Privacy notice pursuant to Article 13 of EU Regulation 679/2016 (GDPR).

Erboristeria Verdi Rimedi di Luca Durì, Via Pleione 26, 30028 Bibione (VE), Italy, hereinafter also «VERDIRIMEDI», processes personal data for the purposes described below.

1. Purposes and legal basis of the processing

Managing the Loyalty Card. Data is processed to grant the user the economic and contractual benefits linked to their active Verdirimedi Loyalty Card, to manage the points accrual programme (see this regulation), and to enable participation in related promotions. Contact data is used exclusively to send service communications by email, for example: accrued points balance, contract changes, digital loyalty card delivery, notice of expiring credits, new ways to earn or speed up points accrual.

The legal basis is the performance of contractual obligations: providing the data is necessary to deliver the requested services (access to Loyalty Card benefits, use of its online features, other information requests), which could not otherwise be provided.

With the data subject’s specific consent (given by ticking the relevant boxes), data may also be processed for:

• Sending promotional material — newsletters, notifications, offers and information about promotional and advertising initiatives, prize competitions, and cultural events promoted by VERDIRIMEDI, also by post, SMS or phone. Consent is free and optional: refusal does not affect processing for other purposes (legal basis: consent).
• Reading purchase preferences — analysing consumption habits and choices (type and frequency of purchases), to send personalised commercial offers by email, SMS or phone (e.g. discount vouchers, offers, anonymous satisfaction surveys). Consent is free and optional, same legal basis.

2. Data Controller and DPO

Controller: Erboristeria Verdi Rimedi di Luca Durì, Via Pleione 26, 30028 Bibione (VE), Italy — PEC: postmaster@pec.verdirimedi.it — email: privacy@verdirimedi.it.
The Data Protection Officer (DPO) can be contacted at the registered office or by email at privacy@verdirimedi.it.

3. Data Processors

For the purposes above, VERDIRIMEDI may rely on third parties acting on its behalf and under its instructions as Data Processors (e.g. CRM technical management and maintenance, IT services for the website). Processing is carried out ensuring data security and confidentiality pursuant to Article 32 of the Regulation, to protect data integrity and prevent access by unauthorised parties.

4. Categories of data processed

Personal data of members: first name, last name, date of birth, residence, domicile, email address, phone number and, with consent, other information such as spending habits.

5. Analysis of purchase preferences for profiling purposes

With consent to reading purchase preferences, purchase data (frequency, quantity and type of products) is analysed automatically through CRM software, to determine purchase propensity by grouping customers into homogeneous clusters with similar consumption profiles or interests. This allows VERDIRIMEDI a deeper analysis of demand dynamics and the preparation of promotional offers dedicated to clusters of customers with similar spending habits.

6. Processing methods and retention period

Processing complies with the principles of confidentiality, fairness, necessity, relevance, lawfulness and transparency set out in the Regulation, for the time necessary to achieve the purposes for which the data was collected or, in case of purchase of goods, for the performance of contractual terms and the retention obligations under tax and administrative law.

• Data processed for sending promotional material: maximum retention 24 months.
• Data processed for reading purchase preferences: limited to purchase data with a historical depth of no more than 12 months, through automated decision-making processes (CRM software).

7. Transfer of personal data outside the EU

Data may be processed by IT service providers acting, as Data Processors, outside the European Union. In compliance with the rules on data transfers outside the EU, VERDIRIMEDI undertakes, where necessary, to enter into agreements ensuring an adequate level of protection and/or to adopt the standard contractual clauses annexed to European Commission Decision 2010/87/EU of 5 February 2010.

8. Rights of data subjects

Under Articles 15 et seq. of the Regulation, at any time, by writing to privacy@verdirimedi.it or to «Erboristeria Verdi Rimedi, Via Pleione 26, 30028 Bibione VE, Italy», you may ask VERDIRIMEDI to:

• confirm whether your personal data exists, learn the purposes of processing or its scope, and access its content;
• update, modify and/or correct your personal data;
• request erasure, anonymisation, blocking of data processed in breach of the law, or restriction of processing;
• object for legitimate reasons to the processing, including profiling;
• object to processing for advertising, direct sales, market research or commercial communication purposes;
• withdraw consent, where given, without prejudice to the lawfulness of processing based on consent given before withdrawal;
• receive a copy of the data provided and request that it be transmitted to another data controller.

If you believe your rights have been violated, you may contact the competent supervisory authority under Article 77 GDPR, or apply directly to the judicial authority (Article 79 GDPR).

9. Your Loyalty Card

To check your accrued points balance and the threshold for your next discount voucher at any time, visit verdirimedi.it/card and enter your card number.