PRIVACY POLICY

DATA CONTROLLER AND DATA PROTECTION OFFICER
This Privacy Policy is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and applies to users browsing the PUPA Milano website on which it is made available (the “Website”) and, where applicable, interacting with the services offered through it.
The controller of your personal data is Micys Company S.p.A. (hereinafter also “PUPA”, “we”, “us” or the “Data Controller”), with registered office at Via Appiani 25, Monza, Italy, and principal office at Via De Gasperi 22, Casatenovo (LC), Italy, VAT number IT02089840967, registered with the Companies Register of Monza and Brianza under number 02089840967.
The Data Protection Officer (“DPO”) of Micys Company S.p.A. may be contacted at dpo@pupa.it.

PURPOSES OF THE PROCESSING
As further explained in the sections of the Website through which users may access specific services and provide their personal data, we process personal data in order to respond to requests submitted by users and provide the services they select. In particular, the processing activities carried out through the Website may concern:
(a)  registration on the Website;
(b)  the purchase of PUPA-branded products;
(c)  the sharing of content available on the Website;
(d)  customer relationship management (“CRM”);
(e)  the submission of job applications and curricula vitae;
(f)  general requests for information;
(g)  registration with the MyPUPA Community;
(h)  participation in promotional initiatives, including loyalty schemes, bonuses and customer coupons;
(i)  the use of PUPA applications, where available, including mobile applications and other applications offered on third-party platforms;
(j)  statistical research and analysis of aggregated or anonymised data, designed to assess the functioning of the Website without identifying individual users;
Providing personal data is generally voluntary; however, failure to provide information necessary for a requested service may prevent us from providing that service. Where processing is necessary for the performance of a contract to which you are a party or to take steps at your request before entering into a contract, the legal basis is Article 6(1)(b) GDPR. Where other legal bases apply to a specific service or processing purpose, these are described in the relevant dedicated privacy notice.
If you purchase products or services through the PUPA online shop, a separate Customer Privacy Notice will be made available, describing the processing activities related to your purchase and any additional purposes, including direct marketing and profiling.
We will use the personal data you provide for the service you have requested and for any other purposes described in the privacy information provided to you in relation to that service. Data that have been genuinely anonymised, so that individuals can no longer be identified, do not constitute personal data for the purposes of the GDPR.

RECIPIENTS OF PERSONAL DATA AND INTERNATIONAL TRANSFERS
For purposes connected with the services requested by users, personal data may be disclosed to third parties acting, as the case may be, as processors on our behalf or as independent controllers. These may include providers of services necessary to fulfil users’ requests (for example, companies handling the delivery of purchased products) and persons or entities to whom disclosure is required by law or regulation. An updated list of the processors appointed by the Data Controller is available upon request.
Personal data may also be accessed by persons expressly authorised by the Data Controller, including, as relevant, personnel engaged in administration, communications, accounting, legal advice, IT systems maintenance and marketing, to the extent necessary for the purposes described in this Privacy Policy.
Your personal data may be transferred to countries within the European Economic Area or to third countries where an adequate level of protection is recognised by the European Commission, or otherwise on the basis of safeguards or other mechanisms permitted under Articles 45 et seq. GDPR.

METHODS OF PROCESSING
Processing activities carried out in connection with the Website are generally performed using electronic or telematic means and may, where necessary, also involve paper records or manual operations. We implement appropriate technical and organisational measures to prevent accidental loss, unlawful or improper use of personal data and unauthorised access, in accordance with Article 32 GDPR. Personal data are processed in a manner consistent with the purposes for which they were collected, as described above or in any dedicated privacy notices made available to users.

CATEGORIES OF PERSONAL DATA PROCESSED
Personal data provided voluntarily by users
Forms made available on the Website may require certain information that is necessary to provide the requested service, together with other information that users may provide on a voluntary basis.
Depending on the service requested, the personal data collected may include identification details, contact information and payment-related information. In particular, identification and contact details (such as an email address and/or telephone number) may be used to respond to requests, manage shipment and delivery of purchased products or facilitate the management of customer services (for example, identifying a customer participating in a loyalty scheme).
If you voluntarily send an email to an address published on the Website or complete an online contact form, we will collect your email address and any other information included in your communication, to the extent necessary to respond to your request. Additional, concise privacy information may be provided within the sections of the Website devoted to specific services. 

Browsing data
The information systems and software procedures used to operate the Website collect, during their ordinary functioning, certain personal data whose transmission is inherent in the use of internet communication protocols. Such information is not collected for the purpose of identifying users, but may, by its nature and through association with data held by third parties, make their identification possible.
This category may include IP addresses or domain names of devices used to connect to the Website, Uniform Resource Identifier (URI) addresses of requested resources, the time and method of requests, the size of files returned, response status codes and other parameters relating to the user’s operating system and IT environment. These data are used to obtain statistical information on the use of the Website and to monitor its proper functioning. They are retained only for the time necessary for those purposes, without prejudice to any further retention necessary to establish liability in the event of alleged offences affecting the Website.

SOCIAL LOGIN
Where available, access to certain services may be offered through credentials provided by a third-party platform (a “social login” service). If you choose to use this option, you should review the relevant provider’s privacy information and account settings, as they determine which personal data may be shared with PUPA.
We may retain the identifier associated with your account with the third-party provider for as long as necessary to enable the requested access or service. Information shared through a social login service may, where appropriate, be used to complete your PUPA user profile. Where access is provided through Google login, the information disclosed to PUPA consists of your first name, surname and email address, for the purpose of facilitating registration and access to your personal area; no other Google profile information is obtained through that login functionality.

COOKIES AND SIMILAR TECHNOLOGIES

For further information on cookies and similar technologies used through the Website, please refer to the Cookie Policy made available on the Website.

YOUR RIGHTS
Under Articles 15 et seq. GDPR, you may request access to your personal data, their rectification or erasure, the restriction of processing in the circumstances provided for by Article 18 GDPR and, where applicable, the portability of your data in a structured, commonly used and machine-readable format under Article 20 GDPR. You may also withdraw any consent previously given at any time, without affecting the lawfulness of processing carried out before its withdrawal.
You may object to processing under Article 21 GDPR. Where your objection concerns processing based on legitimate interests, we will assess whether compelling legitimate grounds exist that override your interests, rights and freedoms, or whether processing is necessary for the establishment, exercise or defence of legal claims. The right to object to processing for direct marketing purposes may be exercised at any time.
You also have the right to lodge a complaint with a competent data protection supervisory authority under Article 77 GDPR if you consider that the processing of your personal data infringes the applicable legislation.
Requests concerning the exercise of your rights may be addressed to the Data Controller at privacyIT@pupa.it.