Up to date as of 24 May 2018
D Scuola S.p.A. (“D Scuola“) acting as Data Controller with respect to the processing of personal data would like to inform the Users (“Users“) of the website www.blackcat-cideb.com (“Site“) about the ways and the manners in which we process the data that we obtain from our Users, according to the Legislative Decree n. 196/2003 (“Privacy Code“) and to the new European Regulation n. 679/2016 on the processing of personal data (“European Privacy Regulation“), applicable from May 25th 2018.
1. Data Controller and Data Processors
D Scuola S.p.A. with registered office in Via Bianca di Savoia 12, 20122 Milano is the Data controller, which can be contacted at the following email address: email@example.com. A complete list of the Data Processors can be requested through the abovementioned email address.
2. Personal Data Collected
According to this Policy, D Scuola will process personal data obtained from its Users; these data may include:
- Personal data and contact details provided by the User upon the creation of the Account online;
- Data related to purchases through the Site;
- Data provided when requesting information or assistance;
- Data provided through surveys, competitions or contests organized by D Scuola, provided that in this case, this Policy will be integrated by the specific Policies that deal with the processing of personal data during each contest;
D Scuola will not process health data or in general other special categories of data defined in article 9 of the European Privacy Regulation. Personal Data of minors will be processed in the ways and manners explained in paragraph 8 of this Policy.
The abovementioned categories of data will be processed only to the extent that is necessary to the purposes described in paragraph 4 of this Policy
3. Processing of Personal Data
Personal data of the Users will be processed using automated or other means and will be protected with the implementation of adequate security measures to ensure safety and confidentiality of the personal data. Specifically, D Scuola implements technical and organizational measures necessary to ensure that personal data are protected against loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
When it is no longer necessary to process the personal data for the purpose for which they were collected, or at the end of the retention period (further explained in paragraph 10), D Scuola will anonymize personal data and will remove identifiers.
4. Purposes of the Processing
D Scuola will require its Users to provide their personal data for the following purposes:
- To allow Users to register to the Site by creating a Personal Account; to perform all the activities regulated by the Terms of Sale of the Site, including purchases on the Site; to enjoy all the services offered through the Site, including participation to online contests and games and customer services and to establish, exercise or defend a claim toward the User or others (jointly defined as: “Contractual Purposes“)
- To comply with legal and regulatory obligations (defined as: “Legal Purposes“)
- When the User gives his consent, to send newsletters, marketing communications trough traditional and other means, including email, SMS, MMS, social network, instant messages, mobile applications, banner, fax, mail and phone, to promote and/or sell products and/or services offered by D Scuola and to conduct other surveys to evaluate the Users’ satisfaction with the Services (defined as “Marketing Purposes“);
- When the User gives his consent, to send marketing communication from other commercial partners of the following categories publishers, mass market retailers, toys sellers and consumer goods distributors in relation to their products/services in ways and manners already explained in the previous paragraph; a list of this subjects can be requested by the Users (defined as: “Marketing Purposes of Third Parties“);
- When the User gives his consent, to send commercial communications in the ways and manners defined at points c) and d) based on preferences, characteristics and habits of the User or to conduct analysis on these basis (defined as: “Profiling Purposes“);
- When the User gives his consent to the processing of his personal data for Marketing Purposes of D Scuola, to send no more than 3 monthly newsletters and communications related to D Scuola product/services to Users identified solely on the basis of general categories such as age range, the fact that they opened a newsletter previously sent, or how they make their purchases, (defines as: “Legitimate Interest for Marketing purposes“); and
- To carry out activities which are functional to transfer of branches, acquisitions, mergers, divisions or other changes and to perform such operations (defined as: “Legitimate Interest for Business Purposes“).
5. Legal Basis for the Processing
Processing of personal data for Contractual Purposes is mandatory since it is necessary for the registration on the Site, for the performance of all activities related to the Terms of Sale of the Site, for the purchase of products online, and to enjoy specific services offered through the Site.
Processing of personal data for Purposes of Law is mandatory since it is required by the applicable laws. If the User does not wish his personal data to be processed for these purposes, he will not be able to register to the Site, nor to enjoy the services offered through the Site by D Scuola.
Processing of personal data for Purposes of Marketing of D Scuola, for Purposes of Marketing of Third Parties and for Profiling Purposes is not mandatory, and subject to prior consent of the User. If the User does not give his consent however, D Scuola and/or other selected commercial partners will not be able to inform the User about new product/services, promotions, personalized offers, or to carry out market surveys, or to send other communications and materials in line with their interests.
Processing of Purposes of Legitimate Interest of Marketing is functional to the pursuit of a legitimate interest of D Scuola, properly balanced with the interests of the Users and, considering the limitation to this form of processing explained in paragraph 4. f), will be carried out starting from May 25th 2018, when the European Privacy Regulation becomes applicable.
Processing for Purposes of Legitimate Interests of Business is carried out according to art. 24 par. 1. d) of the Privacy Code and in order to pursue the legitimate interest of D Scuola and his counterparts to carry out economic operations indicated therein, according to art. 6. f) of the European Privacy Regulation, and properly balanced with the interests of the Users, since the Processing will only be limited to the extent necessary to perform such operations.
