Privacy Policy

The following privacy policy has been drafted based on the EU regulation 2016/679, regarding the personal data of users collected while accessing/registering to the website and/or for the purchase of products through the website www.averyperfumegallery.com

Owner of the process

Intrack S.r.l., registered office in Milan, Via Durini, 24, 20122, Tax Code and Reg no. IT12944250963, owner of the website www.averyperfumegallery.com, email info@averyperfumegallery.com, is the controller of the process of the personal data belonging to all users collected and processed for purposes related to the activity on the site and, in particular, the access and/or the registration on the site for the purchase of products through the order form on the website.

The Data Protection Officer

Users can contact the responsible Data Protection Officer (DPO) for all enquiries related to the treatment and process of personal data and clarifications regarding the new regulation and users’ rights.

It is possible to contact the Data Protection Officer responsible for Intrack S.r.l. at the following:

E-mail: info@averyperfumegallery.com
Phone Number: +39 3668539277
Address: Via Durini, 24 - 20122 Milan

Use Made of the Information

Personal data are collected and processed by the data controller exclusively for purposes related to the activity on the site and, in particular:

• for registration to the website, through the relevant registration form, to provide access services to restricted areas;
• to provide support services and customer care;
• for commercial communication by the data controller;
• for the purchase of products through the order form.

The conferral of data used for the above points is optional: there is no legal or contractual obligation to communicate data; however, as their treatment is necessary to consent the access to the site and/or the browsing of the site and/or the registration on the site and/or the provision of management services of the account non that the conclusion and execution of the purchase contract via the site or to answer the enquiries pre-contract carried out by the user, failure to communicate data will make it impossible for the user to access and/or browse the site and/or register to the site and use the reserved services for the registered users and/or terminate the purchase contract via the site and/or receive an answer to enquires made.

Legal basis of the processing

The data controller processes the personal data relating to the user in case one of the following conditions exists:

• the user has given consent for one or more specific purposes;
• the processing is necessary for the execution of a contract with the user and/or for the execution of pre-contractual measures;
• the processing is necessary to fulfill a legal obligation to which the data controller is subject;
• the processing is necessary for the execution of a task of public interest or for the exercise of public authority in which the data controller is invested;
• the processing is necessary for the pursuit of the legitimate interest of the data controller or third parties.

In any case, it is always possible to ask the data controller to clarify the concrete legal basis of each treatment and in particular to specify whether the treatment was based on the law envisaged by a contract or necessary to conclude a contract.

Place of Treatment

The treatments connected to the services of the site are only handled by the personelle in charge of the processing at Intrack S.r.l., which uses servers located in the UK by register.it.

The management of all mailboxes is carried by Intrack S.r.l. through Aruba and Zimbra platforms.

The data controller adopts the appropriate security measures to prevent access, disclosure, modification or the unauthorized destruction of personal data.

Categories of Subject to whom the user’s data may be communicated

Intrack S.r.l. to the categories of recipients indicated below. The subjects to whom the data can be communicated acta s external process managers designated by Intrack S.r.l. or through a specific contract (data controller) or people authorized to process personal data under the direct authority of Intrack S.r.l. or in the case of third parties for whom the regulation is responsible for processing, use as a sub-responsible, pursuant to Article 28.4 of the regulation, except in cases where the addresses acta s independent data controllers.

Users’ personal data can be communicated by Intrack S.r.l. to the following categories of recipients:

• to companies and/or employees and/or collaborators of Intrack S.r.l. for carrying out activities of accounting, administration and IT support and logistic;
• to companies, consultants and/or professionals, who may be responsible for the installation, the maintenance and the update and in the general of the management of the hardware and software Intrack S.r.l. (platform included), including the suppliers of cloud computing services and third parties that they use;
• to companies appointed by Intrack S.r.l. to send commercial communications both by email and by post;
• to companies that carry out logistic support activities and/or warehouse and/or packaging and/or shipping delivery or collection of products purchased on the site and to third parties that they use;
• to payment server providers and/or to the acquirer and/or banks to allow payment of purchases made on the site or the reimbursement if in the case and to third parties that they use;
• to the companies that provide a software for the tracking, monitoring and profiling activity both for marketing purposes and for fraud prevention purposes and the improper use of the services and the third parties that they use;
• to companies and/or individuals responsible for the repair of products purchased on the website in execution of the legal guarantee of conformity and to the third parties that they use;
• to companies that carry out the service of withdrawal of used products (RAEE) in the case of purchase on the site of an equivalent product;
• to all those subjects including public authorities that have access to data under regulatory or administrative provisions;
• to all those public and /or private entities, personelle and/or and legal individuals (studies of legal, administrative and fiscal advice), if the communication proves necessary or functional to the correct fulfillment of the contractual obligations assumed in relation to the site services, included the purchase contract, as well as obligations deriving from lay or in the case of ascertainment of the exercise or defense of a right.

Retention Period

The data are processed and stored for the time required by the purposes for which they were collected.

Therefore:

• Personal data collected for purposes related to the execution of the contract between the holder and the user will be retained until completion of the contract;
• Personal data collected for purposed related to the legitimate interest of the owner will be retained until the satisfaction of this interest.

