PRIVACY POLICY

This Policy describes the types of data that we may collect and process through your use of the Aruba platform and/or pages operated by 6499 srl describing our collection practices, use, maintenance, protection and disclosure.

Data controller
6499 srl with registered office in Via Genova Thaon di Revel, 21 Milan email: info@6499milano.com, (hereinafter also referred to as “6499” or the “Owner”), in the person of its legal representative, guarantees compliance with the regulations on the protection of personal data by providing the following information about the processing of data communicated or otherwise collected in the course of using the Aruba platform (the “platform” or “ARUBA”), other digital marketing platforms.

Definitions
Data controller: the natural person, legal person, public administration and any other entity, association or body which is responsible, even jointly with another controller, for decisions regarding the purposes, methods of processing of personal data and the instruments used, including the profile of information security.

Data controller: The person, company, corporation, association or body to whom the controller entrusts, including externally, due to special experience or capacity, tasks of management and control of data processing.

End-User or Interested: These terms refer to those who navigate through one of the web pages managed by 6499 srl, are a customer, or potential customer, of 6499 srl (having purchased directly within the stores or by mail order the products and services offered) use an APP managed by 6499 srl, are contacted or enter data through one of the digital marketing platforms used by 6499 srl such as “ARUBA” or directly within one of the 6499 srl locations. In the case of minors, the provisions indicated in Art. 2-quinquies of Legislative Decree 196/03 (as amended by Legislative Decree 101/18).

Personal Data: We consider personal any information that is voluntarily submitted that personally identifies someone, including contact information such as name, email address, company name, address, phone number, and other information about you or your business. Personal Information may also include information about any transaction, whether free or paid, information that is available on the Internet, such as from Facebook, LinkedIn, Twitter, and Google, or information that is publicly available. When the end user registers or logs in through one of its social channels, depending on the configurations of its social accounts some data is shared with the ARUBA platform or one of 6499 Ltd.’s websites. In addition, we also consider credit or debit card numbers, personal financial account information, and passport or other ID numbers to be particularly important personal data.

Sensitive Data: We consider sensitive data racial or ethnic origin, conditions or information about physical or mental health, judicial or health, biometric.

Browsing Information: This refers to information on your computer and visits to this Web site (and other Web pages operated by 6499 Ltd.) such as IP address, geographic location, browser type, referral source, length of visit, and pages viewed.

Consent: We refer to the free manifestation of will of the data subject by which he/she expressly accepts a certain processing of his/her personal/sensitive data, of which he/she has been informed in advance by the Data Controller.

Data processed, purpose and legal basis for processing
Data generated by accessing the site. The computer systems and software procedures used to operate the websites managed by 6499 srl and the digital marketing platform ARUBA, acquire during their normal operation, some personal data whose transmission is implicit in the use of Internet communication protocols.
This data (such as domain names, IP addresses, operating system used, browser device type used for connection) is not accompanied by any additional personal information and is used for:
I) derive anonymous statistical information about the use of the platform;
II) to manage needs to control how it is used;
III) ascertain liability in case of hypothetical computer crimes.
The legal basis that legitimizes the processing of such data is the need to make the functionality of the site usable as a result of user access.

Data voluntarily provided by the user
Personal information, which includes the name, mailing address, e-mail address, telephone number, IP address or any other identifier for contacting the data subject online or offline or any other information that can be attributed directly or indirectly to the data subject and which will be provided by the data subject through the registration process that can be done in paper form and in a direct manner, through the acquisition of the data when joining one of the Fidelity Cards offered by the holder, or through online forms, is collected and processed for the following purposes:

for the execution of the contract: in the case of a subscription or the conclusion of a contract between 6499 Ltd. and the counterparty (end-user). This includes administrative purposes, payment processing, and for the fulfillment of legal obligations such as accounting, tax, or to give effect to requests from judicial authorities;
in the presence of specific consent, for marketing activities such as the periodic sending, by e-mail, of newsletters and advertising material and to receive updates on our activities, reports promotional communications and invitations to events, training courses, webinars, special promotions, participate in analysis and market research or commercial communication by automated contact methods, or through remote (e.g., through mobile and fixed networks, with sms, mms etc.) and traditional (paper mail) communications;
in the presence of specific consent, for the communication or transfer of your data to subsidiaries or third parties operating in the insurance, banking, financial, tourism, publishing, food, industrial, gas, water and energy supply, as well as other services in general sectors so that they may inform you – by telephone or by sending commercial information by paper mail, e-mail or SMS – of opportunities to purchase or provide services.
in the presence of specific consent, the data will be processed for profiling purposes, in particular for the creation of a commercial profile and/or for the analysis of preferences, habits or consumption choices, including by cross-referencing such personal data with other information collected through any profiling cookies accepted. The processing of your personal data for profiling purposes will take place with tools and methods, better provided for in Section 5 (Modalities of processing) below.
Data collected through the ARUBA Platform
As part of the data processing and about the sending of communications addressed to the customer, the data controller will also make use of the ARUBA platform itself, which, through statistical tracking systems, allows to detect the opening of a message, the clicks made on hyperlinks contained within the email, from which IP address or with which type of browser the email is opened, and other similar details. The collection of such data is functional for the use of the platform and is an integral part of the functionality of the message delivery system.
The legal basis legitimizing the processing of such data is the performance of a contract to which the data subject is a party.

3.1 Technologies that 6499 Ltd. and third parties that provide content and applications may use for this automatic data collection include:

COOKIES. A cookie is a small file placed on your computer’s hard drive. You can refuse to accept cookies by appropriately configuring your browser. However, if you select this setting you may not be able to access some of the services on the ARUBA platform or websites operated by 6499 Ltd. Unless you have adjusted your browser settings to refuse cookies, our system may issue cookies while using the ARUBA platform or websites operated by 6499 Ltd. In your browser, you can disable cookie storage or remove registered cookies, but this may result in reduced functionality, slowdown or inability to use some parts of the ARUBA platform or pages operated by 6499 Ltd. For more information about cookies and how to delete them depending on the type of browser you use, refer to: www.allaboutcookies.org.

Nature of conferment
Apart from what is specified for navigation data and data collected through the ARUBA Platform, the provision of data:
with respect to the purposes set forth in point 3 at letter a) is optional, but refusal will make it impossible for 6499 srl to carry out its contractual commitments.
with respect to the purposes set forth in section 3 at paras. b), (c), and (d), adherence is optional, and the use of data for such purposes is strictly contingent on explicit consent from the client or end-user. Any refusal to process, all or part of the same, will make it impossible for 6499 srl to carry out the processing for the purposes described.
Method of processing and data retention time
The data collected will be processed by means of electronic or otherwise automated, computerized and telematic tools, or by manual processing with logic strictly related to the purposes for which the personal data were collected and, in any case, in such a way as to ensure in all cases the security of the same. The data are kept for the time strictly necessary for the management of the purposes for which the data are collected in compliance with current regulations and legal obligations.In any case, 6499 srl and the respective data processors appointed by you, apply rules that prevent the storage of data indefinitely and therefore limits the storage time in compliance with the principle of minimization of data processing by carrying out a periodic audit on an annual basis on the data processed and the possibility of being able to delete them if no longer necessary for the intended purposes.
The processing of personal data for profiling purposes will take place, if consent is given, with data processing tools that, following cross-referencing, will create a commercial and behavioral profile on the web. This data processing tool also relates the data collected in the course of browsing web pages through the use of accepted first-party profiling cookies to the data collected through the previously specified methods.

Persons authorized to process, responsible persons and data communication
The processing of the collected data is carried out by personnel appointed by 6499 srl for this purpose identified and authorized to the processing according to specific instructions given in compliance with the regulations in force.The collected data, if it is necessary or instrumental to the execution of the indicated purposes, may be processed by third parties appointed External Data Processors, (whose updated list can be obtained from info@6499milano.com) and, as appropriate, communicated to the same as autonomous controllers, namely:
I) Companies in the 6499 Ltd. group for the purposes of 3 lett. (a) and b);
II) Persons, companies, associations or professional firms that provide assistance and consulting services to our Company, for the purposes mentioned in point 3 lett.a);
III) Third-party providers of content and value-added services requested by the end-user;
IV) Companies, entities, associations that perform services related and instrumental to the execution of the above purposes (market analysis and research service, credit card payment management, computer system maintenance).
(V) Public authorities, when conditions are met.
The data processors appointed by 6499 Ltd. will process the data only as directed by 6499 Ltd. itself and are authorized to process it for different purposes for the purposes for which it was collected. All data will be used exclusively and limitedly for the purposes determined as a result of the signed contracts. In addition, personal data collected and processed, will never be disseminated.

7. Transfer of personal data outside the EU.
Your data may also be processed by IT service providers in their capacity as Data Processors. Should they operate outside the European Union, 6499 Ltd., in compliance with the regulations on the transfer of data to a non-European country, undertakes to enter into agreements, if necessary, that guarantee an adequate level of protection and/or to sign the necessary contractual clauses.

Rights of the data subject
At any time it is possible to access the data, have confirmation of its existence, know its origin, oppose its processing or request the cancellation, modification or updating of all personal information collected by 6499 srl, exercising the right to limitation of processing and the right to data portability, by sending an email to info@6499milano.com using the email account chosen when registering for the services offered.

9. Data security details

Personal data are protected by technical, computer, organizational, logistical and procedural security measures against the risks of destruction or loss, even accidental, and unauthorized access or unauthorized processing. These measures are updated periodically according to technical progress, the nature of the data and the specific characteristics of the processing, constantly monitored and verified over time. Said security measures correspond to the requirements that, the Data Controller and the managers appointed by him, have identified as adequate. Periodic “Risk Analysis” activities are conducted to verify adherence to adopted security protocols, and new security measures are introduced or updated as necessary as a result of organizational changes and technological innovations or changes in the type of data collected. Security measures are constantly monitored and periodically checked.