When we carry out our activities, it might be necessary to obtain and process information or data in compliance with applicable legislation (General Data Protection Regulation - GDPR), and for this reason we are providing you with this notice.
The Controller is Cris Conf S.p.A., with head office in Strada Comunale per Fornio, 136, 43036 Fidenza (Parma), e-mail PinkoPrivacy@pinko.com (hereinafter the “Controller”, or simply “PINKO”).
Recipients (data subject)
This notice concerns data relative to customers, consumers, persons interested in finding out about specific projects and/or products and/or services promoted/provided by PINKO, including recipients of digital lead-generation campaigns.
Procedures for collecting and source for collecting and/or obtaining data
Data subjects provide data in hard copy and/or electronic forms, available online or at direct and partner stores, and from franchisees, giving their informed consent. Moreover, in some cases, after specifically giving consent, some data and information also relative to connected third parties, might be obtained from lists and databases which are public and/or in the public domain.
Purposes of the processing
The purposes of the processing are detailed below, for each specific case.
4.1 Sale of goods and services, after-sales service and processing of your requests, as well as compliance with legal obligations
Your data might be necessary to make a purchase (via the website and/or from our stores), for related obligations, to make shipments, guarantee after-sales services (if you contact Customer Service we can follow up your requests), comply with applicable laws and/or regulations, also concerning tax refunds. Providing this data is optional, however if you do not give this data, Cris Conf cannot follow up your requests or finalise the contract for the sale of its products / services and/or provide after-sales service. Your data will be processed and kept for the entire time necessary to meet your requests indicated previously, and in any case for no more than 10 years from your last purchase (in line with/for the time indicated by applicable legislation). The legal basis for processing your data is to meet your request, so to achieve the purposes described in this notice, Cris Conf requires your specific consent.
Website registration (Login/Register)
The Website has a specific, reserved section where you can register and create a personal profile, to save your favourite products in a wishlist, save and track your previous orders, manage invoicing and shipment addresses, check the status of orders, manage your credit cards and request product returns, and where we can manage all your subsequent requests, meet related obligations and provide you with relative services. Giving your data (name, surname, date of birth, email address) is optional and we require your consent. If you do not give consent, you cannot register with the Website. Your personal data will be processed by Cris Conf until you decide to cancel your Website registration, according to the procedures indicated in this Notice.
Sending out the newsletter
If you wish to receive our Newsletter for up-to-date news, information about special initiatives, products and services offered by Cris Conf, you can fill in a specific section on the Website and/or the hard copy or digital form available at our Stores, giving your data (name, surname, email address, date of birth). Giving your data is optional, and your consent is required. If you do not give consent, we cannot process your request to sign up to receive the Newsletter with all the latest news about Cris Conf. Your personal data will be processed for the purposes indicated until you decide to cancel your subscription to the Newsletter by clicking on the “unsubscribe” link, or according to the procedures indicated in this Notice.
Meeting requests for information
The Website has a specific section “Contact us”. You can use this section to request further information, if you opt in to register with the website. Giving your data (name, surname, email address) is optional and we require your consent. If you do not give consent, you cannot register with the Website or request further information. Your personal data will be processed by Cris Conf only for the time necessary to meet your requests. You can decide to cancel your Website registration, whenever you want, according to the procedures indicated in this Notice.
Cris Conf has a loyalty programme which allows customers to be recognised as members each time they access Cris Conf’s sales outlets (direct and indirect). Members can also benefit from the programme’s special offers. If you want to register as a Cris Conf customer, you can fill in the hard copy or digital Customer Card available at Cris Conf’s sales outlets. Your personal data will be visible from all Cris Conf outlets worldwide, though you may decide, each time you purchase a product or use a service, whether you want member recognition by giving/not giving your name. Giving your data is optional and we require your consent. If you do not give consent, you cannot register. Your personal data will be processed by Cris Conf for the above purposes for no more than 5 years from your last purchase or involvement in an initiative or notice of the Controller. After this time, your data will be automatically deleted, or made permanently anonymous. In any case, you can cancel your programme membership at any time, according to the procedures indicated in this Notice.
