PRIVACY POLICY PURSUANT TO ART. 13 OF EU REGULATION 679/2016 (GDPR) Last update: 29.04.2022 The purpose of this privacy policy is to describe the processing of personal data carried out by Eley S.r.l. with relation to the offer of its products and services, as well as during the user's browsing on, and interaction with, the "www.insightprofessional.it" website (hereinafter also just "the Site"). 1. DATA CONTROLLER Eley S.r.l. (hereinafter also referred to as "Eley" or “the Data Controller") with registered office in Via G. Di Vittorio no. 11, Cadriano, Granarolo dell'Emilia (BO), VAT number: 02084561204. Phone: +39 051 763418 Fax: +39 051 763532 Email: privacy@eley.it 2. TYPE OF DATA PROCESSED a) Automatic browsing data: Eley uses a number of cookies on the Site to collect information from those who connect to it. Such data are automatically acquired during navigation and are, for example, Internet Protocol (IP) addresses, domain names of the computers used to visit the Site, Uniform Resource Identifier (URI) addresses of the resources requested, various details of the requests sent to the Site's server, generic geographical position as indicated by the IP address, the device used to connect to the Internet site and other parameters relating to the user's operating and computer system, the transmission of which is inherent to the regular and correct operation of the Internet and the Site itself. This information is not collected to be associated with identified subjects, but by their very nature could, through processing and association with data held by third parties, allow them to be identified. For more information on the cookies used on the Site, please refer to our Cookie Policy. b) Data provided by the user: Eley may collect user data in the context of requesting information, filling out online forms, sending paper correspondence or e-mails to the contacts available on the Site or elsewhere and sending/delivering curriculum vitae, such as names, surnames, phone numbers, addresses, e-mails and any other information voluntarily provided to Eley by the user. c) Data provided for the execution of the business relationship: i.e. data such as names, surnames, tax code, addresses, e-mails, telephone numbers, purchases made, as well as any other information necessary for the execution of the business relationship with suppliers and customers, as well as subsequent to the purchase of Company products, also through the appropriate e-commerce on the Site. Please note that on the Site it is possible to make purchases both in "Guest" and "Registered User" mode. 3. PURPOSE AND LEGAL BASIS OF THE PROCESSING Personal data are processed by Eley according to the legal bases and purposes indicated below: PURPOSE MORE INFORMATION LEGAL BASIS 1 - Implement and improve the Site's computer services, analyse the interaction of users with the Site and prevent the occurrence of computer crimes. Browsing data may be used by Eley to ensure the smooth and correct functioning of the Site, to implement and improve the browsing experience, to evaluate the ways in which users interact with the Site, and, where necessary, to ascertain and prosecute any unlawful acts committed against the Site and/or its users. Legitimate interest of the Data Controller in the correct functioning of the Site. Consent of the user, if necessary, for the processing of data collected by cookies. 2 - Respond to requests for information received by filling out online forms or by sending e-mail and/or mail to the contacts indicated on the Site. Eley will process personal data voluntarily provided by the user in order to provide feedback on the requests that the user may make by filling out the forms online or by sending e-mails and/or mail to the contacts indicated on the Site. Said processing of personal data will be limited to the response to the request/ execution of the service requested by the user. Performance of the contract to which the user is a party and/or taking pre-contractual measures in their interest. Consent of the user expressed through the spontaneous sending of the data to the Data Controller. 3 - Evaluate spontaneous applications received by the company or those directly solicited by Eley for open positions and, possibly, recruit staff. Eley uses the information contained in the curricula, such as, for example, contact details, work experience, qualifications, etc., to assess the applications submitted in the light of Eley's employment needs, to organize interviews and subsequently to recruit staff. Execution of pre-contractual measures taken at the user's request. Consent of the interested party expressed by sending the CV. 4 - Management of any adverse reactions In the event the user contacts Eley through the Site to report any adverse reactions, presumably arising from the use of INSIGHT products, special categories of personal data, such as, for example, health data, may also be processed. Such information may be directly transmitted by the user, or requested by Eley's operators in order to obtain more details about the reaction and manage it in the best way possible. In this case, the data will be processed in accordance with the provisions of current legislation on cosmetic surveillance. Fulfilment of legal obligations relating to cosmetic surveillance to which Eley is subject. Consent of the user expressed through the sending of the information. 