General Privacy Policy
Pursuant to articles 12, 13, 14 and following of the General Data Protection Regulation 2016/679 (hereinafter GDPR) on the protection of individuals with regard to the processing of personal data, Bottega Verde S.r.l., Data Controller, provides the following Policy.
Legal basis
The legal basis for processing consists of the obligations arising towards the Data Subject as part of the contractual relationship of sale and purchase ("processing necessary for the performance of a contract" – GDPR art. 6, paragraph 1, letter b)); for processing for direct marketing purposes, the legal basis is the consent of the Data Subject (GDPR art. 6, paragraph 1, letter a)). The company does not preclude itself from basing its legal basis for processing data for direct marketing purposes on legitimate interests ("processing necessary to pursue a legitimate interest of the controller" – GDPR art. 6, paragraph 1, letter f) and "The processing of personal data for direct marketing purposes may be regarded as carried out for a legitimate interest." – Recital no. 47), provided that the interests or fundamental rights and freedoms of the Data Subject do not prevail over this purpose; for all other processing carried out by the Controller, the legal basis is always the consent of the Data Subject (GDPR art. 6, paragraph 1, letter a)).
With reference to paragraph 4 of article 130 of the Privacy Code, on the legal basis of legitimate interest, by informing its customers in advance, Bottega Verde may use the commercial newsletter service known as "softspam", even if it has not received specific consent for this type of treatment.
Personal data and specific processing
Personal data will be processed for commercial purposes, direct sales, marketing and commercial information, promotional and statistical purposes, for the detection of consumer preferences, through processing by electronic and paper means, and for any communications to third party companies for direct marketing purposes. In the latter case, the data may be communicated to companies in the following sectors: home and office furnishings, textiles, clothing, cosmetics and wellness, floriculture, publishing, hobbies and generalists. These will act as independent data controllers and use the data for their own marketing purposes. To this end, Bottega Verde will require specific consent from the Data Subjects.
The provision of data relating to the general information of the Data Subject (name, surname and complete postal address), in addition to the purposes indicated above, is necessary:
- In order to allow Bottega Verde to fulfil its contractual obligations, in the case of making a purchase order;
- for after-sales service;
- for participation in the Loyalty Card program, also present at the Stores. Upon acceptance of its regulations, Bottega Verde S.r.l. issues a personal Loyalty Card to the Data Subject, in order to access rewards related to that initiative through points accumulated.
Other personal data requested (such as cell phone number, date of birth, email address, etc.) will allow us to contact the Data Subject to communicate services related to their order, survey their opinion of the products, or, with their consent, allow us to propose commercial offers (including those based on the detection of their personal consumption preferences), provide commercial information on products and news from Bottega Verde, and send promotional offers, including by means of marketing activities carried out in automated mode by mail or by SMS/MMS, by cell phone, and to the email address provided.
It is possible that, following specific initiatives (including but not limited to: surveys and questionnaires, prize competitions, Data Subjects as product testers or endorsers, etc.), Bottega Verde may request permission both for the processing of personal data and for the dissemination of the details, images or reviews of the Data Subject on various sales channels and/or social networks for advertising purposes. For these initiatives, the Data Subject will be asked for specific authorization and consent to the processing of data provided on these occasions.
Bottega Verde offers the following IT resources to Users interested: the Bottega Verde App and WhatsApp. The data processing operations involved are specified in the pertinent Disclosures.
Users of the website www.bottegaverde.com must provide data such as surname, forename and e-mail address in order to register with the website and enter the reserved area, in which Bottega Verde provides technical assistance for sales aimed at verifying and resolving any difficulties, including technical difficulties, experienced by Users. With the User’s consent, the above data will allow Bottega Verde to send the company’s newsletters.
Bottega Verde S.r.l. confirms that any personal data communicated by the Data Subject is not intended for purposes other than those specified in this Policy.
Database
The personal data are also processed via the creation of a centralized database, with computer and telematic tools. The database containing the personal data of the Data Subjects is accessible only by authorized parties.
The centralized storage of the personal data of the Data Subject allows their widespread distribution and consequent processing on all sales channels.
