PROCESSING OF PERSONAL DATA

This information, provided pursuant to Art. 13 of the European Regulation 679/2016 of the European Parliament and of the Council, complies with the provisions of Legislative Decree n. 196/2003 of the Italian Republic, to the Provision of the Data Protection Authority n. 229 of 8 May 2014, as well as Directive 2002/58/EC of the European Parliament and of the Council.

This version of the information is effective from the date of publication on the site, i.e. May 25, 2018.

WHO IS IT FOR?

This information is addressed to the subjects who will use the services provided by the site www.elisendra.com , namely, in detail:

• natural persons who browse the website, even if only for consultation;
• natural persons who register on the site by creating a private account;
• natural persons who register on the site by creating a business account, in relation to the personal data of the person who physically registers;
• natural persons who make a purchase from the site, with simultaneous registration;
• natural persons who contact the company White Angel Srl using the "Contact Us" form.

In this information they will be indicated as Interested .

WHO PROCESSES THE DATA?

The Data Controller for all processing carried out as a result of using the website www.elisendra.com is the company White Angel Srl (VAT number 06827470482), a company incorporated under Italian law in Florence (FI), in the person of its legal representative pro tempore .

In the context of the treatments covered by this information, it is possible to contact the Data Controller at the following addresses:

190/4, Via de' Cattani, 50145, Florence (FI), Italy

Email: sales@whiteangelostore.it

Pec: legalmail@pec.whiteangelstore.it

The data are materially processed by employees and collaborators of the Data Controller , who have been previously instructed and authorized for processing

In order to carry out the treatments related to the registration and orders placed through the website www.elisendra.com , the Data Controller makes use of the support and assistance of companies that provide IT, advertising and shipping services such as, mainly and without limitation, the following companies:

Ergonet Srl, with registered office in Italy in Montefiascone (VT), 01027, Via Giuseppe Contadini, 15, for the allocation, management and assistance of the website and the integrated management system;

Rocket Science Group LLC, with registered office in the United States of America in Atlanta (GA), 30308, Ponce de Leon Avenue, 675, for communication activities, also for promotional purposes;

Google LLC, with registered office in the United States of America in Mountain View (CA), 94043, Amphitheater Parkway, 1600, for statistical analysis of data relating to the site and profiling of interested parties ;

Facebook Inc, with registered office in the United States of America in Menlo Park (CA), 94025, Hacker Way, 1, for marketing and profiling activities.

The aforementioned companies have therefore been appointed as Data Processors .

The complete list of Data Processors can be found at the headquarters of the Data Controller and will be communicated upon simple request for access, in accordance with current legislation.

The addresses and contacts of the Data Processors , for the purposes of this information, can be found on the respective company websites.

WHICH DATA ARE PROCESSED?

For the management of the services provided through the website www.elisendra.com , the following data are processed:

E-mail, for registering for the newsletter;

Name, Surname, E-mail, for registration on the site;

Name, Surname, E-mail, to get in touch with White Angel Srl;

Name, Surname, E-mail, Full address, Telephone number, to make a purchase.

WHERE ARE THE DATA PROCESSED?

The data collected through the website www.elisendra.com will be processed by the Data Controller in Italy, at its headquarters in Florence and at the Italian branches of the company White Angel Srl.

The data will be processed by the Data Processors at their offices and branches, located in the territory of the European Union.

For some treatments, it may be necessary to communicate the data even outside the European Union, in the event that the Data Processor carries out activities and treatments outside the EU and/or in the event that the delivery of the order is requested outside from the EU.

In any case, the transfer of data outside the European Union will take place on the basis of the hypotheses envisaged by current legislation, including the use of binding corporate rules (BCR - Binding Corporate Rules) for transfers within the companies headed by White Angel Srl, the application of standard contractual clauses defined by the European Commission for transfers to third party companies or the verification of the presence of an adequacy decision of the personal data protection system of the data importing country, such as the EU 2016 Implementing Decision /1250 (Privacy Shield).

HOW ARE THE DATA PROCESSED?

The data are collected from the interested party , through the use of cookies, or by sending them via online forms dedicated to the registration and/or finalization of the purchase order or by sending them via the online form of contact.

Once acquired, the data of the interested party are archived and stored in digital form on the IT systems of the Data Controller and/or its Data Processors .

In case of purchase, the data may also be processed in analogical form at the headquarters of the Data Controller and/or its Data Processors .

WHICH COOKIES COLLECT DATA?

