Privacy Policy

Data Controller
The Controller of the personal data collected through the Site is: PRIMAVERA S.R.L. UNIPERSONALE, (“Seller” or simply “PrimaVera”) with registered office at Via Amilcare Ponchielli n.77, zip code 61122, VAT No. 02850980414, R.E.A. No.: 306477 (hereinafter the ‘Data Controller” or simply “Controller”), e-mail address: info@prima-vera.it

Methods of Processing Personal Data
We hold the right to privacy and the protection of our Users' personal data in the highest regard, and such data will be processed lawfully. The Personal Data provided or acquired will be subject to processing based on the principles of fairness, lawfulness, transparency, and the protection of confidentiality in accordance with current regulations, through appropriate security measures aimed at preventing unauthorized access, disclosure, modification, or destruction of Personal Data. Among the security measures adopted are the SSL certificate and the HTTPS protocol, to protect the Personal Data entered and prevent access by unauthorized third parties.

The processing is carried out using information technology and/or electronic tools, with organizational methods and logic strictly related to the indicated purposes.

Personal Data processed
When the User visits the Site, contacts us (via email, telephone, post, etc.), subscribes to the newsletter, or submits an order, we process some of their Personal Data, independently or through third parties.

We list the categories of personal data processed:

1. Identification, contact, and access data: first and last name, tax code (optional), email address, shipping address, telephone number, as well as any other Personal Data voluntarily communicated by the User.
2. Purchase data: data referring to purchases made;
3. Browsing data: related to the connection, IP addresses, domain names, and other parameters related to the browser and operating system used;
4. Usage Data: information generated by visiting the Site or making purchases on it: log data, data related to registrations made, interaction and transaction processes, performance indicators, data related to browsing flows, and use of features;
5. Billing data: if the User requests the issuance of an invoice.

Purposes of Processing and Legal Basis
The Controller will process the Users' Personal Data, as listed above, for the performance of its economic and commercial activities, for the specific purposes indicated below.

1. Purposes related to the Contract and Legal Obligations
/ol> Browsing the Site;
Activities necessary for the conclusion of the contract for the purchase of products sold on the Site and its execution;
Order processing;
Assistance and customer care activities as well as to respond to requests, complaints, reports, and disputes from Users via email to the Controller's addresses or through other communication channels;
Management of User requests through remote communication tools, such as e-mail, chat, telephone, SMS, chatbots, banners, notification systems, and other remote communication tools available on the Site;
Fulfillment of obligations deriving from current law, regulations, or EU legislation (e.g., tax and accounting obligations) or management of and response to requests from competent administrative, tax, and judicial authorities;
Administrative, accounting, and tax activities such as activities related to the contract concluded through the Site, such as, for example, the issuance of receipts and/or invoices, the keeping of accounting records;
Responding to requests for the exercise of rights granted to Users by the contract entered into with the Controller, by law in relation to such contract, or by the GDPR, and related activities.

For these purposes, the Legal Basis is the necessity to fulfill pre-contractual and contractual obligations to which the User is a party (Art. 6.1.b of the GDPR) or the fulfillment of legal obligations to which the Controller is subject (Art. 6.1.c of the GDPR).

Therefore, their processing is necessary to allow the conclusion and execution of the contract through the Site or to respond to pre-contractual requests made by the User in relation to the Site. Failure to provide the data, therefore, will make it impossible for the User to conclude a contract through the Site and/or receive a response to requests made.



1. Purposes of analysis and statistics and other purposes not based on consent
Perform statistical analyses regarding the use of the Site, browsing, product searches, to improve the site and the offer of products sold through it;

Ensure compliance with the contractual rights of the Data Controller or demonstrate compliance with obligations arising from the contract with the data subject or imposed by law, to prevent and/or repress fraudulent or harmful actions; Remind the User who has started the purchasing process that they have added a product to their shopping cart.

The legal basis for this processing is legitimate interest (Art. 6.1.f of the Regulation). Sometimes the Legal Basis consists of legitimate interest (Art. 6, paragraph 1, letter f, in conjunction with Recital 47 of the Regulation) for sending transactional email communications (e.g., abandoned cart).

