Privacy Policy byou

Privacy notice pursuant to Article 13 of the General Data Protection Regulation “GDPR” (EU) 2016/679.

This notice is provided pursuant to Article 13 of the GDPR, which governs the “protection of personal data”, in connection with membership of the B YOU loyalty programme.

Gifrab Italia S.p.A. is the Data Controller and will process data in compliance with General Regulation (EU) 2016/679 (hereinafter the “GDPR” or the “Regulation”) on the “protection of personal data”. As independent data controller, Gifrab Italia S.p.A. hereby informs you that it will process the personal data you provide (the “Data”) in order to enable you to accept the Rules of the B YOU loyalty programme, as set out and established by the controller and by the terms and conditions of use of the B YOU loyalty programme.

This notice is also provided to govern the closure of the Fidelity Card programme currently in force and the resulting transfer of users to the new BYOU programme, which is currently being launched. During this transition period, personal data will continue to be processed in accordance with applicable law and for the purposes already communicated, ensuring that data subjects’ protection and rights continue uninterrupted.

We also inform you that, pursuant to Article 37 of the GDPR, Gifrab Italia S.p.A. has appointed a Data Protection Officer, who may be contacted at the controller’s registered office, Via Marco D’Agrate 41, 20139 Milan (MI), Italy, or by email at: rpd@gifrab.it.

Personal data collected through the completion and signing of the Fidelity Form containing the Rules will be used by the Data Controller or, on our behalf, by the Data Processors appointed in advance, for the purposes described in detail below.

Gifrab Italia S.p.A. will process the following categories of Data provided directly by you:

  • personal and identification details;
  • contact details (email, telephone);
  • data relating to your purchases in our shops and/or on our websites, points collected, credits earned and access to personalised benefits.

For the purposes set out below, data is processed both by automated means (in electronic or magnetic form) and by non-automated means (on paper), in compliance with the rules on confidentiality and security and in accordance with the criteria laid down in Article 32 of the GDPR.

  1. Legal bases and purposes of processing:
    1. Acceptance of the Rules: by freely and voluntarily joining, you accept the obligations arising from the Rules for membership of the B YOU loyalty programme, in physical or electronic form. These concern the identification of Fidelity Card holders or B YOU members, the collection and management of the data requested in the registration form, and the provision of the services reserved for cardholders. Membership of B YOU involves activities that cannot be carried out anonymously and that are necessary to allow members to obtain and use discounts and promotions, to be offered and sent rewards, to take part in points schemes and to access the other ancillary services provided for in the Rules (legal basis: Article 6(1)(b) of the GDPR).
    2. Legal and contractual obligations: in accordance with applicable laws and regulations and with the B YOU Rules, including in order to prevent and detect possible abuse, unlawful acts, offences or fraud, to handle and/or respond to an official request from a public or judicial authority, and to fulfil tax and accounting obligations (legal basis: Article 6(1)(c) of the GDPR).
    3. Pursuit of our legitimate interests: to establish, exercise or defend our legal rights, including in court, and for IT management, including management of infrastructure and IT security relating to the administration of payments and transactions; or, solely for data subjects who have already used our products and services and who have already expressed an interest or given consent, pursuant to Article 130(4) of Legislative Decree 196/2003 as amended by Legislative Decree 101/2018, to promote the sale of products and services (similar or complementary to those you have already used) via your email address, without prejudice to your right to object and to stop receiving such communications (legal basis: Article 6(1)(f) of the GDPR).
    4. Marketing: with your consent and in view of the interest you have shown in receiving updates on products and events organised by Gifrab Italia S.p.A., also in accordance with the Rules, to send you commercial, informational, promotional and/or advertising material on a regular basis by automated means, including newsletters (email, web, SMS and/or MMS, WhatsApp and Telegram, social media posts and campaigns, automated calls without an operator) and/or by non-automated means (post and calls with an operator), as well as material relating to market research and initiatives organised by Gifrab Italia S.p.A. (legal basis: your express prior consent, pursuant to Article 6(1)(a) of the GDPR);
    5. Definition of your customer profile: with your consent and in view of the interest you have shown in receiving updates on products and events organised by Gifrab Italia S.p.A., to analyse your purchases and choices in order to better understand your selections and preferences and, accordingly, to offer you a personalised service tailored to your specific needs and characteristics, including by means of automated decision-making and profiling (legal basis: your express prior consent, pursuant to Article 6(1)(a) of the GDPR);

    Processing of your Data for the purposes set out in points 1.a), 1.b) and 1.c) is a necessary requirement for your participation in the B YOU loyalty programme. Processing of your Data for the purposes set out in points 1.d) and 1.e), on the other hand, is subject to your prior, optional consent.