If you want to receive up-to-date information about the latest products and services offered by Cris Conf, you can fill in a specific section on the Website and/or the hard copy or digital form available at our Stores, giving your data (besides your personal data, you only need to give us your contact details). If you fill in these forms you can opt in to our marketing initiatives and take part in promotional initiatives and special projects. Cris Conf will also be able to send you the newsletter and/or information, advertising and/or promotional materials, and invitations to sales events, through traditional channels (by post, telephone calls), and by electronic and/or automated methods (for example messages, automated telephone calls).
In particular cases and if the data subject wants to, personal data and/or contact details can be given in a message (text message or other type of message). By sending this message, which is voluntary, the data subject consents to promotional and/or marketing activities, until he/she decides otherwise.
Giving your data is optional, and your consent is required. If you do not give consent, we cannot process your request to opt in to our marketing and information programmes with all the latest news about Cris Conf. Your personal data will be processed for the purposes indicated until you decide to withdraw your consent, according to the procedures indicated in this Notice, or if you subscribe by email only, by clicking on the “unsubscribe” link.
Please note: Cris Conf does not carry out promotional activities for customers under fourteen years of age. When you give your data for this processing purpose, you will be asked your age.
Cris Conf may also analyse your consumer habits and choices in order to send you customised marketing notices. Your specific consent is required in order for Cris Conf to carry out profiling, and you can authorise this by filling in the hard copy or electronic Customer Card at any sales outlet or on the Website. Authorising profiling initiatives is voluntary and your refusal will not affect in any way the provision of other activities you may request (such as the purchase of a product or sending the newsletter), but it will not allow Cris Conf to inform you about products and services that may be of interest for you. Profiling will focus on products or services purchased over the last year and will continue until you decide to withdraw your consent or oppose further profiling, according to the procedures indicated in this Notice.
Participation in initiatives and special projects
If you are interested in taking part in special projects organised by Cris Conf and in receiving information about future initiatives, you can leave your personal data and contact details (name, surname, email, telephone number, address), to be processed by the Controller, so you can be registered for the special project and we can manage your involvement in it, and send you specific notices about it and keep you up to date. Giving your data is optional, and your consent is required. If you do not give consent, you cannot take part in the special project and/or Cris Conf cannot keep you up to date about special projects. Your personal data will be processed for the purposes indicated until you decide to withdraw your consent (according to the procedures indicated in this Notice). In any case, your personal data will be processed until completion of the special project you are interested in, and will be kept for up to 10 years from the end of the special project.
Type of data collected and processed
For the specific purposes indicated in this notice, in compliance with your choices and whether you wish to give consent where requested, the Controller will process the following personal data: personal details (for example name, surname and date of birth); contact details; payment data (credit card or payment details); data on the purchase (date, place, quantity and type, consumer preferences); technical Website browsing data. In the case of tax refund applications, passport details will also be processed. The above data are common personal data, and in some cases may be classifiable as “special” and/or “sensitive” data. If the data subject provides data concerning third parties, s/he is required to inform the third parties that data concerning them are being processed.
12.1 Methods for processing the data
Data are processed according to the following methods:
- lawfully and fairly, in compliance with laws, and in a manner that guarantees the confidential nature of the data;
- using electronic or other means (for example hard copies);
- by (natural and legal) persons that are authorised to carry out such duties and that are identified at all times, and are also appropriately trained;
- using safety measures designed to guarantee the confidentiality of the data subject the data refer to and to prevent undue access by unauthorised third parties.
Moreover, data will be entered in, processed and kept in a CRM database that can be accessed from all countries where Cris Conf operates, through its subsidiaries, franchisees, partners and similar (with a complete, updated list available on the website and at headquarters), with the possibility that processing may also take place outside European Union countries.