1. Purposes of Direct Marketing and profiling

With the User's consent, we will send commercial emails to show them updates, news, offers and promotions, market research, also through automated processing tools such as email and newsletters;

The legal basis is the User's express consent to the processing of personal data for this purpose (Art. 6.1.a of the Regulation). Providing data for this purpose is optional. In case of lack of consent, revocation thereof, or exercise of the right to object, the User's ability to make purchases on the Site will in no way be prejudiced.

1. Soft-spam

To send to the User's email address provided in the context of purchasing products through the Site, commercial communications to propose the direct sale of similar products. This activity does not require the acquisition of prior express consent from the data subject as it is exercised on the legal basis pursuant to Art. 130, paragraph 4, of the Privacy Code (Legislative Decree no. 196 of 30 June 2003), which expressly allows it, provided that the user does not refuse such use, initially or on the occasion of subsequent communications.

Changing choices and revoking consent
In case of giving consent, the User may at any time revoke the consent given and/or object to the processing of personal data for general marketing and profiling purposes through the methods indicated in the ‘Rights of Data Subjects’ section later in this policy.

In the event of revocation of consent, processing carried out on the basis of consent given prior to its revocation will in any case be considered lawful. In case of revocation of consent and/or objection to the processing of their data for the purpose of general marketing, the user's data will no longer be processed for such purpose and will be kept by the Controller only in the event that another legal basis exists that legitimizes its processing (e.g., contractual performance; legal obligation; legitimate interest).

Retention Period
With the User's consent, we will process their Personal Data to attribute specific characteristics, preferences, and send them, also through automated processing tools such as “retargeting” or by inclusion in clusters of subjects with common characteristics, personalized and diversified commercial communications, based on their profile. For this purpose, the processing, including the final decision regarding the promotional communication to send or display to the user based on the cluster(s) they belong to, occurs in an automated manner, without human intervention, based on algorithms whose parameters have been previously set.

The Controller will process the Users' personal data for the time necessary to achieve the purposes for which such data were collected, as defined in this policy. In any case, for each of the indicated purposes, the collected personal data will be kept for the time specified below:

1. For purposes related to the Contract, the Controller will process the User's data for the time strictly necessary to carry out individual processing activities, it being understood that, once this term has expired, the Controller may keep the data for the purposes and for the maximum retention periods referred to in the other sections of this policy, if relevant and/or, in any case, in the cases established by the GDPR and/or by law.
2. For tax, administrative, accounting, and legal purposes, until the expiry of the legal terms provided for the execution of each obligation and/or for the retention times provided by law.
3. For purposes based on the Controller's legitimate interest, the Controller will process the User's data for the time strictly necessary for the satisfaction of such interest, unless, in the face of disputes and/or complaints, the Controller needs to keep personal data to carry out defense activities (letter k) for the subsequent 10 years (statute of limitations) or, in the presence of litigation, further retention is determined by the duration of the litigation or by specific requests from the authority. The User can obtain more information on the legitimate interest pursued by contacting the Controller.
4. For the purpose of marketing and profiling, until consent is revoked and in any case for a period equal to 5 years from when the consent was given or renewed by the User.

After these retention times, the Personal Data will be deleted and the User will no longer be able to exercise the rights of access, deletion, rectification, and portability of the Data.

Communication and dissemination of data
In addition to the Controller, in some cases, the following may have access to the Data:

1. third parties who perform ancillary and instrumental tasks regarding the Controller's activity and who process personal data on behalf of the Controller, such as: payment services, legal, accounting, system administrators, logistics companies, companies offering logistics management services, newsletter services, manufacturers for product repair;
2. public or private entities that can access the Data in compliance with the law, regulations, and provisions issued by competent authorities;
3. potential buyers of the Controller company and entities resulting from merger or any other form of transformation.

These recipients, depending on the case, process the Users' personal data as appointees, data processors, or independent controllers. The User can request the updated list of Data Processors pursuant to Art. 28 GDPR.

Place of Processing and transfer of Data abroad
The processing of Data takes place essentially in Italy and in the countries of the European Union. Some third-party tools may process the data of the users of this website in countries outside the European Economic Area (“Third Countries”).

The transfer of data to Third Countries can also take place through the use of external tools that allow certain services (e.g., statistical analysis, newsletters, remarketing, advertising, use of social buttons).

Sometimes the use of such tools may imply the transfer of personal data of the users who visit this website to a third country, such as for example the United States, for which there is no adequacy decision by the European Commission.

