PERSONAL DATA PROTECTION NOTICE
This Personal Data Protection Notice provides users of this website (hereinafter referred to as the "Site") with as comprehensive an overview as possible regarding the processing of personal data concerning them, as described below, through the Site pursuant to the General Data Protection Regulation (GDPR) (EU) 2016/679 and Italian legislation on personal data protection. In compliance with applicable legislation, this Personal Data Protection Notice also indicates: • the nature of the personal data processed (as defined below); • the purposes of the processing and the means employed; • the identity and contact details of the data controllers; • the contact details of the Data Protection Officer (DPO); • any third parties involved in processing activities; • the period for which personal data is stored; • a brief description of the security measures adopted to protect personal data; • the existence of the data subject's right to request from the data controller access to personal data and rectification or erasure of the same or restriction of processing concerning the data subject or to object to their processing, as well as the right to data portability of the users' data.
This Personal Data Protection Notice applies exclusively to the Site and does not concern any website or platform that the Site may link to. Users under the age of 14 (fourteen) years cannot consent to the processing of personal data without the authorization of the holder of parental responsibility.
DATA CONTROLLER
Under the GDPR, the data controller is the entity that, alone or jointly with others, determines the purposes and means of the processing of personal data. When two or more data controllers jointly determine the purposes and means of processing, they are joint controllers. The data controllers for the processing related to the activities of the Site are:
NLA di Di Francesco Stefano Maria
(the “Joint Controllers”)
A Data Protection Officer has been appointed to ensure that personal data is processed in compliance with the GDPR. The Data Protection Officer can be contacted for any requests at the following email address: info@walmug.com
PERSONAL DATA: PURPOSES OF PROCESSING
The term "personal data" refers to any information relating to users of the Site, including those that personally identify them, either alone or in combination with other information. Personal data is collected automatically through the Site or received via various sources: forms, chats, emails, apps, devices, social media, and other means. The Joint Controllers process personal data in relation to the following activities:
• MANAGING NAVIGATION ON THE SITE
The Joint Controllers collect navigation data (which are not special data under the GDPR) using automated means to enable and improve the user's navigation on the Site (e.g., IP address, date/time of visit and its duration, any referring URLs, pages visited on the Site, the device used, and other information). Processing such personal data allows users to access the Site and fully utilize its features and services. Additionally, navigation data may be used to verify that the Site is functioning correctly. From time to time, navigation data is anonymized and processed for statistical purposes. It is unlikely that navigation data would allow the identification of the data subject. However, by their very nature, navigation data can allow the identification of the data subject if associated with other information. The navigation data described above is stored only temporarily in accordance with applicable regulations. In this instance, the legal basis for processing personal data is the legitimate interest of the data controller.
• MANAGING ORDERS
During verification, the Site requires users to provide personal data solely for the purpose of managing purchase orders and fulfilling contractual obligations with users (e.g., name, surname, email address, delivery address, etc.). This personal data is also essential for Customer Service to assist customers with any requests or needs, before or after the sale (e.g., regarding order delivery status or product returns). Personal data related to orders will be stored for the time necessary to fulfill contractual obligations and any applicable accounting and tax obligations. The Joint Controllers may also verify the validity of payment instruments used by customers for purchases on the Site (e.g., credit or debit cards, etc.) primarily to prevent fraudulent activities or under anti-money laundering regulations. Since this activity is delegated to duly authorized third parties, the Joint Controllers neither process nor store financial information related to customers and payment instruments. Failure to provide the required personal data at the time of verification will prevent users from completing an order on the Site. In this instance, the legal basis for processing personal data is Article 6, point 1, letter b) of the GDPR (performance of a contract to which the data subject is a party). Based on legitimate interest (Article 6, point 1, letter f) of the GDPR), to improve their relationship with customers, the Joint Controllers will send customers who have made purchases on the Site email communications with product suggestions, discounts, feedback requests, or other updates. Customers can always object to receiving further email communications (e.g., by clicking the "unsubscribe" link at the bottom of each email).
• SITE REGISTRATION
When users decide to create and register a personal account on the Site, they are asked to provide personal data (e.g., date of birth, gender, etc.). The Site clearly indicates which personal data is necessary (or not) to set up a Site account. Users must provide truthful and accurate personal data at the time of registration and are encouraged to keep their personal data up to date by accessing their personal account to make any necessary changes. Users who choose to activate or access their account on the Site through social media should be aware that when they link their Site account to a social media account, the Site collects certain personal data that the user has already provided to that social media (e.g., email address and public profile on Facebook). The Joint Controllers neither supervise nor manage such social media services or user profiles on such social media services; furthermore, they do not establish the privacy settings or rules regarding the use of personal data on said social media (Facebook, Twitter, or others). Users are strongly encouraged to read the privacy notices regarding social media services published by the operators of such services for further information on how personal data is processed through these channels. In this instance, the legal basis for processing personal data is the consent of the data subject expressed at the time of registration (Article 6, point 1, letter a) of the GDPR).