5 - Management of the "guest" user and the profile of the "registered" user The Site offers the possibility of making purchases in "guest" mode. In this case the data requested by Eley will be processed to provide the requested service. The Site also offers the possibility of making purchases as a "registered user". In the event of registration, the data will be processed not only to provide the requested service, but also to identify the user as a registered user. The data will be entered into the Eley customer management computer system and associated with the history of purchases made through the Site. The processing will also be carried out in order to offer a more rapid way of ordering online and to access the various functions and products and services that the Site makes available, such as the storage of preferred shipping addresses, checking the status of orders in progress, viewing products purchased previously, changing personal details, etc.. The user can always request Eley to cancel his/her account by communicating with the contacts indicated on the Site. The user is informed that in the event of express consent, as better specified below, the information collected during the purchase as "guest" or "registered user" will be used for profiling and direct marketing purposes. Execution of the contract for the provision of a service requested by the user. 6 - Purchase of products and services also on the Site In the context of the purchase of products, also on the Site, information necessary for the execution of the contract such as nationality, name, surname, e-mail, address, telephone number, tax code, etc. are required. Processing is necessary for: (a) contacting the user regarding any issues related to the execution of the contract and, in general, offering assistance and support (e.g. shipping, billing, customer service, etc.); (b) managing the payment of the purchased products, for example: i. in order to activate the necessary mechanisms to control and avoid potential fraud or scams during the purchase transaction; ii. to ascertain payment and handle any refunds or returns; iii. make the purchase receipts available; (c) deliver the purchased products to the address indicated. 1. Execution of the contract to which the user is a party for all that concerns the processing of data for the purpose of payment, shipment of products, and, in general, the proper fulfilment of the contract. 2. Legitimate interest of Eley in the prevention and prosecution of any fraud or scams. 7 - Profiling and direct marketing Through the Site, Eley provides the user with the opportunity to stay updated on new products, receive expert advice and learn about special offers on INSIGHT products. a) Profiling: with the user's consent, we will use the data collected during the purchase phase to process a personalized profile aimed at sending the promotional communications referred to in the next point. In this case Eley carries out a limited profiling activity linked to direct marketing. In particular, individual and specific profiles are created on the basis of the user's preferences, purchasing propensity and consumption choices for the purpose of sending targeted promotional and informative material. b) Direct e-mail marketing: with the user’s consent, we will use the information processed through the above profiling in order to send promotional e-mail communications about our products or services, personalized according to consumption habits and/or products and services that may be of interest to the user based on their purchase choices. Consenso dell’utente. 8 - Newsletter and mailing list The user may consent to their data being entered into Eley's databases for receiving newsletters and inclusion on mailing lists. This is in order to receive promotional materials, discount vouchers, offers, information material and invitations to Eley initiatives and events by e-mail. The sending of such promotional material does not take place on the basis of profiling carried out on the user's personal data, but is made indiscriminately to those who have given their consent to receive such material. User consent. 9 - Search for and obtain products and services useful for company’s activities Eley uses suppliers of products and services of various kinds, in relation to which information may be collected such as tax code, first and last name, address, contact details or other personal details necessary for the establishment and/or execution of a business relationship. The data are used for the mere purpose of establishing the business relationship, making payments for the products/services received, handling relations with suppliers, keeping accounts, etc. Performance of the contract and/or adoption of pre-contractual measures. 10 - Fulfilment of legal obligations and/or Public Authority orders The user's data may also be processed in the fulfilment of obligations to which Eley is subject under current legislation, such as for example the keeping of accounts or compliance with a Public Authority order. Compliance with a legal obligation to which Eley is subject. 4. OPTIONAL PROVISION OF DATA The user is free to provide their personal data or not. Failure to provide the information requested could make it impossible for Eley to process users' requests or provide the desired services. 5. DATA RECIPIENTS Eley uses suppliers of products and services to which personal data may be communicated in the context of the supply relationship, for example: a) companies in the business group to which Eley belongs; b) credit institutions; c) professional service providers such as accountants, lawyers, labor consultants; d) IT service providers, such as system administrators, software and network administrators, e-mail service providers, web hosting and website designers; e) companies whose activities enable us to send the purchased products, such as payment service providers, warehouses, packaging and order shipping companies; f) Italian, European or foreign public authorities according to the applicable jurisdiction, if necessary, according to the law or by order of the Authority. It is understood that personal data will be used only for the purposes indicated in this policy and may be communicated to third parties only if necessary, in order to fulfil the purposes for which the data is collected. Apart from these cases, personal data will not be communicated unless specifically required by law, or unless the user gives his/her specific consent. 