, the subscription will be carried out by the holder of parental responsibility;
• The data retention period for this purpose is valid until the data subject asks for the unsubscription from the promotional service/sending of newsletters. We remember that the consent could be revoked at any time without that the lawfulness of processing based on consent before its withdrawal is affected;
• The provision of personal data is optional and the eventual rejection will determine the inability to receive brochures and marketing material.

f. Analyze consumption habits and choices (profiling), carry out market research (surveys and analysis of Customer satisfaction):

• The legal basis of this processing is the explicit consent of the data subject. If the data subject is a person under 18 (eighteen) years old, the subscription will be carried out by the holder of parental responsibility;
• The data retention period for this purpose is valid until the data subject does not revoke the consent. We remember that the consent could be revoked at any time without that the lawfulness of processing based on consent before its withdrawal is affected;
• Additional information on the logic applied and on protection provided for the data subject are available by sending a written request to the Data Controller;
• The provision of personal data is optional and the eventual rejection will determine the inability to profile

g. Administrative and management purposes and for the fulfilment of obligations required by the legislation, by a regulation or by an order of the Authority (for example, bookkeeping; tax formalities; administrative and accounting management, etc.):

• The legal basis arises from the need to fulfil a legal obligation to which is subjected the data controller;
• The data retention period for this purpose is connected to each legal obligation regulated by specific relevant legislation;
• The provision of personal data is optional, because the data controller shall fulfil a legal obligation to which is subjected or to the requests of relevant authorities.

h. Prevent, verify and pursue unlawful conducts (in participating stores):

• the legal basis for this processing is pursuit the legitimate interest of the Data Controller in order to prevent, determine or pursue offences or intellectual property rights breaches (also of third parties) or informatic crimes or made through telematic networks;
• The data retention period for this purpose is equal to the time reasonably necessary to assert the Data Controller’s rights from the time you become aware of the offence or of its potential commission.

3)        PERSONAL DATA PROCESSED

By processing personal data we mean any operation or a set of operations, performed with or without the aid of automated processes and applied to personal data or a set of personal data, as the recollection, the registration, the organization, the structure, the retention, the trend or change, the exfiltration, the consultation, the use, the communication through the transmission, spread or any other form available, the comparison or the interconnection, the limitation, the deletion or the disruption. Further treatments, categories of particular data by the Data Controller, will be done only with prior and explicit consent

Personal data processed are the following:

• Data required in the Calliope loyalty program filling form: name, surname, date of birth address, gender, email and phone number;
• Data processed for the access to the Wi-Fi internet connection (in participating stores): Mac Address of the device/system and Hostname (name of the device system);
• Data given by the user: The optional, explicit and voluntary sending of messages to the contact addresses of the Data Controller involve the acquisition of the sender's contact data, necessary to reply, as well as all personal data included in the communications.

4)        RECIPIENT OF PERSONAL DATA

Personal data might be shared, for specific purposes, with: 

• Subjects acting as “Data Processors”, according to the Article n. 28 of the Regulation namely, people, companies or professionals who provide assistance and advisory activities to the Data Controller in connection with the provision of goods/services;
• Subjects with which is necessary to interact for the goods/services provision, as independent Data Controller (for example, third parties or installment payment systems, the access by social network, etc.);
• Subjects, bodies or Authorities whom the communication of data is mandatory by legal provisions or orders from the Authorities;
• Personnel expressed authorized by the Data Controller, necessary to carry out activities strictly related to the provision of goods/services, which are undertaken to confidentiality or are legally bound to do so and that have received opportune operational instructions, pursuant to article 29 of the Regulation.

The full list of Data Processors is available by sending a written request to the Data Controller.

5)        TRANFERS OF PERSONAL DATA

Some of your personal data are shared with recipients who could be out of the European Economic Area (EEA). The Data Controller ensures that the processing of your personal data is carried out according to the Regulation. Verily, transfers shall be based on an adequacy decision or on Standard Contract Clauses approved by the European Commission. Further information is available at the Data Controller.