• NEWSLETTERS AND MARKETING COMMUNICATIONS
On the Site, users can opt to receive newsletters and commercial communications. The Joint Controllers always collect the explicit, free, and unequivocal consent of users before sending newsletters and marketing communications to users or, more generally, before undertaking marketing initiatives dedicated to them. In such cases, in addition to their email address, users may be invited to provide personal data (e.g., gender, country of residence, etc.) to receive personalized marketing communications and newsletters based on the user profile. Users can easily withdraw their consent to receive newsletters and commercial communications in the following ways: • through their account settings; • by clicking the "unsubscribe" link in any of these emails; • by contacting our Customer Service.
In this instance, the legal basis for processing personal data is the consent of the data subject to the processing of their personal data.
• PROFILING
Based on the user's explicit consent, newsletters and marketing communications may be tailored to the user's "profile," based on Personal Information that the Joint Controllers collect from the data subject. Regarding Site customers, it is in the Joint Controllers' legitimate interest to process personal data to offer more interesting products, improve the Site, and personalize the products offered on the Site. The primary purpose of profiling is to propose products, services, and initiatives that are more suited to users' tastes, purchasing habits, and interests. Personal data may also be used for remarketing, retargeting, or profiling purposes, including through third parties (e.g., social networks, etc.). Neither the Site nor the Joint Controllers will ever perform profiling activities related to minors. In this instance, the legal basis for processing personal data is the consent of the data subject to the processing of their personal data (Article 6, point 1, letter a) of the GDPR).
COOKIES
Information regarding the cookies used on the Site is available by consulting the cookie policy.
SHARING AND TRANSFER OF PERSONAL INFORMATION
The Joint Controllers transfer customers' personal data to primary third-party suppliers, acting as data processors (the "Processors"), to perform the necessary operations to fulfill their contractual obligations (e.g., delivery of ordered goods, payments, etc.). The Joint Controllers will make every effort to ensure that all Processors apply the best available procedures to protect personal data and do not use such data for purposes other than those established by the data controllers. For example, the Joint Controllers may share personal data with the following categories of Processors: • Couriers and postal operators; • Order fulfillment centers and warehouses; • Advertising, digital, marketing, and social media agencies; • IT service providers; • Customer service providers; • Payment service providers.
Users can obtain information about the categories of recipients to whom personal data has been or will be communicated by writing an email to: info@walmug.com The data controllers are required to share personal data with third parties in the strict cases provided by law and where it is necessary to protect the rights of the Joint Controllers or related parties or third parties. Additionally, personal data may be disclosed to other companies within the same corporate group as each of the data controllers or to third parties in the event of a corporate reorganization, in full compliance with applicable law. In all other cases, the sharing of personal data will be subject to the prior and explicit consent of the user unless processing is allowed on another legal basis. The Joint Controllers will not transfer any personal data outside the European Economic Area (EEA) unless the user (the data subject) has explicitly authorized such transfer or the transfer of personal data outside the EEA is permitted under the GDPR based on another legal basis. To offer you Klarna's payment methods, we will pass your personal data in the form of contact and order details to Klarna at checkout so Klarna can assess your suitability for its payment methods and tailor those payment methods for you. Your transferred personal data is processed in line with Klarna's own privacy policy.
STORAGE AND PROTECTION OF PERSONAL INFORMATION
Personal data is processed through a combination of IT and electronic tools and, in some limited cases, paper-based tools. The Joint Controllers have implemented appropriate security measures to protect personal data against loss, misuse, and alteration. In particular, they have adopted measures regarding access to data, security, and data retention, as provided by the GDPR. Where the Joint Controllers have provided (or where the user has chosen) a password that enables access to certain parts of the Site, the user is responsible for keeping this password confidential and for complying with any other security procedure notified to them. Users must not share their password with anyone. The Joint Controllers undertake to store personal data only for the period necessary to achieve the purposes for which the data was collected or to comply with legal or regulatory requirements. In particular, personal data will be stored for the entire duration of the user's account on the Site and for a period of ten (10) years following account deactivation or deletion in accordance with applicable civil law, including tax regulations. The data controllers may store personal data for a longer period of time, but only in the event of legal obligations or to protect their rights and interests.
RIGHTS OF DATA SUBJECTS
Under the GDPR, data subjects have the following rights in relation to their personal data: • Right of access: users have the right to obtain from the data controllers confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access to the personal data and information regarding its processing. • Right to rectification: users have the right to obtain the rectification of inaccurate personal data and have incomplete personal data completed. • Right to erasure ("right to be forgotten"): in certain circumstances, users have the right to obtain the erasure of their personal data from the data controllers. • Right to restriction of processing: in certain circumstances, users have the right to restrict the processing of their personal data. • Right to data portability: users have the right to receive their personal data in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller without hindrance from the current data controllers. • Right to object: users have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them.
Data subjects may exercise their rights by contacting the Joint Controllers at the following email address: info@walmug.com
Sold out
Sold out