The website www.elisendra.com uses technical cookies, which can be used without asking the consent of the interested party , since they are strictly necessary for the provision of the service.

Furthermore, third-party profiling cookies may be used, the use of which is subject to the consent directly given to these third parties by accessing the relative information on the use of cookies.

Profiling cookies can be used, by the Data Controller or by the owner of the cookie himself, to memorize the choices made by the interested party , to provide customized or optimized functions or to memorize his habits and preferences shown during navigation. For example, profiling cookies can be used to offer the interested party online services, to send him advertising that takes into account his interests or to avoid being offered services that he has refused in the past.

The website www.elisendra.com uses the following cookies:

Service	Owner	Purpose	Duration	More information
Word Press	White Angel Srl	Techniques	1 day	Ecommerce navigation management
Google Analytics	Google Inc	Profiling	2 days	https://policies.google.com/technologies/cookies/
Facebook pixels	Facebook Inc	Profiling	2 days	https://www.facebook.com/policies/cookies/

The authorization to collect and store data through cookies can be revoked at any time: the interested party can disable the use of cookies through the specific setting options of the various browsers.

Internet Explorer: Delete and manage cookies (microsoft.com)

Chrome: Turn cookies on or off – Computer – Google Account Help

Firefox: Delete cookies | Firefox Support (mozilla.org)

Safari: Manage cookies and website data in Safari on Mac – Apple Support (UK)

Opera: Web preferences – Opera Help

FOR WHICH PURPOSES ARE THE DATA TREATED?

The data collected by the Data Controller is used in order to:

• improve the use of the site and record statistics on its use, as well as profile the interested parties;
• register and register the interested party on the website www.elisendra.com ;
• fulfill the obligations, including legal ones, deriving from the purchase contract signed by the interested party on the website www.elisendra.com , as well as informing the interested party on the progress of the order and of the shipment;
• send communications of a commercial nature regarding the activity carried out and the products sold by the company White Angel Srl

The data will also be processed through automated decision-making processes, such as profiling, in order to improve navigation and the offer to the customer.

ON WHICH LEGAL BASIS ARE THE DATA PROCESSED?

The processing of data collected by the Data Controller is based on the explicit consent of the interested party , in cases of navigation on the site www.elisendra.com and/or registration on the site and/or registration for the newsletter service of the company White Angel Srl and/or in case of contact through the website www.elisendra.com ; in case of purchase, the treatment is based on the consent given at the time of conclusion of the contract.

If the interested party withdraws his consent to the treatment, the Data Controller could continue the treatment for obligations deriving from the law and/or on the legal basis of his legitimate interest.

HOW IS THE DATA PROTECTED?

The data processed by the company White Angel Srl are protected by access with password protection and encryption of navigation data.

IS IT MANDATORY TO PROVIDE DATA?

The provision of data by the interested party is mandatory, in order to fulfill the requests of the interested party , i.e. the registration, purchase or contact request.

Any refusal to provide data will make it impossible to provide the requested service, preventing the interested party from registering, making a purchase and/or getting in touch with White Angel Srl.

The provision of data collected through technical cookies is mandatory to navigate the site, while it is optional for analytical and profiling cookies.

TO WHOM ARE THE DATA COMMUNICATED?

The data collected and processed by the Data Controller will not be disclosed to subjects other than the Data Processors and subjects authorized to process data by White Angel Srl

HOW LONG ARE THE DATA PROCESSED?

The data collected through the website www.elisendra.com are stored and processed only as long as the purposes for which they were collected remain, namely:

• in case of navigation, the data are processed for the duration specified for each cookie;
• in case of registration, until the interested party revokes consent to the processing or requests cancellation from the service;
• in case of purchase, the data relating to the order will be processed for a period not exceeding 26 months from the date of delivery of the order while the data relating to billing will be processed for a period not exceeding 10 years from the date of purchase;
• in the event of a contact request, the data will be processed until the request is fully processed, and in any case for a period of time not exceeding 6 months.

HOW ARE THE INTERESTED PARTIES PROTECTED?

The interested party can protect himself and his personal data by exercising the rights established by current European legislation, by sending a request in free form to the Data Controller .

The Data Controller will respond as soon as possible, and in any case within one month of receiving the request or, if additional time is needed to process the request, within a maximum of two months; in the latter case, the Data Controller will inform the interested party of the reasons for the delay.

In the event that the Data Controller does not deem it necessary to process the request, it will communicate its refusal directly to the interested party within one month of receiving the request. In this case, the interested party can lodge a complaint with the Supervisory Authority of his own country or appeal to the Judicial Authority of his own country.

The exercise of the rights of the interested party is free, unless the requests are manifestly unfounded or repetitive: in this case, the Data Controller may charge a fee or refuse the request.

The interested party can exercise his right of access, pursuant to art. 15 Reg. 2016/679 EU, by making a request to the Data Controller in order to obtain confirmation that data concerning him is (or is not) being processed. In the same way, you can request to know:

• what data are processed and for what purposes;
• how long they are kept;
• if the data have been or will be communicated to other subjects, and possibly the identity of these subjects and the country where they are located, as well as the existence of adequate guarantees for the transfer;
• the existence of the right to request the rectification, limitation or cancellation of one's data;
• the existence of the right to oppose the treatment;
• the existence of the right to lodge a complaint with a Supervisory Authority;
• the existence of an automated decision-making process, including profiling, and the consequences of such treatment.

Lastly, the interested party has the right to receive a copy of their personal data being processed free of charge, provided that this does not harm the rights of other subjects; any further copies requested could be released upon payment of a fee.

The interested party can exercise his right of rectification, pursuant to art. 16 Reg. 2016/679 EU, by making a request to the Data Controller in order to have inaccurate data concerning him corrected. In the same way, the interested party can request that the processed data be integrated with others, providing his own declaration to this effect.

The interested party can exercise his right to cancellation, pursuant to art. 17 Reg. 2016/679 EU, by making a request to the Data Controller to cancel the personal data collected and processed by the company White Angel Srl in one of the following cases:

• if the personal data are no longer necessary in relation to the purposes for which they were collected;
• if the interested party has revoked his consent to the processing;
• if the interested party has opposed the treatment;
• if the personal data have been unlawfully processed by the Data Controller ;
• if the data must be deleted to fulfill a legal obligation to which the Data Controller is subject ;
• if the interested party is under the age of 16 and the persons who exercise parental responsibility have not given their consent.

If the Data Controller has made the personal data of the interested party public and is obliged to cancel them, he will inform any other subjects who are processing the data of the interested party of the request for cancellation, limited to the effective technical and economic possibility of this procedure.

The interested party can exercise his right to limitation, pursuant to art. 18 Reg. 2016/679 EU, by making a request to the Data Controller so that the processing of data is limited solely to the retention of the data itself, without the Data Controller being able to carry out other operations, in one of the following cases:

• if the interested party disputes the accuracy of the data, for the time necessary for the Data Controller to verify it;
• if the processing is unlawful and the interested party opposes the cancellation;
• if the Data Controller no longer needs to process the data but must keep them for legal reasons;
• if the interested party has opposed the processing, for the time necessary to verify the balance between the rights of the interested party and the legitimate interests of the Data Controller .

The interested party can exercise his right to object, pursuant to Art. 21 Reg. 2016/679 EU, at any time and for reasons related to your particular situation. This right can be exercised by sending a communication to the Data Controller in the event that the treatment is based on the legitimate interest of the Data Controller or in the event that the data are processed for scientific research purposes or for statistical purposes.

The interested party can exercise his right to the portability of personal data, pursuant to art. 20 Reg. 2016/679 EU, by making a request to the Data Controller in order to receive the personal data concerning him in a structured format, commonly used and readable by an automatic device. In the same way, the interested party can request that their data be transmitted to another Data Controller .

However, the exercise of this right cannot harm the rights and freedoms of others.

The data will be communicated in .csv format.

In the event that the interested party believes that the processing of his personal data is carried out in violation of the European Regulation 2016/679, he has the right to lodge a complaint with the Supervisory Authority, pursuant to Art. 77 of the same, choosing between the Supervisory Authorities of the Member State in which he resides, of the Member State in which he works or of the Member State in which the alleged violation occurred.

In any case, the interested party can act for the protection of his rights also by appealing to the Administrative and/or Judicial Authority of his own country.

The interested party can revoke the consent to the processing of his data at any time, with the same methods with which he gave the consent or by sending a communication to the Data Controller . The revocation of the consent will not have effect on the treatments already carried out, but will involve the interruption of the treatments in progress and the destruction of the data of the interested party .

7Pixel Srl, in the person of its pro tempore legal representative, is appointed Head of the processing of user data (email address) for the management of requests for comments within the "Trusted Program" of the site https://www.trovaprezzi.it