Privacy Policy

PREAMBLE

​

This notice takes into account the provisions of the GDPR and the Privacy Code (Legislative Decree No. 196 of June 30, 2003). The document has also been drafted in accordance with the Guidelines of the Privacy Authority (especially the Guidelines on combating spam issued by the Privacy Authority on July 4, 2013).

​

Data Controller: HMEDITERRANEA S.R.L

Website to which this privacy policy refers: https://www.holusmediterranea.com

The Data Controller has not appointed a DPO (Data Protection Officer). Therefore, you can send any requests for information directly to the Data Controller.

​

GENERAL INFORMATION

​

This document describes how the Data Controller processes your personal data provided on the Site.

​

Below, the main processing activities of your personal data are described. In particular, the legal basis for processing, whether providing data is mandatory, and the consequences of not providing personal data are explained. To best describe your rights, we have specified if and when a certain processing of personal data does not take place.

​

Registration on the Site

​

The information and data requested during registration will be used to allow you to access the reserved area of the Site and to use the online services offered by the Data Controller to registered users. The legal basis for processing is the necessity for the Data Controller to carry out pre-contractual measures adopted at the request of the data subject. Providing data is optional. However, your refusal to provide data will result in the inability to register on the Site.

​

Purchases on the Site

​

Your personal data will be processed to enable you to make purchases on the Site. In the case of placing an online order, this is to enable the conclusion of the purchase contract and the correct execution of the operations related to it (and, where necessary based on sector regulations, to comply with tax obligations). This processing of personal data also includes the possibility of sending communications (e.g., tracking and order information) through automated tools such as SMS and/or WhatsApp. The legal basis for processing is the obligation of the Data Controller to execute the contract with the data subject or to comply with legal obligations. Regardless of the above (and therefore your consent), the Data Controller may process your data for the purposes of so-called "soft-spam," as regulated by Article 130 of the Privacy Code. This means that, limited to the email you provided in the context of a purchase via the Site, the Data Controller will process the email to allow direct offers of similar products/services, as long as you do not oppose such processing in the manner provided for in this notice. The legal basis for processing is the legitimate interest of the Data Controller to send this type of communication. This legitimate interest can be considered equivalent to the interest of the data subject in receiving "soft-spam" communications. The Data Controller may send emails to remind you to complete a purchase. The legal basis for this processing is the legitimate interest of the Data Controller in sending this type of communication. Through the "follow on shop" option, the Data Controller can also process your personal data to send updates via email and/or phone (depending on the options available on the Site from time to time) regarding the status of orders, shipments, and/or supplies. The legal basis for this processing is the legitimate interest of the Data Controller in sending this type of communication. This interest is equivalent to your interest in receiving such updates. Providing personal data for this purpose is optional. However, if personal data is not provided, the Data Controller will not be able to send this type of communication.

​

Responding to Your Requests

​

Your data will be processed to respond to your requests for information. Providing data is optional, but your refusal will result in the inability for the Data Controller to respond to your questions. The legal basis for processing is the legitimate interest of the Data Controller in following up on user requests. This legitimate interest is equivalent to the interest of the user in receiving a response to communications sent to the Data Controller.

​

Generic Marketing

​

With your prior consent, the Data Controller may process the personal data you provided in order to send you advertising material and/or newsletters related to its own products or those of third parties. The legal basis for this processing is your consent. Providing personal data for this purpose is entirely optional. Failure to consent to the processing of data for marketing purposes will result in the inability for you to receive advertising material related to products/services of the Data Controller and/or third parties, as well as the inability for the Data Controller to conduct market research, including to evaluate user satisfaction, or to send you newsletters. These communications will be sent to the email address you provided on the Site.

​

Profiling

​

With your prior consent, the Data Controller may process your personal data for profiling purposes, that is, to analyze your consumption choices through the identification of the type and frequency of purchases you make, in order to send you advertising material and/or newsletters related to its own products or those of third parties that are of specific interest to you. The legal basis for this processing is your consent. Providing data for this purpose is entirely optional. Failure to consent to the processing of your personal data for profiling purposes will result in the inability for the Data Controller to develop your commercial profile, through the identification of your choices and purchasing habits, as well as to send you advertising material related to the products of the Data Controller and/or third parties that are of specific interest to you. These communications will be sent to the email address you provided on the Site.

​

Data Sharing

​

The Data Controller does not share your personal data with third parties.

​

Geolocation

​

The Site does not implement geolocation tools for the user's IP address.

​

Curriculum Vitae

​

It is not possible to send curriculum vitae through the Site. Therefore, your data will not be processed for these purposes.

​

Appointment Booking

​

The Site does not have third-party systems for booking appointments with the Data Controller. Therefore, your data will not be processed for this purpose. However, you can always contact the Data Controller at the contacts indicated above.

​

Communication of Personal Data

​

In the course of its ordinary activities, the Data Controller may communicate your personal data to certain categories of subjects. In Article 2 you can find the list of subjects to whom the Data Controller communicates your personal data. To facilitate the protection of your rights, Article 2 may specify in some cases when your data is not communicated to third parties.

The "communication" of personal data to third parties is different from "transfer" (regulated in the preceding section). In fact, in communication, the third party to whom the data is transmitted can only use it for the specific purposes described in the relationship with the Data Controller. In transfer, on the other hand, the third party becomes an independent Data Controller of the personal data. Furthermore, your consent is always required to transfer your personal data to third parties.

Notwithstanding the above, it is understood that the Data Controller may still use your personal data to comply with the obligations set forth by the applicable laws.

 

SPECIFIC PRIVACY INFORMATION

 

Art. 1 Processing Methods

​

1.1 The processing of your personal data will primarily be carried out using electronic or automated means, according to methods and tools suitable to ensure security and confidentiality in accordance with the GDPR

1.2 The information collected and the methods of processing will be relevant and not excessive in relation to the type of services provided. Your data will also be managed and protected in secure IT environments appropriate to the circumstances

1.3 Through the Site, "special data" are not processed. Special data are those that can reveal racial or ethnic origin, religious, philosophical, or other beliefs, political opinions, membership in parties, trade unions, religious, philosophical, political, or trade union organizations, health status, and sexual life

1.4 Through the Site, judicial data are not processed

​

Art. 2 Communication of Personal Data

​

The Data Controller may communicate your personal data to certain categories of subjects. Below are the subjects to whom the Data Controller reserves the right to communicate your data:

• The Data Controller may communicate your personal data to all those subjects (including Public Authorities) who have access to personal data based on regulatory or administrative provisions

• Your personal data may also be communicated to all public and/or private subjects, natural and/or legal persons (legal, administrative, and tax consulting firms, Judicial Offices, Chambers of Commerce, Employment Agencies, etc.), when the communication is necessary or functional for the correct fulfillment of obligations arising from the law

• The Data Controller employs employees and/or collaborators in any capacity. For the proper functioning of the Site, the Data Controller may communicate your personal data to these employees and/or collaborators

• In its ordinary activity of managing the Site, the Data Controller uses companies, consultants, or professionals tasked with installing, maintaining, updating, and generally managing the hardware and software of the Data Controller or of which the latter uses for providing its services. Therefore, only in relation to these purposes, your data may also be processed by these subjects

• For sending its communications, the Data Controller uses external companies tasked with sending such communications (CRM platforms). Your personal data (in particular the email) may therefore be communicated to these companies

• The Data Controller does not use external companies to provide customer care services

• The personal data of the purchaser may be communicated to postal offices, couriers, or shippers responsible for delivering the Products purchased through the Site

The Data Controller reserves the right to modify the above-mentioned list based on its ordinary operations. Therefore, you are invited to regularly access this information to check which subjects the Data Controller communicates your personal data to.

​

Art. 3 Storage of Personal Data

​

3.1 This article describes how long the Data Controller reserves the right to retain your personal data

• Your personal data will be retained only for as long as necessary to ensure the correct provision of the services offered through the Site

• Through the Site (or by requesting it from the Data Controller), it is possible to delete the user's account. In this case, all personal data stored will be deleted and will not be retained by the Data Controller for any purpose

3.2 Without prejudice to what is provided for in article 3.1, the Data Controller may retain your personal data for the time required by specific regulations, as modified from time to time.

​

Art. 4 Transfer of Personal Data

​

4.1 The Data Controller is based within the European Union. Therefore, the processing of your data is secure from a regulatory point of view as it is governed by the GDPR. If the transfer of your personal data occurs to a non-EU country for which the European Commission has expressed an adequacy judgment, the transfer is considered secure from a regulatory point of view in any case. This article 4.1 indicates from time to time the countries to which your personal data may be transferred and where the European Commission has expressed an adequacy judgment

• Therefore, users are invited to regularly access this article to verify if the transfer of their personal data occurs to a country with these characteristics

4.2 Without prejudice to what is indicated in article 4.1, your data may also be transferred to non-EU countries for which the European Commission has not expressed an adequacy judgment. You are therefore invited to regularly review this article 4.2 to ascertain in which of these countries your data is potentially transferred

4.3 In this article, the Data Controller indicates the countries to which it potentially directs its activity. This circumstance may imply the application of the laws of the country in question, alongside the GDPR

• Upon the user's request, the Data Controller will apply the legislation potentially more favorable provided by the national legislation of the user

Art. 5 Rights of the Data Subject

​

Pursuant to article 13 of the Privacy Regulation, the Data Controller informs you that you have the right to:

• request the Data Controller access to your personal data and the rectification or deletion of the same or the limitation of processing concerning you or to object to their processing, in addition to the right to data portability

• revoke consent at any time without affecting the lawfulness of processing based on consent before revocation

• file a complaint with a supervisory authority (e.g., the Guarantor for the protection of personal data)

The above rights can be exercised with a request addressed informally to the contacts indicated in the Introduction

​

Art. 6 Modifications and Miscellaneous

​

The Data Controller reserves the right to make changes to this privacy notice at any time, providing suitable notice to users of the Site and ensuring in any case adequate and equivalent protection of personal data. To view any changes, you are invited to regularly consult this privacy notice. In the case of substantial changes to this privacy policy, the Data Controller may also communicate them via email.