6)        EXISTENCE OF AN AUTOMATED DECISION-MAKING PROCESS, INCLUDING PROFILING

The Data Controller does not adopt an automated decision-making process on personal data, including the profiling, referred to in Article 22 of the Regulation. Further information will be available at the Data Controller.

7)        DATA ABOUT PEOPLE UNDER 18 YEARS OLD

The subscription of information services company, like the subscription to newsletter (direct marketing), profiling, the subscription to the loyalty program, shall be carried out by the holder of the parental responsibility by the subscription of the written filling form. The Data Controller will not be responsible for possible recollection of personal data, as well as false statements.

8)        RIGHTS OF DATA SUBJECT

Data subject has the right to obtain from the Data Controller, in certain specific cases, the access to personal data and the rectification or the erasure of the same or the restriction of the processing or to the right to object to the processing (Article 15 and following of the Regulation). The appropriate petition to the Data Controller shall be presented by contacting the email designed for the feedback to the data subject or by filling the form available in the dedicated privacy section.

In particular, regardless of the purpose or the legal basis on which we process your data, you have the following rights

• to request access to data: this consists in asking the data controller whether or not personal data concerning him or her is being processed and, if so, to obtain access to that personal data. At any time, the Data Subject registered on the Site has the possibility of verifying his or her data by accessing the private area of the Site;
• request rectification of data: this consists in the possibility for the Interested Party to request changes to his/her personal data in the event that he/she believes that such personal data is out of date or in any case inaccurate. In any case, the Interested Party registered on the Site has the possibility of modifying or updating his/her data by accessing the private area of the Site. The Interested Party is responsible for the truthfulness and accuracy of the data provided and undertakes to notify the Data Controller of any change or modification of such data; any liability or loss deriving from the inclusion of inaccurate or out-of-date data on the Site or data referring to third parties is exclusively attributed to the Interested Party;
• request the deletion of personal data or object to the processing of personal data;
• request the interruption or limitation of the processing of personal data;
• request portability of personal data;
• if the data subject has given consent to the processing of his/her personal data for any purpose, request the revocation of the consent(s)
• if the Data Subject considers that the processing of personal data relating to him/her is in breach of the provisions of the Regulation, he/she has the right to lodge a complaint with the Italian Data Protection Authority (www.gpdp.it) or with the Supervisory Authority of the Data Subject's country, as provided for in Article 77 of the Regulation, or to take appropriate legal action (Article 79 of the Regulation).

9)      HOW TO EXERCISE YOUR RIGHTS

In order to exercise your right, you shall access to the Privacy Area of the website cilliope.com, and use the special form provided. Alternatively, you can contact the people in charge of the data subject’s response:

Data Controller: Teddy S.p.A., via Coriano n. 58, Grosrimini, blocco 97, 47924 Rimini (RN), Tel. (+39) 0541 301411, Fax (+39) 0541 383430, E-mail help@calliope.style

Data Protection Officer (DPO): 365TRUST Europe S.r.l., Piazza IV Novembre n. 4, 20124 Milano (MI), E-mail dpo@calliope.style

10)    UNSUBSCRIBE NEWSLETTER AND/OR COMMERCIAL COMMUNICATIONS 

In order to stop the sending of newsletter and/or commercial communications by email it is enough following the instructions included in the last email received or by sending an email to help@calliope.style by indicating: "Clp", name, surname and email address to which stop the sending of communications. Upon the receipt of the email we will act the deletion. In order to stop the sending of SMS it is enough sending a SMS directly by the phone number from which you desire to no longer receive communications, by mentioning the word “delete me” (without quotation marks) at the following phone number +393666369292.

11) CHANGES

The Data Controller reserves the right to amend and/or supplement this Policy at any time and he undertakes to publish the changes on the website cilliope.com into the Privacy Area and/or to inform Clients in the most appropriate manners assessed.