Place of data processing
Data Subjects’ personal data are processed at the company’s administrative and fiscal headquarters in Via XXV Aprile 10, 13836 Cossato (Italy).
Corporate figures
Contact information for the Data Protection Officer:
The Company has appointed Eng. Bettina Gallia as the person responsible for the protection of personal data. He can be contacted by writing to: RPD@bottegaverde.com.
The Data Controller is Bottega Verde S.r.l., with registered office in Palazzo Massaini, 53026 Pienza (Siena), Italy. If the data are collected at an affiliated Store, the latter may hold the position of Joint Data Controller, signing the internal agreement of co-ownership with Bottega Verde S.r.l. (art. 26 GDPR).
The Store in affiliation, if Joint Data Controller, exercises its ownership in a manner merely subordinate to the Data Controller Bottega Verde, with which it shares only the processing of data collected at the store for the purpose of direct marketing, with the exclusion of any other marketing treatment, in particular excluding the right to make promotional offers tailored to the consumption habits of the Data Subject.
Subjects authorized to process personal data
Specifically authorized subjects such as employees or external collaborators may become aware of the data during the processing necessary for:
- sending advertising material
- communication
- fulfilment of orders and execution of the contractual relationship
- strictly functional services
- and in general for the provision of services instrumental to the pursuit of the processing purposes indicated above.
Each authorized person is given specific directives regarding the processing of the data, which they must respect so as not to incur disciplinary sanctions and/or judicial action.
Data recipients
External parties, identified as recipients of data, which process data on the instructions of Bottega Verde are:
a) data entry companies for personalization and enveloping of messages
b) call centres for surveys, questionnaires and commercial offers
c) carriers for package delivery
d) companies providing payment services
e) operational centres of surveillance institutions
f) studios for photographic sessions
g) software and hardware management and maintenance service companies
h) social networks for targeting operations
i) technology service companies.
Where necessary, the entities mentioned above may be designated as Data Processors pursuant to art. 28 of the Regulation.
None of the Data Subjects’ personal data will be transferred to a third country outside the European Union, or to International Organisations.
Retention period
In observance of art. 5, para. 1, letter e) of the GDPR, the personal data processed are stored in a form that allows for the identification of the Data Subjects for a period of time that does not exceed the time required to achieve the purposes indicated below and for which the personal data are processed.
Period of data retention based on purposes:
- For processing for direct marketing purposes, personal data are stored for a maximum period of 24 months.
- For processing related to profiling, personal data are stored for 12 months.
- For the Loyalty Card program, personal data are stored for the duration of the prize operation, usually 3 years.
- The personal data provided by each Data Subject, regarding the individual and their address, are stored for a maximum period of 10 years, for statutory, fiscal, accounting and administrative purposes, to provide possible evidence in the event of a dispute and in response to specific requests from the competent Authority or the Data Subject.
- Some specific personal data, such as reviews, photographs, films and images are stored for the time strictly necessary to carry out the processing operations carried out in relation to each Data Subject, according to their choices, preferences and instructions in pursuit of the above purposes.
Web browsing
The User, accessing the home page of the Site of Bottega Verde or other pages of the Site itself, will see the cookie policy banner therein and can access the specific Cookie Policy as well as the Site Policy. Then, according to their preferences, the User can refuse or accept any type of cookies that require prior and express consent for their installation.
Through monitoring of the User's browsing on the Site, Bottega Verde may:
a) collect anonymous statistical data concerning the percentage of email delivery compared to emails sent, reading or opening of the message, forwarding to third parties, the number of "clicks", etc.
b) count unique visitors to a Web page or service
c) process aggregate statistics including those regarding the functioning of their sites and services
d) collect data about Users' traffic and interaction on the Site to identify trends and to estimate our audience
e) improve the performance of the Site by making the User's searches faster
f) prevent the same advertisements from being displayed multiple times
g) evaluate the impact of other advertising channels to improve performance based on User behaviour on the Site
h) anonymously evaluate User satisfaction with the services available on the Site, including those of an advertising nature
i) store the products chosen and previously added to the User's shopping cart
j) speed up searches
k) recognize a specific computer when the User returns to use the Site again
l) adapt the presentation of the Site to the display preferences of the User's device (screen resolution, system used, etc.)
m) adopt security measures, for example when the User connects again to a content or service after a certain period of time
n) with the consent of registered Users in the reserved section, which may be withdrawn at any time, conduct dedicated surveys to detect and identify personal consumer preferences and consequently record the data monitored with a view to developing targeted offers and promotions.