Should there be a need to transfer data to Third Countries, the Controller undertakes to ensure that the country to which the data will be sent guarantees an adequate level of protection, as provided by Article 45 GDPR; such transfer will be regulated on the basis of standard data protection contractual clauses approved by the European Commission for the transfer of personal information outside the EEA pursuant to Article 46.2 GDPR.

Cookies
This Website uses cookies. Cookies are small text files that can be installed by websites on users' devices to make the browsing experience more efficient and to personalize content and ads, provide social media features, and analyze traffic. To learn more, read the Cookie Policy.

Personal Data Processing Tools

CONTACT FORM
By filling out the contact form, the User consents to the processing of the personal data entered therein and to their use to respond to requests for information. The personal data subject to processing are those requested by the form and all other personal data potentially entered by the user in the body of the message.

NEWSLETTER AND DIRECT MARKETING
The newsletter service allows the Data Controller to send commercial communications, promotions, updates on new products, and the like to users via email. The management of email addresses occurs through a database containing the user's email address, which is added to the list of users subscribed to the newsletter when they subscribe to the newsletter by consenting to the sending of commercial communications, or make a purchase (in the case of soft-spam). In both cases, the user will be able to unsubscribe from the Newsletter service using the relative button present inside the emails. After their request for cancellation, the user's data will be deleted from the database of the software used by the Site for sending the newsletter. The Personal Data processed by this service are: name, surname, email address, shipping address, billing address, Tax Code (optional), Payment information, Phone number. However, the software used by the Site for sending the newsletter might also process Data related to the date and time of viewing the message or clicks on the links inserted in the body of the same. This Site uses the following email sending service:

Klaviyo (Klaviyo Inc.)
Klaviyo is an address management and email message sending service provided by Klaviyo Inc. To benefit from the service provided by Klaviyo, the Controller generally shares information regarding Users (who make purchases), such as contact details and purchase history. For further information regarding the scope of such sharing, check the indications provided below the wording “Personal Data processed”. Personal Data processed: name and email. Place of processing: United States – Privacy Policy – Opt out.

TEXT MESSAGE COMMUNICATIONS (SMS/MMS)

Collection and use of phone numbers

The Controller collects Users' phone numbers at the time of subscription to the text message communication program and/or during the purchase phase, if the User provides the relevant consent. Phone numbers are used exclusively to send commercial and transactional communications via SMS/MMS, including: order updates, promotions, product news, and abandoned cart reminders.

Text messages for abandoned cart

The PrimaVera website uses cookies to keep track of items added to the cart, even when the cart is abandoned. This information is used to determine when to send cart reminders via text message.

Sharing data with third parties

Users' personal data may be shared with third-party service providers that support the sending of SMS/MMS communications (including Klaviyo Inc., based in the United States), exclusively for the purposes indicated in this privacy policy. These providers act as Data Processors pursuant to Art. 28 of the GDPR.

SMS program subscription data and user consent to receive text messages will not be shared with non-affiliated third parties nor sold for marketing purposes by third parties. The foregoing excludes the data and subscription consent of the message author: this information will not be shared with third parties.

Legal basis and consent

The processing of data for SMS marketing purposes is based on the user's express consent (Art. 6.1.a of the GDPR). The user may revoke consent at any time by replying STOP to any message received or by contacting the Data Controller at info@prima-vera.it. Revocation of consent does not affect the lawfulness of processing carried out prior to the revocation, nor the ability to make purchases on the Site.

Data retention

Data related to the SMS program will be stored until the user revokes consent and, in any case, for a period not exceeding 5 years from the last consent given or renewed.

SOCIAL NETWORK BUTTONS
Users can use social buttons to visit the Site's social pages, via the following social tools that collect personal user data such as traffic data on the pages visited and on which they are installed. The Site provides the following social buttons:

Instagram (Meta Platforms Ireland Limited) The Instagram button is a service for interaction with the Instagram social network, provided by Meta Platforms Ireland Limited. Personal Data collected: Cookies, Usage Data and other data as per the relevant privacy policy. Place of processing: IRELAND – UNITED STATES - Privacy Policy

Facebook (Meta Platforms Ireland Limited) The Facebook social button and widgets are services for interaction with the Facebook social network, provided by Meta Platforms Ireland Limited. Personal Data collected: Cookies and Usage Data. Place of processing: IRELAND – UNITED STATES Privacy Policy

TikTok (TikTok Technology Limited) The TikTok social button and widgets are services for interaction with the TikTok social network, provided by TikTok Technology Limited. Personal Data collected: Cookies and Usage Data. Place of processing: IRELAND – Privacy Policy

Place of processing: IRELAND – Privacy Policy

STATISTICS

Statistics services allow the Data Controller to monitor and analyze traffic data and are used to keep track of User behavior. This Site uses the following third-party services:

Google Analytics (Google Ireland Limited)

Google Analytics is an analysis service provided by Google Ireland Limited. Google uses the Personal Data collected for the purpose of tracking and examining the use of this Site, compiling reports, and sharing them with other services developed by Google. Google may use Personal Data to contextualize and personalize advertisements within its advertising network. Google may also transfer this information to third parties where required by law or where such third parties process the information on Google's behalf. IP anonymization is active on this site. The IP address transmitted by the browser for purposes related to Google Analytics will not be associated with other data already held by Google.

The use of Google Analytics may in some cases involve the transfer of personal data of users visiting this website to a third country, such as the United States, for which there is no adequacy decision by the European Commission.

At the following link https://tools.google.com/dlpage/gaoptout?hl=it Google makes available the browser add-on for deactivating Google Analytics. Personal Data collected: Cookies, IP address, Usage Data, and other personal data defined in Google's privacy policy.
Place of processing: IRELAND and in some cases UNITED STATES – Privacy Policy (https://policies.google.com/privacy?hl=it)

Hotjar (Hotjar Ltd.)
Hotjar is a statistics service provided by Hotjar Ltd that also allows identifying the areas of this Site with which the user interacts most. Personal Data processed: Usage Data; Tracking Tools. Place of processing: Malta – Privacy Policy – Opt Out.

REMARKETING

These services allow this Site to communicate, optimize, and serve advertisements based on the User's past use of this website. This activity is performed through the tracking of Usage Data and the use of Cookies. This website uses the following services:

Facebook Remarketing (Meta Platforms Ireland Limited)
Facebook Remarketing is a Remarketing and Behavioral Targeting service provided by Meta Platforms Ireland Limited ('Meta'), which connects activity on this Site with the Meta advertising network. This Site uses the Facebook Pixel tool to measure conversions. Thanks to the Facebook Pixel, one can understand the actions that people perform on the website. The Data collected may be used to ensure that ads are shown to the right people; to create audiences to whom ads are addressed; to leverage additional advertising tools of the platform where advertising is run.
The information detected is anonymous to the operators of this Site and cannot be used to identify the identity of an individual user. However, the information is saved and analyzed by Facebook, which could link the action to an individual profile and use this information for Facebook's internal advertising purposes, as outlined by Facebook's privacy policy. This will allow Facebook to show ads both on Facebook and on third-party sites. The Site Owner has no control over how this data is used. For more information on how users can protect their privacy, please refer to Facebook's Privacy Policy. Place of processing: IRELAND and UNITED STATES.

Google ADS (Google Ireland Limited)
Google ADS is a service provided by Google Ireland Limited that connects this website with the Google advertising network. This website uses Google Analytics Remarketing features combined with Google ADS cross-device adaptability. This functionality makes it possible to link target groups for promotional campaigns created by the Google Analytics Marketing function with the cross-device adaptability of Google ADS. This allows for displaying advertisements based on the user's personal interests, identified through an analysis of the user's behavior on the web, whether on a mobile device or other devices. You can permanently disable targeting and remarketing functions by disabling the “personalized advertising” function in your Google account. To do so, simply follow the opt-out link. Personal Data collected: Cookies and Usage Data. Place of processing: Ireland – Privacy Policy - Opt out.

Facebook Pixel (Meta Platforms Ireland Limited)
This site uses the Facebook Pixel, a conversion tracking tool from Facebook provided by Meta Platforms, Inc. This analyzes conversions attributable to sponsorships on the Facebook social network through the use and analysis of certain User Personal Data. Personal Data collected: Cookies; Usage Data. Place of processing: Ireland and in some cases UNITED STATES - Privacy Policy.

Tik Tok Remarketing
This site uses Tik Tok Remarketing, which is a conversion tracking tool from Tik Tok provided by TikTok Inc. or TikTok Technology Limited. Personal Data processed: Usage Data; unique advertising device identifiers (e.g., Google Advertiser ID or IDFA identifier); device information; Tracking Tools. Place of processing: Ireland – Privacy Policy.

PAYMENT MANAGEMENT

For the management of order payments, this Site uses the following third-party tools:

PayPal (Paypal Europe S.à.r.l. et Cie, S.C.A Inc.)
PayPal is a payment service provided by PayPal Europe S.à.r.l. et Cie, S.C.A Inc., which allows the User to make online payments using their PayPal credentials. Personal data collected: Cookies and various types of Data as specified by the service's privacy policy. Place of processing: LUXEMBOURG - Privacy Policy

Stripe (Stripe Payment Europe Limited)
Stripe is a payment service provided by Stripe Payments Europe, Ltd., which allows the User to make online payments using their Stripe credentials. Personal Data collected: Various types of Data as specified by the service's privacy policy. Place of processing: USA – Privacy Policy

Apple Pay (Apple Payments Inc.)
Apple Pay is a non-instant mobile payment tool created by Apple Inc. Personal data collected: Cookies and various types of Data as specified by the service's privacy policy. Place of processing: UNITED STATES - Privacy Policy

Shop Pay (Shopify Inc.)
Shop Pay is a fast payment service provided by Shopify Inc., which allows customers to save email address, credit card, and shipping and billing information. Cookies and various types of Data as specified by the service's privacy policy. Place of processing: CANADA - Privacy Policy

Google Pay (Google LLC)
Google Pay is a digital wallet system developed by Google LLC. Cookies and various types of Data as specified by the service's privacy policy. Place of processing: EUROPEAN ECONOMIC AREA - UNITED STATES - Privacy Policy

SECURITY MEASURES

This Site uses security measures designed to prevent unauthorized access, disclosure, modification, or destruction of Personal Data. Security measures adopted include an SSL certificate and the HTTPS protocol to protect the Personal Data entered and prevent access by unauthorized third parties.

Google reCAPTCHA (Google Ireland Limited)

This Site uses the Google reCAPTCHA tool, a service provided by Google Ireland Limited that protects the Site from spam and abuse by robots. The service verifies that the user is a human and not a robot by showing certain questions based on text or images, or in some cases by using a JavaScript element in the source text that analyzes the User's behavior and operations to rule out that they are a robot, without showing questions. For more information on the data collected by the application, please view the relevant Privacy Policy and Terms of Service

LIVE CHAT

WhatsApp (Meta Platforms Ireland Limited)

Live Chat via the 'WhatsApp' channel can be used by users to access assistance or customer care services, before, during, and after purchase. The service is provided by Meta Platforms Ireland Limited and may use various technologies to collect and store information when using the services it is integrated with; this may include the use of cookies and similar tracking technologies. Place of Processing: IRELAND – Privacy Policy.

Rights of Data Subjects

Data subjects have the right to exercise the rights provided for in Articles 7, 15-22 of the Regulation.

In particular, Users have the right to obtain: access, updating, rectification or, when interested, the integration of data; cancellation, transformation into anonymous form, or blocking of data processed in violation of the law, including data whose storage is not necessary in relation to the purposes for which the data were collected or subsequently processed; certification that the above operations were brought to the attention, also regarding their content, of those to whom the data were communicated or disseminated, except where such fulfillment proves impossible or involves the use of means manifestly disproportionate to the protected right.

Furthermore, Users have the right to revoke consent at any time, where processing is based on their consent, to request data portability (i.e., to receive all personal data concerning them in a structured, commonly used, and machine-readable format), to request the restriction of the processing of personal data and/or cancellation (“right to be forgotten”), as well as the right to object to the processing of personal data concerning them and to the processing for the purpose of sending advertising material, direct selling, and for conducting market research.

Pursuant to the Applicable Law, the Data Controllers inform Users that they have the right to obtain an indication of (i) the origin of the personal data; (ii) the purposes and methods of processing; (iii) the logic applied in case of processing performed with the aid of electronic tools; (iv) the identification details of the Controllers and the processors; (v) the subjects or categories of subjects to whom the personal data may be communicated or who may become aware of them as designated representatives or persons in charge.

Data subjects may exercise their rights by sending a specific communication to the Data Controller: