ACT OF INFORMATION PURSUANT TO ART. 13 OF EU REGULATION 2016/679

B810 S.r.l. (Tax Code and VAT n.: 03378920361) (hereinafter “B810”), in the person of its legal representative pro tempore, with registered office in Reggio Emilia, via E. Lazzaretti, 2/1, in its capacity as Controller pursuant to art. 4 n. 7) and 24 of EU Regulation n. 2016/679 (GDPR) informs you, pursuant to art. 13 of GDPR, that your personal data described in art. 1 will be processed, by Controller, for execution of the processing purposes described in art. 2.

1. Category of personal data being processed

1.1. B810 collects and processes, for execution of the specific processing purposes described in art. 2, your personal data pursuant to art. 4 n. 1) of the GDPR known as identification data (e.g. name; surname; email address), including data relating to the location pursuant to art. 121 paragraph 1bis) letter i) of amended Legislative Decree n. 196/2003 (Privacy Code), the latter used, in fact, only to give full effect to the device and its functions described in art. 2.1. letter a) (hereinafter only “personal data”).

With exclusive reference to the processing purpose described in art. 2.1. letter a), B810 may also collect and process, either compulsorily or optionally, personal information related to a person connected to you (e.g. a photograph of a minor, connected to you, who will use the anti-abandonment device in question; (maximum three) telephone numbers to be used for the so-called emergency event, previously entered by you in the mobile software application described below or obtained, again on your express indication, from your telephone book).

2. Purposes of processing and related legal basis.

2.1. Your personal data are processed, by B810, for the following purpose:

1. Effective and complete use of “TIPPY PAD” bluetooth anti-abandonment device and of the interconnected and homonymous mobile software application (app), including any available function (e.g. audible and vibrating alarm for 40 seconds; alarm via sms; geolocation), as well as performance of any legal/regulatory obligation connected, also directly or indirectly, to the use of the device and the connected app.

In accordance with art. 13 paragraph 2) letter e) of GDPR, B810 informs you that failure to provide your personal data, which is compulsorily requested, may result in the impossibility of a correct and complete activation of the app, and consequent use of the services and functionalities made available by the device and the related app.

In this respect, B810 specifies to you that the legal basis of the processing purpose referred in art. 2.1. letter a) is to be found in art. 6 paragraph 1) letters b) and c) of GDPR.

2.2. Your personal data are processed, by B810, for the following purposes:

1. Soft spam activities, to be carried out by electronic mail and/or by so-called traditional methods (e.g. paper mail);
2. Profiling pursuant to art. 4 n. 4) of GDPR, not based solely on automated processing, aimed at determining and constituting categories/classifications (clusters), based on personal information provided directly, in order to learn about the preferences and characteristics of TIPPY PAD’s customers and, consequently, to customise offers or offer products/services that best meet their needs and desires;
3. Execution of customer satisfaction activities, aimed at verifying/obtaining, also thanks to a special survey, some information on the degree of appreciation/improvement and/or benefits, also indirect, of TIPPY PAD, including the relative app and/or the connected “tippy-fi” accessory.

In accordance with art. 13 paragraph 2) letter b) of GDPR, B810 informs you of the existence of your faculty/right to object, at any time, to each (or all) of the processing purposes described in art. 2.2, by using the contact details in art. 7.

In this regard, B810 specifies that the legal basis of the processing purpose referred in art. 2.2. letter b) is found in art. 6 paragraph 1) letter f) of GDPR and in art. 130 paragraph 4) of Privacy Code, and that, instead, the legal basis of the processing purpose referred in art. 2.2. letters c) and d) is found in art. 6 paragraph 1) letter f) of GDPR.

