Information Notice on Personal Data Processing

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016

Pursuant to and for the purposes of Article 13 and Article 14 of Regulation (EU) no. 2016/679 of the European Parliament and the Council of April 27, 2016 on the protection of individuals with regard to Personal Data processing, as well as on the free movement of such Data (General Regulation on Data Protection, hereinafter, also, “Regulation” or “GDPR”), and which repeals Directive 95/46/EC, we inform you that the Personal Data you voluntarily provided to REXITE SRL (hereinafter, also “the Company” or “REXITE SRL”), shall be processed in compliance with the current legislation on personal data protection and, in any case, the principles of confidentiality that inspire the Company’s activities.

1. Categories Of Personal Data Processed

Rexite Srl will process the following Personal Data provided by the Data Subject:

• Personal data (such as name, surname, date of birth, sex), password, invitation code, email, company email, mobile phone, address (hereinafter, also, “Personal Data” or “Data”).

2. Purposes of Processing

Personal Data you have provided to REXITE SRL may be used for the following purposes:

1. allow your use of products and/or services, as well as the performance of activities reserved to you;
2. administrative-accounting purposes and fulfilment of obligations under current legislation;
3. for marketing purposes, following your possible and specific consent, including the submission of informative and commercial communications, also of a promotional nature (including our newsletter), of advertising material and/or offers of goods and services, by any means, including, but not limited to, mail, Internet, telephone, e-mail, MMS, SMS from Italy or abroad (also from countries not belonging to the European Community) by REXITE SRL, parent companies, subsidiaries and/or affiliates thereof, as well as by physical or legal entities contractually bound to REXITE SRL, which submit communications on behalf and in the name of REXITE SRL;
4. for profiling purposes, following your possible and specific consent, to allow the elaboration and carrying out of studies and statistical and market research, as well as for the analysis of tastes, preferences, habits, needs and consumption choices and to receive customized offers based on purchase preferences, by REXITE SRL, of parent companies, subsidiaries and/or affiliates thereof, as well as, on behalf and in the name of REXITE SRL, by physical entities or legal entities linked contractually to REXITE SRL and/or that, in any case, collaborate in the commercial activities of the latter;
5. following your possible and specific consent, to transfer data to the commercial partners of REXITE SRL, with a view to receiving their communications.

We remind you that the provision of your personal data is required to fulfil the purposes highlighted in points a) and b) above. Accordingly, any refusal and/or provision of incorrect and/or incomplete information on your part would prevent:

• as regards the purpose referred to in point a): your use of products and/or services, as well as the performance of activities reserved to you;
• as regards the purpose referred to in point b): on the part of REXITE SRL, the execution of administrative and accounting activities and the correct fulfilment of regulatory obligations.

As regards further purposes highlighted in points c), d) and e), the provision of your Personal Data, and the consent to the processing of the same for the aforementioned purposes, is optional. However, any refusal on your part to provide your data and/or consent for processing relating to the aforementioned purposes, and/or the provision of inaccurate and/or incomplete information may prevent the Company from:

• as regards the purpose referred to in point c): sending promotional communications by REXITE SRL;
• as regards the purpose referred to in point d): carrying out profiling activities and sending personalized offers based on your purchase preferences by REXITE SRL;
• as regards the purpose referred to in point e): transferring your Personal Data to the commercial partners of REXITE SRL, with a view to receiving their communications.

3. Processing methods

The processing of your personal data will be done by means of suitable paper, electronic and/or telematic tools, with logic strictly related to the above purposes and, however, in such a way as to guarantee the security and confidentiality of data themselves.

Should the user

1. log in or register with REXITE SRL services using the access credentials of a social network (for example, Facebook or Twitter, hereinafter referred to as “Social Network”), or
2. should the user associate his/her own account with an account of the same user on a Social Network, REXITE SRL can receive data from this Social Network relating to the user, in accordance with the terms of use and the provisions of the privacy policy of the Social Network itself. REXITE SRL can add this information to the User Data already collected through its services.

