PRIVACY POLICY

Policy notice pursuant to EU Regulation 2016/679

This policy is provided pursuant to Art. 13 of Regulation EU 679/2016 (General Data Protection Regulation). This policy shall not be applicable to any other website made available via links on the domain holder’s websites; under any circumstance, the holder cannot be held responsible for third-party websites.

1. Data controller

This policy notice is provided pursuant to Art. 13 by Sugar S.r.l as Data Controller (Art. 4 and Art. 24 of Reg. EU 2016/679) with registered office in Corso Italia 19, 52100 Arezzo (AR) in relation to personal data provided by users through the access and/or the registration to the Website https://www.sugar.it (Website).

Contacts: Phone: 0575/354631 or e-mail: customerservice@sugar.it

1. Nature of the data processed and purposes of the processing

• Browsing data

IT systems and procedures required for Website’s operation collect, in their normal course, some personal data that are implicitly shared in the implementation of Internet communication protocols. This information is collected anonymously. Our operations are governed by ethical principles and we commit to protect the privacy of all visitors to our website. For this reason, the way we collect and store data is closely correlated to the usage of our Website and its services.

• Data provided voluntarily by the user

When users/visitors visit our Website and provide their personal data in order to make requests (via e-mail) for access and/or registration, their data are collected by the Data Controller.

1. Legal bases and purposes of the processing

SUGAR S.R.L will process personal data provided by the user for the following purposes:

1. allowing navigation on this Website – legitimate interest (legal basis of the processing: Art. 6 Par. 1 Letter f));
2. managing a request through the completion of the contact form available on the Website - legitimate interest (legal basis of the processing: Art. 6 Par. 1 Letter f));
3. allowing the registration to the Website and the usage of services made available to registered users, as well as allowing the purchase of products available for sale on the Website and allowing the conclusion of the purchase contract and the proper execution of related operations (legal basis of the processing: Art. 6 Par. 1 Letter a)).
4. for administration-accountability purposes related to the registration to the Website - statutory and contractual obligations (legal basis of the processing: Art. 6 Par. 1 Letters b) and c));
5. prior express consent by the user, allowing SUGAR S.R.L to send informational and promotional e-mails (including the newsletter) related to product offered for sale on the Website (marketing purposes) - (legal basis of the processing: Art. 6 Par. 1 Letter a)).
6. limited to the e-mail details provided by the user to purchase a product for sale on the Website, allowing the direct sale of similar products without requesting the user’s express and prior consent (pursuant to Art. 130, Par. 4 of Privacy Code) and provided user does not exercise their right to object (so-called “soft spamming”) – legitimate interest (legal basis of the processing: Art. 6 Par. 1 Letter f)).
7. Personal data retention period or criteria for determining the retention period

Pursuant to Art. 5 Par. 1 Letter e) of Reg. EU 679/2016, personal data collected shall be kept in a form which permits identification of data subjects for no longer than it is necessary for the purposes for which the personal data are processed.

Personal data retention period varies according to the purposes of the processing:

1. navigation on this Website (see Cookie Policy);
2. contact requests (up to 12 months);
3. e-commerce data (until user unsubscribes) and data related to legal duties or other fulfilments shall be stored for 10 years after user unsubscribes.
4. data collected for administration-accountability purposes related to the registration to the Website will be stored in accordance with applicable tax regulations
5. newsletter data will be stored for 24 months after user consent registration, unless the user unsubscribes earlier;
6. soft-spamming data will be stored until user unsubscribes.

In accordance with the law, SUGAR S.R.L will store log files and IP addresses used for shopping online in order to prevent and detect any fraud in online transactions.

1. Data transfer and consequences when user does not allow processing

Transfer of personal data for purposes (a), (b) (d) is necessary and mandatory for the correct displaying and browsing of the Website.

Transfer of personal data for purposes stated in section (c) above is completely optional. However, as data transfer is mandatory for registering to the Website and shopping online, if user denies consent to data transfer, user will not be able to register to the Website and shop online.

In respect to the purposes of the processing as of section (e) (the so-called “marketing” purposes) of Art. 3 above, user consent to personal data processing is completely optional. Failure to consent will not affect registration to the Website and/or online shopping; however, user will not be able to receive by SUGAR S.R.L informational and promotional contents via e-mail newsletters regarding products offered for sale on the Website.

User may, in any circumstance, withdraw his/her consent previously agreed for the purposes stated in section (e) (the so-called “marketing” purposes) and exercise the right to object to processing for the purposes stated in section (f) (“soft spamming”):

• By contacting SUGAR S.R.L using the contact details provided in Art.1 of this document;
• By clicking on the relevant link displayed at the bottom of every promotional e-mail sent by SUGAR S.R.L. The right to object exercised through these means also applies to all contents received via standard mail.

Notwithstanding the above, user may exercise the right to object at any time by contacting SUGAR S.R.L via the contact details provided in Art. 1 above.

1. CCPA

The California Consumer Privacy Act (CCPA) is the most recent Californian law on privacy aimed at protecting the rights of users resident in California (United States). CCPA entered into force on January 1st 2020 and is effective as of July 1st 2020.

CCPA introduces new requirements for personal data processing and gives consumers new rights regarding Privacy. It can be thus be expected that CCPA will significantly impact business responsibilities and procedures.

Pursuant to CCPA, “Personal data” are “information that can identify, relate to, describe, be associated with, or be reasonably capable of being associated, directly or indirectly, with a particular consumer or household”. (Name, pseudonyms, postal address, personal ID, IP address, e-mail address, user name, social security number, driving license number, passport number or similar ID information, business information, such as assets, product or services records purchased, obtained or taken into account, and other logs or purchasing and consumption trends, biometric data; networking activities information (via Internet or other channels), including browsing technologies, research history and information regarding interactions with a website, an app or an ad; geo-localization data)

 For the purposes stated in Article 3, section (c) of this document, the company may process data of users resident in CALIFORNIA.

Pursuant to CCPA, consumer has the right to object, at any time, by notifying the company, to the sale of their personal data to third parties; in this respect, consumer may decline personal data sale using the form "Do Not Sell My Personal Information" (DNSMPI) available on the Website banner at the first purchase.

By doing this, Data Controller shall not sell personal information to third parties, unless the user explicitly allows to do so at a later time (opt-in).

Pursuant to and in compliance with CCPA, consumer may exercise the following rights:

1. Right to be informed (consumer has the right to be informed regarding their data processing terms before or upon data collection)
2. Right to access personal information. (In particular, consumer can access to the following categories of personal information: data collected within the last 12 months; personal information; different data sources; purposes of data collection or sale; types of third parties personal data are shared with, types of sold data and types of third parties they were sold to; types of personal data shared for commercial purposes)

• Right to data portability and right to access data (the information shall be in a portable and, to the extent technically feasible, in a readily usable format that allows the consumer to transmit this information to another entity without hindrance)

1. Right to deletion - Consumer may exercise the right to request deletion of their personal information. Once a (verifiable) deletion request is received

User can submit a request to the following e-mail address customerservice@sugar.it

1. Scope of data transfer

Personal information provided by the user for the purposes stated in Art. 3 of this document may be disclosed to or shared with the following entities:

• Employees or partners of SUGAR S.R.L for purposes of administration, accountability and logistics activities acting as data processors or managers, respectively;
• Companies and organizations in charge of newsletter services;
• Online payment transactions managers;
• All private/public entities, natural persons and/or legal entities (legal, administrative or fiscal consulting companies), when data transfer is necessary or required to ensure correct fulfilment of contractual obligations undertaken in relation to services provided through the Website, as well as to ensure the correct fulfilment of legal obligations;
• All entities (including public authorities) who have access to data pursuant to regulatory and administrative provisions;
• Forwarders and entities in charge of the delivery and/or pick-up of purchased items;
• The company that distributes, on behalf of SUGAR S.R.L newsletter and other informational contents submitted on behalf of SUGAR S.R.L.
• We partner with Rakuten Marketing, which reserves the right to collect personal information when users interact with our Website. Data collection and use are subject to the Privacy Policy terms available here:

https://rakutenmarketing.com/legal-notices/services-privacy-policy/

https://rakutenmarketing.com/legal-notices/subject-requests/

Personal data provided by user with respect to the registration to the Website and/or online shopping on the Website will not be disclosed. The updated Data Controller list is available at the Data Controller’s registered office; the updated list can also be requested by contacting us using the details provided in Article 1 of this notice.

1. Transfer of personal data to third countries and/or international organisations and related warranties

Personal data provided by user may be transferred to other EU countries in relation to the above-mentioned purposes. 

Transferred data will not be disclosed without prior consent.

1. Right to access personal information

User may exercise their rights as expressed by Articles 15, 16, 17, 18, 19, 20, 21, 22 of Regulation EU 679/2016 by contacting the Data Controller. User may request at any time the Data Controller to access, amend or delete their personal data or to restrict the processing. User may request at any time to object to processing concerning their data (including automated processing, such as profiling) as well as to exercise data portability.  Without prejudice to any other administrative or judicial remedy, if user believes that the processing of their personal data does not comply with Reg. EU 2016/679, pursuant to Art. 15 Letter f) of the aforementioned Reg. EU 2016/679, user shall have the right to lodge a complaint with the Data Protection Officer and, in respect to Art. 6, Par 1, Letter a) and Art. 9, Par. 2, Letter a) user shall have the right to withdraw their consent at any time.

As to the purposes stated in Par. 3, Letter c) the withdrawal of consent shall not affect the lawfulness of processing based on the consent given before its withdrawal. (Pursuant to Art. 7).