6. Communication of Personal Data
For the Purposes explained in paragraph 4, D Scuola might communicate Users’ personal data, strictly necessary to each type of processing, to the following categories of subjects:
- Employees, collaborators and suppliers of D Scuola, within the performance of their tasks and/or contractual obligation and in relation to the commercial relations with the Users;
- Sub suppliers and/or subcontractors within the activities connected to the performance of services and products offered by D Scuola;
- To Postal Offices and couriers to send and deliver products purchased by the Users and/or other materials related to the services offered by D Scuola;
- To legal, administrative and fiscal consultants, within the limits of what is necessary or functional to the activities of D Scuola, in the ways and manners explained above;
- To financial institutions for the management of revenues and payments deriving from the performance of the contract with the User.
Personal data of the Users will not be disclosed.
7. Overseas Transfer of Personal Data
Personal Data of the Users can be freely transferred outside the national territory to other European Countries, but they may also be transferred outside the European Union, and in particular in UK and U.S.A.
Whenever D Scuola transfers personal data outside the European Union, it will take reasonable steps and appropriate safeguards to keep the personal data safe, according to art. 44 of the Privacy Code and articles 45 and 46 of the European Privacy Regulation.
Users will have the right to obtain a copy of the Data held abroad and to receive information on the place where the Data are kept, by asking directly to the Controller, through the contact details provided in paragraph 9 of this document.
8. Data of Subjects under 18
The services offered by the Site can be enjoyed also by subjects under 18, therefore minors. In this case, D Scuola collects and processes personal data of minors only for the purposes, and in the ways and manners explained in this Policy, in compliance with the provisions of the European Privacy Regulation for processing of personal data of minors (art. 8) and with the prior consent of a parent or another legal guardian, whose data will be collected only for the purpose of obtaining such consent.
9. Rights of the Users
In relation to his personal data, the User will be able to exercise, with no additional charge and at any time, the following rights:
- To obtain confirmation as to whether or not personal data concerning him are being processed, and, where that is the case, access to the personal data;
- To know the origin of the data, the purposes and the way in which they are processed and the logic applied to processing by automated means;
- To ask for the update, rectification or – if he is interested – the integration of the data;
- To ask the erasure, the anonymization or the blocking of data unlawfully processed or to object to the processing for legitimate reasons;
- To object, fully or partially, to the processing of data for purposes of direct marketing carried out either through automated or more traditional ways;
- To withdraw his consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
Together with the abovementioned rights, starting from May 25th 2018, Users will also enjoy the rights enshrined in the following paragraph 10 c).
Users will be able, at any time, to exercise their right, to modify their contact details, to notify D Scuola changes and updates regarding their data, to obtain further information on the processing of their personal data carried out by D Scuola, by writing an email to the following address: firstname.lastname@example.org.
10. Further provisions applicable after May 25th 2018
The following provisions will become fully effective starting from May 25th 2018, when the European Privacy Regulation will be applicable
- Personal data collected for Contractual Purposes (par. 4.a) will be retained for the duration of the contract and for 10 years after its termination to exercise/defend a right of D Scuola, both in court and outside, where a claim should arise relation to the contract;
- Personal data collected for Purposes of Law (par. 4.b) shall be retained in accordance with the specific limitation periods defined by law;
- Personal data collected for Marketing Purposes of D Scuola (per 4.c) shall be retained for the duration of the service provided, the participation to the contest and for 2 years after the collection and/or the termination of the service offered;
- Personal data collected for Purposes of Marketing of Others and Profiling Purposes (par 4.d-e) shall be retained for 12 months after the collection;
- Personal data collected for Purposes of Legitimate Interest of Marketing (par 4.f) should be retained for all the duration of the registration of the User on the Site through his Account end/or the participation to an online contest and for 2 years after the cancellation/deactivation of the Account;
- Personal data collected for Purposes of Legitimate Interest of business (par. 4.g) will be retained for 10 years from the moment of their collection.
Once these terms have expired, Users’ personal data will be deleted/anonymized and/or aggregated.
- Additional rights: the User, at any time and in the ways and manners explained in the previous paragraph will have the right to:
- Ask for a restriction of the processing when: (i) the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data; (ii) the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead; (iii) D Scuola no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims; (d) the data subject has objected to processing pursuant to Article 21.1 of the European Privacy Regulation, pending the verification whether the legitimate grounds of the controller override those of the data subject;
- Ask for the erasure of personal data without undue delay;
- Ask for the portability of his personal data.
- Bring a claim before the National Authorities for the processing of personal data.
This document will be effective from the date indicated in the heading.
D Scuola might change and/or integrate this document, also as a consequence of further modifications and/or integration of the European Privacy Regulation. Updates and modifications will be notified in advance and Users will always be able to view the update Policy at the following link http://www.blackcat-cideb.com/en/privacy-policy-2 .
If you have doubts, questions or complaints with regard to the collection and processing of your personal data, you may contact D Scuola at the address: