PRIVACY POLICY (Articles 13–14 GDPR)

Controller

Vestopazzo S.r.l., with registered office at Via Alexandre Gustave Eiffel 100, Modulo B31, 00148 Rome (RM), Italy, VAT no.[●], e-mail: privacy@vestopazzo.it, processes the personal data collected through this website and related forms.

1. Purpose of the processing and legal basis

a) Managing contact requests

The data is processed to respond to requests sent by users.

Legal basis: pre-contractual measures (Article 6(1)(b) GDPR).

b) Subscription to the loyalty program and management of the Fidelity Card

The data is processed to allow registration and use of the benefits connected to the card.

Legal basis: contract (Article 6(1)(b) GDPR).

With consent, the data may be used for promotional purposes and for limited profiling related to the benefits of the program only.

c) Sending the newsletter

The data is processed for the sending of information and promotional communications.

Legal basis: data subject consent (Article 6(1)(a) GDPR).

Consent can be withdrawn at any time.

d) Participation in the “VPeople” community

The data is processed to manage participation, communicate initiatives and collect feedback.

Legal basis: pre-contractual measures and legitimate interest (Article 6(1)(b) and (f) GDPR).

With consent, dedicated promotional communications are sent.

e) Proposals to “open a store”

The data is processed to evaluate business proposals and the suitability of potential partners.

Legal basis: pre-contractual measures and legitimate interest (Article 6(1)(b) and (f) GDPR).

If third-party data is entered, the user guarantees that they have informed them (Article 14 GDPR).

f) Whistleblowing

The data is processed to receive, evaluate and manage reports relating to regulatory breaches relevant to the public interest, as required by Italian Legislative Decree 24/2023.

Legal basis: fulfilment of legal obligations (Article 6(1)(c) of the GDPR) and, where applicable, performance of a task in the public interest (Article 6(1)(e) of the GDPR).

The confidentiality of the identity of the whistleblower, the persons involved and the documentation is guaranteed.

Retaliation must only be reported through the National Anti-Corruption Authority (ANAC) channel: https://www.anticorruzione.it/-/whistleblowing

2. Types of data processed

Vestopazzo S.r.l. processes:

personal and contact information

information entered on online forms

data relating to the use of the Fidelity Card

any information entered in the free fields

Warning: do not enter data relating to health, political opinions, trade union membership, religious beliefs or irrelevant third-party information, unless strictly necessary in connection with the report.

3. Methods of processing

The processing is carried out using computerised and/or paper-based tools, adopting appropriate technical and organisational measures to guarantee the security, integrity and confidentiality of the data.

For the whistleblowing channel, these include:

segregated access

operational logs

whistleblower identity protection

tracked data retention

4. Data retention

Purpose  -- Duration

Enquiries -- Time required to handle the request (max. 6 months)

Loyalty / Fidelity Card -- duration of the contract + tax/legal periods

Newsletter -- until withdrawal of consent

VPeople -- subscription duration

Open a store -- 12 months

Whistleblowing -- for the time necessary for the assessment and possible legal protection

5. Recipients or categories of recipients

The data may be disclosed to:

subjects authorised by the Controller

competent internal bodies (e.g. Supervisory Body)

legal or technical advisors

competent authorities, where required by law

The data is not disclosed.

6. Transfers outside the EU

If necessary, appropriate safeguards are adopted pursuant to Articles 44–49 GDPR (e.g. Standard Contractual Clauses).

7. Data subject rights

Users can exercise the rights referred to in Articles 15–22 GDPR (access, rectification, limitation, erasure, opposition, portability) by writing to privacy@vestopazzo.it.

For whistleblowing reports, the exercise of these rights may be deferred or limited to avoid compromising the assessment activities (Article 23 GDPR).

8. Requirement to provide data

To subscribe to the Fidelity Card / Community → data required.

For the newsletter → optional consent.

For whistleblowing → it is also possible to report anonymously.

9. Prohibition of retaliation

Any form of retaliation against the whistleblower is prohibited and punishable under current legislation.

10. Profiling

Profiling, where authorised, is exclusively aimed at providing tailored offers and benefits and does not produce significant or legal effects (Article 22 GDPR).

11. Data Protection Officer (DPO)

If appointed, the name and contact details will be made available in the updated privacy policy.

12. Updates

This privacy policy may be updated; any changes will be communicated through the appropriate channels.