PRIVACY POLICY ABOUT CALLIOPE LOYALTY PROGRAM

1. DATA CONTROLLER

Teddy S.p.A., via Coriano n. 58, Grosrimini, blocco 97, 47924 Rimini (RN), Tel. (+39) 0541 301411, Fax (+39) 0541 383430, E-mail help@calliope.style

2. PURPOSES, LEGAL BASIS, PERSONAL DATA PROCESSED, STORAGE RETENTION PERIOD 

Personal data, depending on the actions carried out by the data subject, will be processed for the following purposes:

1. Calliope Loyalty Program membership 

• The legal basis of this processing is the need to perform a contract of which the data subject is party, pursuant to the “General Terms and Conditions for Calliope Loyalty Program” and to regulations of individual promotional initiatives, and also the legitimate interests pursued by the controller;
• If the person concerned is a minor of 18, the signature must be made by the parental responsibility operator.
• The personal data collected are those requested in the registration form for the Calliope Loyalty Program: name, surname, date of birth, gender, address, e-mail, mobile phone;
• The data will be store for the entire duration of the contract and, after the termination of the contract, for a further period of five years; in case of litigation, for the whole duration of it, until all the appeal actions terms will be exhausted;
• Personal data is essential to execute the request and the eventual rejection will determine the inability to activate the Fidelity Card. 

2. “Community Tester” Membership:

• The legal basis of this process is the explicit consent of the data subject to be contacted in taking part to products satisfaction test;
• The personal data collected are those requested in the registration form for the Calliope Loyalty Program;
• The data retention period for this purpose is valid until the data subject does not revoke the consent. We remember that the consent could be revoked at any time without that the lawfulness of processing based on consent before its withdrawal is affected;
• Additional information on the logic applied and on protection provided for the data subject are available by sending a written request to the Data Controller;
• The provision of personal data is optional and the rejection will determine the inability to participate in product satisfaction tests. 

3. Send brochures and marketing material (direct marketing), also by email or SMS (mailing list, offers, etc.):

• The legal basis of this process is the explicit consent of the data subject;
• The personal data collected are those requested in the registration form for the Calliope Loyalty Program.
• The data retention period for this purpose is valid until the data subject asks for the unsubscription from the promotional service/sending of newsletters. We remember that the consent could be revoked at any time without that the lawfulness of processing based on consent before its withdrawal is affected;
• The provision of personal data is optional and the rejection will determine the inability to receive brochures and marketing material. 

4. Analyze consumption habits and choices (profiling), carry out market research (surveys and analysis of Customer satisfaction):

• The legal basis of this processing is the explicit consent of the data subject;
• The personal data collected are those requested in the registration form for the Calliope Loyalty Program and the data relating to purchases made in the store and/or through the terranovastyle.com website;
• The data retention period for this purpose is valid until the data subject does not revoke the consent. We remember that the consent could be revoked at any time without that the lawfulness of processing based on consent before its withdrawal is affected;
• Additional information on the logic applied and on protection provided for the data subject are available by sending a written request to the Data Controller;
• The provision of personal data is optional and the rejection will determine the inability to profile. 

3. RECIPIENT OF PERSONAL DATA

Personal data might be shared, for specific purposes, with: 

• Subjects acting as “Data Processors”, according to the Article n. 28 of the Regulation;
• Subjects with which is necessary to interact for the goods/services provision, as independent Data Controller;
• Subjects or Authorities whom the communication of data is mandatory by the legal provisions or orders from the Authorities;
• Personnel expressed authorized by the Data Controller, necessary to carry out activities strictly related to the provision of goods/services, which are undertaken to confidentiality or are legally bound to do so and that have received opportune operational instructions, pursuant to article 29 of the Regulation. 

The full list of Data Processors is available by sending a written request to the Data Controller.

4. TRANFERS OF PERSONAL DATA

Some of your personal data are shared with recipients who could be out of the European Economic Area (EEA), and in particular in the Republic of San Marino. The Data Controller ensures that the processing of your personal data is carried out according to the Regulation. Verily, transfers shall be based on an adequacy decision or on Standard Contract Clauses approved by the European Commission. Further information is available at the Data Controller. 

5. EXISTENCE OF AN AUTOMATED DECISION-MAKING PROCESS, INCLUDING PROFILING

The Data Controller does not adopt an automated decision-making process on personal data, including the profiling, referred to in Article 22 of the Regulation. Further information will be available at the Data Controller.

6. DATA ABOUT PEOPLE UNDER 18 YEARS OLD

Company’s information services such as the subscription to the newsletter (direct marketing), profiling and online chat it must be authorized by the parent/guardian by signing the application form. The Data Controller will not be responsible of possible recollection of personal data, as well as false statements, offered by the minor, and in every cases, if it is seen to be used, the Data Controller will facilitate the right to access and the right to erasure forwarder by the guardian, foster or who exercises the parental responsibility. 

7. RIGHTS OF DATA SUBJECT

You have certain rights under law to your Personal Data.:

1. You have the right to access your data and to ask for a copy of your Personal Data;
2. You have the right of rectification of incorrect data. If any data we have is incorrect, you have a right to ask for correction; 
3. You have the right to be forgotten and that your data is erased after the passage of time. You may file a request, so that any data that we have on you is deleted. As stated above, due to legal requirements, your data will be held by us for the periods stated in the data retention section and then deleted. 
4. You have the right to restriction of procession. This can be done in the following cases: 

• Where you are contesting the accuracy of the data, while such a claim is being checked; 
• If we process your data unlawfully 
• If we no longer need your data but are keeping the data because we need it for a legal claim;
• Kindly note however the if you exercise this right, it will hinder our ability to provide you with the required services, since we may need your Personal Data to be able to provide you with our services. 

5. You have the right to data portability. Your data may be requested in a machine-readable format and you may also request that your data is transferred directly to another person or service provider directly. 
6. You may object to the processing of your data. You may at any time inform us that you are objecting to the use of your data for direct marketing and after which we shall stop using your data for such purposes.
7. If you have provided consent for the processing of your data you have the right to withdraw that consent at any time which will not affect the lawfulness of the processing before your consent was withdrawn. In making your request in relation to the above, please not that: 

• We will analyse your request and provide you with a reply within 1 month, except in extreme situations as allowed under law.
• We have the right to refuse your request, if your request is not justified. In this case we shall inform you as to the reasons of why your request was refused. 

8. RIGHT TO COMPLAIN

The data subject that believes that the processing of personal data is taking place in breaching of the provisions of the Regulation, shall have the right to lodge a complaint to the Italian Data Protection Authority (www.gdpr.it) or to the Data Protection Authority of the Member State in which the data subject has his/her habitual residence, as required by the article 77 of the Regulation, or bring the issue before the competent courts (article 79 of the Regulation). 

9. HOW TO EXERCISE YOUR RIGHTS

In order to exercise your right, you shall access the Privacy Area of the website www.calliope.style and use the special form provided. Alternatively, you can contact the people in charge of the data subject’s response:

Data Controller: Teddy S.p.A., via Coriano n. 58, Grosrimini, blocco 97, 47924 Rimini (RN), Tel. (+39) 0541 301411, Fax (+39) 0541 383430, E-mail help@calliope.style

Data Protection Officer (DPO): PRIVACY365 Italia S.r.l., viale Berna 9B, 47924 Rimini (RN), E-mail dpo@calliope.style