Alajmo+ Privacy Policy

Information notice pursuant to Art. 13 of EU Regulation no. 2016/679 of 27 April 2016

This information notice is provided pursuant to and for the purposes of Art. 13 of EU Regulation no. 2016/679 of 27 April 2016 (hereinafter also referred to as "GDPR") concerning the protection of natural persons with regard to the processing of personal data. Specifically, Alajmo S.p.A., as Data Controller, wishes to inform you that, in compliance with the obligations arising from the GDPR, it is required to provide certain information regarding the methods and purposes of the processing of personal data, which it may come into possession of as a result of the Customer's use of the App.

A. Data Controller
The Data Controller for all personal data collected and processed through the App is Alajmo S.p.A, with registered office in (35030) Sarmeola di Rubano (Pd), Via Liguria 1/A.
Phone: 049.630303
E-mail: privacy@alajmo.it

B. Data processed and purposes of processing
1. Type of data processed:
The identification, contact and access data processed for registration to the App are: name, surname, date of birth, gender (with the option not to specify it), email address, phone number, password. This data is processed to allow the Customer to register for the App. If the Customer wishes, the following data is also processed: residential address, city, postcode, state, country, photo.

2. Purposes of Processing
a. The personal data acquired is processed in order to allow the use of the App, in particular to collect Alajmo Smiles for prize redemption, or for the use of the App as a pre-paid card, according to the methods described in the accepted General Conditions. Such data may also be processed for the fulfillment of all obligations imposed by law (such as, by way of example and not exhaustive: tax purposes, anti-money laundering purposes L. 231/07 and subsequent amendments).

b. Personal data will be processed for direct marketing purposes. Specifically, the data processed for this purpose are: name, surname, e-mail, date of birth, telephone number. Processing for direct marketing purposes will be carried out through automated contact methods, specifically via email.

c. Personal data, subject to consent, will be processed for profiling purposes. In particular, by analyzing personal data, it will be possible to elaborate information regarding the Customer's interests and preferences concerning the products and services offered, in order to personalize the Customer's experience by proposing previews and offers in line with their tastes and sending personalized commercial communications.

 C. Legal basis of processing
The legal basis for the processing of Customer data indicated in point 1. letter B), Type of data processed, is the necessity to perform the services provided and described in the General Conditions. The provision of data is mandatory and any failure to provide it may result in the non-execution or suspension, even interruption, of the services offered.
The legal basis for direct marketing activities related to promotional initiatives promoted by Alajmo is the legitimate interest of the Controller. The Customer may object at any time by sending an e-mail to: privacy@alajmo.it. Please note that the Customer may receive further communications even after objection, as some mailings may have already been planned.
The legal basis for profiling activities is the consent given by the Customer. Consent can be freely revoked through the App in the Profile section.  

D. Processing Methods
Processing is carried out through operations, performed with or without the aid of electronic tools, and consists of the collection, recording, organization, storage, consultation, processing, modification, selection, extraction, comparison, use, interconnection, blocking, communication, erasure, and destruction of data.
Personal data will be stored and controlled, also in relation to the knowledge acquired based on technical progress, the nature of the data, and the specific characteristics of the processing, through the adoption of appropriate and preventive security measures, both physical and logical, in order to minimize the risks of destruction or loss of data; unauthorized access; unauthorized processing or processing not in accordance with the purposes of collection.
It is specified that the Data Controller uses Amazon Web Service as hosting. The processing will be carried out by the Data Controller and by persons expressly authorized by the Data Controller.
It is also specified that the processing of personal data for profiling purposes will take place, in case of consent, with data processing tools that, following cross-referencing, will create a commercial and behavioral profile of the Customer. This data processing tool relates the data collected during the use of the App. Furthermore, such data and/or information will be associated with any and/or further data and/or information already in our possession following adherence to our services. Specifically, profiling activity is carried out using the HubSpot platform.

E. Data Retention Period
The personal data of customers registered with the App is stored for 15 (fifteen) days following the deletion procedure within the App or in the event of Account deletion by the Data Controller as provided for in Article 11.1 of the General Conditions.
Data provided for marketing and profiling purposes will be stored for the same duration, and in any case until objection and withdrawal of consent, with the understanding that, upon expiry, such data will be automatically deleted or permanently and irreversibly anonymized.

F. Recipients and categories of recipients
The personal data provided will not be disseminated, meaning it will not be made known to undetermined individuals.
However, data may be communicated to clearly defined subjects only by the Data Controller for the specified purposes, in particular:

a) Software house;
b) Data Processors and appointees;
c) To legal, tax and business consultants, for the better management of tax and invoicing profiles, who will in any case remain autonomous data controllers, unless they are expressly appointed as external data processors;

The list of subjects appointed as external Data Processors is available at the following references: Website: www.alajmo.it Data Controller's email address: privacy@alajmo.it

G. Data Subject Rights
The data subject has the right to:

- access, rectification, erasure, restriction and objection to data processing;
- obtain without hindrance from the Data Controller data in a structured, commonly used and machine-readable format to transmit it to another Data Controller;
- withdraw consent to processing, without prejudice to the lawfulness of processing based on consent acquired before withdrawal;
In this regard, please be informed that the deadline for responding to the data subject is, for all rights, one month from receipt of the request, extendable up to three months in cases of particular complexity.
The aforementioned rights may be exercised by written communication sent via email to: privacy@alajmo.it, unless a specific method for exercising these rights is provided within the APP itself.

H. Complaint to the Supervisory Authority and right to judicial remedy
The data subject has the right to lodge a complaint with the Data Protection Authority.
A complaint is a tool that allows the data subject to contact the Garante to complain about a violation of personal data protection regulations pursuant to Article 77 of the GDPR and to request verification from the Authority.
A complaint can be submitted by the data subject to the Supervisory Authority of their place of residence, or where they work, or where the alleged violation occurred.
The data subject also has the right to bring a judicial appeal before the ordinary court if they believe that their rights have been violated as a result of processing.

I. Data transfer abroad
Personal data is stored in the Amazon Web Service Cloud within the European Union.
Hubspot transfers personal data to the United States.
It should be noted, however, that US government authorities, under certain legally defined conditions, may access such data.

J. DPO (Data Protection Officer)
Alajmo S.p.a. has appointed a Data Protection Officer, in accordance with Articles 37 et seq. of the Privacy Regulation, who can be contacted at the following email address: privacy@alajmo.it