PRIVACY POLICY – ONLINE INFORMATION

View the original language version

1. DATA CONTROLLER

Teddy S.p.A., via Coriano n. 58, Grosrimini, blocco 97, 47924 Rimini (RN), Tel. (+39) 0541 301411, Fax (+39) 0541 383430, E-mail help@calliope.style
 

2. PURPOSES, LEGAL BASIS, STORAGE RETENTION PERIOD AND NATURE OF THE PROCESSING OF PERSONAL DATA

Personal data, depending on the actions carried out by the data subject, will be processed for the following purposes:

1. Enable membership in the Calliope Loyalty Program (“Program”), issuance of the Fidelity Card to the customer, and customer participation in promotional initiatives reserved for Program’s customers  

• The legal basis of this processing is the need to perform a contract of which the data subject is party, pursuant to the “Terms and Conditions for Calliope Loyalty Program”. This includes, by way of example but not limited to, the issuance of the fidelity card, the creation of the master data in the Controller's database, the sending of technical (non-promotional) communications necessary to comply with the ‘Terms and Conditions for Calliope Loyalty Program’ or its annexes, other activities necessary to comply with the ‘Terms and Conditions for Calliope Loyalty Program’ and not executable anonymously;

• If the person concerned is a minor of 18, the parental responsibility operator must make the signature.

• The retention period of personal data processed for this aim is the contract period and, in case of litigation, for the whole duration of it, until all the appeal actions terms will be exhausted;

• Personal data is essential to execute the request and the eventual rejection will determine the inability to activate the Fidelity Card. 

2. Responding to inquiries received from the Data Subject by e-mail or text message or by filling out the appropriate online forms on the Calliope website

• The legal basis of this processing is the need to perform contractual or pre-contractual measures required by the Data Subject and to respond to his inquires;

• The retention period of personal data processed for this aim is the contract period and, in case of litigation, for the whole duration of it, until all the appeal actions terms will be exhausted;

• Personal data is essential to execute the request and the eventual rejection will determine the inability to respond to Data Subject’s inquire. 

3. Send brochures and marketing material (direct marketing), also by email or SMS (mailing list, offers, etc.):

• the legal basis of this process is the explicit consent of the data subject;

• The data retention period for this purpose is valid until the data subject asks for the unsubscription from the promotional service/sending of newsletters. We remember that the consent could be revoked at any time and In this case, the data processing carried out under the consent is lawful until the effective date of the termination of consent;

• The provision of personal data is optional and the eventual rejection will determine the inability to receive brochures and marketing material. 

4. Analyze consumption habits and choices (profiling), carry out market research (surveys and analysis of Customer satisfaction):

• The legal basis of this processing is the explicit consent of the data subject;

• The data retention period for this purpose is valid until the data subject does not revoke the consent. We remember that the consent could be revoked at any time and In this case, the data processing carried out under the consent is lawful until the effective date of the termination of consent;

• Additional information on the logic applied and on protection provided for the data subject are available by sending a written request to the Data Controller;

• The provision of personal data is optional and the eventual rejection will determine the inability to profile. 

3. PERSONAL DATA COLLECTED

The personal data processed are the following: 

• Data requested in the Calliope Loyalty Program registration form: name, surname, date of birth, gender, address, e-mail, mobile phone.

• Data given by the user: The optional, explicit and voluntary sending of messages to the contact addresses of the Data Controller involves the acquisition of the sender's contact data, necessary to reply, as well as all personal data included in the communications. 

4. HOW DATA CONTROLLER COLLECTS PERSONAL DATA

Direct Methods:

• Information and personal data that Data Subject provides directly to Data Controller through online (web or mobile app, if applicable) forms, paper inquiry forms, email or SMS.
   

Indirect Methods:

• Information and personal data that Data Subject provides directly to Teddy S.p.A.'s business partners who operate the Calliope stores in the Kingdom of Saudi Arabia and who have been designated Data Processors;
• Government agencies or any other entity that share information about Data Subject, if applicable;

• Data collected through cookies when Data Subject visits Calliope website

  
   

5. RECIPIENT OF PERSONAL DATA

Data Controller do not sell, trade, or otherwise disclose your personally identifiable information. Data may be shared with trusted third-party processors who assist Data Controller, subject to contractual obligations ensuring they protect the Data Subject’s personal data. In particular, personal data might be shared, for specific purposes, with: 

• Subjects acting as “Data Processors”, according to the Article n. 28 of the Reg. (EU) 2016/679 (“GDPR”) and/or according to Article 1 (19) of the Personal Data Protection Law of Saudi Arabia (“PDPL”), if applicable;

• Teddy S.p.A.'s business partners who operate the Calliope stores in the Kingdom of Saudi Arabia and who have been designated Data Processors, according to the Article n. 28 GDPR and/or according to Article 1 (19) PDPL, if applicable;

• Subjects with which is necessary to interact for the goods/services provision, as independent Data Controller;

• Subjects or Authorities with whom the communication of data is mandatory by the legal provisions or orders from the Authorities;

• Personnel expressed authorized by the Data Controller, necessary to carry out activities strictly related to the provision of goods/services, which are undertaken to confidentiality or are legally bound to do so and that have received opportune operational instructions, pursuant to article 29 GDPR and or PDPL. 

The full list of Data Processors is available by sending a written request to the Data Controller.

6. TRANFERS OF PERSONAL DATA

Personal data collected in the Kingdom of Saudi Arabia and relating to individuals residing in the Kingdom of Saudi Arabia will be transferred to the European Economic Area (EEA), as the Data Controller is based in Italy. The Data Controller may transmit such data to recipients based outside the European Economic Area (EEA). The Data Controller ensures that the processing of your personal data is carried out according to the PDPL, and where applicable, to the GDPR and LPDL. Verily, transfers shall be based on an adequacy decision or on Standard Contract Clauses approved by the Saudi Data and AI Authority or where applicable, the European Commission. Further information is available at the Data Controller. 

7. EXISTENCE OF AN AUTOMATED DECISION-MAKING PROCESS, INCLUDING PROFILING

The Data Controller does not adopt an automated decision-making process on personal data, including the profiling. Further information will be available at the Data Controller.
 

8. DATA ABOUT PEOPLE UNDER 18 YEARS OLD

Company’s information services such as the subscription to the newsletter (direct marketing), profiling and online chat it must be authorized by the parent/guardian by signing the application form. The Data Controller will not be responsible of possible recollection of personal data, as well as false statements, offered by the minor, and in every cases, if it is seen to be used, the Data Controller will facilitate the right to access and the right to erasure forwarder by the guardian, foster or who exercises the parental responsibility. 
 

9. RIGHTS OF DATA SUBJECT

The Data Subject have the following rights:

• right to be informed about the lawful basis and the purpose of the collection of their personal data;
• right to access the personal data which is processed by the Data Controller;
• right to request their personal data to be provided to them in a readable and clear format;
• right to have their personal data corrected (if inaccurate), completed (if incomplete) or updated (if out of date);
• right to request destruction of their personal data;
• right to withdraw their consent to processing of their personal data.

The Data Subject that believes that the processing of personal data is taking place in breaching of the provisions of the Regulation, shall have the right to lodge a complaint with a supervisory authority (in Kingdom of Saudi Arabia it is “Saudi Data & AI Authority” and in Italy “Garante per la protezione dei dati”), as required by the Article 77 GDPR and/or Article 34 PDPL, or bring the issue before the competent courts (article 79 GDPR). If applicable, the Data Subject shall have the rights to complain in accordance with national laws and regulations in Kingdom of Saudi Arabia.
 

10. METHODS OF CANCELLATION OF PERSONAL DATA AND UNSUBSCRIPTION FROM THE NEWSLETTER AND/OR COMMERCIAL COMMUNICATIONS

To request the cancellation of personal data processed by Data Controller, the Data Subject may send a request by e-mail to the addresses help@calliope.style or dpo@calliope.style.

Data Subject may revoke one or more consents in one of the following ways: 

• to stop sending newsletters and/or commercial communications by e-mail, simply follow the instructions contained in the last e-mail received or by sending an e-mail to help@calliope.style indicating: "Clp", first name, last name and the e-mail address to which to stop sending communications; 

• to stop sending text messages, simply send an sms message directly cell phone number from which you want to stop receiving communications, indicating with the word "unsubscribe me" (without quotes) to the following number (+39)366.6369292;

• to revoke consents given to the data controller, the data subject may send a request by e-mail to the following addresses help@calliope.style and/or dpo@calliope.style.

   

11. HOW TO EXERCISE YOUR RIGHTS

In order to exercise your right, you can contact the people in charge of the Data Subject’s response:

Data Controller: Teddy S.p.A., via Coriano n. 58, Grosrimini, blocco 97, 47924 Rimini (RN), Tel. (+39) 0541 301411, Fax (+39) 0541 383430, E-mail help@calliope.style

Data Protection Officer (DPO): PRIVACY365 Italia S.r.l., viale Berna 9B, 47924 Rimini (RN), E-mail dpo@calliope.style