• The nature of the personal information processed;
• The purposes and means of the processing of personal information;
• The identity and contact details of the data controller;
• The contact details of the Data Protection Officer (DPO);
• Any third parties involved in the processing activities;
• The retention period of personal information;
• The security measures adopted to protect personal information;
• The privacy rights of users.
Users with fewer than 14 (fourteen) years old are not allowed to consent to the processing of Personal information without parental authorization.
Under the GDPR, the controller is the subject that, alone or jointly with others, determines the purposes and means of the processing of personal information.
The controller for data processing of personal information strictly linked to purchases made on the Site is:
• THE LEVEL GROUP S.R.L., Piazza Arcole 4, 20143 Milano, Italia; contact: PRIVACY@THELEVELGROUP.COM
There is a designated Data Protection Officer to ensure that the Controller processes personal information in compliance with the GDPR. The DPO can be contacted for any enquiries at the following email address: PRIVACY@THELEVELGROUP.COM
With respect to any personal information processed for reasons that do not relate to purchases made on the Site, the sole data controller is Coccinelle SpA., Via Lega dei Carrettieri 6, 43038 Sala Baganza (Parma), Italy.
Personal information. Purposes of processing
“Personal information” means any information relating to users that identifies or is potentially able to identify them personally, either alone or in combination with other information.
Personal information is collected automatically by the Site or received via multiple sources: forms, chat, e-mail, apps, devices, social media and other means.
The Controller processes personal information in various shapes for the following purpose:
At checkout, the Site asks users to provide personal information for the essential purpose of fulfilling their purchase orders and comply with contractual obligations (e.g., name and surname, e-mail address, delivery address, etc.).
Such personal information is also essential for the Customer Service to assist customers on enquiries and for any related necessity, before or after the sale (for instance, with respect to the order delivery status or on product returns).
Personal information related to orders will be stored as long as required to comply with contractual obligations and with the applicable tax and financial reporting obligations.
The Site may also verify the payment instruments used by customers to purchase on the Site (e.g. credit or debit card, etc.) for the main purpose of preventing fraudulent activities or pursuant to the applicable anti-money-laundering laws. As full reliance for payment verification is given to third party payment processors, the Controller does not process or store any financial information belonging to customers.
Failure to provide any personal information required at checkout will prevent users from completing an order on the Site.
Based on its legitimate interest to improve its relationship with customers, the Site may send to customers email communications with product suggestions, discounts, feedback requests or other updates. Customers are always free to unsubscribe from such email communications (for instance, by clicking on the “unsubscribe link” at the bottom of each email).
Users can always easily withdraw their consent from receiving newsletters and commercial communications in the following ways:
• Through their account settings;
• By clicking on the ‘unsubscribe’ link in any of such email;
• By contacting our Customer service.
Information relating to the cookies used on the Site can be found at the following link.
Sharing and transfer of personal information
The Controller may transfer personal information of customers to primary third-party suppliers, acting as “data processors” (the “Processors”), for the purpose of performing business operations in order to fulfil its contractual obligations.
The Controller will make its best effort to ensure that all Processors will apply any best practice of their industry to protect personal information and that they will not use personal information for any other purposes than those agreed with the Controller.
For instance, the Controller may share personal information with the following categories of Processors:
• Couriers and postal operators;
• Fulfilment centers and warehouses;
• Advertising, digital, marketing and social media agencies;
• IT service providers;
• Customer care service providers;
• Payment service providers.
In such cases, sharing personal information with the Processors is necessary for the Controller to fulfil its contractual obligations and, also, to improve the Site’s products and services.
Users can request an updated list of the Processors involved in the processing of personal information relevant to the Site’s activities by writing an email to: PRIVACY@THELEVELGROUP.COM
The Controller reserves the right to disclose personal information about users as required by law (for instance, in response to law enforcement requests), and where needed to protect the rights of the Controller or its affiliates or third parties.
Moreover, personal information may be disclosed to other companies within the same corporate group of the Controller, or to third parties in the event of a corporate restructuring process, in full compliance with the applicable law.
In any other cases, the sharing of personal information will be conditional upon the preliminary and explicit consent of the user, unless processing is allowed under an alternative legal basis.
The Controller will not transfer any personal information outside the European Economic Area (EEA), unless the user has explicitly authorized such transfer or the transfer of personal information outside the EEA is allowed by the GDPR on another legal basis.
Processing methods and security measures
Personal information of users is processed by the Controller with IT, automated and electronic tools and, in limited cases, by using documentary means. In accordance with the GDPR, specific security measures have been implemented to prevent data loss, unlawful or improper use, and unauthorized access.
Only authorized employees of the Controller, and authorized employees of related parties or third-party suppliers, acting as Processors on behalf of the Controller, have access to personal information related to the Site activities. Data processing agreements are in place with the Processors to ensure that they always meet the level of security required by the GDPR while processing personal information related to the Site activities.
While the Site adopts primary security measures to prevent loss, destruction or dissemination of personal information, at the same time it cannot exclude the safety risks that are naturally involved by online transmission of data. The user accepts the inherent risks of providing personal information over the internet and will not hold the Site responsible for any breach of security, unless this breach is due to the Site’s negligence or willful default.
Retention of personal information
The Controller will store personal information for as long as it is needed to provide users and customers with the required services or to meet legal or tax obligations or for the minimum period prescribed by the law.
In order to determine the appropriate retention period for personal information stored by the Site under user consent, the Controller will take into account multiple factors to ensure that personal information is not stored for longer than the necessary or appropriate period. Such criteria will also include:
• The purpose for which the Site holds personal information;
• Legal, tax and regulatory obligations in relation to that personal information;
• The type of ongoing relationship with the concerned user or customer (how often the user logs into their Site account, whether users continue to receive marketing communications, how regularly they browse or buy on the Site, etc.);
• Any specific user request in relation to the deletion of personal information;
• Legitimate business interests.
The Site will promptly delete or anonymize personal information that is no longer needed or retained according to the law.
Connection to third-party websites or platforms
The Site may contain banners, advertising messages and other links to third-party websites or platforms. The Controller cannot control or be held responsible for the conduct of such third-party websites or platforms with respect to privacy law. Users are encouraged to read their privacy policies to verify how they collect and process personal information.
The rights of users
Users are entitled to receive confirmation as to whether the Controller hold any personal information about them.
If this is the case, under the GDPR, users also hold the rights to:
• Be informed about the collection and use of their personal information;
• Access their personal information at no cost;
• Have inaccurate personal information rectified, or completed (when it is incomplete);
• Have personal information erased (“the right to be forgotten”);
• Under specific conditions, obtain the restriction or suppression of their personal information;
• Obtain and reuse their personal information for their own purpose across different services when processing is based on a contract or on consent, and the processing is carried out by automatic means (“the right to data portability”);
• Under specific conditions, to object to the processing of their personal information;
• Object at any time to the use of personal information for “profiling” or “automated decision-making” purposes.
• The right to submit complaints related to the collection and processing of personal information to the competent supervisory authority;
• The right to withdraw consent to the processing of personal information at any time.
Users can contact the Site for any enquiry and to exercise their privacy rights at the following email address: PRIVACY@THELEVELGROUP.COM