  2. Access to data: For the purposes set out in points 1.a), 1.b), 1.c) and, subject to your express consent, 1.d) and 1.e), your data may be made accessible to various categories of recipients, such as:
    • employees and staff of the Controller in their capacity as persons authorised to process data and/or internal data processors and/or system administrators;
    • third-party companies or other parties (for example consultants, business partners, IT service providers, companies or individuals engaged by the Controller to store data and, more generally, companies carrying out outsourced activities on behalf of the Controller), in their capacity as external data processors.

    The Controller may also disclose your data, for the purposes stated above, to:

    • supervisory bodies, judicial authorities, police forces, public bodies and any other parties to whom disclosure is required by law for the purposes stated. These parties will process the data as independent data controllers.

    Only with your express prior consent, for the purposes set out in points 1.d) and 1.e) above, may the Controller disclose your personal data to third-party companies such as marketing and advertising agencies, business partners and event organisers, which will process the data as external data processors.

    1. 2.1. Data transfers: Personal data is not transferred outside the European Union. However, should it become necessary, we may also transfer personal data to non-EEA countries, and we undertake that any such transfer will take place in compliance with the applicable legal provisions:
      • for international transfers of personal data from the European Economic Area (EEA) to a non-EEA country, the transfer may take place if the European Commission has recognised that the non-EEA country provides an adequate level of data protection: in this case, your personal data may be transferred on that basis;
      • for transfers to non-EEA countries whose level of protection has not been recognised as adequate by the European Commission, we may rely on a derogation applicable to the specific situation and/or adopt the standard contractual clauses approved by the European Commission for the transfer of personal data outside the EU.
  3. Retention period: For the purposes set out in points 1.a), 1.b) and 1.c), your data will be processed and retained for as long as strictly necessary to achieve the purposes for which it was collected and, in any event, for no longer than 10 years from the end of the contractual and/or commercial relationship, after which it will be deleted or anonymised, unless further retention is required to establish, exercise or defend legal claims. Data collected and processed for the purposes set out in points 1.d) and 1.e) above will be processed and retained for 2 years from the date of your registration if no purchases or activity have been recorded on the membership profile. Where there have been purchases or activity, the 2-year retention period will run from the date of the last purchase or the user’s last active interaction.

    Data processed for marketing purposes will be retained for a maximum of 24 months from the data subject’s last meaningful interaction with the Controller’s communications, unless consent is withdrawn sooner.

  4. Whether provision of data is mandatory and consequences of refusal: Provision of data for the purposes set out in points 1.a), 1.b) and 1.c) is mandatory insofar as it is required by legal and contractual obligations; therefore, refusal to provide it, in whole or in part, may make it impossible for the Controller to perform the contract. For the processing set out in points 1.d) and 1.e) above, failure to provide data will prevent the user from receiving communications, invitations, promotions or offers, without of course affecting the user’s ability to use the products and services requested and offered by the Data Controller.
  5. Data subject rights and how to exercise them: Please note that you may, at any time and where the relevant conditions are met, exercise your rights under Articles 15 et seq. of the GDPR to:
    • obtain confirmation as to whether or not personal data concerning you exists and receive a copy of it in an intelligible form;
    • have your data updated, rectified or completed;
    • request the erasure of your data, to the extent permitted by law;
    • object, in whole or in part, to the processing of personal data concerning you;
    • restrict processing in the event of a breach, a request for rectification or an objection;
    • request the portability of data processed electronically and provided on the basis of consent or contract;
    • withdraw your consent to the processing of your data, where applicable;
    • in relation to fully automated profiling, obtain human intervention by the Controller, express your point of view and contest the decision;
    • obtain information on the purpose of the consent;
    • lodge a complaint with a supervisory authority.

    You may exercise your rights at any time by writing to the following email address: info@gifrab.it or by sending a recorded delivery letter with acknowledgement of receipt to: Gifrab Italia S.p.A., Via Marco D’Agrate 41, 20139 Milan, Italy (for the attention of the Gifrab Privacy Officer).

    We would also remind you that, simply to update your personal data or for any questions or clarifications, you can write to info@gifrab.it. You may lodge a complaint with the supervisory authority at any time if you believe the rules on personal data protection have been infringed.

    For further information, please visit the website of the Italian Data Protection Authority (Garante per la protezione dei dati personali) at www.garanteprivacy.it.

  6. Changes and updates to this notice: Gifrab Italia S.p.A. may amend, supplement and/or update this Notice, in whole or in part, including in light of future changes to privacy legislation. Any amendment, addition or update will be communicated to you promptly and in full by the electronic or paper means the Controller considers most appropriate.