Privacy Policy

This document (hereinafter also the "Privacy Policy") serves as information and illustrates, with particular reference to the principle of transparency pursuant to Art. 13 of EU Regulation 679/2016 (hereinafter, for convenience, the "GDPR"), which data the Data Controller processes and how it manages them.
Pursuant to Article 5 of the GDPR, the processing of personal data is based on general respect and observance of the principles of lawfulness, fairness, purpose limitation and retention, data minimization, accuracy, integrity, confidentiality, and accountability, in accordance with the principles of privacy by default and by design.
In particular, the regulation of the matter in question is contained, among other legal provisions, in Legislative Decree 196/2003 and subsequent amendments, in Legislative Decree 101/2018 and in the aforementioned GDPR.

For the purposes of this text, "website" shall be understood as https://www.biojoux.it/, including each of its pages, sections, and subsections.
A User is any person who comes into contact with the website, uses its services, communicates, or even simply accesses and/or views one or more pages of the website.
For further definitions, such as personal data or others, please refer to the text of the aforementioned GDPR.
We kindly ask you to carefully read this Privacy Policy, which applies whenever you access and/or browse this website and/or use its services, regardless of the data processed. Therefore, by accessing the website, you consent to the Privacy Policy described herein. For any further inquiries regarding data processing, you can contact the Data Controller at the email address indicated in point 1 of this Privacy Policy.

Data Controller

The Data Controller, pursuant to Articles 4 and 24 of the GDPR, is Sanico SRL, with registered office in Via Turati 7 – 20121 Milan (MI) – Italy. Tax code / VAT number: 00750030157 – Economic and Administrative Index (REA): MI-670215. Email: privacy@sanicare.it
For the personal details of the Owner, it is possible to send a written request to the above email address.

Type of data processed

Navigation data

This is the set of data whose transmission is implicit in the use of Internet communication protocols. It is acquired, in the absence of any human activity, independently by the computer systems and software procedures used to operate the website. This category includes, for example, the IP addresses or domain names of the devices used during navigation, the URI addresses of the requested resources, the date, time, and date of the request, the method used to submit the request to the server, the size and type of the file obtained in response, the numerical code indicating the status of the response given to the server, and other parameters relating to the user's operating system and IT environment.
This data, which is necessary for the use of web services, is also processed for the purpose of obtaining statistical information on the use of the services and verifying the correct functioning of the services offered.

Data communicated by the user

This data is collected when the User sends a message to the email address referred to in Article 1, fills out the contact form on the website, or contacts the User by telephone or any other means to receive information or commercial proposals, request clarification, or otherwise. This also includes commenting on articles on the website by leaving your name and email address. In this case, the voluntary sending of messages to the contact addresses, as well as the completion and submission of the forms therein, entails the acquisition of the sender's contact information as well as all personal data voluntarily included in the communications and/or requested by completing the relevant form. All data provided will be processed in order to fulfill the User's requests.

Data collected through cookies

This information is contained in cookies, which is sent back to the server when the user returns to the site. Cookies are text files that the servers of the sites visited can store on the user's device. For more information, please consult the website's Cookie Policy.

Newsletter subscription data

This is the data entered by the user to subscribe to the newsletter, which requires their name, surname, and email address via a specific form. In this case, the data is useful and preparatory to receiving updates and commercial communications.
This marketing activity may, depending on the case, be carried out through third-party service providers such as:
Mailchimp - https://www.intuit.com/privacy/statement/, in relation to which the Owner has undertaken to collect and maintain all necessary permissions and valid consents required to legally transfer the data and to allow such data to be legally collected, processed and shared by Mailchimp for the purposes of providing the Service.

Purchase, billing and payment data

This data is collected to allow you to place an order and purchase products on the website. The Data Controller receives this information directly from the user through the dedicated registration and payment form.
In particular, the following data are acquired:
identification, personal and, more generally, personal contact details such as name, surname, place and date of birth, residence, domicile, email address and telephone numbers, also useful for any shipments;
relating to payment and invoicing methods, as well as administrative, accounting and tax ones.

Review data

This is data entered by the user to review purchased products and/or services, whereby name, surname, and email address are requested via a specific form. In this case, the data is useful and preparatory to publishing the review.
All of the aforementioned information is intended to be provided solely for purposes related to this website and not for other sites that may be accessed via links. Therefore, the Data Controller cannot be held responsible for personal data processed independently by the provider of the linked platform.

Mandatory or optional provision of personal data

In cases where the nature of the provision is to be defined as mandatory, the relevant text field in the form on this website will be expressly indicated as such, including through the use of symbols or graphic signs.
If, in the presence of such fields marked as mandatory, the User fails to enter the requested information, it will be objectively impossible for the Data Controller to manage the pre-contractual/contractual and communication/purchase/sales relationship.
In short, failure to provide the data in question will prevent the relationship from being established.

Purpose of the processing and related legal basis

The data is processed, subject to express consent pursuant to Art. 6, letter a, GDPR, for the following purposes: 

a) Marketing, profiling and commercial promotion, sending, via all digital and/or paper communication tools, information, updates and news regarding products, services and promotions.
At any time, the User has the right to withdraw their consent to receive promotional information by communicating their wish in writing to the email address referred to in Article 1, or by following the procedure available at the link at the bottom of communications received by email, which allows them to unsubscribe.
b) Publish reviews of products previously purchased by the user.
At any time, the User has the right to revoke the consent given to the publication of the review uploaded on the website by communicating his/her will in writing to the email address indicated in Article 1.

The data is processed, without prior express consent pursuant to art. 6, letters b, c, and f, GDPR, for the following purposes: 

a)allow the User to join the community and receive paper and/or digital communications on the legal basis of contractual fulfillment;
b)fulfill orders, process payments, ship products, and provide related customer support and assistance on the legal basis of implementing pre-contractual and contractual measures, adopted at the customer's request;
c)comply with all legal, tax, accounting and administrative obligations;
d)Provide information on products or services similar to those already purchased and monitor customer satisfaction with the products or services purchased. Users have the right to withdraw their consent at any time by sending a written request to the email address referred to in Article 1, or by following the unsubscribe link found in email communications received;
e)Processing User requests and requests and responding to questions and concerns raised through the contact tools available. The legal basis is the Data Controller's legitimate interest in providing customer support, as well as information on products and services, developing new products, implementing existing ones, and generally achieving greater efficiency;
f)to establish an adequate defense in the appropriate judicial and extrajudicial venues in the event of a dispute with the User.
At any time, the User has the right to revoke the consent given by communicating it in writing to the email address indicated in art. 1.

All data collected is processed solely for purposes related to this website and not for other sites that may be accessed via links or social media buttons. Therefore, the Data Controller cannot be held responsible for data processing performed independently by the owners of platforms connected via links and/or social media buttons. It is hereby specified that the website is autonomous and independent from the sites and/or platforms accessed via the aforementioned links and/or social media buttons.

Method of treatment

The data is processed by the Data Controller using electronic and telematic methods, without prejudice to the possibility of execution in paper form.

The processing of personal data may include any type of operation, including collection, recording, modification, storage, organization, consultation, processing, selection, extraction, comparison, use, interconnection, blocking, communication, cancellation and destruction.

In any case, the data is collected and processed for specific, explicit, and legitimate purposes, and used in a manner compatible with the purposes indicated in point 4. This is accomplished by adopting the most appropriate security measures possible to minimize the risks associated with these activities. This is particularly true where deletion or destruction are not the subject of the processing, in order to prevent such occurrences, as well as unauthorized access or processing that is not permitted and/or inconsistent with the purposes.

Place of treatment

The data is processed at the Data Controller's registered and operational headquarters and by personnel assigned to server maintenance and backup operations, as well as on the hosting servers, which are to be understood as third parties with respect to the Data Controller and not under its direct control.

Retention period

The data is processed for the time necessary to fulfill the service requested by the User, coinciding with the achievement of the purposes for which it was collected, and in any case, no longer than 10 years from that date.
At the end of the retention period the data will be deleted.
For marketing purposes only, this period is reduced and equal to 24 months from the last interaction and in any case never more than 10 years.

Dissemination of personal data

Data processing is carried out by the Data Controller and by personnel assigned by the Data Controller to carry out tasks related to the proper management of contractual and marketing relationships with customers, potential customers, and suppliers.
The data controller undertakes not to disclose personal data, unless authorized by the User, to persons other than the Data Controller's employees and/or professionals, collaborators, and third parties (natural or legal persons) who perform activities on behalf of the Data Controller and who need to know such data solely for the purpose of carrying out the requested activities.
In particular, the data may be communicated to:
subjects who need to access the data within the limits strictly necessary to achieve purposes ancillary to the contractual relationship;
individuals and companies that collaborate with the Data Controller, to the extent necessary to carry out their professional duties, including in particular bookkeeping or the completion of legal procedures.
In this sense, these individuals will act as Data Processors.
The aforementioned entities, duly appointed pursuant to Art. 28 GDPR, will process the data in full compliance with this Privacy Policy and applicable legislation. The list of these entities is available upon written request from the interested party, including by email to the address indicated in point 1, addressed to the Data Controller.
Pursuant to national and European laws and/or the provisions of the competent authorities, the data may also be communicated or made available to public or private entities indicated by them, within the limits and for the purposes set forth therein. These entities will be provided only with strictly necessary information.

Rights of the interested party

The interested party has the right to receive accurate information regarding the processing of their data, as established by Articles 12 et seq. of the GDPR.
At any time, pursuant to Articles 15 et seq. of the GDPR, the data subject has the right to access their data, rectification, erasure, or restriction of processing, and to request and obtain information and clarification regarding the purposes and objectives of the processing, the categories of personal data, the recipients to whom the data has been disclosed, and the relevant retention period. For further information on data subject rights, please refer to the further details in Articles 15-22 of the GDPR.
The right to revoke previously granted consent is always recognized, to be done via email, addressed to the email address better specified in point 1 and intended for the Data Controller.
We also point out the legal right to lodge a complaint with the Supervisory Authority (Garante per la protezione dei dati personali), as provided for by Article 77 of the GDPR, or to take appropriate legal action pursuant to Article 79 of the same text.
The exercise of all the aforementioned rights, with the exclusion of complaints to the Supervisory Authority (Garante) and to judicial authorities, is possible by sending a specific request to the email address referred to in Article 1.
With specific reference to erasure, you have the right to request the deletion of your personal data. Your data will be deleted upon request, unless there are legally required circumstances preventing this, such as the validity of a contract or the existence of debt/credit relationships. Likewise, data cannot be deleted if there are retention obligations.
Furthermore, it is specified that, pursuant to Art. 23 GDPR, and only under certain circumstances, European Union Member States have the right to limit certain data subject rights. We reserve the right to exercise this right, always in compliance with applicable EU and national law, in exceptional cases where this is permitted.

Links and social buttons

All information provided in this policy is intended to apply only to the website on which it is posted.
It is in no way valid for other sites and/or platforms in any way connected to this site and accessible by the User via links and social buttons.

Social buttons are the link buttons on the web page depicting the icons of social networks to facilitate sharing and interaction on a specific social network of what the user has chosen.
The data processing carried out by these third parties is independent of that carried out on this website, and we therefore ask you to refer to their respective privacy policies, which can be consulted free of charge at the following links:

Facebook: https://facebook.com/about/privacy
Instagram: https://help.instagram.com/519522125107875
YouTube: https://policies.google.com/privacy?hl=it
Linkedin: https://it.linkedin.com/legal/privacy-policy?

Transfer of personal data

Personal data will not be transferred outside of Europe. Any transfer to countries outside the European Union, where necessary and with the User's prior authorization, will be carried out in accordance with Articles 44 et seq. of the GDPR, i.e., ensuring the best possible data protection measures.

Minors

Minors under the age of 16 are not required to provide any type of personal information or data without the consent of their parent or guardian.

Updates and Changes

The Owner reserves the right to modify and/or update this document, in whole or in part, in the future, also in light of potential regulatory changes on the matter in question. Users are advised to check this page regularly for updates.

This document was last updated on June 16, 2023.