When the treatment is based on the user’s consent, the holder can keep the personal data longer until this consent is revoked. Moreover, the owner could be obliged to keep personal data for a longer period in compliance with a legal obligation or by order of an authority.

At the end of the retention period, personal data will be deleted. Therefore, at the end of this term, the right of access, cancellation, rectification and the right to data portability will no longer be exercised.

Opposition Right

The interested party has the right to oppose at any time for reasons related to his particular situation to the processing of personal data concerning him/her for the purposes of this statement and having as its legal basis the legitimate interest of the data controller.

In the event of the data are processed for the direct marketing purposes, the data subject also has the right to object at any time to the processing of the personal data concerning him/her for such purposes including profiling in so far as such direct marketing is connected.

The interested party may exercise the right to object to the data controller by contacting Intrack S.r.l. at +39 3668539277.

In case of exercise of the right of opposition, the data controller refrains from further processing personal data unless it proves the existence of binding legitimate reasons to proceed with the processing that prevail over the interests, rights and freedom of the person concerned or for the ascertaining, the exercise or the defense of this right in court.

If the interested party opposes the processing of the treatment for direct marketing purposes, personal data will no longer be processed for this purpose.

Right of access your data

The interested party has the right to obtain from the data controller access to personal data and information concerning him/her.

The interested party can exercise the right of access by contacting Intrack S.r.l. at +39 3668539277.

In the case of exercising the right of access, the user can obtain access to personal data and the following information:

• purpose of processing;
• the category of personal data in question;
• the recipients or categories of recipients to whom personal data have been or will be disclosed in particular if recipient of third countries or international organizations;
• whenever possible, the retention period for personal data provided or, if not possible, the criteria used to determine such period;
• the existence of the right of the data subject to ask the data controller to rectify or delete personal data or limit the processing of personal data concerning him/her or to oppose their processing;
• the right to propose a complaint to a supervisory authority;

If personal data are transferred to a third country or to an international organisation, the data subject has the right to be informed of the existence of adequate guarantees relating to the transfer in accordance with the article 46 of the regulation.

The data controller provides a copy of the personal data being processed in the event of further copies requested by the data subject; the data controller may charge a reasonable fee based on administrative costs. If the person submits the request by electronic means and unless indicated other than the data subject, the information is provided in a commonly used electronic format.

Right of Rectification

The interested party has the right to obtain from the data controller the correction of personal data concerning him/her without undue delay. Taking into account the purposes of the processing, the data subject has the right to obtain the integration of incomplete personal data, also by providing an additional declaration.

The interested party can exercise the right of rectification by contacting Intrack S.r.l. at +39 3668539277.

Cancellation Right

The data subject has the right to obtain from the data controller the deletion of personal data concerning him/her without undue delay and the data controller is obliged to cancel the personal data without undue delay, if there is one of the following reasons:

• personal data are no longer necessary with respect to the purposes for which they were collected or otherwise processed;
• the interested party revokes the consent on which the treatment is based, if there is no other legal basis for the treatment;
• the interested party opposes the treatment based on the legitimate interest of the data controller for reasons related to his particular situation and there is no legitimate overriding reason or opposes the processing of his personal data for direct marketing purposes, including profiling extent to which it is connected to such direct marketing;
• personal data are unlawfully processed;
• personal data must be deleted in order to fulfill a legal obligation under the European Union or the Member State Law to which the controller is subject to.

The interested party can exercise the right to cancel by contacting Intrack S.r.l. at +39 3668539277.

If the data controller discloses the personal data and is obliged to delete them, taking into account the available technology and the costs of implementation, it adopts reasonable measures, including technical ones, to inform the data controllers who are processing the personal data of the request of the data subject to delete any link, copy or reproduction of his personal data.

The right of cancellation does not apply to the extent that the treatment is necessary:

• for exercising the right to freedom of expression and information;
• for the fulfillment of a legal obligation under the European Union or Member State Law to which the holder is subject either for the performance of a task carried out in the public interest or in the exercise of official authority;
• for reasons of public interest in the public health sector;
• for archiving purposes in the public interest, for scientific or historical research or for statistical purposes, so far as the right of cancellation risks making it impossible or seriously prejudices the achievement of the objectives of such treatment;
• for the assessment, exercise or defense of a right in court.

Right to data portability

The interested party has the right to receive, in a structured format, commonly used and readable by automatic device, the personal data concerning him/her provided to a data controller and has the right to transmit this data to another data controller without impediments on the part of the data controller who supplied them. If:

• the processing is based on the consent of the interested party or on a contract;
• the treatment is carried out by automated means.

The interested party can exercise the right to portability by contacting Intrack S.r.l. at +39 3668539277.

In exercising its right to data portability, the data subject has the right to obtain direct transmission of personal data from one data controller to another, if technically feasible.

The exercise of the right to portability is without prejudice to the right to cancellation.

The right to portability must not harm the rights and freedoms of others.

Right to propose a complaint

Without prejudice to any other administrative or judicial appeal, the interested party who considers that the treatment concerning him/her is in violation of the regulations has the right to lodge a complaint with the competent supervisory authority pursuant to article 77 of the regulation, particularly in the Member State in which he/she normally resides, works or the place where the alleged violation has occurred. The supervisory authority to which the complaint has been lodged shall inform the complainant of the status or outcome of the complaint, including the possibility of a judicial remedy.