Should the user opt for sharing information with these Social Networks, REXITE SRL may receive data from them in accordance with the consent options provided by the user. Personal Data possibly communicated by the Social Network shall be subject to the terms and conditions of use of the Social Network.

4. Recipients or Categories of Recipients of Personal Data

People who may gain knowledge of your personal data include shareholders, members of the Board of Directors or other administrative bodies, Data Processors and, in any case, any Responsible person appointed by REXITE SRL, as well as Data Processing Managers appointed by the Company.

Your Personal Data may be disclosed to any person who provides REXITE SRL with services or services instrumental to the purposes indicated in the previous par. 2 such as, but not limited to, parent companies, subsidiaries, investees and/or affiliates.

Your Personal Data may also be disclosed to suppliers, contractors, subcontractors, banks and/or insurance companies or other subjects and/or bodies that provide for (on behalf of REXITE SRL):

• the management and/or maintenance of websites and electronic and/or telematic tools used by REXITE SRL;
• the submission of informative and promotional communications, also of a commercial nature, of advertising material and/or offers of goods and services;
• the execution of profiling activities, including the detection of habits, tastes, preferences and consumption choices, as well as the development and completion of studies and market research.

Your Personal Data may possibly be transferred abroad, in accordance with the provisions of current legislation, even to countries outside the European Union, where the Company may eventually pursue its interests.

The transfer to countries outside the EU, further to cases in which this is guaranteed by the adequacy decisions of the European Commission, is carried out in such a way as to provide appropriate and relevant guarantees pursuant to art. 46 or 47 or 49 of the Regulation.

5. Duration of processing and criteria used for personal data retention

5.1  Duration

For the purposes referred to in letters a) and b) of paragraph 2 “Purposes of Processing” hereby, your Personal Data will be processed only for as long as necessary.

For the purposes of marketing, profiling and communication to the commercial partners of REXITE SRL referred to in letters c), d) and e) of paragraph 2 “Purposes of Processing” hereby, your Personal Data will be processed until the data subject withdraws his/her consent.

5.2  Retention

Data will be retained according to the following criteria:

• Data processed for membership/subscription to the loyalty program referred to in letters a) and b) of paragraph 2 “Purpose of Processing” hereby, shall be kept for as long as you adhere to the same program and for a period of 10 years following the interruption of the relationship, unless there is a need for further retention so that REXITE SRL can assert its rights;
• Data processed for marketing and profiling purposes referred to in letters c), d) and e) of paragraph 2 “Purposes of Processing” hereby, shall be kept for a maximum of 24 months.

6. Rights of the Data Subject

We inform you that, at any time in relation to your data, you may exercise the rights provided within the limits and conditions set forth in articles 7 and 15-22 of the Regulation.

To exercise these rights, described below, please contact the Data Controller through the Privacy office at the email address amministrazione@rexite.it you request will be appropriately responded within the deadlines established by the GDPR.

In particular, Data Subjects shall be entitled to:

• revoke the consent previously given, without prejudice to the lawfulness of the processing based on consent before revocation,
• ask the Data Controller to access, correct or delete (so-called “right to be forgotten”) Personal Data or to limit the processing of its personal data, or to oppose their processing;
• obtain data portability;
• to file a complaint with the Data Protection Authority if it deems that its rights have been infringed.

7. Data Controller, Data Processors and Data Protection Officer

The Data Controller of your data is REXITE SRL, with registered office in Via Edison, 7, 20090 Cusago MI, in the person of its Legal Representative pro tempore. Any request relating to personal data processed by REXITE SRL may be submitted to the Company’s registered office, or by writing to the e-mail address amministrazione@rexite.it.

An updated list of Data Processors pursuant to Article 28 of GDPR is available from the Company and can be obtained by specific request made in the manner described above.

This information may be subject to changes. Accordingly, REXITE SRL invites Users to visit this page periodically should they be interested in knowing how Personal Data collected by REXITE SRL is processed.

Data Controller

REXITE SRL Unipersonale