Encanto srl

Via Dante Alighieri, 1/A
41030 San Prospero s / S (Modena) Italy
VAT number: IT02793310364
Contact of the Data Controller
Contact of the Data Processor

The categories of Personal Data that this Application collects, independently or through third parties, are specified below:

Biographical Data
First name, middle name, last name, date of birth, gender, ID (in case of applications for open positions or spontaneous applications).

Contact Information
Residential address (street, city, county, state, zip code), home address, email address, phone number, cell phone number.

Sales Data
Shipping and billing address, delivery and payment method, cardholder’s name and card expiration date, information required by Customer Service, VAT number and/or Tax ID number (where required by a law and within the limits of that law).

Tracking Newsletters and Related User Actions/Behaviors
Information related to opening newsletters or links.

Purchase Data
Detail of products purchased (e.g., item, price, discount, variant, calculated spending level, abandoned cart, etc.).

Browsing Data
Data related to browsing behavior and/or use of the Owner’s Website/Application through, for example, cookies or information related to pages visited or searched or related to wishlist collected while browsing or shopping in the online store.

Full details on each type of Personal Data collected are provided in the dedicated sections of this Privacy Policy or by specific explanatory texts displayed before the Data Collection.
Personal Data may be freely provided by the User or, in case of Usage Data, automatically collected when using this Application.
Unless otherwise specified, all Data requested by this Application are mandatory and failure to provide the Data may result in this Application being unable to provide its services. In cases where this Application explicitly specifies that some Data are not mandatory, Users are free not to communicate these Data without consequences for the availability or operation of the Service.
Users who are not sure which personal data are mandatory are invited to contact the Data Controller.
Any use of cookies – or other tracking tools – by this Website/Application or by the owners of third-party services used by this Website/Application is for the purpose of providing the Service requested by the User, in addition to any other purpose described herein and in what relates to Cookie Management.
Users are responsible for the Personal Data of third parties obtained, published or shared through this Application and confirm that they have the consent of the third party to provide the Data to the Data Controller.

Processing Methods
The Data Controller adopts appropriate security measures to prevent unauthorized access, disclosure, modification or destruction of the Data.
Data processing is carried out by means of computers and/or computer-enabled tools, following organizational procedures and methods strictly related to the stated purposes. In addition to the Data Controller, in some cases, the Data may be accessible to certain types of persons in charge, involved in the operation of this Website / Application (administration, sales, marketing, legal, system administration) or external parties (such as service providers third party technicians, postal couriers, hosting providers, IT companies, communication agencies) also appointed, if necessary, as Data Processors by the Data Controller. The updated list of these subjects may be requested at any time from the Data Controller.

Legal basis of processing
The Controller may process Personal Data related to Users if one of the following conditions is met:

• Users have given their consent for one or more specific purposes. Note: in some legislations the Data Controller may be authorized to process Personal Data until the User objects to such processing (“opt-out”), without having to rely on consent or any other of the following legal bases. This, however, does not apply when the processing of Personal Data is subject to European data protection legislation;
• The provision of Data is necessary for the execution of an agreement with the User and / or for any pre-contractual obligations of the same;
• The processing is necessary to fulfill a legal obligation to which the Data Controller is subject;
• Processing is related to a task that is carried out in the public interest or in the exercise of the official authority conferred on the Data Controller;
• the processing is necessary for the purposes of the legitimate interests pursued by the Data Controller or by a third party.

In any case, the Data Controller offers the utmost willingness to clarify the specific legal basis applicable to the processing and in particular if the provision of Personal Data is a legal or contractual requirement or a requirement necessary to enter into a contract.

Location
Data are processed at the operational offices of the owner and at any other location where the parties involved in the processing are located.
Depending on the location of the User, it may be necessary to transfer the collected data to a country other than your own. For further information on the place of processing of such transferred data, users can consult the section containing the details on the processing of Personal Data. In case of transfer outside the EEA (European Economic Area), this will always take place in compliance with the rights and guarantees provided by the Privacy Law (GDPR).
Users also have the right to know the legal basis of data transfers to a country outside the European Union or to any international organization governed by international public law or established by two or more countries, such as the United Nations, and on security measures adopted by the Data Controller to safeguard their data.
Users can find further information by checking the relevant sections of this document or inquire by contacting the Data Controller using the information provided in the ‘Data Controller and Data Processor’ section.

Retention time of collected data
Personal Data must be processed and retained for as long as necessary for that for which it was collected. Therefore:Personal Data collected for purposes related to the performance of a contract between the Controller and the User must be retained until the contract has been fully performed.Personal Data collected for the purposes of the legitimate interests of the Controller must be retained for as long as necessary to fulfill those purposes. Users can find specific information regarding the legitimate interests pursued by the Controller within the relevant sections of this document or by contacting the Controller.
The Controller may be authorized to retain Personal Data for a longer period whenever the User has given consent to such processing, provided that such consent is not withdrawn. Furthermore, the Data Controller may be obliged to keep Personal Data for a longer period when required for the execution of a legal obligation or on the order of an authority.
Once the retention period has expired, the Personal Data will be deleted. Therefore, the right of access, the right to erasure, the right of rectification and the right to data portability cannot be enforced after the retention period has expired.

The Data relating to the User is collected to allow the Owner to provide its Services, as well as for the following purposes:

• Traffic optimization and distribution;
• Hosting and back-end infrastructure;
• Registration and authentication;
• User purchase order management;
• User order shipping management;
• Managing contacts and sending messages;
• Contact with the user, assistance management and contact requests;
• Displaying content from external platforms;
• Content comments;
• Analyses;
• Remarketing and Behavioral Targeting;
• Spam protection.

Users can find further detailed information on these processing purposes and on the specific Personal Data used for each purpose in the respective sections of this document.

Personal Data is collected for the following purposes and using the following services:

Analyses

The services contained in this section allow the Owner to monitor and analyze web traffic and can be used to keep track of user behavior.

Google Analytics (Google Inc.)
Google Analytics is a web analytics service provided by Google Inc. (“Google”). Google uses the Data collected to track and examine the use of this Application, to prepare reports on its activities, and to share them with other Google services.
Google may use the Data collected to contextualize and personalize ads in its ad network.
Personal Data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy – Opt Out.

Facebook Ads Conversion Tracking (Meta Platforms Ireland Limited)
Facebook Ads conversion tracking is an analytics service provided by Meta Platforms Ireland Limited that links data from the Facebook ad network with actions performed on this Application.
Personal data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy.

Contact the user

Mailing list or Newsletter (this Application)
By filling out the contact form with your Data, you authorize this Application to use these details to respond to inquiries, quotes or any other type of request as indicated by the form header.
Personal Data collected: email address, first and last name, company.

Comments on content

Content commenting services allow users to make and publish their comments on the contents of this Application.
Depending on the settings chosen by the Owner, users can also leave anonymous comments. If an email address exists in the Personal Data provided by the user, it can be used to send notifications of comments on the same content. Users are responsible for the content of their comments.
If a content comment creation service provided by a third party is installed, it can still collect web traffic data for pages where the comment service is installed, even when users do not use the content comment service.

Directly managed commenting system (this Application)
This Application has its own internal content commenting system.
Personal data collected: email address, user name, and website.

Viewing content from external platforms

This type of service allows you to view content hosted on external platforms directly from the pages of this Application and interact with them.
This type of service may still collect data on web traffic for the pages in which the service is installed, even when Users do not use it.

Google Fonts (Google Inc.)
Google Fonts is a font display service provided by Google Inc. that enables this Application to embed font content on its pages.
Personal Data collected: Usage Data and various types of Data as specified in the privacy policy of the service.
Place of processing: EU/US – Privacy Policy.

Google Maps Widget (Google Inc.)
Google Maps is a map display service provided by Google Inc. that enables this Application to embed content of this type on its pages.
Personal data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy.

Gravatar (Automattic Inc.)
Gravatar is an image display service provided by Automattic Inc. that enables this Application to embed content of this type on its pages.
Note that if Gravatar images are used for comment forms, the commenter’s email address or parts of it may be sent to Gravatar – even if the commenter has not registered for that service.
Personal data collected: email address and usage data.
Place of processing: EU/US – Privacy Policy.

Instagram Widget (Instagram, Inc.)
Instagram is an image display service provided by Instagram, Inc. that enables this Application to embed content of this type on its pages.
Personal data collected: cookies and usage data.
Place of processing: EU/US- Privacy Policy.

SoundCloud Widgets (SoundCloud Limited)
Soundcloud is an audio content delivery service provided by SoundCloud Limited that enables this Application to embed content of this type on its pages.
Personal Data Collected: Usage Data.
Place of Processing: DE – Privacy Policy.

Spotify Widget (Spotify AB)
Spotify Spotify is an audio content delivery service provided by Spotify AB that enables this Application to embed content of this type on its pages.
Personal data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy.

Typekit (Adobe Systems Incorporated)
Typekit is a font display service provided by Adobe Systems Incorporated that enables this Application to embed content of this type on its pages.
Personal Data collected: Usage Data and various types of Data as specified in the privacy policy of the service.
Place of processing: EU/US – Privacy Policy.

Vimeo video (Vimeo, LLC)>
Vimeo is a video content viewing service provided by Vimeo, LLC that enables this Application to embed content of this type on its pages.
Personal data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy.

YouTube video widget (Google Inc.)
YouTube is a video content display service provided by Google Inc. that enables this Application to embed content of this type on its pages.
Personal data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy.

Back-end hosting and infrastructure

This type of service is intended to host data and files that allow this Application to be distributed, as well as to provide a ready-to-use infrastructure for the execution of specific functions or parts of this Application. Some of these services work through geographically distributed servers, making it difficult to determine the actual location in which Personal Data is stored.

Register.it (Register SpA)
Register.it is a hosting service provided by Register SpA
Personal Data collected: various types of Data as specified in the privacy policy of the service.
Place of processing: EU – Privacy Policy.

Managing contacts and sending messages

This type of service allows you to manage a database of e-mail contacts, telephone contacts or any other contact information to communicate with the user.
These services may also collect data relating to the date and time when the message was viewed by the User, as well as when the User interacted with it, for example by clicking on the links included in the message.

MailChimp (The Rocket Science Group, LLC.)
MailChimp is an email management and delivery service provided by The Rocket Science Group, LLC.
Personal data collected: email address.
Place of processing: EU/US – Privacy Policy.

Management of assistance and contact requests

This type of service allows this Application to manage the support and contact requests received by e-mail or by other means, such as the contact form.
The personal data processed depend on the information provided by the user in the messages and on the means used for communication (e.g. email address).

WhatsApp (WhatsApp Ireland Limited)
WhatsApp (WhatsApp Messenger e WhatsApp Business) è un’applicazione e una piattaforma di messaggistica istantanea, dal 19 febbraio 2014 fa parte del gruppo Meta Inc. La sede di riferimento per l’EU è a Dublino, in Irlanda, sotto la denominazione di WhatsApp Ireland Limited.
Dati personali raccolti: numero di telefono cellulare e per usufruire delle funzioni di servizi facoltativi, vengono raccolte informazioni ulteriori.
Luogo di elaborazione: EU– Privacy Policy.

Facebook Messenger (Meta Platforms Ireland Limited)
Facebook Custom Audience is a behavioral remarketing and targeting service provided by Meta Platforms Ireland Limited that links this Application’s activity to Facebook’s advertising network.
Personal data collected: cookie, email address, and to take advantage of optional service features, additional information is collected.
Processing Location: EU – Privacy Policy – Opt Out.

Registration and authentication

By registering or authenticating, users allow this Application to identify them and provide them with access to dedicated services.
Depending on what is described below, third parties may provide registration and authentication services. In this case, this Application will be able to access some Data, stored by these third-party services, for registration or identification purposes.

Direct Registration (this Application)
The User registers by filling out the registration form and providing Personal Data directly to this Application.
Personal Data collected: email address, username, and various types of data.

Management of purchases, payments and shipments

This type of service allows this Application to manage the order, payment and shipment of users’ purchase orders for goods and / or services.
The Personal Data collected by this Application, independently or through third parties, are described below.

WooCommerce (Automattic Inc.)
WooCommerce is an e-commerce solution provided by Automattic Inc., it works on this Application to provide the user with online shopping experiences for goods or services.
The user who registers and/or authenticates on this Application can proceed with the execution of a purchase order.
Personal data collected: name, billing address, shipping address, email address and other data (some optional) to execute the order placed by the user.
Place of processing: EU/US – Privacy Policy.

Nexi XPay (Nexi Payments SpA)
XPay is a payment gateway provided by Nexi that allows you to accept online payments through all channels and in all modes: e-commerce, mobile transactions, recurring payments, one-click payments.
Personal data collected: depending on the Services you choose, personal data and/or data to make purchases from merchants, to process payments, including information on any financing instruments.
Place of processing: EU – Privacy Policy.

PayPal (PayPal Inc.)
PayPal offers digital payment and money transfer services provided by PayPal Inc. The user can securely log into his PayPal account from this Application and proceed with the payment for the purchase of products or services. The user’s PayPal account login credentials, credit card number, and security code are never stored in this Application.
Personal data collected: depending on the Services the user chooses, personal data and/or data to make purchases from merchants, to process payments, including information about any financing instruments.
Place of processing: EU/US – Privacy Policy.

Apple Pay (Apple Inc.)
Apple Pay is a non-instant mobile payment tool provided by Apple Inc. that enables contactless payments, using mobile devices in physical stores and online payments on supported websites and apps, including via fixed devices.
Personal data collected: depending on the Services you choose, personal data and/or data to make purchases from merchants, to process payments, including information on any financing instruments.
Place of processing: EU/US – Privacy Policy.

Google Pay (Google Inc.)
Google Pay is a non-instant mobile payment tool provided by Google Inc. that enables contactless payments, using mobile devices in physical stores and online payments on supported websites and apps, including via fixed devices.
Personal data collected: depending on the Services you choose, personal data and/or data to make purchases from merchants, to process payments, including information on any financing instruments.
Place of processing: EU/US – Privacy Policy.

Remarketing and behavioral targeting

This type of service allows this Application and its partners to inform, optimize and serve advertising based on the past use of this Application by the User.
This activity is performed by monitoring the Usage Data and using cookies, the information that is transferred to the partners who manage the remarketing and behavioral targeting activity.
In addition to any opt-out offered by one of the services listed below, the User can disable the use of cookies by a third-party service by visiting the Network Advertising Initiative opt-out page .

Facebook Custom Audience (Meta Platforms Ireland Limited)
Facebook Custom Audience is a behavioral remarketing and targeting service provided by Meta Platforms Ireland Limited that links this Application’s activity to Facebook’s advertising network.
Personal data collected: cookie and email address.
Processing Location: EU/US – Privacy Policy – Opt Out.

Facebook Remarketing (Meta Platforms Ireland Limited)
Facebook remarketing is a behavioral remarketing and targeting service provided by Meta Platforms Ireland Limited that links this Application’s activity to Facebook’s advertising network.
Personal data collected: cookies and usage data.
Place of processing: EU/US – Privacy Policy – Opt Out.

Spam protection

This type of service analyzes the traffic of this Application, potentially containing users’ Personal Data, in order to filter it from parts of traffic, messages and content that are recognized as SPAM.

Akismet (Automattic Inc.)
Akismet is a SPAM protection service provided by Automattic Inc.
Personal Data collected: various types of Data as specified in the service’s privacy policy.
Place of processing: EU/US – Privacy Policy.

Users can exercise certain rights relating to their data processed by the Data Controller.

Right to access
Right to know what data is being processed by the Data Controller, obtain information about certain aspects of processing, and obtain a copy of the data being processed.

Right to portability
Receive a copy of the Personal Data you have provided to the Data Controller and the right to have it transmitted to another data controller, if technically possible.

Right to rectification
Right to obtain from the Data Controller the rectification of inaccurate Personal Data concerning him/her without undue delay.

Right to erasure
Deletion of any Personal Data in relation to which the Data Controller no longer has any legal basis for processing.

Right to restrict processing
Limitation of the way the Data Controller processes your Personal Data, to the extent required by applicable data protection law.

Right to object
In addition to the rights listed above, you have the right to object at any time to the processing of your Personal Data by the Data Controller in pursuit of its legitimate interest. You have the right to object to direct marketing, which includes profiling. If you prefer that your Personal Data be processed exclusively through traditional contact methods, you can object to the processing of your Personal Data carried out through automated contact methods.

Right of revocation
You have the right to revoke in whole or in part, your consent to the processing of your Personal Data concerning the purpose of sending advertisements or direct sales or the performance of market research or commercial communication by automated contact methods (e-mail , other remote communication systems via communication networks such as, for example: SMS, MMS, messaging platforms, etc.) and traditional modes of contact (mail).

Details of the right to object to processing
Where Personal Data are processed for a public interest, in the exercise of an official authority vested in the Data Controller, or for the purposes of the legitimate interests pursued by the Data Controller, Users may object to such processing by providing a reason related to their particular situation to justify the objection.

Any requests to exercise user rights can be addressed to the Data Controller through the contact details provided in this document, in the ‘Data Controller and Data Processor’ section. These requests can be exercised free of charge. Subject to verification of legitimacy in the exercise of the User’s right, the Data Controller will provide an answer as soon as possible and usually within one month.

This Website / Application uses cookies. To learn more and for detailed information on cookies, the User can consult our information on Cookie Management .

The user’s personal data may be used for legal purposes by the owner in court or in the stages that lead to possible legal actions deriving from the improper use of this application or related services. The User declares to be aware that the Data Controller may be required to disclose personal data at the request of the public authorities.

In addition to the information contained in this privacy statement, this Application may provide the User with additional and contextual information on particular Services or the collection and processing of Personal Data upon request.

System Logs and Maintenance
For operational and maintenance purposes, this Application and all third-party services may collect files that record your interaction with this Application (system logs) use other Personal Data (such as your IP address) for this purpose.

Information not contained in this policy
More details regarding the collection or processing of personal data can be requested from the Owner at any time. Please see the contact information at the beginning of this document.

How “Do Not Track” Requests Are Handled
This Application supports “Do Not Track” requests.
To determine whether any of the third-party services using the Application comply with “Do Not Track” requests, read their specific privacy policies.

The Owner reserves the right to make changes to this Privacy Policy at any time by notifying Users on this page and possibly within this Website / Application and / or – as far as technically and legally feasible – by sending a notice to Users through any contact information available to the Owner. It is highly recommended that you check this page often, referring to the date of the last modification listed below. If a User objects to any of the changes to the policy, the User must cease using this application and may request that the Owner remove their Personal Data. Unless otherwise indicated, the Privacy Policy in force at the time applies to all Personal Data of the Owner relating to Users.