2.3. Your personal data are processed by B810 for the following purposes, subject to obtaining your specific, free, informed, granular and unambiguous consent:

1. Commercial/promotional/advertising/marketing activities (including market research), to be carried out by automated/electronic/telematic means (e.g. email; website; mobile app; social page; newsletter) or by non-automated/traditional means (e.g. paper mail; conference and/or event; telephone; sms; mms; telefax; informative/advertising material);
2. Acquisition by third parties, belonging to the product/business category of B810 or who may in any case use the services/products offered by the latter, for commercial/promotional/advertising/marketing activities (including market research), to be carried out with automated or traditional methods or in the form of indirect marketing where B810 acts, for this purpose, as a vehicle for the promotional/commercial/advertising message concerning the goods/products/services of the third party assignee.

In accordance with art. 13 paragraph 2) letter c) of GDPR, B810 informs you of your right to withdraw, at any time, any consent you may have given to each (or both) of the processing purposes described in art. 2.3., by using the contact details in art. 7.

In this regard, B810 specifies that the legal basis of the processing purposes described in art. 2.3. letters e) and f) is found in art. 6 paragraph 1) letter a) of GDPR.

3. Retention period.

3.1. In accordance with art. 13 paragraph 2) letter a) of GDPR, B810 informs you of the following retention periods/criteria, after which your personal data will be erased, destroyed or anonymised: (i) for the processing purpose referred in art. 2.1. letter a): a term no longer than the fulfilment of the processing purpose in question (whose time criterion is, however, identifiable, approximately, until such time as you inform B810 unequivocally that you do not wish to/can no longer use TIPPY PAD and the connected app), a time criterion that may be extended if necessary in order to comply with regulatory obligations or in order to assert or defend a right, also in court; (ii) for the processing purpose set forth in art. 2.2. letters b), c) and d): until your objection, a time criterion that may be extended in order to comply with a legal obligation, including those that have arisen or to assert or defend a right, including in court; (iii) for the processing purpose referred in art. 2.3. letters e) and f): until you revoke your consent, a time criterion that may be extended in order to comply with a legal obligation that has arisen or to assert or defend a right, including in court.

4. Target audience.

4.1. In compliance with art. 13 paragraph 1) letter e) of GDPR, B810 specifies that your personal data may be subject to communication, if appropriate and necessary, to one or more recipients pursuant to art. 4 n. 9) of GDPR, identified as follows, in a general way, by category: (i) for the processing purpose referred in art. 2.1. letter a): persons authorized to process data by B810; consultants or companies of various kinds that provide, in any case, services and/or performances (including professional services) connected, even indirectly, to the performance of the processing purpose in question (e.g. IT/cloud computing companies); (ii) for the processing purpose referred in art. 2.2. letter b): parties authorized to process data by B810; consultants or companies of various kinds providing, in any event, services and/or benefits (including professional services) connected, even indirectly, with the performance of the processing purpose in question (e.g. marketing companies); (iii) for the processing purpose referred in art. 2.2. letter c): parties authorized to process data by B810. (iii) for the processing purpose referred in art. 2.2. letter c): persons authorized to process data by B810; consultants or companies of various kinds who provide, in any case, services and/or performances (including professional ones) connected, even indirectly, to the performance of the processing purpose in question (e.g. analysis companies); (iv) for the processing purpose referred in art. 2.2. letter d): persons authorized to process data by B810; consultants or companies of various kinds who provide, however, services and/or performances (including professional ones) connected, even indirectly, to the performance of the processing purpose in question (e.g. customer care/analysis companies); (v) for the processing purpose referred in art. 2.3. letter e): parties authorized to process data by B810; consultants or companies of various kinds providing, in any event, services and/or performances (including professional ones) connected, even indirectly, with the performance of the processing purpose in question (e.g. marketing companies); (vi) for the processing purpose referred in art. 2.3. letter f): parties authorized to process data by B810; third-party assignees.

5. Transfer.

5.1. Your personal data are stored in automated, partially automated and/or non-automated files belonging or in any case traceable, even indirectly, to B810, and located, as regards automated files (public cloud computing), outside the European Economic Area (EEA): with regard to this last aspect, B810 specifies, in compliance with art. 13 paragraph 1) letter f) of GDPR, that the appropriate guarantee consists in the measure ex art. 46 paragraph 2) letter c) of GDPR.

6. Rights of the data subject.

6.1. In relation to your personal data, B810 informs you of your right to exercise the following rights, which may be subject to the limitations set out in art. 2 undecies and 2 duodecies of Privacy Code: right of access pursuant to art. 15 of GDPR: right to obtain confirmation as to whether or not personal data concerning the data subject are being processed, as well as the information referred in art. 15 of GDPR (e.g. purpose of processing, storage period); right to rectification under art. 16 of GDPR: right to correct, update or supplement personal data; right to erasure under art. 17 of GDPR: right to obtain erasure or destruction or anonymisation of personal data, where, however, the conditions listed in the same article apply; right to restriction of processing under art. 18 of GDPR: right to obtain the restriction of the processing of personal data in the cases governed by art. 18 of GDPR; right to data portability under art. 20 of GDPR: right to obtain the personal data provided to B810 in a structured, commonly used and machine-readable format (and, where required, to transmit them directly to another Data Controller), where the specific conditions set out in that article are met (e.g. legal basis of consent and/or execution of a contract; personal data provided by the data subject); right to object under art. 21 of GDPR: right to obtain the cessation, on a permanent basis, of a specific processing of personal data; right to lodge a complaint with the Privacy Guarantor under art. 77 of GDPR: right to lodge a complaint where it is considered that the processing under analysis violates national and EU legislation on the protection of personal data. 

6.2. In addition to the rights described in art. 6.1. above, B810 specifies that, in relation to the personal data of the data subject, there is, where possible and conferring, the right to exercise, on the one hand, the (sub)right provided for art. 19 of GDPR (“The controller shall communicate to each of the recipients to whom the personal data have been transmitted any rectification or erasure or restriction of processing carried out pursuant to article 16, article 17(1) and article 18, unless this proves impossible or involves a disproportionate effort. The data controller shall inform the data subject of such recipients if the data subject so requests”), to be considered connected and related to the exercise of one or more of the rights regulated in articles 16, 17 and 18 of GDPR; on the other hand, B810 specifies that, in relation to the personal data of the data subject, there is, where possible and conferring, the right to exercise the right provided for in art. 22(1) of GDPR (“The data subject shall have the right not to be subject to a decision which is based solely on automated processing, including profiling, and which produces legal effects concerning him or her or significantly affects him or her in a similar way”), subject to the exceptions provided for in paragraph 2).

6.3. Pursuant to art. 12 paragraph 1) of GDPR, B810 undertakes to provide the communications referred in art. from 15 to 22 and 34 of GDPR in a concise, transparent, intelligible, easily accessible and plain language form: such information shall be provided in writing or by other electronic means, or, at data subject’s request, orally provided that the data subject’s identity is proven by other means.

5.4. In accordance with art. 12 paragraph 3) of GDPR, B810 informs you that it undertakes to provide you with information regarding the action taken in respect of a request pursuant to art. from 15 to 22 of GDPR without undue delay and, in any event, at the latest within one month of receipt of such request; this period may be extended by n. 2 months if necessary, taking into account the complexity and number of requests (in this case, Controller undertakes to inform the user of such extension and the reasons for the delay, within one month of receipt of the request).

6.5. The user may exercise the above-described rights at any time (with the exception of the right under art. 77 of GDPR) by using the contact details set out in art. 7.

7. Contact details.

7.1. B810 can be contacted at the following address: info@b810group.it

7.2. The Data Protection Officer (DPO) under art. 37 of GDPR, appointed by B810, can be contacted at the following address: privacydpo810@baldiandpartners.it

Reggio Emilia, 1.3.2022 (date of last update)

B810 S.r.l.

(in the person of its legal representative pro tempore)