12.2 Mandatory and/or optional nature of giving/processing data and consequences of refusing to give data
The processing of data is mandatory where specifically required for the activities described above. The consequences of refusing and/or not consenting to the processing of data are given for each single case, which could make it impossible or difficult to meet contractual requirements.
12.3 Data subject to profiling
YES, as described previously for individual purposes.
12.4 Duration of the processing and retention of data
Data are processed for the time necessary to meet the purposes described above, or for the entire duration of contractual relations and even after termination of the contract, in order to meet obligations arising therefrom, in compliance with applicable laws. Provisions on anti-money laundering require the retention of data for 10 years following the termination of business relations or end of the professional service.
12.5 Disclosure of data to third parties
To carry out the above activities and attain the above purposes, and in relation to the management and business model adopted, data may be disclosed to the following categories of entities.
12.6 Categories of external entities to whom data are transferred
External entities used by Pinko to market the products/services (e.g. dealers, franchisees, partners); Authorities and supervisory and control authorities; professionals, businesses and partners outsourced some functions and/or that provide services/consultancy services (for example, related to administrative, tax, control, audit, certification, IT management, promotional and advertising obligations, professionals, external staff and consultants, partner companies); other subsidiaries or investees of Cris Conf spa; partners for the organisation of special projects; Banks, financial organisations, payment systems, insurance companies.
A full and updated list is available at the registered office of the Controller.
12.7 Dissemination of data
Data and information are not disseminated.
12.8 Transfer abroad
Your personal data will be entered in a CRM database that can be accessed from all countries where Cris Conf operates, through its subsidiaries. This means your personal data may also be transferred outside the European Union. In any case, this transfer is guaranteed by the existence of adequacy decisions issued by the European Commission or by standard data protection clauses adopted for relations among companies belonging to the Controller’s group of companies.
You may ask for a copy of your personal data that have been transferred outside the EU and information about the specific safeguards in place in each individual non-EU country, by sending a specific request to PinkoPrivacy@pinko.com.
12.9 Rights that may be exercised by the data subject
Rights that may be exercised
The data subject has the right to obtain confirmation as to whether or not his/her personal data are being processed and also to obtain access to the personal data, as well as the following information:
- the purposes of the processing;
- the categories of personal data concerned;
- the recipients or categories of recipient to whom the personal data have been or will be disclosed, in particular recipients in third countries or international organisations;
- where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
- the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing;
- the right to lodge a complaint with a supervisory authority;
- where the personal data are not collected from the data subject, any available information as to their source;
- the existence of automated decision-making, including profiling, referred to in Article 22(1) and (4) and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.
The data subject shall also have the right to obtain the rectification of inaccurate personal data concerning him or her and taking into account the purposes of the processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement. The data subject shall have the right to obtain from the controller the erasure of personal data concerning him or her without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
- the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- the data subject withdraws consent and where there is no other legal ground for the processing (for example, a legal obligation);
- the data subject objects to the processing and there are no overriding legitimate grounds for the processing (for example, a legal obligation);
- the personal data have been unlawfully processed;
- the personal data have to be erased for compliance with a legal obligation in Union or Member State law to which the controller is subject;
- the personal data have been collected in relation to the offer of services by an information society;
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data;
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
- the data subject has objected to processing pursuant to Article 21(1) pending the verification of whether the legitimate grounds of the controller override those of the data subject.
Terms and Conditions
The Controller shall provide information on action taken on a request to the data subject without undue delay and in any event within one month of receipt of the request. In compliance with the GDPR, that period may be extended by two further months where necessary, taking into account the complexity and number of the requests. In this case, the Controller shall inform the data subject of any such extension within one month of receipt of the request, together with the reasons for the delay. Where the data subject makes the request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.
Data subjects may contact us by email or telephone (see the above contact details) to exercise their rights, and to receive any clarifications also regarding this Notice.