6. DATA RETENTION TIME The Company will keep the data only for the time necessary to achieve the above-mentioned purposes or, alternatively, according to the legal obligations to which Eley is subject. In particular: PURPOSE STORAGE TIME Management of information requests by filling in the form and/or by e-mail Information relating to requests for information will be kept for the time necessary to process the request or for longer periods if a contractual relationship is established. Execution of the business relationship with customers The time required for the management of the purchase and the handling of returns, associated complaints or disputes, as well as the additional period established by law. Execution of the business relationship with suppliers The time necessary for the management of the relationship, as well as the additional period established by law. Management of adverse reactions The documentation relating to the management of reports of any adverse reactions will be kept for the time required by the law on cosmetic surveillance. Management of "registered" user profile Until the deletion of the profile if requested by the user. Profiling The information collected will be used for profiling and direct e-mail marketing purposes for a period not exceeding 1 year after its registration. Newsletter and mailing list Until consent is revoked by the user. Curriculum vitae management The CVs received will be kept for a period not exceeding 12 months. 7. PROFILING The purchase data will be subject to profiling, after expression of consent. Profiling consists in collecting personal data through any form of automated processing, in order to obtain information regarding certain characteristics that distinguish the user. The profiling carried out by Eley exclusively concerns preferences and purchasing habits with reference to the products and services offered by the Company. The data processing process will be carried out in order to carry out studies on customer preferences and the degree of satisfaction with our products, as well as to allow our marketing departments to identify the offers and products that best suit the user, in order to send targeted promotional material. It is understood that the user has the right, at any time, to object to the processing of their data for purposes related to profiling and direct marketing. 8. TRANSFER OF DATA ABROAD For the operation of the Site and for the e-commerce service, Eley uses IT service providers and hosting providers that can transfer user information collected through the Site to data centers and clouds located in Canada and the USA, through the security measures identified by these providers (autonomous data controllers) and provided for by EU Reg. no. 679/2016 for data transfers abroad. In particular, data transfers to Canada are legitimate under the adequacy decision no. 2002/2/EC of the European Commission, adopted pursuant to Article 45 of the GDPR. The companies, on the other hand, to which the data is transmitted in the USA, are members of the Privacy Shield between the European Union and the United States for the secure transfer of data to the USA. 9. RIGHTS OF DATA SUBJECTS In relation to the personal information that Eley collects and processes, the company guarantees the following rights: withdrawal of consent: allows for the interruption of data processing where this is based on consent, except where there are further valid legal bases for which Eley can continue processing even in the absence of consent; access: allows the data subject to obtain confirmation or not of the existence of a processing activity in progress, of the personal data held by Eley and, if necessary, to access such data and information relating to them; rectification: allows for the modification of inaccurate personal data without undue delay and, taking into account the purposes of the processing, for the integration of incomplete personal data; deletion: allows for the deletion of data without unjustified delay (e.g. when the personal data is no longer necessary in relation to the purposes for which it was collected), subject to the exceptions provided for by the applicable legislation (e.g. when the retention of the data is necessary to comply with legal obligations applicable to Eley); portability: allows the data subject, under certain circumstances provided for by applicable law, to receive the personal data provided to Eley in a structured, commonly used and machine-readable format; limitation: allows the data subject, in certain circumstances provided for by the applicable legislation, to obtain the limitation of the processing of personal data. In such cases, Eley may continue to process the data only in certain cases, for example for the exercise of the right of defense or to protect the rights of another individual or legal entity; opposition: allows the data subject, in certain circumstances provided for by the applicable legislation, to oppose the processing of personal data unless there are overriding legitimate reasons, rights or freedoms such as to allow Eley to continue processing. It is also possible, moreover, to lodge a complaint with the Italian Data Protection Authority at any time.