Within the Bottega Verde Site third party cookies are used in order to:
a) improve the User's browsing experience by suggesting the best products and promotions based on the User's browsing patterns
b) store information about Users' preferences and thus customize the Site according to Users' specific interests
c) send personalized offers based on the User's consumption habits, also based on observation of the User's browsing patterns on the Site
d) detect the User's consumption preferences for specific and targeted commercial and advertising initiatives.
Additional services
At the express request of the customer, Bottega Verde S.r.l. can activate the electronic invoicing service. This telematic service involves making the electronic invoice available to the Data Subject in their reserved area on the website of the Italian Revenue Agency, which the Data Subject accesses by way of their personal credentials, in addition to making it available to Bottega Verde S.r.l. in its own reserved area. At the request of the Data Subject, Bottega Verde can release a copy of the invoice issued. The personal data released specifically by the customer, for the sole purpose of issuing the electronic invoice, are not used by Bottega Verde S.r.l. for any other type of processing.
For those under 18 years of age. Are you still a minor, but at least 16 years old? Bottega Verde will be happy to accept your orders placed on the site www.bottegaverde.com. Your personal data collected in this way (name, surname, address, date of birth) will be processed only for all the purposes related to the execution of the order and the delivery of the products; they will not be communicated to other companies nor will any profiling be done. You will be sent the newsletter if you have requested it, as well as other commercial messages, but you can unsubscribe at any time. For any clarification on the processing of your data, do not hesitate to contact us at ufficio.privacy@bottegaverde.com.
Rights of the Data Subject
The Data Subject, pursuant to articles 15 to 22 of the GDPR, has the right:
a) to access their personal data (art. 15 GDPR);
b) to obtain the rectification of inaccurate personal data concerning them (art. 16 GDPR);
c) to obtain the erasure of personal data concerning them without undue delay under the conditions indicated in art. 17 of the GDPR;
d) to ensure the limitation of processing of personal data, in the presence of the conditions referred to in art. 18 of the GDPR;
The Data Subject also has the right:
e) to object at any time to the processing of their personal data processed for direct marketing and profiling purposes, insofar as it is related to such direct marketing (art. 21 GDPR);
f) where the processing has its legal basis in consent, to revoke consent at any time, without prejudice to the lawfulness of the processing based on the consent before revocation;
g) of data portability, to receive their personal data provided to the Data Controller, in a structured, commonly used and machine-readable format and to transmit it to a different Data Controller without hindrance from the Data Controller to whom they provided it. In exercising their rights with respect to data portability, the Data Subject also has the right to obtain the direct transmission of personal data from one Data Controller to another, if technically feasible.
These rights may be exercised by the Data Subject at any time, by writing to the Data Controller of Bottega Verde S.r.l., at its administrative headquarters in Via XXV Aprile 10, 13836 Cossato (BI), Italy, to the attention of the Privacy Office, or by sending an email to ufficio.privacy@bottegaverde.com. The Data Subject is always entitled to exercise their rights by directly contacting, in addition to Bottega Verde S.r.l. as indicated above, the headquarters of the direct or affiliated Stores.
If the Data Subject receives commercial and promotional offers by email from Bottega Verde and brands represented, concerning the services of its partners, in addition to exercising the rights mentioned above, they may also follow the simple procedure activated by the "unsubscribe" link available in all commercial communications sent by the Data Processor, on the express instructions of the Data Controller.
Pursuant to art. 77 of the GDPR, the Data Subject has the right to apply to the Italian Data Protection Authority, whose contact details are found on the site www.garanteprivacy.it, in the manner specified therein.
This Disclosure may be amended following any subsequent changes and/or additions to regulations, the updating and provision of new services or as a result of technological innovations. All revisions will be published in this document.
