Privacy Policy

PRIVACY POLICY

Pursuant to the EU Regulation 2016/679 (hereinafter “GDPR”), laying down provisions for the protection of persons and other subjects with regard to the processing of personal data, we inform you that personal data provided through browsing and interaction with the website www.acquaspartafirenze.com (hereinafter “Website”) will be processed in accordance with the GDPR and applicable national law. This policy relates only to the Web Site and not also to third party websites accessible through appropriate links that may be present on the Web Site.

1. Data controller

Foho Luxe S.r.l., with registered office at Via Filippo Turati no. 29, 20121 – Milan (Italy), C.F. 12327080961 is the owner of the processing of personal data of the user of the Website (hereinafter “Owner”).

2. Type of data processed

Through browsing and/or interaction with the Website, the Data Controller may process certain personal data about you, such as browsing data (e.g., IP addresses, device, location, time zone, pages visited, and preferences) as well as other data voluntarily provided by you, through the use of features on the Website, such as: (i) WhatsApp chat or contact form (first name, last name, contact information, message content); (ii) the creation of a personal account (first name, last name, email, address, purchases made, data entered when sending purchase proposals); (iii) the purchase of products (shopping cart information, first name, last name, contact information, address, shipping information, payment method, and billing information); (iv) subscription to the Holder’s newsletter (email).

In addition, the Web Site uses cookies to improve your browsing experience as well as to enable you to take advantage of online services. Users are encouraged to read the cookie policy posted on the Web Site.

3. Purpose, legal basis, retention period and nature of providing personal data

Purpose of processing	Legal Basis	Retention period	Mandatory/optionality of data provision
Navigation and interaction with the Web Site.	For technical cookies: the legitimate interest of the Data Controller to enable the navigation and usability of the Website for users. For non-technical cookies: user consent.	See the cookie policy.	Technical cookies are necessary to enable the operation and usability of the Web Site. Non-technical cookies are optional.
Response to a user request for information or contact.	Execution of a contract/service or pre-contractual measures taken at your request.	Up to 10 years, in connection with the exercise of Holder’s rights.	Required in order to acknowledge the user’s request.
Creating a personal account on the Web Site.	Execution of a contract/service or pre-contractual measures taken at your request.	Until the user has deleted the account.	Required for user account creation.
Purchasing a product and any returns.	Execution of a contract and/or pre-contractual measures taken at your request as well as fulfillment of legal obligations to which the Owner is subject.	10 years in connection with the exercise of the Holder’s rights as well as the fulfillment of legal obligations to keep records.	Necessary to execute the contract/request of the user and to fulfill legal obligations on the part of the Owner.
Subscription to the Holder’s newsletter in order to receive email promotions and other advertising material regarding the Holder’s products.	User Consent.	Until the user unsubscribes from the newsletter.	Optional.

4. Method of treatment

Personal data may be processed either through the use of paper-based tools or through the use of electronic, computerized and telematic tools, online or offline, in accordance with the principles of proportionality, accuracy and minimization. The Owner applies specific security measures to prevent and remedy data loss, illegal or incorrect use, unauthorized access, or other breaches. The activation of certain non-technical cookies by the user may result in the performance of profiling activities of users using the Website, including by third parties. Please refer to the cookie policy.

5. Disclosure of data

In order to achieve the purposes set forth in this policy, the data (or part of them) voluntarily provided by the user may be processed by employees or collaborators of the Owner, as data processors, within the scope of their respective work duties. The data (or part of it) may also be communicated to parties contractually linked to the Data Controller, such as data processors or persons in charge of the processing, in order to fully execute the contracts entered into on the Web Site or for the fulfillment of legal obligations of the Data Controller: financial institutions, logistics and transportation service providers, suppliers of the computer and telematic services, professionals and consultants for tax and/or accounting requirements and/or for legal assistance. Data may also be disclosed to public authorities for the fulfillment of legal obligations or the execution of measures. In any case, the user’s personal data will not be disseminated.

6. Transfer of personal data abroad

The Owner does not transfer personal data provided by the user outside the European Union or to international organizations.

7. Rights of data subjects

At any time the user may exercise the rights provided by the GDPR – within the limits and under the conditions provided therein – including those of:

• to request confirmation as to whether their personal data are being processed, to request access to them as well as information about the purposes of the processing, the categories of personal data, the recipients or categories of recipients to whom the personal data are disclosed, their transfer abroad and the retention period or criteria for determining it;
• Request rectification and deletion of data in the cases and within the limits provided by law;
• Request restriction of processing in cases provided for by law;
• Request portability of data, i.e., receive them from the Data Controller in a structured, commonly used, machine-readable format and transmit them to another Data Controller without hindrance and by fulfilling the conditions provided by law;
• to object at any time to processing based on a legitimate interest of the Data Controller or to processing for marketing purposes or subjecting to automated decision-making in cases provided for by law;
• revoke the consent given at any time without affecting the lawfulness of the processing based on the consent given before revocation;
• Propose complaints to the supervisory authority.

8. Ways of exercising rights

You may exercise your rights at any time by sending:

an email to the following address: servizioclienti@acquaspartafirenze.com;
A registered letter to the address: Via Filippo Turati no. 29, 20121 – Milan (Italy).

9. Links to other websites

Some pages on the Web Site may contain links to other Internet sites that are not operated or owned by the Owner. The Controller does not share personal data with such websites and is not responsible for their content, security or the measures to protect personal data applied by the relevant data controllers.